FW: Proxies and CHAP

[MSITMI02.XZ46G8 () eds com]

I regard this as just a special case of a more general problem of any
form of access to an authorised data source via a firewall. Whether it is
because a VPN is used that requires user identification on a portable, or
a OTP to get past the firewall, the user then has to issue another
password or logon to e.g. a 3270 mainframe service, a privileged
webserver, etc.

When this system is a fee paying customer service it is desirable for
ease of use that a client perform only one logon, but that the privileged
data source have access to the user name used to log on at the firewall
as this is frequently used to determine type of access to different
levels of service.

So is anybody working on a solution? Does anybody else even see this as a
need?

I presume the standard way to go would be that the firewall implement DCE
security services, right?

distinti saluti/regards
Philip Kerrigan
EDS Italy    tel +39 2 2524272
Viale Monza, 257   fax +39 2 27002588
20126 Milano   email msitmi02.xz46g8 () eds com
Italy

 ----------
From:  owner-firewall-wizards
Sent:  Friday, September 19, 1997 12:23 AM
To:  XZ46G8
Subject:  Proxies and CHAP

I've been giving some thought to the idea of how CHAP can be handled
through proxies. I'm not referring to anyone's particular implementation
of a proxy, just the concepts in general.

If I want to perform a CHAP with a server beyond a Proxy Firewall, then
I'm actually having the client authenticate against the Firewall, and
the Firewall authenticate against the Server, right? This means two CHAP
sessions, and it means I rely on the Firewall to tell the server that
the client really did authenticate with it, and therefore can accept the
authentication request from the Firewall.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security