A new CDE session is started on the appropriate server, and the user is prompted for a login and password as with any other Solaris Operating Environment system. If smart cards are not used, a user must log out of one desktop and then log in to another. While Sun Ray appliance users without smart cards can still use any desktop within the workgroup, they will not be able to automatically reconnect to an active session. The registered authentication policy affords a higher level of security, as all tokens must be registered before they can be used to create a session. For example, administrators may assign known smart cards to CDE desktop sessions, while other users logging in from a Sun Ray appliance may be assigned a session with a limited Web browser instead.
Administrators can choose a distributed or a centralized registration policy.
With a distributed policy, users accessing the system with a new token number are sent to a registration screen to complete self-registration before being authenticated. A centralized policy provides greater security, as the registration program runs only at a single location, such as a badging station or site security officer's station. As with the zero administration policy, any user would also need a Solaris Operating Environment login and password to complete the authentication process. Additional authentication policies may be included in later releases, and administrators will be able to extend the provided authentication policies. The Session Manager manages all running user sessions.