Download to read offline
![Please fill out the session feedback survey:
http://SPSNashville.org/[session#]/
Session Feedback](https://image.slidesharecdn.com/kerberossurvivalguide-nashville-150808125817-lva1-app6891/75/Kerberos-Survival-Guide-SharePoint-Saturday-Nashville-2015-36-2048.jpg)
Uploaded byJ.D. Wade
Kerberos Survival Guide: SharePoint Saturday Nashville 2015
The document is a comprehensive Kerberos survival guide presented by JD Wade, covering key aspects such as the logon process, ticket management, and delegation in a Windows environment. It outlines the complexities of Kerberos authentication, including service ticket structures, time synchronization issues, and common pitfalls. Additionally, the guide includes resources for further reading and tools to aid in Kerberos troubleshooting.
More Related Content
Similar to Kerberos Survival Guide: SharePoint Saturday Nashville 2015
![[HUN][Hackersuli] Tickets Please - Kerberos](https://cdn.slidesharecdn.com/ss_thumbnails/ticketsplease-251119151220-b4647bd5-thumbnail.jpg?width=640&height=640&fit=bounds)
Kerberos Survival Guide: SharePoint Saturday Nashville 2015
- 1. Kerberos Survival Guide Presentedby: JD Wade, SharePoint Consultant, MCITP Mail: jd.wade@hrizns.com Blog: http://wadingthrough.com LinkedIn: JD Wade Twitter: http://twitter.com/JDWade
- 2. Agenda •Overview •Logon Process •Accessing aWeb Site •Keep in Mind •Delegation •Tools •Resources
- 3. Kerberos Massachusetts Institute ofTechnology Client Server Trusted Third Party
- 4. Details Out ofScope •Renewing tickets •Ticket expiration •Keys •Authenticator •TGT Structure •Service Ticket Structure •Encryption/Decryption •Multiple domains/forests
- 5. Client to serveror server to server Windows = Kerberos V5 Safe on open networks Default authentication W2K+ domains Ticket
- 6.
- 7. Service Principal Name ServiceClass Host Name Port HTTP/website:80
- 8. Service Classes allowedby host alerter http policyagent scm appmgmt ias protectedstorage seclogon browser iisad rasman snmp cifs min remoteaccess spooler cisvc messenger replicator Tapisrv clipsrv msiserver rpc time dcom mcsvc rpclocator trksvr dhcp netdde rpcss trkwks dmserver netddedsm rsvp ups dns netlogon samss w3svc dnscache netman scardsvr wins eventlog nmagent scesrv www eventsystem oakley Schedule fax plugplay http://servername
- 9. Kerberos •Benefits •Delegated Authentication •Interoperability (non-Microsoft) •MoreEfficient Authentication •Mutual Authentication • Server to client • Client to server
- 10.
- 11.
- 12.
- 13.
- 14.
- 15.
- 16.
- 17.
- 19.
- 20.
- 21. •IIS – Chattyby default •IIS6 – See MS KB 917557 •IIS7/8 – See MS KB 954873
- 23.
- 24.
- 25.
- 26.
- 27.
- 28.
- 29.
- 31. • Uses ProtocolTransition (Forest/domain limited until Server 2012) (Constrained Only) • Excel Services • Visio Services • PerformancePoint • InfoPath Form Services • SQL SSRS 2012 • Access Service 2013 • Does NOT Use Protocol Transition (Forest limited until Server 2012) (Unconstrained or Constrained) • SQL Reporting Services 2008 R2 • BCS • Project Server • Doesn’t usually require Kerberos • PowerPivot for SharePoint Server
- 32. •New PowerShell parameter •PrincipalsAllowedToDelegateToAccount •ConstrainedDelegation across forests and domains •Must have at least one W2K12 DC in all domains involved •SharePoint must be running on W2K12 servers •Backend server must be W2K3 or later •Must apply MS KB 2665790 to all W2K8 and W2K8 R2 DCs •Must not have W2K3 DCs • New KDC operational event log in W2K12 • Application and Services/Microsoft/Windows/Kerberos-Key-Distribution-Center/Operational •New Kerberos operational event log in W2K12 • Application and Services/Microsoft/Windows/Security-Kerberos/Operational •Performance counters added Windows 2012
- 33. •Kerberos Authentication Tester •http://blog.michelbarneveld.nl/media/p/33.aspx •KList •http://www.microsoft.com/download/en/details.aspx?id=11583 •KerberosPowerShell Module •https://gallery.technet.microsoft.com/scriptcenter/Keberos-Module- 3a6ab12a •SharePoint Kerberos Buddy •DelegConfig v2 Tools
- 34. •Kerberos Survival Guidewiki page Named my session that title before the wiki page existed •Kerberos for Microsoft BI wiki page •Microsoft BI Authentication and Identity Delegation paper •The Final Kerberos Guide for SharePoint Technicians Resources
- 35. Remember to follow@SPSNashville and tag #SPSNashville in your posts! Platinum Sponsors Gold Sponsors Thank You for being a part of SharePoint Saturday Nashville!
- 36. Please fill outthe session feedback survey: http://SPSNashville.org/[session#]/ Session Feedback
- 37.
- 38.
