It uses SSL , Kerberos , and HTTP cookies . This document gives the details of how and why. The web login tool itself is here . This simple scheme has worked reasonably well. In the following paragraphs we describe a relatively secure scheme that will allow such access.
Proof consists of providing a local username and password.
In return the user receives a tamper-proof credential in the form of a cookie that is presented when accessing pages. The cookie contains, among other things, the user's CSE identity and an expiration date after which the credentials must be renewed. It is tamper-proof because it has been signed by the trusted web server which initially verified the user's identity. The signature consists of an MD5 checksum of the cookie's contents encrypted in a key known only to the web server. On a subsequent page access, the checksum of the cookie is calculated and compared against the original, decrypted checksum.