Red Hat CERTIFICATE SYSTEM 8 - DEPLOYMENT Deployment Manual page 17

2. The client sends the name and password across the network, either in plain text or over an
encrypted SSL connection.
3. The server looks up the name and password in its local password database and, if they match,
accepts them as evidence authenticating the user's identity.
4. The server determines whether the identified user is permitted to access the requested resource
and, if so, allows the client to access it.
With this arrangement, the user must supply a new password for each server accessed, and the
administrator must keep track of the name and password for each user.
1.3.2.2. Certificate-Based Authentication
One of the advantages of certificate-based authentication is that it can be used to replace the first
three steps in authentication with a mechanism that allows the user to supply one password, which is
not sent across the network, and allows the administrator to control user authentication centrally. This
is called single sign-on.
Figure 1.5, "Using a Certificate to Authenticate a Client to a Server"
works using certificates and SSL. To authenticate a user to a server, a client digitally signs a randomly
generated piece of data and sends both the certificate and the signed data across the network. The
server authenticates the user's identity based on the data in the certificate and signed data.
Figure 1.4, "Using a Password to Authenticate a Client to a
Like
Certificate to Authenticate a Client to a Server"
and requested a resource and that the server has requested client authentication before granting
access to the requested resource.
Figure 1.5. Using a Certificate to Authenticate a Client to a Server
Unlike the authentication process in
Server", the authentication process in
assumes that the user has already trusted the server
Figure 1.4, "Using a Password to Authenticate a Client to a
Figure 1.5, "Using a Certificate to Authenticate a Client to
Authentication Confirms an Identity
shows how client authentication
Server", Figure 1.5, "Using a
7