- 39. References •Ken Schaefer’s Multi-PartKerberos Blog Posts: http://www.adopenstatic.com/cs/blogs/ken/archive/2006/10 /20/512.aspx •What Is Kerberos Authentication? http://technet.microsoft.com/en- us/library/cc780469%28WS.10%29.aspx •How the Kerberos Version 5 Authentication Protocol Works http://technet.microsoft.com/en- us/library/cc772815%28WS.10%29.aspx •Explained: Windows Authentication in ASP.NET 2.0 http://msdn.microsoft.com/en-us/library/ff647076.aspx
- 40. References •Kerberos Authentication Toolsand Settings http://technet.microsoft.com/en- us/library/cc738673%28WS.10%29.aspx •How To: Use Protocol Transition and Constrained Delegation in ASP.NET 2.0 http://msdn.microsoft.com/en-us/library/ff649317.aspx •Spence Harbar’s Blog http://www.harbar.net
- 41. •Kerberos is anopen authentication protocol. Kerberos v5 was invented in 1993 at MIT. •Authentication is the process of proving your identity to a remote system. • Your identity is who you are, and authentication is the process of proving that. In many systems your identity is your username, and you use a secret shared between you and the remote system (a password) to prove that your identity. •User password is encrypted as the user key. User key is stored in credentials cache. Once the logon session key is received, the user key is discarded. •Service password is encrypted as the service key. •KDCs are found through a DNS query. Service registered in DNS by DCs.
- 42. •Showing detail behindwhat is happening inside of KDC but for day-to-day, use can just remember KDC •Another reason for simplification: encryption upon encryption upon encryption…just remember it is encrypted •This is a Windows-centric Kerberos presentation •Load balanced solutions need service account •All web applications hosted using the same SPN have to be hosted with the same account •Use A records, not CNAME records
- 43. •Terms •Key Distribution Center(KDC) – In Windows AD, KDC lives on domain controllers (DC), KDCs share a long term key across all DCs. •KDC security account database – In Windows, it is Active Directory •Authorization Service (AS) – part of the KDC •Ticket Granting Service (TGS) – part of the KDC •Ticket Granting Ticket (TGT) - A user's initial ticket from the authentication service, used to request service tickets, and meant only for use by the ticket granting service. Keeps the user from having to enter password each time a ticket is requested.
- 44. Tickets •Ticket Granting Ticket(TGT) •A user's initial ticket from the authentication service •Used to request service tickets •Meant only for use by the ticket-granting service. •Service ticket for the KDC (service class = krbtgt) •Service Ticket •Enables the ticket-granting service (TGS) to safely transport the requester's credentials to the target server or service.
- 45. •Troubleshooting • Have userlogon and logoff if they don’t regularly: TGTs are only renewable for so long and then they expire (7 day default), then password has to be re- entered. • Remember that authenticators contain the current time. Check for time sync issues.
- 46. •Request TGT (Rememberthere is even more complexity) 1. User (client) logs into workstation entering their password. 2. Client builds an authentication service request containing the user’s username (KPN), the SPN of the TGS, and encrypts the current time using the user’s password as an authenticator. 3. Client sends these three items to the KDC. 4. KDC get user’s password from AD, decrypts time and verifies it is valid. 5. AS generates a logon session key and encrypts with the user’s password. AS generates a service ticket which contains a logon session key and the user’s KPN encrypted with the AS shared key. This is a special service ticket called a Ticket Granting Ticket (TGT).
- 47. •Request TGT (Rememberthere is even more complexity) 6. KDC sends both to the client. 7. Client decrypts logon session key using its password and stores the logon session key in cache. The client stores the TGT in cache.
- 48. •Access Service (Rememberthere is even more complexity) 1. User (client) encrypts the current time using the logon session key in cache creating an authenticator and sends the authenticator, the user’s KPN, the name of the target service (SPN), and the TGT to the TGS. 2. TGS decrypts the TGT using its shared key to access the logon session key. The logon session key is used to decrypt the authenticator and confirms the time is valid. 3. TGS extracts the user’s KPN from the TGT. TGS generates a service session key and encrypts the service session key using the logon session key. TGS uses server session key to generate service ticket and encrypts it using service’s password. 4. TGS sends service session key and the service ticket to the client.
- 49. •Access Service (Rememberthere is even more complexity) 5. Client decrypts service session key using cached logon session key, adds current time (as well as other items), and encrypts with the service session key to create an authenticator. 6. Client sends ticket and authenticator to remote server which runs service. 7. Service decrypts service ticket accessing the server session key and the KPN. Using the service session key, the service decrypts the authenticator and confirms the current time is valid. A Windows access token is generated 8. (Optional) If client requests mutual authentication, service encrypts current time using the service session key creating an authenticator and sends to the client. 9. Clients decrypts authenticator and validates time.
- 50. Common Issues thatbreak Kerberos • Times are out of sync – authenticators contain current time • Missing SPN • Duplicate SPN • SPN assigned to wrong service account • IIS Providers are incorrect (For IIS 5 or 6, see http://support.microsoft.com/kb/215383) • IIS 7 – remember Kernel mode authentication and check settings • Client TGT expired (7 days expiration – have user logon and logoff, no reboot required) • IE and non-default ports