# HTTP Digest Authentication

## Contents
Overview Configuration

## Overview
A client can authenticate to the Enterprise Gateway with a username and password digest using HTTP Digest Authentication. Whenever an HTTP Digest Authentication filter is configured, the Enterprise Gateway requests the client to present a username and password digest as part of the HTTP Digest challenge-response mechanism. The Enterprise Gateway can then authenticate this user against a user profile stored in the Enterprise Gateway database. The realm presented in the challenge for HTTP Digest Authentication is the realm currently specified in the system settings. See the Default Settings topic for more information.
## Configuration
The information specified on this screen informs the Enterprise Gateway where it can find user profiles for authentication purposes. The Enterprise Gateway can lookup user profiles in the Enterprise Gateway's local repository, in a database, or in an LDAP directory. Users can be added to the local repository using the Users interface. See the Users tutorial for more information on how to do this. To configure the HTTP Digest Authentication filter, complete the following fields. Name Enter a name for the filter here. Credential Format The username presented to the Enterprise Gateway during the HTTP Digest handshake can be of many formats, usually either username or Distinguished Name (DName). Because the Enterprise Gateway has no way of inherently telling one format from the other (for example, the client's username could be a DName), it is necessary to specify the format of the credential presented by the client. This format is then used internally by the Enterprise Gateway when performing authorization lookups against third party Identity Management servers. Session Timeout As part of the HTTP Digest Authentication protocol, the Enterprise Gateway must generate a nonce (number used once) value, and send it to the client. The client uses this nonce to create the digest of the username and password. However, it should only be allowed a certain amount of time to do so. The Session Timeout field specifies the length of time (in milliseconds) for which the nonce is valid. Remove HTTP Authentication Header Select this checkbox to remove the HTTP `Authorization` header from the downstream message. If this option is not selected, the incoming `Authorization` header is forwarded on to the destination Web Service. Repository Name This specifies the name of the Authentication Repository where all user profiles are stored. This can be in the Enterprise Gateway's local repository, in a database, or in an LDAP directory. Select a pre-configured Repository Name from the drop-down list. You can add a new repository on the External Connections tab by right-clicking the appropriate node under Authentication Repository Profiles (for example, Database Repositories), and selecting Add a new Repository. For more details, see the Authentication Repository tutorial.