Feature Overview

After remote authentication is configured, a CDN point of presence (POP) can forward a user request to a preset authentication server after it receives the request. If the user request passes the authentication, the POP returns the requested content to the user. This feature can ensure that user authentication rules are defined on the origin server.

Application Scenarios

If you need flexible authentication rules that you can change anytime without binding them to CDN, you can use the remote authentication feature.

Additional Considerations

After remote authentication is enabled, a CDN POP forwards each user request to the specified authentication server. Make sure that the authentication server can handle the corresponding number of concurrent requests and quickly return the results.
If remote authentication is enabled, a response latency can occur because it takes time for the authentication server to return results. We recommend that you enable this feature for latency-insensitive workloads, such as large file downloads.

Procedure

Currently, this feature cannot be configured on your own. If you need to configure this feature, please contact our customer support team via hotline (852)31000000 or email global.noc@chinatelecomglobal.com. This feature can only be manually configured by the technical support team.

Please provide the following information:

Parameter	Description
Authentication server	The address of an authentication server. You can specify an IP address or a domain name.You can specify multiple authentication servers (one primary server and multiple secondary servers).
Authentication URI	The URI that you want to use for an authentication request. You can specify the URI of the original user request as the authentication URI. You can also specify a custom URI based on the original user request.
Authentication parameters	The query string (parameters following a question mark (?)) that you want to use in an authentication request. You can specify the parameters in the original request as the authentication parameters. You can also add, delete, or modify the parameters based on the original request parameters.
Authentication request headers	The request headers that you want to use in an authentication request.You can specify the headers in the original request as the authentication request headers. You can also add, delete, or modify the request headers based on the original request headers.
Authentication protocol + port	The authentication protocol and authentication port. You can specify http or https as the authentication protocol. You can specify any port as the authentication port.
Whether to pass authentication in case of a timeout	Specifies whether the request passes authentication when the authentication service times out.
Whether to pass authentication in case of an authentication error	Specifies whether the request passes authentication when the authentication server returns an error code, such as 5XX.
Authentication rule	The conditions that are used to determine that the request passes the authentication. 1. You can specify this parameter based on the status code returned from the authentication server. You can specify a blocklist or trustlist. For example, you can specify a blocklist that contains only the status code 403. In this case, the request fails authentication only if the authentication server returns 403. You can also specify a trustlist that contains only 200. In this case, the request passes authentication only if the authentication server returns 200. You can specify multiple status codes. 2. You can specify this parameter based on the JSON string returned from the authentication server. In this case, you need to provide specific information that can be used to determine whether the request passes authentication.

In addition to the preceding parameters that you must specify, the following table describes other parameters related to this feature. In most cases, the default values are used for these parameters. If you need to change the values, please describe your requirements.

Parameter	Description
Status code for retries	When a response status code returned by an authentication server meets a specific condition, CDN retries authentication. By default, if the authentication server times out or returns 5XX, CDN retries authentication.
Authentication method	The request method that is used to forward requests to the authentication server. Valid values: GET, POST, and OPTIONS. Default value: GET.
Authentication timeout period	The authentication timeout period. The default authentication timeout period is 3 seconds.
Connection pool size for authentication requests	The size of the connection pool used to connect to the authentication server. Default value: 1000.
Idle connection timeout period	The maximum length of time that a connection can stay active when no requests are sent over the connection. After this idle connection timeout period expires, the connection is automatically closed to avoid an excessive number of connections. The default idle connection timeout period is 10 seconds.

Content Delivery Network

Remote authentication