SIP digest authentication settings

Use this page to configure Session Initiation Protocol (SIP) digest authentication settings; these settings allow the SIP container to authenticate secured applications.

To view this administrative console page, click Security > Global Security > Authentication > Web and SIP Security > SIP digest authentication .

Enable digest authentication integrity

Specifies the authentication integrity (auth-int) quality of protection (QOP) for digest authentication. Digest authentication defines two types of QOP: auth and auth-int. By default, basic authentication (auth) is used. If the value is set to True, the auth-int QOP is used, which is the highest level of protection.

Data type Boolean
Default False

Enable SIP basic authentication

Specifies the authentication (auth) quality of protection (QOP) for digest authentication. Digest authentication defines two types of QOP: auth and auth-int. By default, basic authentication (auth) is used. If the value is set to True, basic authentication will be performed. It will not be processed by the Trust Association Interceptor.

Data type Boolean
Default True

Enable multiple use of nonce

Specifies whether to enable multiple uses of the same nonce. If you use the same nonce more than once, then less system resources are required, however, your system is not as secure.

Data type Boolean
Default False

Enable nonce maximum age

Specifies the amount of time, in milliseconds, for which a nonce is valid. If the value is set to 1, then the amount of time is considered to be infinite.

Data type Integer
Default 1

LDAP cache clean intervals

Specifies the amount of time that must expire, in minutes, before the LDAP cache is cleaned.

Data type Integer
Default 120

LDAP password attribute name

Specifies the LDAP attribute name that stores the user password .

Data type String
Default userpassword

User cache clean intervals

Specifies the amount of time that must expire, in minutes, before the security subject cache is cleaned.

Data type Integer
Default 15

Digest password server class

Specifies the Java class name that implements the PasswordServer interface.

Data type String
Default LdapPasswordServer

Hashedcredentials

Specifies the name of the LDAP field that contains the hashed credentials. If a value is specified for this setting, then this setting overrides the pws_atr_name setting.

LDAP servers automatically provide password support. Unless you enable the LDAP server to use hashed values, the LDAP server stores user passwords and then the request processing component uses these passwords to validate a request. Because this method of authentication exposes user passwords to potential internet theft, you should enable the use of hashed credentials to authenticate a request.

When you enable the use of hashed credentials, the LDAP server stores a hash value for the user, password and realm information. The SIP container then requests this hash value from the LDAP server instead of asking for a user password. This methodology protects the passwords even if the hash data is compromised through internet theft. However, this methodology has the following limitations:
To enable the LDAP server to use hashed credentials, you must define the following two settings:
Data type String
Default empty string

Hashedrealm

Specifies the realm for hashed credentials, if the hashed credentials setting is enabled.

Data type String
Default empty string



Related tasks
Configuring the SIP container
Configuring security for the SIP container
Configuring digest authentication for SIP
Reference topic    

Terms of Use | Feedback

Last updated: Oct 21, 2010 5:30:17 AM CDT
http://www14.software.ibm.com/webapp/wsbroker/redirect?version=compass&product=was-nd-iseries&topic=usip_digestauth
File name: usip_digestauth.html