Setting authentication preferences

Top   Previous   Next

Users may authenticate with JSCAPE Secure FTP Server using a variety of different authentication protocols.  To view the current authentication method used click on the "Authentication" node for the desired domain.

 

Domain User Authentication

Database User Authentication

Database Query Authentication

LDAP User Authentication

LDAP Query Authentication

LDAP Filter Grammar

Custom User Authentication

Password Hashing

 

Domain User Authentication

 

Domain User Authentication is the most basic form of authentication, authenticating against local user accounts created for the domain using JSCAPE Secure FTP Server Manager. 

 

Figure 58

 

clip0058

 

 

Database User Authentication

 

Database User Authentication allows you to authenticate a user based on whether the user has credentials to connect to a database.  When connecting to the supplied JDBC URL the username and password provided at time of login are used to login to the JDBC URL.  If user authenticates successfully with the JDBC URL then user is considered a valid user of the JSCAPE Secure FTP Server service.

 

Figure 59

 

clip0059

 

JDBC URL - The JDBC URL used to connect to the database.  The above example demonstrates connecting to a MySQL database.  Contact your database vendor for access to JDBC libraries and assistance on specifying the JDBC URL.  Libraries for JDBC drivers must be placed in the libs directory of your JSCAPE Secure FTP Server installation, driver class registered under File > Settings > JDBC and JSCAPE Secure FTP Server Service restarted in order to be loaded. 

 

Create account if not found using template - This allows for accounts to be created automatically upon successful authentication.  If selected, an account will be created automatically (if it does not exist already) using the specified User Template.

 

Database Query Authentication

 

Database Query Authentication allows you to authenticate a user based on the results of a database query.  If one or more records are returned from the query then the user is successfully authenticated.

 

 

Figure 60

 

clip0060

 

 

JDBC URL - The JDBC URL used to connect to the database.  The above example demonstrates connecting to a MySQL database.  Contact your database vendor for access to JDBC libraries and assistance on specifying the JDBC URL.  Libraries for JDBC drivers must be placed in the libs directory of your JSCAPE Secure FTP Server installation, driver class registered under File > Settings > JDBC and JSCAPE Secure FTP Server Service restarted in order to be loaded. 

 

User - The username to connect with when authenticating with JDBC database.

 

Password - The password to connect with when authenticating with JDBC database.

 

SQL query - The query to perform to authenticate the user.  There are two special variables that may be used when performing the database query %username% and %password% which refer the username and password passed in during the authentication process.  Note:  SQL queries and stored procedures may be used, however stored procedures which make use of output parameters MAY NOT be used.  Variables %username% and %password% are treated as strings so MUST be enclosed in single quotes.

 

Hash password class - The Java class to use for hashing password before passing to SQL query.  If no class is specified then password will be passed to SQL query in clear text.

 

Create account if not found using template - This allows for accounts to be created automatically upon successful authentication.  If selected, an account will be created automatically (if it does not exist already) using the specified User Template.

 

See also

 

Password Hashing

 

 

LDAP User Authentication

 

LDAP User Authentication allows you to authenticate a user based on whether the user has the credentials to connect to the LDAP or Active Directory service.

 

 

Figure 61

 

clip0061

 

Host - The hostname or IP address of the LDAP service.

 

Port - The port of the LDAP service.

 

Use SSL connection - Connect to LDAP server using SSL connection. 

 

User DN - The users distinguished name for authenticating with the LDAP service. The variable %username% may be used which refers to the username passed in during the authentication process.

 

Create account if not found using template - This allows for accounts to be created automatically upon successful authentication.  If selected, an account will be created automatically (if it does not exist already) using the specified User Template.

 

 

LDAP Query Authentication

 

LDAP Query Authentication allows you to authenticate a user based on the results of a LDAP query.  If one or more records are returned from the query then the user is successfully authenticated.

 

Figure 62

 

clip0062

 

Host - The hostname or IP address of the LDAP service.

 

Port - The port of the LDAP service.

 

Use SSL connection - Connect to LDAP server using SSL connection. 

 

User DN - The users distinguished name for authenticating with the LDAP service.

