Authorization and Authentication.pptx

1. 1
What is Authentication?
 Remember, from before:
 Authentication
 The process of reliably verifying the identity of someone or something
 In particular, did a message indeed come from its specified sender?
 When authenticating messages, we need to guard against:
 Disclosure of a message to any unauthorized person or system
 Messages masquerading as being from a source
 Content modification
 Was the message changed between sender and recipient?)
 Source or destination repudiation
 Can the sender or recipient deny they sent/received the message?

2. 2
Identification, Authentication, Authorization
 Be sure to distinguish these three concepts:
 Identification
 Associating an identity with a subject
 Authentication
 Establishing the validity of something, such as an identity
 Authorization
 Associating rights or capabilities with a subject

3. 3
What are we Authenticating?
 Authentication of a person
 Others know you by your appearance or voice
 By your picture on an identification badge
 Other information you have or know
 Authentication of a computer
 Computer authenticating another computer
 Print spooler authenticating a printer, etc.
 Person using a public workstation
 Workstation will (should) not store authentication information for every user.
 Person needs to remember the authentication information

4. What Is a Directory Service?
A service that helps track and locate objects on a network
Active Directory Management
Users
Services
Workstations Files
 A directory service that uses the “tree” concept for managing resources on a Windows
network.
 Stores information about the network resources and services, such as user data, printer,
servers, databases, groups, computers, and security policies.
 Identifies all resources on a network and makes them accessible to users and applications.

5. Active Directory Functions and Benefits
 Centralized resource and security administration.
 Single logon for access to global resources.
 Fault tolerance and redundancy.
 Simplified resource location.

6. Active Directory Components
 Forests – One or more domain trees, with each tree having its own unique
name space.
 Domain trees – One or more domains with contiguous name space.
 Domains – A logical unit of computers and network resources that defines a
security boundary.
 Organization Units (OUs): A container that represents a logical grouping of
resources

7. Active Directory Domains
Boundary of
Authentication
Boundary of
Policies
Boundary of Replication
CONTOSO.COM

8. Active Directory Trees
CONTOSO.COM
US.CONTOSO.COM
Shared
Schema
Configuration
Global Catalog
OHIO.US.CONTOSO.COM

9. Active Directory Forests
US.CONTOSO.COM
FABRIKAM.COM
UK.FABRIKAM.COM
CONTOSO.COM
Schema Configuration
Global
Catalog

10. Organizational Units
CONTOSO.COM
OU Admin
Organized For:
•Administration
•Same Requirements
•Delegation
•Group Policy
•Configuration
•Security
OU Policy
OU Security

11. Domain Controllers
Windows Server
DC
DC
DC
 Server that stores the Active Directory database
and authenticates users with the network
during logon.
 Stores database information in a file called
ntds.dit.
 Active Directory is a multimaster database.
 Information is automatically replicated between
multiple domain controllers.