1 — NetCrusader/Web Product Overview

[Previous] [Next] [Contents] [Index]

This chapter describes the Entegrity^® NetCrusader™/Web product and where it fits in the NetCrusader product line. It contains the following sections:

1.1 The NetCrusader Product Line
1.2 NetCrusader/Web
1.3 NetCrusader/Web Product Components

1.1 The NetCrusader Product Line

The Entegrity NetCrusader product line provides an enterprise security infrastructure for web-based and other distributed computing applications (for example, CORBA). NetCrusader/Web provides access management for web-based applications.

1.2 NetCrusader/Web

NetCrusader/Web is a permissions management solution that allows organizations to safely extend their access-controlled applications to the web.

1.2.1 Features

Some of the features of NetCrusader/Web include:

• Single Sign-On (SSO) — NetCrusader/Web features web single sign-on, which allows users to authenticate only once while accessing a distributed web application environment.

  With NetCrusader/Web SSO, once a user authenticates with a secured web server, the user is not challenged again as long as the user keeps the web browser open and maintains activity within a timeout period. NetCrusader/Web SSO can function with all secure web servers in a NetCrusader domain.

  NetCrusader/Web SSO employs browser cookies in conjunction with the NetCrusader Security Server and the NetCrusader/Web Security Adapters to provide SSO. Since the cookies are secure and contain only a session Universal Unique Identity (UUID), the cookies are not a security liability.

• Scriptable API Objects — The Authorization Object works with web scripting languages to enable web developers to build web applications that apply NetCrusader's powerful access control, personalization, and management models to their web applications. Additionally, the NetCrusader/Web Security Adapter Toolkit allows similar features for C/C++ programmers. For more information on development components, see Section 1.3 on page 11.

• Forms-based Logon — Using a web scripting language and a standard HTML form, you can use the Authorization Object to log a user in and authenticate that user.

• X.509 Distinguished Name (DN) Mapping — You can map a Distinguished Name (DN) to a NetCrusader identity. Mapping a DN allows you to configure the Security Adapter to acquire the DN from a client certificate. Authentication is performed by the server's SSL (Secure Sockets Layer) sub-system.

• Support for Custom and/or Third-Party Authentication Proxies and Filters — NetCrusader/Web retrieves a DN from a configuration-specified header and maps the name to a NetCrusader user.

• Access Restriction Based on IP Address — You can restrict access based on the source of the HTTP request. For example, you can place an authentication proxy server between a browser and the web server that contains the Security Adapter. You can then limit access to requests from the proxy server.

• Reverse Proxy Mechanism — Using a NetCrusader/Web junction, you can proxy URL requests from a Security Adapter server to another web server. In this way, you can restrict access to servers not normally under NetCrusader/Web control.

• Custom Authentication Header Generation for Target Servers — You can customize the authentication header that is sent through a NetCrusader/Web junction to target servers.

• Graphical User Management Tool — NetCrusader Commander, an easy-to-use graphical management tool, manages users, groups, and permissions for all products in the NetCrusader product line, including NetCrusader/Web. This single-tool approach simplifies management and administration, decreasing administration costs.

  Commander's point-and-click interface provides greater convenience than the command-line alternative and greatly simplifies the execution of NetCrusader security management tasks. For a more detailed description of NetCrusader Commander features, see Section 1.3.6 on page 12.

• Single-button Install — You can install the entire NetCrusader/Web system with a single installer.

• LDAP Support — NetCrusader/Web supports the Innosoft Distributed Directory Server (IDDS) for LDAP (Lightweight Directory Access Protocol) as a security registry.

NetCrusader/Web contains many elements that support secure networked communications over the World Wide Web.

1.2.2.1 Support for Authentication

NetCrusader/Web supports multiple authentication methods including:

• SSL Basic Authentication

• Forms-based Logon

• Public-key (X.509) digital certificates (SSL with client certificates)

• Custom or third-party web authentication filters

• Custom or third-party web proxy servers

NetCrusader/Web provides a single, consistent authorization model for all users and application resources in the enterprise including a fine-grained access control model for objects, data, and applications.

Other access control models typically allow you to set these controls only at the directory or file level. With NetCrusader Commander, you can easily set access controls on files and directories. With the NetCrusader/Web Authorization Object or the NetCrusader/Web Toolkit, you can extend what Commander can manage, down to any level of granularity. For example, you can have unique access controls for methods of custom or third-party objects or for specific records in a file or specific fields in a record.

Commander, the Authorization Object, and the Toolkit also support dynamic access permission inheritance and role (group) based access control.

1.2.2.3 Support for Firewalls

The NetCrusader/Web Security Adapter operates seamlessly behind application and packet-filtering firewalls. You can configure gateways so that they direct HTTP and HTTPS traffic to the web servers on which the NetCrusader/Web Security Adapter has been installed.

NetCrusader/Web works with and reinforces existing firewalls by providing authentication, authorization, and encryption capabilities inside the perimeter defense of the firewall and throughout the enterprise. Investments in existing web browsers and servers are preserved and enhanced.

1.2.3 Other NetCrusader/Web Features

In addition to the features that support the basic elements of secure networked transactions, NetCrusader/Web has the following additional features:

• Multi-platform Support — Any desktop platform that has a browser that supports SSL and cookies can leverage the full power of the NetCrusader/Web Security Adapter. The Security Adapter is available on Windows NT and Sun Solaris servers.

