How SecretStore Works

Architecture

SecretStore 3.0 runs on Solaris*, Linux*, NetWare 5.x, NetWare 6, and Windows 2000/NT.

The Solaris and Linux servers require Novell eDirectory 8.5 or Corporate Edition 8.5 or later. (NICI is automatically installed during server installation.)

The NetWare 5.x and NetWare 6 servers can run NDS 7, as long as NICI 1.5.4 or later is installed. However, we recommend that you upgrade to Novell eDirectory 8.5 or later.

Windows NT/2000 servers require eDirectory 8.6x and NICI 2.02.

The following figure illustrates SecretStore running on these platforms:

When you install SecretStore on these servers, the installation program installs the SecretStore service on top of eDirectory and NICI. SecretStore plug-ins run on top of SecretStore.

The following figure illustrates this software:

SecretStore plug-ins include DirXML^TM, client APIs, NCP^TM, and an LDAP extension.

You install administrative and SecretStore components on a Windows workstation and administer SecretStore from there.

The following figure illustrates client software running on a Windows workstation:

The following steps illustrate how SecretStore works:

1. A user logs in to eDirectory by using a password.
2. A successful login allows the user's secrets to be downloaded (when necessary) from SecretStore to the workstation. Through the use of SecureLogin, this process enables disconnected use.
3. The user accesses a Windows, Web-based, or host-based application. SecureLogin recognizes the application and responds with the appropriate username and password fetched from SecretStore.

   If SecureLogin does not discover matching credentials, the client prompts the user to add the application. Secrets are synchronized when certain events occur or when the user connects to or disconnects from eDirectory.

For illustrations concerning how SecretStore works, see Novell SecretStore in the November 1999 AppNotes. This article illustrates the following:

• How applications authenticate before SecretStore is enabled
• A user's first-time authentication to SecretStore-enabled applications
• A user's subsequent authentications