HowTo X509 and several user-Groups

[D K]

Hi all,
i search for informations how the IAS handles different groups of users
(worker/admin) while auhenticate and authorise with certificates.
While athenticating with certificates the IAS shoud send different
Filter -IDs with the radius response but how does the IAS know which group
an user belongs to?
Thanks DK

[James McIllece [MS]]

Post by D K
Hi all,
i search for informations how the IAS handles different groups of
users (worker/admin) while auhenticate and authorise with
certificates. While athenticating with certificates the IAS shoud send
different Filter -IDs with the radius response but how does the IAS
know which group an user belongs to?
Thanks DK

Hi D K --

When you create a remote access policy in IAS, you base the policy on a
group that you have created in Active Directory. So the process is:

1. Create a group in AD
2. Populate the group with members
3. In IAS, create a remote access policy that applies only to the group you
created. (In other words, IAS will process the policy against a connection
request only if the connecting user or computer is a member of the group
specified in the policy.)
4. Configure the policy with the rules that you want matched by the
connection request when the connection request is initiated by a member of
the group.

In IAS Help there is a lot of information about remote access policies and
how they work.

See "Remote Access Policies" at http://technet.microsoft.com/en-
us/library/cc757988.aspx

******************

James McIllece, Microsoft

Please do not send email directly to this alias. This is my online account
name for newsgroup participation only.

This posting is provided "AS IS" with no warranties, and confers no rights.

[James McIllece [MS]]

Post by James McIllece [MS]

Post by D K
Hi all,
i search for informations how the IAS handles different groups of
users (worker/admin) while auhenticate and authorise with
certificates. While athenticating with certificates the IAS shoud
send different Filter -IDs with the radius response but how does the
IAS know which group an user belongs to?
Thanks DK

Hi D K --
When you create a remote access policy in IAS, you base the policy on
1. Create a group in AD
2. Populate the group with members
3. In IAS, create a remote access policy that applies only to the
group you created. (In other words, IAS will process the policy
against a connection request only if the connecting user or computer
is a member of the group specified in the policy.)
4. Configure the policy with the rules that you want matched by the
connection request when the connection request is initiated by a
member of the group.
In IAS Help there is a lot of information about remote access policies
and how they work.
See "Remote Access Policies" at http://technet.microsoft.com/en-
us/library/cc757988.aspx
******************
James McIllece, Microsoft
Please do not send email directly to this alias. This is my online
account name for newsgroup participation only.
This posting is provided "AS IS" with no warranties, and confers no rights.

Also, you can specify the authentication method (certificate-based or
otherwise) in the remote access policy, so that different authentication
methods can be used per AD group.

James McIllece, Microsoft

Please do not send email directly to this alias. This is my online account
name for newsgroup participation only.

This posting is provided "AS IS" with no warranties, and confers no rights.

[D K]

...

Post by James McIllece [MS]
When you create a remote access policy in IAS, you base the policy on a

with other words - the IAS maps the certificate to the User/Computer account
and handles the groups like with username/password and not with some markers
within the certiuficate!?

D.K.

[James McIllece [MS]]

Post by D K
...

Post by James McIllece [MS]
When you create a remote access policy in IAS, you base the policy on

with other words - the IAS maps the certificate to the User/Computer
account and handles the groups like with username/password and not
with some markers within the certiuficate!?
D.K.

The first step in the process is that IAS uses the properties of the
connection request (which is the Access-Request message) and compares them
to the properties and settings of remote access policies until it finds a
policy whose properties match those of the connection request. It will
process all policies in order until it finds a match, and if it does not
find a match it rejects the connection request.

If the connection request properties match the properties and settings of
the remote access policy, IAS uses the policy to authorize the connection
request. (In other words, to determine whether the user has permission to
access the network on that day and time and under the existing conditions
of the connection.)

In the remote access policy, the allowed authentication methods are
specified. So the client and the IAS server negotiate an authentication
method and determine which one they agree to use for the connection.

When authentication occurs, if a certificate-based authentication method is
in use (like PEAP-TLS or EAP-TLS), the client and server exchange
certificates to prove their identities. IAS examines the client computer
certificate to determine whether or not the certificate is valid and meets
the minimum requirements for a client/user cert. IAS checks to see if the
cert is revoked or not. And IAS checks to ensure that the cert was issued
by a trusted CA and that the cert chains to a trusted root CA.

The manner in which IAS processes a connection request is detailed in the
IAS Technical Reference, in the section "How IAS Technology Works: Internet
Authentication Service (IAS)" at http://technet.microsoft.com/en-
us/library/cc773343.aspx.

That is a pretty long topic, just search on the page for the sentence "When
you configure IAS as a RADIUS server, Access-Request messages are processed
locally." That will take you to the numbered list of processing steps when
IAS is configured as a RADIUS server (as opposed to being configured as a
proxy that forwards connection requests to other servers.) The proxy
pipeline is detailed farther down the page.

HTH...

***************

James McIllece, Microsoft

Please do not send email directly to this alias. This is my online account
name for newsgroup participation only.

This posting is provided "AS IS" with no warranties, and confers no rights.