• Compatibility with Industry-standard Browsers and Servers — NetCrusader/Web works with standard browsers and servers, not proprietary ones.

• Integration with Environments that Run Non-secure Web Servers — Through junctions, a NetCrusader/Web mechanism to proxy URL requests from a Security Adapter server to web servers not directly supported by NetCrusader/Web (for example, Apache, Lotus Domino) or supported web servers running on unsupported platforms. Using NetCrusader/Web junctions, you can protect all your web servers.

For more information on the features and benefits of the NetCrusader/Web product, access the Entegrity Solutions web site at http://www.entegrity.com.

1.3 NetCrusader/Web Product Components

The Entegrity NetCrusader/Web product consists of three main software components plus two separate development components.The following sections briefly describe each of these components.

1.3.1 NetCrusader Security Server

The NetCrusader Security Server provides a centralized security registry which maintains user names and passwords, group, organization, and role information, and other customizable registry attributes.

In addition to providing authentication services to users and applications, the NetCrusader Security Server also provides identity mapping between naming domains such as X.500 and NetCrusader.

1.3.2 Security Adapter

The NetCrusader/Web Security Adapter is available on Microsoft Windows NT and Sun Solaris.

Implemented as a Microsoft ISAPI (Internet Server API) filter or Netscape NSAPI (Netscape Server API) filter, the Security Adapter incorporates NetCrusader security directly into your web server. You can use the Security Adapter with Microsoft Internet Information Server (IIS) or Netscape Enterprise Server. The NetCrusader/Web Installation and Operation Guide has details on which versions of these web servers are supported.

The Security Adapter provides:

• Support for one or more authentication schemes
  
• NetCrusader Authorization services
  

The Security Adapter configuration wizard is a graphical user interface that steps you through the configuration process. Except for minor platform-related differences, the configuration wizard is identical on both Windows and UNIX platforms, which makes administration easier for administrators who must work with both platforms.

For more information on the Security Adapter configuration wizard, see the NetCrusader/Web Installation and Operation Guide and the Security Adapter configuration wizard online help.

1.3.4 Authorization Object

The NetCrusader/Web Authorization Object enables web scripting developers to build web applications that apply NetCrusader's powerful access control, personalization, and management model to their web applications. The Authorization Object allows web developers to easily make authorization (access control) decisions inside applications developed using Active Server Pages (ASP).

Developers can authenticate users, determine access rights, create users, change users' passwords, manage session state, add users to or remove users from groups, perform single sign-on, and set and retrieve custom attributes. Samples illustrating how to perform these tasks are included with the product.

With the Authorization Object, developers have access control over sub-page level objects such as HTML elements and images, and control over custom functionality, custom content, and component objects. The Authorization Object allows an application to manipulate the full functionality of the NetCrusader authorization system.

1.3.5 Toolkit

The NetCrusader/Web Toolkit allows C/C++ application developers access to the same functionality as the Authorization Object. The NetCrusader/Web Toolkit is included with the NetCrusader/Web product. Appendix A describes the libraries that ship with the Security Adapter. For more information on using the libraries and samples, see the NetCrusader/Web Toolkit Programmer's Guide, located in the Nt40/Toolkit directory of the product CD.

1.3.6 NetCrusader Commander

NetCrusader Commander provides an easy-to-use, graphical management interface to the NetCrusader security environment. With Commander you can manage all security-related aspects of your NetCrusader environment from a single, central location.

NetCrusader Commander allows you to:

• Create, modify, and delete NetCrusader groups and users

  Manage user properties such as password, authentication settings, validity of a user's account, group membership, and other attributes.

• Define and manage Access Control List (ACL) entries for NetCrusader objects
  

  Display a list of all the hosts in the NetCrusader security domain, all the web servers and web applications on the hosts, and display a hierarchical tree of the objects under the web servers and web applications. Each of these objects is associated with a NetCrusader ACL, which controls access permissions for an object.

  By setting ACL permissions based on group membership or user identity, you can control access to objects in your NetCrusader site, grant (or deny) specific types of access to secure documents, objects, executables, and other resources. You may also control access to entire subtrees of objects.

• Enable identity mapping for user authentication over SSL

  For a user to be authenticated using public-key certificates over SSL, an X.500 Distinguished Name must be associated with the user's NetCrusader identity in the NetCrusader security database. Use Commander to associate a user's X.500 name with its NetCrusader identity, and specify who has permission to map the user's X.500 DN to its NetCrusader identity.

• Work efficiently in a large-scale environment

  In NetCrusader sites with many nodes, list generation can be time-consuming. Commander allows you to customize the lists it generates, filtering out unneeded information and conserving system resources. Commander provides the following features to facilitate operation in large-scale environments:

  • Specifying Users and Groups by Name
    
  • Caching
    

NetCrusader Commander is available on Windows NT, Version 4.0 and is included in the NetCrusader/Web installer. Commander runs as a Microsoft Management Console (MMC) snap-in. For information on how to use Commander, see the Commander online help.

[Previous] [Next] [Contents] [Index]

To make comments or ask for help, contact support@entegrity.com.

Copyright © 1996-2001 Entegrity Solutions Corporation & its subsidiaries