CSP Gateway Configuration Guide - InterSystems Documentation

CSP Gateway Operation and Configuration
• ../bin
• ../../bin
The Gateway attempts to load the library at the time it is first required. If successful, the following status message is written
to the Event Log: CSP Gateway Initialization The CCONNECT library is loaded - Version: 5.3.0.175.0. (This library is
used for the optional Kerberos-based security between the Gateway and Caché)
If the Gateway is unable to locate or link to the cconnect library, a suitable statement of failure and error message is
written to the Event Log.
For Kerberized communications between the Gateway and Caché, the Gateway is the Kerberos client.
The procedure for configuring the Gateway to use Kerberos is as follows.
Windows
Kerberos key tables are not implemented for Windows. Therefore, authentication uses network credentials that are either
obtained when the hosting service starts in a named account or from the Trusted Computing Base (TCB) when the hosting
service runs in the System Logon Session (that is, as LOCAL SYSTEM).
Windows domain accounts use a permanent key derived from a password to acquire a Kerberos Ticket Granting Ticket
(TGT) and service ticket for the local machine. The local machine must also have a permanent Kerberos key, shared with
the Key Distribution Centre (KDC) component of the domain controller. That key can be used to acquire a TGT and service
ticket to authenticate to another Kerberos principal such as Caché.
For practical purposes the Gateway, operating within the context of a Windows-based Web server is operating through
either the Network Service logon session or the System logon session. The account used must have Log on as a batch
job rights assigned.
The built-in Network Service logon session has access to the machine's credentials and is designed for services that need
network credentials to authenticate to other machines. However, the Network Service logon session is not always present.
The System logon session can also be used for the purpose of authenticating the Gateway to Caché.
For IIS installations, and ISAPI extensions in particular, using the Network Service login session is the preferred means
through which both databases (local and remote) and remote computers should be accessed.
Gateway Configuration
Set the Service Principal Name to that of the target Caché server that the Gateway is connecting to. Leave the User
Name, Password, and Key Table fields empty.
The client principal name (or client username) is that of the Gateway host. This is the Kerberos name representing the
Gateway hosts' network service session:
$
Assign this principal the necessary privileges in the Caché server to allow the Gateway’s service to operate.
UNIX® and OpenVMS
These Operating Systems support Kerberos Key Tables. The Gateway configuration is conceptually more straightforward
for these systems.
Gateway Configuration
Set the Service Principal Name to that of the target Caché server that the Gateway is connecting to.
Enter the name of the key table file (including the full path) in the Key Table field.
Set the User Name field to the name of the appropriate key in the key table file.
Leave the Password field empty.
30 CSP Gateway Configuration Guide