CAC Authentication in TMG for SharePoint 2010




SharePoint 2010 Configuration Prerequisites:

  • Integrated Authentication (Kerberos / Negotiate)
  • SPN’s created according to AD and/or IIS versions for SharePoint server or service accounts. See SPN Checklist and scenarios for IIS 7 below.

Active Directory Prerequisites:

  • Delegation configured for SharePoint
  • Delegation configured for SQL
  • Delegation configured for TMG
  • User certificates and EDIPI imported into Active Directory.

Note: Delegation should be set to “Use any authentication protocol” to allow for translation.

Network Configuration Prerequisites:

  • Port configuration chart included below for chained routers / firewalls.

Microsoft Forefront TMG Configuration Steps:

  1. Install current DOD Root certificates on TMG server (s) (This installs all the DOD CA’s to trusted certificate authorities in the Computer Account / Registry).
  2. Install current (x64) version of Tumbleweed Desktop Authority on the TMG server (or on all TMG array members).
  3. Import current client tumbleweed configuration file.
  4. Disable HTTPS Inspection & NIS.
  5. Create Access Rule allowing TMG to access SharePoint environment (Local to Internal all allowed).
  6. When access from TMG to SharePoint has been verified successfully, the next step is to create the CAC policy.
  7. Create a Web Listener requiring Client Certificate Authentication, with no fallback, and be sure to configure with a valid trusted server certificate.
  8. Create SharePoint Access Rule using the previously created listener, and set authentication delegation to Negotiate (Kerberos/NTLM), use the previously created SPN for the configuration.

    At this point you should be able to test the policy and verify that you can log on with your CAC.

Service Principal Name (SPN) checklist for Kerberos authentication with IIS 7.0/7.5

IIS 7.0 has a new Kernel-mode authentication feature using which the ticket for the requested service is decrypted using Machine account (Local system) of the IIS server. It no longer depends upon the application pool Identity for this purpose by default and in turn improves the performance.

SCENARIO 1a

IIS 7.0 Web Site/Application  
Authentication Integrated Windows authentication
Application Pool Identity NETWORK SERVICE
Kernel-Mode authentication Enabled (<attribute name=”useKernelMode” type=”bool” defaultValue=”true” /> in the ApplicationHost.config file)
Site URL Accessed with the NetBIOS name, like http://<myIISserver-NetBIOS-name>/Default.aspx

SPNs will be required ONLY for the IIS machine account:

HOST/<myIISserver-NetBIOS-name>
HOST/<myIISserver-NetBIOS-name.fully-qualified-domainname> for e.g. HOST/myIISserver.mydomain.com

***Note: By default HOST/<myIISserver-NetBIOS-name> and HOST/<myIISserver-NetBIOS-name.fully-qualified-name> is already added for the machine account when a machine is added to a domain and HTTP forms a part of HOST. So you may not have to do anything special here for SPNs. Everything should be set by default.

You can check the set of existing SPNs for the machine account by running the following command:

> Setspn.exe -L <myIISserver-NetBIOS-name> or directly using a Snap-in like Adsiedit.msc.

SCENARIO 1b

IIS 7.0 Web Site/Application  
Authentication Integrated Windows authentication
Application Pool Identity Custom account for e.g. Domain1\Username1
Kernel-Mode authentication Enabled (<attribute name=”useKernelMode” type=”bool” defaultValue=”true” /> in the ApplicationHost.config file)
Site URL Accessed with the NetBIOS name, like http://<myIISserver-NetBIOS-name>/Default.aspx

The SPN requirements remain the same as above. You don’t have to add SPNs like http/<myIISserver-NetBIOS-name> for the Domain1\Username1 unlike in IIS 6.0 (where we had to add an SPN of the form http/<myIISserver-NetBIOS-name> for the Application Pool identity).

SPNs will be required ONLY for the IIS machine account:

HOST/<myIISserver-NetBIOS-name>
HOST/<myIISserver-NetBIOS-name.fully-qualified-domainname> for e.g. HOST/myIISserver.mydomain.com

***Note: By default HOST/<myIISserver-NetBIOS-name> and HOST/<myIISserver-NetBIOS-name.fully-qualified-name> is already added for the machine account when a machine is added to a domain and HTTP forms a part of HOST. So you may not have to do anything special here for SPNs. Everything should be set by default.

