TCP/IP Tutorial and Technical Overview - IBM Redbooks

13.3.3 DCE threads
are then decrypted by the security server using its own copy of the password
stored in the registry database.
If the security server is not able to authenticate the client for some reason, such
as the entering an invalid password, an error is returned and the logon is
terminated. However, if the exchange completes with the client being
successfully authenticated, the security server returns credentials that are then
used by the client to establish sessions with other DCE servers, such as
resource and directory servers. These credentials contain information in the form
of a privilege ticket granting ticket (PTGT) and extended privilege attribute
certificate (EPAC):
EPAC This is a validated list supplied by the security server
containing the client's name, groups the client belongs to, and
the extended registry attributes for the authenticated client (if
any were defined and associated with their account). A client
must present its EPAC (acquired during third-party
authentication) to any server the client wants to connect to in
order to access its resources.
PTGTA PTGT is a privilege ticket granting ticket. It contains the EPAC,
which has all the relevant information about a user (UUID,
group membership, ERAs, and so on). The PTGT is what is
actually passed from a DCE client to a DCE server when it
needs to access resources.
Public key support
The latest version of DCE (DCE Version 1.2.2) introduces the option of using
public key technology (such as that from RSA or smart cards) to support the login
process. Using this technology, the long-term key (or password) for a user (or
other DCE object) does not need to be stored at the security server, providing
enhanced security in the event of a compromise of the security server.
Administrators can specify that some principals can use the pre-DCE 1.2
mechanisms while others have access to the public key mechanism. DCE_1.2.2
retains full interoperability with previous DCE releases. During the login process,
public key users receive credentials that allow them to use the current
(Kerberos-based) DCE authentication mechanism. A new pre-authentication
protocol is used. The login client does not have to determine whether a given
user is public key-capable prior to requesting credentials.
Traditional applications (written in languages such as C, COBOL, and so on)
have many lines of programming code that usually execute in a sequential
manner. At any time, there is one point in the program that is executing. This can
Chapter 13. Remote execution and distributed computing 505