Front cover - IBM Redbooks

For example, when a user tries to open a database that has an ACL with No
Access as the default, Domino challenges the user for a valid user name and
password. Authentication succeeds only if the user provides a name and
password that matches the name and password stored in the user’s Person
document and if the database ACL gives access to that user. Anonymous users
are not authenticated.
It is possible to use name-and-password and anonymous access with TCP/IP
and SSL (which we cover in detail in the next section). Name-and-password and
anonymous access with TCP/IP are described here.
This section also applies to Web clients who are accessing a Domino Web
server for which session authentication has been enabled.
Name-and-password authentication
Name-and-password authentication, also known as basic password
authentication, uses a challenge/response protocol to ask users for their names
and passwords and then verifies the accuracy of the passwords by checking
them against a secure hash of the passwords stored in Person documents in the
Domino Directory.
When set up for this, Domino asks for a name and password only when an
Internet or intranet client tries to access a protected resource on the server.
Internet and intranet access differs from Notes client and Domino server access
in that a Domino server asks a Notes client or Domino server for a name and
password when the client or server initially attempts to access the server.
If the administrator wants to assign database access to an Internet or intranet
client based upon Domino ACL security, that person must create a Person
document for that client in the Domino Directory, or, optionally, in a secondary
Domino directory or an external LDAP directory. Clients who do not have Person
documents are considered Anonymous and can only access servers and
databases that allow Anonymous access.
Name-and-password authentication allows Domino to locate the Person
document (if one exists) for the client accessing the server. After the client is
identified, access to server resources can then be determined. For example, if
we want to give Alice Editor access to a database and all others accessing the
database to have Author access, it is necessary to create a Person document for
Alice. It is possible to set up the database ACL to include Alice as an Editor and
Anonymous as Author.
It is possible to use name-and-password authentication with either TCP/IP or
SSL on any servers that run an Internet protocol, meaning LDAP, POP3, HTTP,
SMTP, IIOP, or IMAP.
Chapter 6. Public key infrastructures 241