Windows Authentication
- The bumpy road ahead

Andrew Bartlett

Samba Team

Areas to be covered

Authentication technologies

NTLMSSP

Kerberos

OS Services

LSA

NETLOGON

SSPI

NTLMSSP

Linilarised wrapping of NTLM

3-stage network handshake

Many negotitated options

Including changes to cryoptosystem

Sign and Seal based on RC4

Kerberos

Strong Cryptography

Trusted Third party (the KDC)

Microsoft Kerberos is almost sane

Bundles Authorization into the PAC

Starting to hit it

Wine starting to be used for network apps

IE on Linux

Microsoft SQL Clients

'FAT' may no longer be enough

Forces issues of local account management

Windows and Single Signon

Windows is all about transparency

Little distinction between local/network

Automatic logins to network servers

Securely

Well, almost...

Transparently

Security zones starting to restrict this

Protocols that hit 'Security'

HTTP

DCE/RPC

Including DCOM

Outlook clients

IMAP

POP

Exchange

Samba Experience

Scattered authentication

Host Protocol tied

Partial implementations

Little generic code

Improved with Samba 3.0

Only 3 implementations of NTLMSSP...

Samba4 Experience

Much like 'DLL seperation'

We have an interface similar to SSPI

Called from everywhere else

Client and server side

Blob passing

Sign and seal

Known as GENSEC

Credentials

Challenge for wine:

How to get user credentials

While still being single sign on

PAM (username/pw stash?) module?

Samba prompts

But only if we can't use Kerberos

Calls back to the GUI for GTK apps

GENSEC for Wine?

My crazy idea in exploring this area

Could we wrap GENSEC into SSPI?

What would the apps then do?

What can we learn

And then decide how to build it properly

OS Services

Logon Services

Netlogon

ntlm_auth is a very simple wrapper

LSA

User Databases

Simple mappings on posix get complex fast...

2005-04-29T07:41:42