时间戳

首页 > 解决方案 > How do http requests work with Active Directory?

iis - How do http requests work with Active Directory?

问题描述

I have an ASP.NET MVC application that authenticates users against Active Directory.

As I understand this is the process happens when a user logs on to his computer:

  1. User enters credentials on the local machine.

  2. Local machine checks if it already has an authentication ticket for these credentials.

  3. If not, it contacts the first ADS server it can find that offers kerberos authentication functions

  4. The ADS machine checks the credentials against the LDAP database.

  5. If they check out, kerberos returns a TGT (ticket-granting-ticket) to the client machine

  6. For a certain duration set in AD (usually 8~10 hours) this TGT will bypass any credential checking in case the local machine user wishes to connect to resources that require permissions not present in his bare user account (i.e. group memberships, additional machine and share access, etc.)

My question is how does IIS know about the TGT when the browser is making a request to it for my app? Does the operating system send it out on every outbound http request to every single website?

标签： iisactive-directory

解决方案

服务器 (IIS) 将通过返回带有WWW-Authenticate标头的 HTTP 401 错误代码向客户端（浏览器）指示它需要进行身份验证。客户端检测到这一点并确定它是否可以正确进行身份验证。其工作方式如下：

  1. 通过检查请求者的服务主体名称来确定请求者是谁。它存在于{type}/{fully.qualified.domain}，例如HTTP/resource.domain.com。此 SPN 映射到 AD 中的计算机或服务帐户。如果此 SPN 未注册，则客户端将回退到 NTLM 等较小的协议。
  2. 本地机器使用 TGT 向 AD 请求服务票证。AD 验证 TGT 并在请求中查找 SPN，如果找到，则创建一个根据与 SPN 关联的帐户密码加密的服务票证。
  3. 客户端通过标头将服务票证发送到服务器Authorization: Negotiate YII...。
  4. 服务器使用提供的密码解密服务票证，通过域加入、Windows 服务运行方式配置或 keytab。
  5. 服务器将解密的服务票证的内容转换为 Windows 身份。
  6. 身份被呈现给应用程序。

此流程本质上不是特定于 Web 的。这就是所有服务在使用 Kerberos 时对自身进行身份验证的方式。

推荐阅读