Seminario MS IDA
•
0 recomendaciones•874 vistas
Este documento presenta una introducción a las soluciones de identidad y acceso (IDA) de Windows Server 2008, incluyendo Active Directory, Active Directory Lightweight Directory Services, Active Directory Federation Services y Active Directory Rights Management Services. Explica brevemente el propósito y uso de cada tecnología y cómo ayudan a administrar identidades de usuario y controlar el acceso a recursos y aplicaciones de manera segura.
![Agenda ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
Más contenido relacionado
Destacado
Destacado (17)
Similar a Seminario MS IDA
Similar a Seminario MS IDA (20)
Más de Marcela Berri
Más de Marcela Berri (11)
Último
Último (20)
Seminario MS IDA
- 1. Seminario Identity & Access Solutions Marcela Berri MCT – MCITP – MCTS - MAP
- 3. Overview IDA Identity and Access Solutions con Windows Server 2008
- 6. Overview AD CS Active Directory Certificate Services
- 8. Componentes de PKI CA Certificados digitales CRLs (Certified Revocation List) Plantillas de certificados Public Key Aplicaciones y Servicios CA Management Tools
- 10. Overview AD LDS Active Directory Lightweight Directory Services
- 12. Estructura interna 26 Application Partition 1 Configuration Partition Schema Partition
- 13. Estructura de LDS Workgroup Member Domain member Domain Controller 36 AD LDS Server Aplicación
- 14. Configuration Sets 46 Configuration Partition Schema Partition App2 Partition App1 Partition Configuration Set 1 Configuration Partition Schema Partition App2 Partition Instance B Configuration Set 2 Configuration Partition Schema Partition App3 Partition App4 Partition Configuration Partition Schema Partition App3 Partition Instance C ADLDS-SRV2 ADLDS-SRV3 ADLDS-SRV1
- 15. Consolas de AD LDS 56
- 16. Resumen Tools Platform Support Access Replication User / Groups Usage Scenarios AD LDS 66
- 17. Overview AD FS Active Directory Federation Services
- 23. Componentes básicos de AD FS 615 Las cuentas de usuario deben existir en AD DS o AD LDS Domain Controller Resource Federation Server Federation Service Proxy Account Partner Resource Partner Web Server Running AD FS Web Service Agent Account Federation Server Federation Trust CLAIM Petición
- 26. Tráfico AD FS en esenario B2B 915 Federation Trust A. Datum Account Partner Contoso R esource P artner Internet Account Federation Server Cookie ilegítima (pantalla logon) Home Realm Discovery Finaliza HTTP request Redirige al Account Partner Autent. integrada Security token firmado (con Cookie de autent. con los datos del claim) Envía security token para validación Federation crea, firma y asegura un token de seguridad 1 2 4 3 9 5 6 7 8 10 AD DS Domain Controller Web Server / AD FS Agent Resource Federation Server Client HTTPS al Web server chequea cookie
- 27. Tráfico AD FS en esenario B2E 1015 Federated Web SSO with Forest Trust AD DS Domain Cont Internal Client/Employee (AD FS Web Agent) AD DS Domain Controller Resource Federation Server Account Federation Proxy Server Federation Trust One-Way Forest Trust Internet This perimeter network is its own one-domain forest Separate Active Directory One-Domain Forest Account Federation Server Token de seguridad Recibe Token de seguridad GeneraToken de Autent. 2 1 9 10 3 4 5 6 7 8 11
- 28. Tráfico AD FS en esenario B2C 1115 Federation Proxy Server Resource Federation Server AD FS Web Agent AD LDS Server Client Web SSO Internet 1 2 3 4 5 6 7 8 9
- 30. Consola AD FS
- 31. Consola AD FS 1415
- 32. Consola AD FS 1515
- 33. Overview AD RMS Active Directory Rigths Management Services
- 38. Componentes AD RMS 515 AD RMS Client AD RMS Client SQL Server Configuration Data Logging AD RMS Root Cluster Web Server (IIS) --Lockbox-- AD DS AD RMS Licensing-Only Cluster SQL Server AD RMS Client AD RMS Client Genera SCP object en AD Server Licensor Certificate (SLC) (firma las licencias y certificados) Right Account Certificate (RAC) (Contiene la «llave pública» de la PC encriptada con «llave Privada» del usuario ) Client Licensor Certificate (CLC) (Permite que una Appl. firme una licencia sin contactar al server) AD RMS credentials +
- 40. AD RMS workflow Decripta la Licencia A Re-encripta con Public key del recipient Usuario asegura un Doc (establece credenciales) Encripta con Public key del RMS cluster 715 Autor Recipient 2 3 1 4 5 6 8 7 9 Database Server AD RMS Cluster Active Directory Publicación Consumo Genera una Licencia A de publicación La appl. Encripta con symetric key (AES-128) File Bound (unidos) Publishing Licenses Private key y SLC Trust Policies La Appl. verifica CRL Y abre el archivo La Appl. Pide usar la licencia A Devuelve la licencia al Recipient (User licence) La Appl. Verifica el RAC en la PC, si no está lo solicita Autentica al cliente
- 41. Tareas de administración AD RMS 815 AD RMS Trust Policies Exclusion Policies Rights Policy Template
- 42. Trust Policies en AD RMS 915 Se configura: Permite: Trusted user domains Procesar requerimientos de CLCs (importa SLC del otro server) y procesar licencias de usuarios con RACs (Certificado del server) asegurados por otro Cluster. Trusted publishing Domains Asegurar licencias de uso (importa SLC + Private key ) publicadas x otro Server. Windows Live ID Mandar contenido protegido a un usuario que tenga Windows Live ID. Federated trust Crear confianza entre 2 Forest en donde uno no tiene RMS EL Root RMS Cluster asegura el RAC al usuario, pero por default AD RMS no recibe RACs de otro Root AD RMS cluster.
