Re: SSL & Certificates or Windows Auth

From: Ken Schaefer (kenREMOVE_at_THISadOpenStatic.com)
Date: 11/20/03

  • Next message: Simon: "The directory datatype cannot be converted to/from a" 
    Date: Thu, 20 Nov 2003 14:28:18 +1100

    Is you are using something like "Basic Authentication" to authenticated
    against the Windows User database, then it is strongly recommended that you
    use SSL, as the username/password are essentially passed as clear-text.

    On the otherhand, if you use Integrated Windows Authentication (or NTLM or
    Keberos), then a challenge-response system is used, and the password is
    never passed. So SSL doesn't help you as much here.

    That said, SSL encrypts everything except the actual request header (ie what
    file is being requested), so every other header (including the HTTP headers
    conveying the username, password or password hash) are encrypted.

    Cheers
    Ken

    "Andrew" <anonymous@discussions.microsoft.com> wrote in message
    news:051e01c3aef8$53c8b210$a401280a@phx.gbl...
    : Hi,
    :
    : From a security point of view, how much additional
    : security does having a certificate to access a website
    : provide over using Windows authentication?
    :
    : Also, when using a SSL connection and using Windows
    : authentication, i take it that the username/password is
    : also encrypted?
    :
    : Andrew

  • Next message: Simon: "The directory datatype cannot be converted to/from a"

    Relevant Pages

    • Re: SSL & Certificates or Windows Auth
      ... Are you talking about client and server certificates? ... Is using Integrated Windows Authentication with SSL as ... secure as SSL with certificates? ... :>Is you are using something like "Basic Authentication" to ...
      (microsoft.public.inetserver.iis.security)
    • Re: Logon failures filling the event log
      ... Exchange web interface and CompanyWeb all require SSL and 128 bits. ... It's probably a brute-force attack. ... The authentication as seen from the authentication service comes from ... server farm (Windows 2003 standard, IIS6) hosting SSL secured, NTLM ...
      (microsoft.public.windows.server.sbs)
    • Re: Logon failures filling the event log
      ... Exchange web interface and CompanyWeb all require SSL and 128 bits. ... It's probably a brute-force attack. ... The authentication as seen from the authentication service comes from ... server farm (Windows 2003 standard, IIS6) hosting SSL secured, NTLM ...
      (microsoft.public.windows.server.sbs)
    • Re: WS Security issues
      ... You should consider using SCTs(Secure context tokens) they allow you to be authenticated once and the service issues a token that can be used for subsequent requests. ... But I guess that you only use it for authentication and then let SSL handle the rest? ... We are sending the Username/password in the userName token, ... Windows 2000 server and client, Windows XP and Windows Server 2003. ...
      (microsoft.public.dotnet.framework.webservices.enhancements)
    • Singe forms-based login for website and OWA
      ... I've got a Windows 2003 web server that is also running Exchange 2003. ... are directed to a page that allows anonymous access without SSL. ... I've got no problem using forms-based authentication with OWA, ...
      (microsoft.public.inetserver.iis.security)