Authenticating Web Browser Users

Summary of Steps

1. Place a REALM (if required) and a PASSWORD access control record in a DIRMAP or ACCESS file to specify how you want VM:Webgateway to authenticate a web browser user.
2. Place one or more WHEN access control records in a DIRMAP or ACCESS file to cause VM:Webgateway to authenticate a web browser user.

Steps in Detail

1. Place a REALM (if necessary) and a PASSWORD access con trol record in a DIRMAP or ACCESS file to specify how you want VM:Webgateway to authenticate a web browser user.

   The REALM record specifies the prompt you want to display when issuing a userid-password authentication challenge. Do not supply a REALM record if you choose to authenticate users with their client certificates.

   The PASSWORD record specifies the method VM:Webgateway should use to authenticate browser users. VM:Webgateway can authenticate browser users using one of the following methods:

   VM userids and passwords

   Specify VMDIR on the PASSWORD record.

   Site-assigned userids and passwords

   Specify the name and location of the file that contains the userids and passwords on the PASSWORD record. A site can set up more than one password file. However, you can use only one password file for each URL.

   Client certificates

   Specify CLIENTCERTIFICATE on the PASSWORD record.

   Site-written user exit

   Specify the name of the user exit on the PASSWORD record. A site can set up more than one password user exit. However, you can use only one password user exit for each URL.

   VM:Webgateway allows only one method of authentication for each URL. If VM:Webgateway evaluates a PASSWORD record in a DIRMAP or ACCESS file, and then encounters a subsequent PASSWORD record that specifies a different method of authentication, it will issue an error.

2. Place one or more of the following access control records in a DIRMAP or ACCESS file to cause VM:Webgateway to authenticate a web browser user:
   • WHEN USER
   • WHEN GROUP
   • WHEN SYSADMIN
   • WHEN SYSOPER
   • WHEN CCERTKNOWN
   • WHEN CCERTEMAIL
   • WHEN CCERTCOUNTRY
   • WHEN CCERTSTATE
   • WHEN CCERTLOCALITY
   • WHEN CCERTORG
   • WHEN CCERTORGUNIT
   • WHEN CCERTCOMMONNAME
   • WHEN CCERTDISTINGUISHEDNAME
   • WHEN USEREXIT with one or more of the following parameters: ALLOWED, CCERTCOMMONNAME, CCERTCOUNTRY, CCERTDISTINGUISHEDNAME, CCERTEMAIL, CCERTKNOWN, CCERTLOCALITY, CCERTORG, CCERTORGUNIT, CCERTSTATE, CNAME, CNAMEKNOWN, FILEDOMAIN, GROUPS, IP, METHOD, REFERRER, SYSADMIN, SYSOPER, and USER

   Based on the placement of the WHEN access control records, you can:

   • Specify one type of authentication for all data
   • Specify different authentication based on the logical directory structure
   • Specify different authentication based on the origin of a request