Click here to get back home

authenticating users from different domains

 HomeNewsGroups | Search | About
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
authenticating users from different domains vassone 01-19-2006
Posted by vassone on January 19, 2006, 6:35 pm
Please log in for more thread options
Hi, could someone please offer me some advice about authenticating users
from a different domains.

Scenario: -
A new online application that students from 5 different universities require
secure access to. The number of students would be around 6000 per year. The
universities have their own networks, servers etc. that their students are
authenticated against (mostly active directory).

Ideally, we would want to leave the authenication headache with the
universities e.g. have the student login with their university credentials,
which would then allow them secure access to data on a centralised server
sitting on a complete seperate network.

I would very much welcome any advice/guidance you could offer.

Vassone.



Posted by Roger Abell [MVP] on January 20, 2006, 4:33 am
Please log in for more thread options
What does "online application" mean ??
If this is a web based applicating (i.e. http served) then you
should look into implementing ADFS in its v1 incarnation that
released as a part of Windows Server 2003 R2
Active Directory Federation Services (ADFS) is designed for
exactly the scenario you have described (assuming web application
as that is all that v1 supports), including leaving the responsibility
for authentication of students and of authorization for them to use
the application with their respective organizations. The host realm
of a resource makes a policy agreement with the accessing realms
that grants them the responsibility over access control using their
AD credentials.

> Hi, could someone please offer me some advice about authenticating users
> from a different domains.
>
> Scenario: -
> A new online application that students from 5 different universities
> require
> secure access to. The number of students would be around 6000 per year.
> The
> universities have their own networks, servers etc. that their students are
> authenticated against (mostly active directory).
>
> Ideally, we would want to leave the authenication headache with the
> universities e.g. have the student login with their university
> credentials,
> which would then allow them secure access to data on a centralised server
> sitting on a complete seperate network.
>
> I would very much welcome any advice/guidance you could offer.
>
> Vassone.
>
>



Posted by Ondrej Sevecek on January 20, 2006, 4:38 am
Please log in for more thread options
probably not the whole solution, but may help.

currently, I participate in the process of implementing the
http://www.eduroam.org/ project for one of our universities and also some
government institutions. Although, this is designed to provide access to
networks for wireless roaming users, the concept of RADIUS servers
authenticating the remote users over heterogenous authentication environment
seems to me as a best one.

The core principle is the following:
you have several independent authentication networks. Each network hosts its
own RADIUS server that proxies authentication to the network's own
authentication service (AD, NDS, ...) for local users. The local RADIUS
servers know nothing about other servers with one exception, one RADIUS that
is set up as a central/root for all the networks. The root RADIUS have to
know about all other RADIUS servers.

When a remote user authenticates against a local RADIUS server, the local
RADIUS forwards the request to the central one and the root RADIUS then
forwards the request to the user's own RADIUS somewhere.



The problem will occure with your required resource access. I currently do
not know how to establish access credentials for Windows based servers
through RADIUS servers with the only exception - WebDAV file servers.


Other option would be if all your authenticating domains use Kerberos. Then
you need to only establish a trust amongst them and all resources will be
"simply" (non windows domains will require some aditional steps, such as
mapping user acounts and so).
https://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/featured/kerberos/default.mspx
http://www.microsoft.com/technet/prodtechnol/windows2000serv/deploy/confeat/kerberos.mspx
http://www.microsoft.com/technet/prodtechnol/windows2000serv/howto/kerbstep.mspx
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/Operations/d5749d76-7261-4508-9942-16f2450ac1ef.mspx
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/DepKit/0cff4aac-9bc7-47db-8d13-79d876a67f0d.mspx
http://support.microsoft.com/?kbid=260123
http://support.microsoft.com/?kbid=312003
http://support.microsoft.com/kb/q266080/
http://support.microsoft.com/default.aspx?scid=kb;EN-US;311242



O.




> Hi, could someone please offer me some advice about authenticating users
> from a different domains.
>
> Scenario: -
> A new online application that students from 5 different universities
> require
> secure access to. The number of students would be around 6000 per year.
> The
> universities have their own networks, servers etc. that their students are
> authenticated against (mostly active directory).
>
> Ideally, we would want to leave the authenication headache with the
> universities e.g. have the student login with their university
> credentials,
> which would then allow them secure access to data on a centralised server
> sitting on a complete seperate network.
>
> I would very much welcome any advice/guidance you could offer.
>
> Vassone.
>
>



Similar ThreadsPosted
IAS authenticating users in trusted domain (server 2003 ent.) October 20, 2005, 1:04 pm
Domain authenticating non-domain accounts February 22, 2008, 9:14 am
Authentication Across Domains using IIS July 29, 2005, 6:47 am
Questions about using IPsec across domains February 25, 2008, 5:47 pm
Connecting Three Domains/Forests August 5, 2008, 7:23 am
Certificate server for disjointed domains. July 12, 2005, 10:38 am
Accessing resources between non-trusted domains September 12, 2006, 9:53 am
Share certificate services between two domains September 19, 2007, 1:28 am
PKI in multi sites/domains environment December 10, 2007, 12:29 pm
Re: Server 2008 Domains - Security issue February 15, 2008, 2:51 am

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap