Front cover - IBM Redbooks

472 Lotus Security Handbook
► Session-based name-and-password authentication
Session based authentication occurs via an HTML form prompt to the user.
The authentication credentials are then cached within a session that is
created in Domino for the user, and a session identification cookie is passed
to the browser so that the user can be identified on subsequent requests.
This authentication method allows for persistence of the user’s connection on
a single server, and allows for a customized login prompt via the HTML login
form. This method does not provide single sign-on support.
► Multi-server session-based authentication
Multi-server authentication is similar to basic session authentication, except
an LTPA cookie is passed to the browser containing the username and
verifying the users valid authentication. This LTPA “token” is then trusted by
other servers for authentication. Thus, this authentication method supports
single sign-on across a multi-server infrastructure.
A more detailed discussion of some of these authentication options is available in
6.2.4, “Web client authentication” on page 240, while a more detailed discussion
of LTPA can be found in 7.2, “LTPA” on page 285
The rest of this section discusses the key security aspects to consider when
using these various authentication options.
11.9.1 Name variation considerations
You can select the level of name restriction Domino uses when authenticating
users in Domino Directories and LDAP directories. This applies to all Internet
protocols (HTTP, LDAP, IMAP, POP3). Using this setting makes servers less
vulnerable to security attacks by refining how Domino searches for names and
authenticates Internet clients. Domino also uses this setting when a Java applet
hosted on a Domino server authenticates users with the Domino IIOP protocol.
Fewer name variations with higher security
The option “Fewer name variations with higher security” is the default setting and
is recommended for tighter security. This authentication method is less
vulnerable to attacks because a single authentication attempt does not produce
as many matches, lessening the likelihood that a guessed password matches.
Only the variations identified in Table 11-7 can be entered by the user in the
name-and-password dialog box in a Web browser or other Internet client.