The purpose of this table is to define the supported and trusted authentication systems for this database, e.g. LDAP, RSA, KEON, KERBOS, Internal, etc.
If the authentication system is a PAM module plug-in then details of the supported plug-in behavior are also recorded. If the authentication system is not a PAM plug-in then the method is simply a registered and therefore trusted valid authentication system for this database.
An authentication system must be registered in this table and installation specific domain information defined in the _sec-authentication-domain table in order to use this authentication system for application or database access.
This table facilitates the central definition and deployment of the supported authentication systems to simplify the job of the DBA for an installation so that the DBA just has to capture installation specific information for the authentication systems being used.
D: The name of this authentication system, e.g. LDAP, KERBOS, RSA, KEON, Internal, etc.
This field must contain a value for a registered authentication system in the _sec-authentication-system table.
V: esz 70 BY 8 sv MAX-CHARS 500 D: This is a free text description to describe the authentication system, its purpose, use, etc. primarily for tools and reporting purposes.
D: This is the name of a keystore that is used to supply the key for performing data integrity checking on client login tokens (principals). The keystore works in conjunction with the domain access code.
The domain name points to a key in the keystore, and the domain access code is an encrypted value for the keystore entries access code.
D: This is an optional field supported for PAM plug-ins only.
It specifies a path and procedure name of a 4GL persistent procedure that will be called by the PAM library during the authentication process. In that procedure the 4GL application has the opportunity to add application specific name-value string pairs which will be unchangeable and protected by the CLIENT-PRINCIPAL's data-integrity MAC seal.
The procedure specified must contain standard methods.
D: This is an optional field supported for PAM plug-ins only.
This field contains a RAW 16 byte MD5 hash value for the PAM plug-in library. If specified, the plug-in load operation will perform a MD5 hash of the plug-in module and match that value to this field's value before the actual load operation will be allowed to commence.
If the field's value is UNKNOWN, no module checking will be performed.
D: This is required for PAM plug-ins only.
This is the name of the PAM module. The location of the library is defined for each domain that uses this authentication system in the _PAM-library-path field of the _sec-authentication-domain table.
V: tb D: This is a logical field to indicate whether this authentication system is a PAM module plug-in library definition. If set to NO then this system is simply a registered and therefore trusted valid authentication system for this database. For non-PAM authentication systems it is the combination of the domain name and secure access code that are used to validate that a CLIENT-PRINCIPAL object originated, and was not modified, by a trusted authentication system and can therefore be used for application or database access. For PAM plug-ins additional details are recorded to control the behavior of the plug-in.
D: The name of this authentication system, e.g. LDAP, KERBOS, RSA, KEON, Internal, etc.
This field must contain a value for a registered authentication system in the _sec-authentication-system table.
V: esz 70 BY 8 sv MAX-CHARS 500 D: This is a free text description to describe the authentication system, its purpose, use, etc. primarily for tools and reporting purposes.
V: tb D: This is a logical field to indicate whether this authentication system is a PAM module plug-in library definition. If set to NO then this system is simply a registered and therefore trusted valid authentication system for this database. For non-PAM authentication systems it is the combination of the domain name and secure access code that are used to validate that a CLIENT-PRINCIPAL object originated, and was not modified, by a trusted authentication system and can therefore be used for application or database access. For PAM plug-ins additional details are recorded to control the behavior of the plug-in.
D: This is required for PAM plug-ins only.
This is the name of the PAM module. The location of the library is defined for each domain that uses this authentication system in the _PAM-library-path field of the _sec-authentication-domain table.
D: This is an optional field supported for PAM plug-ins only.
It specifies a path and procedure name of a 4GL persistent procedure that will be called by the PAM library during the authentication process. In that procedure the 4GL application has the opportunity to add application specific name-value string pairs which will be unchangeable and protected by the CLIENT-PRINCIPAL's data-integrity MAC seal.
The procedure specified must contain standard methods.
D: This is an optional field supported for PAM plug-ins only.
This field contains a RAW 16 byte MD5 hash value for the PAM plug-in library. If specified, the plug-in load operation will perform a MD5 hash of the plug-in module and match that value to this field's value before the actual load operation will be allowed to commence.
If the field's value is UNKNOWN, no module checking will be performed.
D: This is the name of a keystore that is used to supply the key for performing data integrity checking on client login tokens (principals). The keystore works in conjunction with the domain access code.
The domain name points to a key in the keystore, and the domain access code is an encrypted value for the keystore entries access code.