 

Password - The users password for authenticating with the LDAP service.

 

Base DN - The base distinguished name in which to perform the filter.

 

Filter - The filter to execute using the LDAP filter syntax.  There are two special variables that may be used when performing the database query, %username% and %password% which refer the username and password passed in during the authentication process.

 

Hash password class - The Java class to use for hashing password before passing to filter.  If no class is specified then password will be passed to filter in clear text.

 

Create account if not found using template - This allows for accounts to be created automatically upon successful authentication.  If selected, an account will be created automatically (if it does not exist already) using the specified User Template.

 

See also

 

Password Hashing

 

 

LDAP Filter Grammar

 

When using LDAP Query Authentication you must define a filter that will be used to identify the record you are searching for.  The syntax of LDAP filters are defined in RFC 2254.  The table below provides a list of valid expressions and their meanings.

 

Symbol

Filter

Example

Example matches

=

Equality

(sn=Smith)

Surname of Smith only.

>

Greater than

(sn>Smith)

Any surname that alphabetically follows Smith.

>=

Greater than or equal to

(sn>=Smith)

Any surname that includes or alphabetically follows Smith.

<

Less than

(sn

Any surname that alphabetically precedes Smith.

<=

Less than or equal to

(sn<=Smith)

Any surname that includes or alphabetically precedes Smith.

=*

Presence

(sn=*)

All surnames (all entries with the sn attribute).

=*

Substring

(sn=Smi*)

Any matching substring of Smith.

&

And

(& (sn=Smith) (cn=John) )         

Surname of Smith and common name of John.

|

Or

(| (sn=Smith) (sn=Jones) ) 

Surname of Smith or Jones.

!

Not

(! (sn=Smith)) 

Surname not equal to Smith.

 

See also

 

Authenticating with Microsoft Active Directory

 

 

Custom User Authentication

 

Using Custom User Authentication you may define your own custom authentication class.

 

Figure 86

 

clip0086

 

Authentication class - The custom authentication class name. 

 

Create account if not found using template - This allows for accounts to be created automatically upon successful authentication.  If selected, an account will be created automatically (if it does not exist already) using the specified User Template.

 

See also

 

Authenticating using custom authentication API

 

Password Hashing

 

The Database Query Authentication and LDAP Query Authentication services both support optional password hashing.  Many databases and LDAP repositories store passwords in a hashed format.  This is a security measure used in order to protect user credentials should a database or LDAP repository be compromised.  JSCAPE Secure FTP Server includes some built-in classes that may be used for hashing a password before it is sent for authentication  against  a database or LDAP repository.  These classes are com.jscape.inet.mft.authentication.MD5Hasher and com.jscape.inet.mft.authentication.SHA1Hasher which offer MD5 and SHA1 hashes respectively. 

 

Note : The hashes provided by the MD5Hasher and SHA1Hasher classes are provided in lowercase format.

 

Some databases or LDAP repositories may store passwords in a salted hash format.  In a salted hash format the password is combined with other data (the salt) prior to being hashed.  Salted hash passwords are typically used in an effort to avoid brute-force password attacks should the database or LDAP repository be compromised.  Password salting is generally application dependent, therefore should you need to use a salted password it is necessary to write your own password hasher using the JSCAPE Secure FTP Server API.  To implement your own password hashing provider you must perform the following:

 

1.  Create a Java class which implements the com.jscape.inet.mft.authentication.Hasher class.

 

2.  Overload the public String createHash(String login, String password) method, returning the hashed value.

 

3.  Create a JAR file that contains the compiled version of your com.jscape.inet.mft.authentication.Hasher implementation.  To compile your authentication class you will need to include the data.jar library in your classpath.  The data.jar library may be found in the default installation directory for JSCAPE Secure FTP Server.

 

4.  Place the JAR file created in step 3 into the libs directory of your JSCAPE Secure FTP Server installation.

 

5.  Shutdown any open instances of JSCAPE Secure FTP Server Manager and restart the JSCAPE Secure FTP Server Service.

 

6.  In the "Hash password class" field of the "Database Query Authentication" service or "LDAP Query Authentication" service enter the full classname, including package name of your hash provider.