- 43. Interacción de un usuario de dominio confiado Northwind Traders Contoso Por default un RMS no asegura “licencias de uso” a usuarios cuyos RACs fueron asegurados por otro RMS cluster Contoso envía su SLC a Northwind Traders (firma licencias y certificados) 1 Alice@nwtraders.msft envía contenido RMS a Bob@contoso.com 3 [email_address] envía la “Licencia de Publicación” y RAC pidiendo la “Licencia de Uso” de Northwind Traders 4 El Server usa el SLC importado para verificarel RAC de Bob y devolver su Licencia de Uso 5 Northwind Traders importa el SLC 2 Contoso Contoso
- 44. Interacción de una Publicación de dominio confiada Contoso Por default un RMS no asegura “licencias de uso” contra licencias aseguradas por otro RMS en un cluster diferente 1115 Contoso importa la llave privada y el SLC (firma licencias y certificados) 2 Alice@nwtraders.msft envía contenido RMS a Bob@contoso.com 3 Bob@contoso.com envía la “Licencia de Publicación” y RAC pidiendo la “Licencia de Uso” desde Northwind Traders 4 Contoso usa la llave privada importada para desencriptar la “Licencia de Publicación y asegura la “Licencia de Uso” 5 Northwind Traders exporta la llave privada y el SLC 1 Northwind Traders NwTraders NwTraders NwTraders
- 45. Consola de AD RMS 1215
- 46. Consola de AD RMS 1315
- 47. Consola de AD RMS 1415
- 51. Marcela Berri MCT – MCITP – MCTS [email_address] Gracias!
Notas del editor
- 09/19/11 19:47
- 09/19/11 19:47
- 09/19/11 19:47
- 09/19/11 19:47
- 09/19/11 19:47
- 09/19/11 19:47
- 09/19/11 19:47
- 09/19/11 19:47
- System Center Configuration Manager System Center Configuration Manager enables secure and scalable operating and application deployment, desired configuration management, system quarantine, and asset management of servers, desktops, and mobile devices. New capabilities ensure that systems are checked and updated before joining the network, operating system and application deployment is greatly simplified for both new and existing systems, and configuration changes and system updates are more effectively managed regardless of location or device type, all of which enable IT managers to take control of their environment like never before. The current plan of record is to provide the following key capabilities: • Operating system deployment (OSD) is an automated and end-to-end solution for hands-off deployment • Network Access Protection • Software distribution • Software update management (SUM) • Desired configuration management • Device management • Software inventory and metering • Hardware inventory • Remote control • Wake On LAN • Windows Vista and Microsoft Office 12 upgrade assessment • Vulnerability assessment • Software Development Kit (SDK) provides extensibility • Scalable yet flexible • Internationalization • Easy to use infrastructure
- 09/19/11 19:47
- 09/19/11 19:47
- 09/19/11 19:47
- 09/19/11 19:47
- Module 6: Configuring AD RMS Course 6426B Describe the various scenarios that can be deployed using AD RMS, such as: Deploying AD RMS in a single forest - Explain that it may contain a single server or have multiple servers in a single cluster. Deploying an AD RMS licensing-only cluster - Explain that this scenario is typically used to distribute the licensing services. Deploying AD RMS in a multi-forest environment - Explain the need for multiple AD RMS root clusters and the configuration of trust policies. Deploying AD RMS in an extranet - Explain how either a licensing-only server or Internet Security and Acceleration (ISA) server can be used in this scenario. Deploying AD RMS with AD FS - Explain some of the considerations for integrating AD RMS and AD FS.
- Module 6: Configuring AD RMS Course 6426B Discuss the following steps: Contoso, Ltd., exports and sends its SLC (public key) to Northwind Traders. Northwind Traders specifies Contoso, Ltd., as a trusted user domain and imports its SLC. Alice@nwtraders.msft sends Bob@contoso.com an item of RMS-protected content. Bob receives the content and, in his attempt to consume it, sends his RAC and publishing license (PL) to the issuing licensing server at Northwind Traders. The licensing server at Northwind Traders is aware that Contoso, Ltd.’s domain is a trusted user domain and can use the imported SLC to verify Bob’s RAC and issue him a use license (UL).
- Module 6: Configuring AD RMS Course 6426B Use the diagram to explain the workings of a TPD.