Configuring Authenticators

Configuring Predefined Authenticators

Select this option to use one of the predefined authenticators that are provided by SBM. Use the provided tooltips for guidance when configuring an authenticator.

Select the Explicit checkbox to force an authenticator to reject any incompatible credentials that are received. For example, an x509 authenticator will deny any requests that contain a user name and password if this option is selected.

The following predefined authenticators are available:

• Default authenticator

  Provided for testing purposes only.

• Compound authenticator

  Compound authenticators enable you to implement multiple authenticators using logical operators like OR and AND. After you add a compound authenticator, define additional authenticators as needed, and then drag and drop them into the compound authenticator container.

• NTLM authenticator

  Authenticate credentials against a Windows domain.

• Application Engine authenticator

  Authenticate credentials against Application Engine. No additional configuration is necessary.

• LDAP authenticator

  Authenticate credentials against LDAP. This is analogous to configuring SSO LDAP.

• x509 Base authenticator

  Authenticate credentials using client-side certificates.

• x509 LDAP authenticator

  Authenticate credentials from x509 certificates against LDAP.

  Note: The x509 LDAP authenticator assumes that the user's distinguished name is contained in the certificate's subject value. If certificates issued by your certificate authority do not have the distinguished name or have additional parameters included in the subject, authentication fails. In this case, you can modify the sample LDAP authenticator and use it as a custom authenticator.
• x509 CRL authenticator

  Authenticate credentials from x509 certificates against a certificate revocation list (CRL). A CRL is a certificate authority–managed list of certificates that have been revoked or are no longer valid.

  Important: Authentication is assumed for certificates that are not in the CRL. This means that if authentication does not occur prior to accessing SBM, you must set up and configure an authenticator that performs the actual identity check. For example, you can configure the LDAP authenticator to enforce authentication against LDAP, and then validate the certificate against the CRL.
• x509 OCSP authenticator

  Authenticate credentials from x509 certificates against using Online Certificate Status Protocol (OCSP).

Configuring Custom Authenticators

Select Custom authenticator to enter XML that describes for your custom authenticator. Click Reindent to fix any indentation problems in the XML and improve readability. Click Validate to check that the XML is valid.

Related Topics