Using CA AppLogic › Grid Administration Guide › Role-Based Access Control › Overview › User Authentication

User Authentication

Authentication is the process of confirming a user’s identity for the purpose of accessing a grid. CA AppLogic supports password-based authentication in the GUI and public key based authentication when accessing the command-line interface (CLI) using secure shell (SSH).

• GUI authentication for local users is performed using the built-in local directory service for password-based authentication.
• GUI authentication for global users relies on the external global directory service for password-based authentication.
• SSH authentication for local and global users relies on SSH to provide public key based authentication. Public SSH keys for global users are maintained locally by each grid because most global directories do not provide this capability.
• When a global user accesses the CLI using SSH, the resulting interactive command-line shell requires the user to authenticate with the global directory service. This maintains the trust relationship between the grid and the global directory service.
• Non-interactive remote command-line execution using SSH is disabled for global users.
• When a user logs into the CA AppLogic GUI, or logs in using SSH to open a command-line shell, the login consists of two separate operations: authentication and authorization. Even when authentication succeeds, access to the grid is denied if the user does not have permission to log in.

  Note: It is valid for there to be users which do not have permission to login. Typically, only a limited subset of all users maintained in a global directory service are permitted to log in to a particular grid. A grid administrator may want to deny a particular user the ability to log in, effectively disabling the user’s account without destroying it.

  All access levels defined for the grid ACL provide permission to log in. As long as the user is granted access level rights on the grid ACL, or is a member of a group with such rights, the user has permission to log in.

• When a global user authenticates, that user's global group membership is read from the global directory service. This information is cached in the local directory service. This cached global group membership information is used when determining whether the user is authorized to perform an action.