User Security

NCache provides robust, LDAP-integrated security architecture to safeguard your cache clusters from unauthorized access and management operations. Security is enforced at the node level, i.e., once a cache node is secured, all communication, data operations, and management tasks must be explicitly authenticated and authorized.

Note

All the caches on a secured node are automatically secured.

Authentication and Authorization

NCache offers the LDAP-integrated security to secure cache nodes. Once a node is secured, there are two access levels defined on that node:

  • Machine Level Authorization: It is performed by an OS-level administrator on the target server.
  • NCache-level Authorization: This ontrols who can manage NCache and who can access secured caches.
Note

All the caches on a secured node are automatically secured.

An OS-level administrator, also referred to as a Machine Administrator, is a user who has local administrator privileges on the server machine. This user does not have to be an LDAP or Active Directory user. If the Machine Administrator is not added to NCache security, the user is not treated as a Node Administrator or Cache User. Such a user can only authorize enabling or disabling NCache security.

Once NCache security is enabled on a node, NCache uses registered security users to authorize management and cache operations. NCache supports the following types of security users:

Machine Administrators

A Machine Administrator is an OS-level user with local administrator privileges on the server where NCache security is being enabled or disabled. This user is used to authorize security configuration changes at the machine level.

A Machine Administrator is not automatically granted NCache management or cache access rights. To perform NCache management operations after security is enabled, the user must also be added as a Node Administrator in NCache security.

If the Machine Administrator account cannot query the LDAP or Active Directory directory, you can provide separate directory browsing credentials to validate the Node Administrator identity.

Node Administrators

Node Administrators are Super-Users and have complete control over the cache - they can create, modify, remove caches, and perform any other cache management operations.

Cache Users

However, if you want to limit some users to having cache API access only, and don't want them to perform any management operations, then configuring Cache User is your go-to option. Where you can restrict the user to perform data operations including Add, Remove, Update, and Retrieve through the relevant APIs only.

But, if you don't want to define different access levels for your users and allow all of them to perform all types of operations on cache. Then, there is no need to configure Cache User, as your Node Administrators have all the rights to manage and operate the cache smoothly.

gMSA Cache Users

NCache supports gMSA accounts as a special type of cache user for applications that operate under a Windows gMSA identity. Unlike standard LDAP users, gMSA accounts do not require a password to be provided or stored, instead, the NCache Client SDK automatically retrieves a Kerberos token from Windows at runtime, delegating authentication to Windows Authentication (SSPI/LSA) which obtains Kerberos tickets from the Kerberos Key Distribution Center (KDC). gMSA accounts can be added as cache users (not node administrators) and are authenticated against Active Directory the same way as standard LDAP users. The '$' suffix must be used when specifying the account name (e.g., user1gmsa$).

Note

gMSA accounts are supported as cache users only. gMSA support requires NCache 5.3.7 or above.

Credential Validation and Caching

NCache validates LDAP and Active Directory users through the configured domain controller. When a user or group is added to NCache security, NCache verifies that the identity exists in the directory.

If the domain controller is unavailable during validation, the operation fails and the user cannot be added or authenticated.

To reduce repeated authentication during the lifetime of a process, NCache provides Credential Caching. When enabled, credentials of an already authenticated user are cached by NCache so the user does not have to be authenticated repeatedly during the same process lifecycle.

Credential Caching is disabled by default. To enable it, set the NCacheServer.EnableCredentialCaching tag to True in the NCache Service configuration file.

Homogeneous Security Settings

After establishing security settings for one node, you need to ensure that all the nodes in that cluster have similar security settings on them. The user acting as Node Administrator on one node should be the administrator on all the other nodes in that cluster. Similarly, the user acting as a Cache User on one node should be a Cache User on the rest of the nodes.

If homogeneous security settings are not ensured on all nodes of a cluster, you may encounter different issues while managing and operating cache.

Note
  • A secured node as the first node in a cache cluster should prevent the addition of vulnerable nodes.
  • A vulnerable node as the first node in a cache cluster shall prevent the addition of secured nodes.

See Also

Configure Authentication and Authorization
Configure Encryption for Cache