TCP/IP Tutorial and Technical Overview - IBM Redbooks

Login facility Provides the environment for a user to log in and
initialize the security environment and credentials.
These services enable user authentication, secure communication, authorized
access to resources, and proper enforcement of security.
The DCE security service communicates with the Cell Directory Service to
advertise its existence to the other systems that are part of the cell. The DCE
security service also uses the Distributed Time Service to obtain time stamps for
use in many of its processes.
13.3.2 Authentication service
The role of the authentication service is to allow principals to positively identify
themselves and participate in a DCE network. Both users and servers
authenticate themselves in a DCE environment, unlike security in most other
client/server systems, where only users are authenticated. There are two distinct
steps to authentication. At initial logon time, the Kerberos third-party protocol is
used within DCE to verify the identity of a client requesting to participate in a
DSS network. This process results in the client obtaining credentials, which form
the basis for setting up secure sessions with DCE servers when the user tries to
access resources.
In DCE Version 1.1, the idea of preauthentication was introduced, which is not
present in the Kerberos authentication protocols. Preauthentication protects the
security server from a rogue client trying to guess valid user IDs in order to hack
into the system. In DCE 1.1, there are three protocols for preauthentication:
No preauthentication This is provided to support DCE clients earlier than
Version 1.1.
Timestamps This is used by DCE Version 1.1 clients that are
unable to use the third-party protocol. An encrypted
time stamp is sent to the security server. The time
stamp is decrypted, and if the time is within five
minutes, the user is considered preauthenticated. This
option needs to be specified for cell administrators and
non-interactive principals.
Third-party This is the default used by DCE Version 1.1 (and later)
clients. It is similar to the time stamps protocol, but
additional information about the client is also
encrypted in various keys.
502 TCP/IP Tutorial and Technical Overview