Front cover - IBM Redbooks

same server/realm combination, it can reissue the request using the appropriate
user ID and password.
Some browsers go a step further and simply send a user ID and password for
any URL that is likely to need it. Opera, Mozilla, Netscape Navigator and Internet
Explorer all send the information with any URL that is in the same logical
directory.
The objective of these tricks is to reduce network traffic and improve
responsiveness by eliminating a number of invalid requests and 401 status code
responses. They also, unfortunately, have the undesired side effect of
re-transmitting the user ID and password when it may not be necessary.
However, there are ways to mitigate that. For each Internet protocol enabled on
the server, it is possible to specify the method of security. For example, an
Administrator might enable client certificate authentication for HTTP connections
but require name-and-password security for LDAP connections that use TCP/IP.
Or the Administrator might use name-and-password security with anonymous
and SSL client authentication, for example, to allow users with SSL client
certificates to authenticate using SSL client authentication and to allow other
users to enter a name and password if they do not have an SSL client certificate.
Note: Name-and-password authentication is not supported when a Domino
server acts as an SMTP client – for example, when a Domino server connects
to an SMTP server to route mail. Name-and-password security is supported
only when a Domino server acts as an SMTP server, that is, when SMTP
clients access a Domino server.
It is possible to select the level of restriction Domino uses when authenticating
users in Domino Directories and LDAP directories. This applies to all Internet
protocols (HTTP, LDAP, IMAP, POP3). Using this setting makes servers less
vulnerable to security attacks by refining how Domino searches for names and
authenticates Internet clients. Domino also uses this setting when a Java applet
hosted on a Domino server authenticates users with the Domino IIOP protocol.
Fewer name variations with higher security
The option “Fewer name variations with higher security” is the default setting and
is recommended for tighter security. This authentication method is less
vulnerable to attacks because a single authentication attempt does not produce
as many matches, lessening the likelihood that a guessed password matches. It
requires users to enter only the items listed in Table 6-2 on page 244 for the
name-and-password dialog box in a Web browser or other Internet client.
Chapter 6. Public key infrastructures 243