1. Kerberos Survival Guide Presented by: JD Wade Senior SharePoint Consultant, MCTS, MCITP Mail: jd.wade@hrizns.com Blog: http://wadingthrough.com LinkedIn: JD Wade Twitter: http://twitter.com/JDWade

3. Certified KnowledgeLake Partner

4. With Horizons since 2005

5. Member of SharePoint 2007 and 2010 TAP

6. Over 10 years of IT experience

7. Technical Editor for book SharePoint 2010 Disaster Recovery http://tinyurl.com/SPDRBook2010

8. Loves anything related to sound

10. Logon Process

11. Accessing a Web Site

12. Troubleshooting Kerberos

15. Ticket expiration

16. Keys

17. Authenticator

18. TGT Structure

19. Service Ticket Structure

20. Encryption/Decryption

22. Dependencies SPN

24. Service Principal Name Service Class Host Name Port HTTP/website:80

25. Service Classes allowed by host alerter http policyagent scm appmgmt ias protectedstorage seclogon browser iisad rasman snmp cifs min remoteaccess spooler cisvc messenger replicator Tapisrv clipsrv msiserver rpc time dcom mcsvc rpclocator trksvr dhcp netdde rpcss trkwks dmserver netddedsm rsvp ups dns netlogon samss w3svc dnscache netman scardsvr wins eventlog nmagent scesrv www eventsystem oakley Schedule fax plugplay

27. Delegated Authentication

28. Interoperability

29. More Efficient Authentication

30. Mutual Authentication

31. IIS – Chatty by default

32. IIS6 – See MS KB 917557

34. KDC

35. KDC

36. KDC SPN

37. KDC

38. Access Web Site

39. 401

40. SPN

42. <system.webServer> <security> <authentication> <windowsAuthentication enabled="true" useAppPoolCredentials="true" /> </authentication> </security></system.webServer>

44. TroubleshootingKerberos

46. SetSPN

47. Windows Security Logs

48. Windows 2008 ADUC or ADSIEdit

49. Kerbtray or Klist

50. Netmon and Fiddler

51. IIS Logs and IIS7 Failed Request Tracing

52. LDP

53. Kerberos Logging

55. Missing SPN

56. Duplicate SPN

57. SPN assigned to wrong service account

58. IIS Providers are incorrect (For IIS 5 or 6, see http://support.microsoft.com/kb/215383)

59. IIS 7 – remember Kernel mode authentication and check settings

60. Client TGT expired (7 days expiration – have user logon and logoff, no reboot required)

64. FBA Kerberos

68. What Is Kerberos Authentication?http://technet.microsoft.com/en-us/library/cc780469%28WS.10%29.aspx

69. How the Kerberos Version 5 Authentication Protocol Workshttp://technet.microsoft.com/en-us/library/cc772815%28WS.10%29.aspx

71. How To: Use Protocol Transition and Constrained Delegation in ASP.NET 2.0http://msdn.microsoft.com/en-us/library/ff649317.aspx

73. Appendix

75. Authentication is the process of proving your identity to a remote system.

76. Your identity is who you are, and authentication is the process of proving that. In many systems your identity is your username, and you use a secret shared between you and the remote system (a password) to prove that your identity.

77. User password is encrypted as the user key. User key is stored in credentials cache. Once the logon session key is received, the user key is discarded.

78. Service password is encrypted as the service key.

80. Another reason for simplification: encryption upon encryption upon encryption…just remember it is encrypted

81. This is a Windows-centric Kerberos presentation

82. Load balanced solutions need service account

83. All web applications hosted using the same SPN have to be hosted with the same account

85. Key Distribution Center (KDC) – In Windows AD, KDC lives on domain controllers (DC), KDCs share a long term key across all DCs.

86. KDC security account database – In Windows, it is Active Directory

87. Authorization Service (AS) – part of the KDC

88. Ticket Granting Service (TGS) – part of the KDC

90. A user's initial ticket from the authentication service

91. Used to request service tickets

92. Meant only for use by the ticket-granting service.

93. Service ticket for the KDC (service class = krbtgt)

94. Service Ticket

96. SetSPN

97. Windows Security Logs

98. Windows 2008 ADUC or ADSIEdit

99. Kerbtray or Klist

100. Netmon and Fiddler

101. IIS Logs and IIS7 Failed Request Tracing

102. LDP

103. Kerberos Logging

105. Have user logon and logoff if they don’t regularly: TGTs are only renewable for so long and then they expire (7 day default), then password has to be re-entered.

111. Knowledge - Know your Forests, Domains, Trusts, Functional Levels…get a basic lay of the land.

112. Always test from a different machine than the web server or domain controller!

113. SetSPN

114. Windows Security Logs

115. Windows 2008 ADUC

116. Kerbtray

117. Netmon and Fiddler

118. IIS Logs and IIS7 Failed Request Tracing

119. Kerberos Logging

121. Missing SPN

122. Duplicate SPN

123. SPN assigned to wrong service account

124. IIS Providers are incorrect (For IIS 5 or 6, see http://support.microsoft.com/kb/215383)

125. IIS 7 – remember Kernel mode authentication and check settings

126. Client TGT expired (7 days expiration – have user logon and logoff, no reboot required)

127. IE and non-default ports