Name-and-password authentication for Internet/intranet clients

Name-and-password authentication, also known as basic password authentication, uses a basic challenge/response protocol to ask users for their names and passwords and then verifies the accuracy of the passwords by checking them against a secure hash of the password stored in Person documents in the Domino® Directory.

When set up for this, Domino® asks for a name and password only when an Internet/intranet client tries to access a protected resource on the server. Internet/intranet access differs from Notes® client and Domino® server access in that a Domino® server asks a Notes® client or Domino® server for a name and password when the client or server initially attempts to access the server.

If you want to assign database access to an Internet/intranet client based upon Domino® ACL security, you must create a Person document for that client in the Domino® Directory, or, optionally, in a secondary Domino® directory or an external LDAP directory. Clients who do not have Person documents are considered Anonymous and can only access servers and databases that allow Anonymous access.

Name-and-password authentication allows Domino® to locate the Person document (if one exists) for the client accessing the server. After the client is identified, access to server resources can then be determined. For example, if you want Alan Jones to have Editor access to a database and all others accessing the database to have Author access, you must create a Person document for Alan Jones. You can set up the database ACL to include Alan Jones as an Editor and Anonymous as Author.

You can use name-and-password authentication with either TCP/IP or SSL on any servers that run an Internet protocol -- namely, LDAP, POP3, HTTP, SMTP, IIOP, or IMAP. For each Internet protocol enabled on the server, you can specify the method of security. For example, you might enable client certificate authentication for HTTP connections but require name-and-password security for LDAP connections that use TCP/IP. Or you might use name-and-password security with anonymous and SSL client authentication -- for example, to allow users with SSL client certificates to authenticate using SSL client authentication and to allow other users to enter a name and password if they do not have an SSL client certificate.

If you are setting up name-and-password authentication for an HTTP server, you have an additional method to use with name-and-password authentication: session-based authentication. Name and password authentication sends the name and password in unencrypted format and is sent with each request. Session-based authentication differs in that the user name and password is replaced by a cookie. The user' name and password is sent over the network only the first time the user logs in to a server. Thereafter the cookie is used for authentication. Session-based name-and-password authentication offers greater control over user interaction than basic name-and-password authentication and lets you customize the form in which users enter their name and password information. It also allows users to log out of the session without closing the browser.