Re: Allow Integrated Windows Authentication Token to be delegated?

From: Ken Schaefer (kenREMOVE_at_THISadOpenStatic.com)
Date: 03/25/04 

Date: Thu, 25 Mar 2004 12:34:08 +1100

Integrated Windows Authentication actually involves two different types of
authentication. Kerberos, and NTLM v2. Kerberos is supported, natively, by
Windows 2000 and Windows XP client machines. Delegation is possible using
Kerberos.

If you are also running a Windows 2003 Domain, then with constrained
delegation you can also configure Protocol Transition, which allows
non-Kerberos authentication to the webserver, and then the webserver will
get a Kerberos tokent to access the remote file server.

Some links that may be helpful:

Here are a few articles to get you started:

http://support.microsoft.com/default.aspx?scid=kb;en-us;810572
HOW TO: Configure an ASP.NET Application for a Delegation Scenario

http://support.microsoft.com/?id=294382
Authentication May Fail with "401.3" Error If Web Site's "Host Header"
Differs from Server's NetBIOS Name

http://support.microsoft.com/default.aspx?kbid=325894
HOW TO: Configure Computer Accounts and User Accounts So That They Are
Trusted for Delegation in Windows Server 2003 Enterprise Edition (also
includes Windows 2000 instructions)

http://www.microsoft.com/resources/documentation/WindowsServ/2003/standard/proddocs/en-us/Default.asp?url=/resources/documentation/WindowsServ/2003/standard/proddocs/en-us/se_con_del_computer.asp
Configuring Users and Computers for delegation (there's a couple of pages -
use the links in the nav bar to get to them)

Windows 2003 Protocol Transition
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/constdel.mspx

Cheers
Ken

"Raterus" <raterus@localhost> wrote in message
news:eEdC35eEEHA.3412@TK2MSFTNGP10.phx.gbl...
: I'm writing an asp.net intranet application that allows the current user
to
: manage their user folder on a shared network drive on the same domain as
the
: webserver. These user folders have permissions set up for the current
user.
:
: From what I understand about IIS/Integrated Windows Authentication, it
: doesn't support delegation, that is passing an authentication token to a
: server beyond the webserver (like this network share). Any access beyond
: that "one-hop" would be executed under the configured identity of asp.net.
:
: Is there a way, from code perhaps, to beef up the token IIS receives from
: the browser (that has been authenticated by Integrated Windows), so it can
: overcome the one-hop rule, and access a network share that has permissions
: set for the current user? I know this problem is easily solved with using
: basic authentication, but I don't want the user to have to re-enter their
: username/password in the webpage.
:
: I just want it so authenticated user "joe" can access this shared network
: folder because there are permissions set for "joe", not because I've done
: some crazy process to change the identity asp.net runs under. It seems
: silly that there wouldn't be a way to do this!
:
: Please help!
: --Michael
:
:

Relevant Pages

  • Re: Access denied. delegation scenario accessing to a shared resource in cluster
    ... Depending on how your web server is configured ... for delegation, ... application via Kerberos too. ... web server and the cluster server and find out what kind of authentication ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • cross-realm authentication problem
    ... I am trying to get cross-realm authentication to work between AD and our MIT Kerberos realm. ... Windows client are in KLIENT.UIB.NO, Windows user accounts are in UIB.NO, Unix/Linux machines and accounts are in UNIX.UIB.NO. ... After choosing UNIX.UIB.NO as authentication domain on a Windows machine Kerberos negotiation works fine. ... But using a Windows machine where the user is authenticated in UIB.NO I get cross-realm authentication only to the web server running RHEL4, not the one running RHEL5, I never even get a ticket for UNIX.UIB.NO from AD when trying to access the RHEL5 server web page. ...
    (comp.protocols.kerberos)
  • Re: Kerberos authentication NOT in AD
    ... I'm not sure where the piece of code is that gives you a high level Kerberos ... Windows to do it yourself, but I'm not an expert at this. ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... so I'm not doing any authentication as of yet (I've ...
    (microsoft.public.dotnet.security)
  • Re: How to start/stop windows service on a remote machine?
    ... Yes, in IIS virtual directory, you can use only one authentication type at ... your application previously use "integrated windows ... and this is transfered to server as clear text, so in internet scenario, ... Kerberos delegation in your environment(from client to webserver and the ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: UNC Virtual Directories; NTFS permission authentication not ac
    ... If you want Kerberos delegation to work, you need to have everything setup correctly end-to-end. ... The browser must authenticate using Kerberos, which means that both IE must attempt Kerberos *and* the relevant server SPNs must be created/set correctly. ... > Windows Authentication option the ...
    (microsoft.public.inetserver.iis.security)