Partially Automatic Client Authentication Is Slow

[BarryStiefel]

Partially Automatic Client Authentication (i.e. Implicit Client Authentication, or Session Auth of HTTP is slow)



Using Session Authentication for HTTP will result in performance problem, at least in the standard way. This is because like you've said, the browser opens HTTP connection for each item in the page, so an authentication session will be done for each item. Even if you cache the passwords, there is still a significant overhead for each connection. There are two standard ways to provide efficient user-level authentication for HTTP:

• Standard HTTP User Authentication
• Client Authentication

There is another way to do this called "Implicit Client Auth," or Partially Automatic Client Auth. In FireWall-1 4.0 and later, you perform the following steps:

• Create a rule like so:

Source Destination Service Action All-Users@Any Any http Client Auth

• Edit the properties on the Client Auth action and change the Sign-On Method to Fully Automatic Sign-On

So what does this do for you?

• The first time a user tries HTTP through the firewall, the "Client Auth" rule will not be available because the user has not authenticated. FireWall-1 will then attempt to authenticate the user via Session Authentication.
• After the user successfully authenticates, the firewall will "mimic" a Client Auth for the user, i.e. performing a "standard sign-on" for all Client Auth rules that apply for that user.
• Future HTTP sessions will hit the "Client Auth" rule. FireWall-1 will remember that it has already authenticated you.
• If you want the user to reauthenticate every 15 minutes or after so many accesses, you can set the Client Auth timeouts accordingly. When the user has reached his timeout value, new connections will not succeed until a successful Session Authentication has been performed.

Note that you can also do this with Session Auth as well. Set the sign-on method to "Fully Automatic" (uses User Auth for supported services, Session Auth for other services) or "Agent Automatic" (Session Authentication used for all services) instead of "Partially Automatic."

-- PhoneBoy - 30 Dec 2003

FAQForm FAQs.Class: AuthenticationFAQs, ContentSecurityFAQs, TroubleshootingFAQs OperatingSystem?: FAQs.Version: