Front cover - IBM Redbooks

246 Lotus Security Handbook
Session-based name-and-password authentication
Session-based name-and-password authentication is the alternative to
name-and-password authentication for Web clients, and includes additional
functionality that is not available with basic name-and-password authentication.
A session is the time during which a Web client is actively logged onto a server
with a cookie. To specify settings that enable and control session authentication,
the Web Site document or the Server document should be edited, depending on
the desired configuration.
Furthermore, there are two selections for enabling session-based authentication:
single and multi-server options. The single server option causes the server to
generate a cookie that is honored only by the server that generated it, while the
multi-server option generates a cookie that allows single sign-on with any server
that shares the Web SSO configuration document.
To use session-based authentication, Web clients must use a browser that
supports cookies. Domino uses cookies to track user sessions.
Features of session-based name-and-password authentication
Using session-based name-and-password authentication provides greater
control over user interaction than basic name-and-password authentication. For
example, it is possible to customize the form in which users enter their name and
password information. It also allows users to log out of the session without
closing the browser.
Customized HTML log-in form
An HTML log-in form allows a user to enter a name and password and then use
that name and password for the entire user session. The browser sends the
name and password to the server using the server’s character set. For HTTP
session authentication, a user can enter a name using any printable characters
in Unicode. The user password, however, must be entered in any printable
characters in US-ASCII.
Note: The range of printable characters excludes control characters.
Domino provides a default HTML form ($$LoginUserForm), which is provided
and configured in the Domino Configuration database (DOMCFG.NSF). You can
customize the form or create a brand new one to contain additional information
that can be presented to the user. For example, you can modify the form to have
a look and feel consistent with the rest of your Internet or intranet site.