Welcome to ISAserver.org

Web server authentication

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA Server 2004 General ] >> Server Publishing >> Web server authentication

Page: [1]

Message

<< Older Topic Newer Topic >>

Web server authentication - 13.Jul.2006 5:13:11 PM

mjgraves@tisecurity.

Posts: 41
Joined: 19.Jun.2006
Status: offline

I am testing a new web app that we want to publish using ISA 2006. This same ISA will be used for new Sharepoint deployment, hence 2006, which seems to have more features for Sharepoint.

The web server I am presently trying to publish has nothing to do with SP. Here is the scenario:

1. ISA will publish web listener on DMZ (NIC1)
2. ISA will be on internal network and member of domain on NIC2.
3. This web server should only be accessible to authorized users, so I want ISA to authenticate users against AD
4. I am asssuming I should use forms authentication?
5. (now I get confused) The web developer is asking me how he should set up his app (ASP.NET/IIS 6.0) to receive proof of authentication.
6. I have read the ISA Server 2006 authentication details http://www.microsoft.com/technet/prodtechnol/isa/2006/authentication.mspx
But am not sure of what to tell the developer that he will receive from ISA after ISA authenticates the user against AD.

Thanks!

_____________________________

Mark

Post #: 1

Featured Links*

RE: Web server authentication - 16.Jul.2006 5:51:03 PM

tshinder

Posts: 47668
Joined: 10.Jan.2001
From: Texas
Status: offline

Hi Mark,

How do you want the ISA firewall to delegate credentails to the Web site?

Thanks!
Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to mjgraves@tisecurity.)

Post #: 2

RE: Web server authentication - 17.Jul.2006 4:01:52 PM

mjgraves@tisecurity.

Posts: 41
Joined: 19.Jun.2006
Status: offline

Tom,

Thanks for the response, and I am receiving much help from you ISA Server 2004 book.

From what I am finding on the Microsoft web site it appears I should have ISA server use Kerberos/NTLM and pass the ticket to the published server after authentication against AD. The web server and AD are all runnning server 2003.

Any input is appreciated.

Thanks,
Mark

(in reply to tshinder)

Post #: 3

RE: Web server authentication - 18.Jul.2006 3:15:12 PM

mjgraves@tisecurity.

Posts: 41
Joined: 19.Jun.2006
Status: offline

Tom,

In reviewing our internal requirements again, we still need to keep the internal server as forms authentication to properly serve some of our user base.

Therefore I think I need the following:

ISA server performs forms authentication to external internet users and authenticates against AD
ISA server delegates this to published server, which brings up some questions
1. Is this possible? I see it described for OWA, but not sure about IIS. I need help here.
2. From what I see in the ISA 2006 authentication docs http://www.microsoft.com/technet/prodtechnol/isa/2006/authentication.mspx the published server would also authenticate against AD when it receives use credentials from ISA server.

(in reply to mjgraves@tisecurity.)

Post #: 4

RE: Web server authentication - 18.Jul.2006 3:37:13 PM

tshinder

Posts: 47668
Joined: 10.Jan.2001
From: Texas
Status: offline

Hi Mark,

ISA server performs forms authentication to external internet users and authenticates against AD
TOM: OK, but you need to know what type of delegation you want the ISA firewall to use: Basic? Integrated? NTLM? Kerberos?
ISA server delegates this to published server, which brings up some questions
1. Is this possible? I see it described for OWA, but not sure about IIS. I need help here.
  TOM: Yes, this is a new feature with the 2006 ISA firewall
2. From what I see in the ISA 2006 authentication docs http://www.microsoft.com/technet/prodtechnol/isa/2006/authentication.mspx the published server would also authenticate against AD when it receives use credentials from ISA server.
  TOM: That's correct, that's how delegation of credentails works when the ISA firewall pre-authenticates the user.

I hope I am explaining the problem clearly. Basically I want the same web server to be accessible using forms authentication to internal and external users. I want ISA to force external users to authenticate using forms

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to mjgraves@tisecurity.)

Post #: 5

RE: Web server authentication - 18.Jul.2006 8:54:25 PM

mjgraves@tisecurity.

Posts: 41
Joined: 19.Jun.2006
Status: offline

Thanks. Your question thankfully exposes part of my confusion

If the published internal web server is running forms authentication, can I still have ISA server use Integrated to delegate to it? If not, I guess I can use basic with SSL turned on? This is what I am unclear on.

I am willing to set up ISA server for what can be secure with the internal web server still using forms. I understand basic can be helped with SSL between ISA and internal web server.

Thanks.

(in reply to tshinder)

Post #: 6

RE: Web server authentication - 19.Jul.2006 5:27:30 PM

tshinder

Posts: 47668
Joined: 10.Jan.2001
From: Texas
Status: offline

Hi MJ,

If the internal server must use FBA, then the ISA firewall can't also use FBA, and it won't delegate to an FBA site, so the ISA firewall must not pre-authenticate the user, which is not an optimal security config.

HTH,
Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to mjgraves@tisecurity.)

Post #: 7

RE: Web server authentication - 28.Aug.2006 5:08:57 PM

mjgraves@tisecurity.

Posts: 41
Joined: 19.Jun.2006
Status: offline

Tom,

I have a need for non-authenticated Internet users to get to part of my sharepoint that is being designed for public access. I have tested non-authentication and authentication rules for ISA to publish anon and non-anon IIS instances on the inside network.

What do you recommend to allow public internet access to anon sharepoint sites that are part of the domain?

_____________________________

Mark

(in reply to tshinder)

Post #: 8

RE: Web server authentication - 3.Sep.2006 5:19:23 PM

tshinder

Posts: 47668
Joined: 10.Jan.2001
From: Texas
Status: offline

Hi Mark,

Create another rule that requires no auth for certain paths.

HTH,
Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to mjgraves@tisecurity.)

Post #: 9

RE: Web server authentication - 5.Sep.2006 8:49:25 PM

mjgraves@tisecurity.

Posts: 41
Joined: 19.Jun.2006
Status: offline

Thanks.

From what what I have read ISA server 2006 will provide application level protection even in the non-authenticated mode. I am concerned about public non-authenticated users accessing the internal sharepoint (anonymous portions) web server. I am relying on ISA server 2006 to allow this in a secure fashion.

Your thoughts?

Thanks.

(in reply to tshinder)

Post #: 10

RE: Web server authentication - 6.Sep.2006 3:46:28 PM

tshinder

Posts: 47668
Joined: 10.Jan.2001
From: Texas
Status: offline

Hi MJ,

External anonymous users will only have access to what you give them access.

HTH,
Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to mjgraves@tisecurity.)

Post #: 11