Pass Through Authentication

Here is a high-level overview of Pass-through Authentication.

Stephen Lombardo from Identicentric wrote:

” +1 for virtual directory pass-through authentication.

It’s definitely technically feasible and works very well to drive consolidation of authentication services. From past experience it’s one of the most powerful benefits of virtual directory technology. In fact, this feature was key to the value proposition and purchasing decision for several of the prominent deployments I’ve worked on. ”

UPDATED: We added wizards in Penrose Studio to automatically configure Penrose server to allow pass authentication requests back to Active Directory.

UPDATED: We currently support three different modes of PTA, namely:

• Default mode: Penrose initially binds to the target directory to check the credentials, then to switch to a proxy account for all further operations on the connection. This is by far the most common scenario.
• Full mode: Penrose binds to the target directory check credentials and then holds the connection open to process all directory operations for that connection. In this mode the same credentials you supplied during bind will continue to be used when you perform the subsequent operations. This mode is the most valuable in a security conscious directory environment that makes heavy use of ACLs. In that kind of environment the use of default mode might be undesirable.
• Disabled mode: In this mode, Penrose doesn’t allow passthrough at all. It always operates on the back end directory with a proxy account. All bind operations against the target server are rejected. Any other operations will be executed using the proxy account specified in its xml config.