Re: How to make integrated auth fallback to Basic

Why should an authentication protocol assume that?

Domain of relevance is as much a necessary qualifier on identity as the
username itself.

Besides, membership of server in a "domain" says nothing about transitivity.
For example:

What happens if you have two domains, A and B, and username C exists in both
domains A & B (imagine a company merger and username is something common
like David). If someone tries to log in as "David" to a webserver that is in
domain A, you're saying it should assume "domain A's David" when it could
well be "domain B's David" that is trying to login. How in the world can the
webserver figure this out? And if you want the code to try "domain B's
David" on failure to login as "domain A's David", then attackers can use
that to DoS your machine. Security has a knack to be hard like that.

There is no such thing as a "default domain" when it comes to Integrated
Windows Authentication because the protocol is secured against that. Since
Basic authentication passes username/password to the server in clear text
and the server calls LogonUser() Win32 API to login the user, that API
allows you to insert a "domain" -- hence Basic Authentication has this
"feature".

Integrated Windows Authentication, on the other hand, does NOT pass
username/password to the server in any form - just a bunch of hashes and
binary blobs pass back and forth and IIS just gets a NT User token at the
end if successful -- so there is no way to insert a "default domain". It
wouldn't make security sense, either - because ability to alter the "default
domain" of a user principle means that you are able to alter the domain of
relevance of the identity, and that is a security no-no.

Now, if the problem is that users cannot seem to remember a domain name,
then try configuring Windows to use UPN in which case it is
username@xxxxxxxxxx and password -- and if you configure email
correspondingly, users only remember "my email address" and "my password"
without even thinking about the domain.

--
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//

"Mark" <marka@xxxxxxxxxxxxxx> wrote in message
news:1139518417.294186.230940@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Ok - makes sense. So if I want to disable Basic and use IWA
exclusively, is there anyway to specify a default domain? I only have
one domain which the web server is a member of. You'd think IWA would
authenticate non-domain clients against it automatically.



.

Relevant Pages

  • Re: OWA (Outlook Web Access) Domain Problem
    ... You will need to have SSL setup on your Server to secure your ... username and passwords when Authenticating to your OWA Server. ... > I see that "Windows Integrated Authentication" is ... >> log him in correctly to OWA without the internal domain being specified. ...
    (microsoft.public.exchange2000.admin)
  • Re: Smartcard authentication in a multi-tier application
    ... side where the user enters the username and password and on the server ... implementation as we need the domain username and password of the PIN- ... since SC authentication on the Windows client results in a Kerberos ... bootstrapped a secure authentication mechanism using Kerb and PKInit ...
    (microsoft.public.platformsdk.security)
  • Re: Access Shared Printer??
    ... shares) on other domain member computers (centralized user account ... defined as a local printer that is shared is called the server. ... at the client computer with the username and password that is common to ... This command will use the ServerUserName to do an "authentication" on the ...
    (microsoft.public.win2000.printing)
  • Re: PPP LCP: timeout
    ... authentication isn't done _directly_ on the box that ... On the box you are dialing into, it looks at the username, and MAY make ... a decision which authentication server to ask. ... you will see the chat script looking for a login ...
    (comp.os.linux.networking)
  • email problem
    ... server requires authentication which is fine for the personal account but ... anyway to enter smtp authentication info that is different to the user and ... David ...
    (microsoft.public.pocketpc)