You can check the set of existing SPNs for the machine account by running the following command:

> Setspn.exe -L <myIISserver-NetBIOS-name> or directly using Snap-in like Adsiedit.msc.

SCENARIO 2a

IIS 7.0 Web Site/Application  
Authentication Integrated Windows authentication
Application Pool Identity NETWORK SERVICE
Kernel-Mode authentication Enabled (<attribute name=”useKernelMode” type=”bool” defaultValue=”true” /> in the ApplicationHost.config file)
Site URL Accessed with a Custom Host name, like http://http://www.mysite.com


SPNs will be required ONLY for the IIS machine account in the following format:

HTTP/<site-custom-name> for e.g. HTTP/http://www.mysite.com

You can add an SPN using Setspn.exe like

> Setspn -a http/<site-custom-name> <myIISserver-NetBIOS-name>

where <myIISserver-NetBIOS-name> is the IIS machine account and <site-custom-name> is the custom host/host header name for the Web Site URL.

e.g. > Setspn -a http/www.mysite.com <myIISserver-NetBIOS-name>
*The command is NOT case sensitive

You can check the existing set of SPNs for the machine account by running the following command:

> Setspn.exe -L <myIISserver-NetBIOS-name>

SCENARIO 2b

IIS 7.0 Web Site/Application  
Authentication Integrated Windows authentication
Application Pool Identity Custom account for e.g. Domain1\Username1
Kernel-Mode authentication Enabled (<attribute name=”useKernelMode” type=”bool” defaultValue=”true” /> in the ApplicationHost.config file)
Site URL Accessed with a Custom host/Host header name, like http://http://www.mysite.com


SPNs will be required ONLY for the IIS machine account and NOT for Domain1\Username1 account unlike in IIS 6.0.

HTTP/<site-custom-name> for e.g. HTTP/http://www.mysite.com

You can add an SPN using Setspn.exe like

> Setspn -a http/<site-custom-name> <myIISserver-NetBIOS-name> where <myIISserver-NetBIOS-name> is the IIS machine account and <site-custom-name> is the custom host/host header name for the Web Site URL.

e.g. > Setspn -a http/www.mysite.com <myIISserver-NetBIOS-name>
*The command is NOT case sensitive

You can check the existing set of SPNs for the machine account by running the following command:

> Setspn.exe -L <myIISserver-NetBIOS-name>

Running IIS 7.0 in a WEB FARM

If you are running IIS 7.0 server in a Web farm the KDC will not know in advance which individual server the request may go to and hence ticket decryption may fail. Hence in such a scenario instead of registering SPNs under a specific machine account use a domain account. I am not a SharePoint guy but based on what I have read on the Web this scenario is also applicable to a single SharePoint server configuration.

There are two ways to go:

Either

Disable Kernel mode authentication and follow the general steps for Kerberos as in the previous IIS 6.0 version. Refer this.

Or,

[Recommended for Performance reasons]

Let Kernel mode authentication be enabled and the Application pool’s identity be used for Kerberos ticket decryption. The only thing you need to do here is:

1. Run the Application pool under a common custom domain account.

2. Add this attribute “useAppPoolCredentials” in the ApplicationHost.config file.

<system.webServer>
<security>
<authentication>
<windowsAuthentication enabled=”true” useKernelMode=”true” useAppPoolCredentials=”true” />
</authentication>
</security>
</system.webServer>

Remember there is no GUI setting for this. You need to modify the ApplicationHost.config file from

<%SystemDrive%>/Windows/System32/inetsrv/config folder on the IIS 7.0 machine.

3. Add the SPNs in the form:

http/<virtualhost-name> and

http/<virtualhost-name.fully-qualified-name>  for the Application Pool Identity.

Ensure that we don’t have such an entry for SPNs for any other account including IIS server machine account.

*If we have the same SPN mapped to multiple accounts (be it a machine or an user account) it leads to Duplicate SPNs and will break Kerberos.

About these ads

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Follow

Get every new post delivered to your Inbox.

%d bloggers like this: