Control User Access To Your Web Site example essay topic

F E A T U R E Authentication Gets Tough May 28, 2001 By Michael Ross and Jeff Rubin Your Web presence has grown over the past five years. Shouldn't your authentication and authorization system be growing with it? Today's high-performance Web-based policy-management solutions are secure, scalable, easy to manage and designed for thousands of users in a distributed environment -- not just dozens accessing a single server. Although custom modules can be built in any language, and can use SSL (Secure Sockets Layer) to secure password transmission and LDAP to manage user accounts, the scripts are difficult to manage and slow to process, and they lack strong security for storing passwords. In contrast, commercial Web-based policy-management packages provide a strong alternative to custom authentication modules for intranet, Internet and extranet applications.

We tested five Web-based policy-management packages. Each boasts of having performance, management, scalability, security and reliability. And all take advantage of SSO (single sign-on) so users can authenticate just once and access multiple resources within the same or external domains. In most cases, our tests showed that the products could handle 100,000 connections per hour without a performance hit. The packages do this by using a delegated (decentralized) authority model, which allows an organization to assign various administrative and user levels. Most of the products offer several layers of security, including: OpenNetwork Technologies DirectorySmart We were pleased with the installation and integration of DirectorySmart, but this package's Web-based management interface was disappointing compared with those of the others.

DirectorySmart's unusual structure also placed a significant performance load on the LDAP server. We began by installing DirectorySmart's management components on our Windows NT product server. We also installed the API, and used the DirectorySmart Web configuration tool to install the Menu of Services (MOS) and the Web Access Control (WAC). The MOS is used to view resources each user may access; the WAC is OpenNetwork's Web server plug-in. A step-by-step wizard simplified the installation of each service, but having to re-enter the name of the server and port number a dozen or more times for each installation of the plug-in was tedious. We also ran into a DLL (dynamic link library) dependency hang-up with one DirectorySmart file, but OpenNetwork resolved the glitch by sending us an updated system DLL.

Although we found no unique features in DirectorySmart's Web-based management interface, the basic options are well-laid-out. Using the management menu, we could create, modify, view or delete choices for resources, users and rules. Securant's product is more powerful, but DirectorySmart's interface is straightforward and explicitly offers a long list of DirectorySmart administrative options. However, we didn't like having to take the intermediary step of searching for users, resources or rules. We tested DirectorySmart by securing the administration pages of our Web site and requesting a protected URL from a Web browser.

We chose forms-based authentication for integration with our test Web site. Initial configuration was easy, but we needed to use a custom API to decrypt the current user ID from the DirectorySmart cookie. The plug-in intercepted our request and redirected our browser to the DirectorySmart form login page. Once authenticated, DirectorySmart stored our credentials in an encrypted session cookie (as other products do). No HTTP header variables were used for storing credentials. Before redirecting back to the Web server, DirectorySmart performed an authorization check to verify we had access to the protected resource.

Unlike competing products, DirectorySmart authenticated directly against our LDAP server, rather than send the request to an intermediary server. Our load generator ran a script that logged us into DirectorySmart, browsed the site and then logged out. When we stopped the test at 2,400 simultaneous connections, our LDAP server was maxed out at 100 percent CPU usage, and the system was handling 300 transactions per second with a response time of 6.4 seconds per Web page. These results indicate that using a plug-in to talk directly to the LDAP server rather than using an intermediary server to cache and balance requests to the LDAP server significantly hurts performance for the entire system. In addition, the Web servers were able to handle the same amount of traffic as the other products, indicating that the repeated calls to the LDAP server triggered the bottleneck and not the overhead caused by the Web server plug-in. DirectorySmart, $10,000 to $850,000, OpenNetwork Technologies.

(727) 561-9500, (877) 561-9500; fax (727) 561-0303. web Michael Ross is a consultant with Internet Consulting Services. Jeffrey H. Rubin is an instructor with the School of Information Studies at Syracuse University and a consultant with Internet Consulting Services. Send your comments on this article to Ross at or Rubin at. Executive Summary Web-Based Policy-Management Tools Managing dozens of users on a single Web site is easy. But multiply the number of users by 100 or more, and you have the makings of a security disaster. Today's commercial Web-based policy-management tools let you control user access to your Web site, and provide better performance, manageability, scalability, security and reliability than ever before.

We tested five single sign-on packages that let users authenticate just once and give you total control over their access. Beyond measuring the products' authentication and authorization abilities, we also tested the ease of integration and configuration of Baltimore Technologies Select Access, Entegrity Solutions Assure Access 1.2, Entrust Technologies get Access 4.5, OpenNetwork Technologies DirectorySmart and Securant Technologies ClearTrust SecureControl 4.5. Securant's ClearTrust SecureControl won our horse race, with its shining performance, excellent management tools, live testing features, simple interface and thorough logging and reporting capabilities. How We Tested Web-Based Policy-Management Tools In our Syracuse University Real-World Labs (R), we installed, configured and tested each of the five software packages. Before the first package was installed, we mirrored the Syracuse University Law School Web site to our test environment. Our setup comprised four dual-Pentium 600-MHz servers running Microsoft Windows NT 4.0 SP 6 a and Internet Information Server (IIS) 4.0.

The Web server hosted ASPs (Active Server Pages) that connected to our Microsoft SQL 7 server to provide dynamic content. We installed the latest Netscape Directory Server (4.12) and imported a user and group structure to simulate the user base the law school supports with custom Web technology. We wanted to see how well these software solutions would integrate with existing directory stores and if they could simplify security and management for a highly customized Web site. For each product, we installed the back-end services software on a separate dual-Pentium 600-MHz Windows NT 4.0 server.

The plug-in was installed on each of our three Web servers. We then secured access to the Web site administration pages with user name / password authentication against our LDAP server. To simulate user sessions, we chose RadView Software WebLoad 4.51. WebLoad connected to nine Windows 2000 servers on our isolated, switched 100-Mbps Ethernet network.

For our test browsing session, we first tried to access the protected administration pages, then logged in when we were challenged for credentials. We browsed through 10 unprotected pages and two protected pages before ending the session. Using WebLoad, we recorded this session and synchronized our load servers with Web servers. WebLoad started with 150 user sessions distributed to all three Web servers (50 client connections per server). We increased the load by 100 client connections every 40 seconds. We stopped the test if one of three things happened: a Web server failed, WebLoad received more than 50 response errors (not time-outs), or we reached 2,000 simultaneous client connections.

Once the test ended, we recorded the CPU usage. We also recorded the total number of simultaneous connections, current and average number of transactions per second, current and average response time per Web page, and the sum total connection attempts and the sum total connection failures. WebLoad 4.51, RadView Software, web.