Integrated Windows Authentication

From Wikipedia, the free encyclopedia - View original article

 
Jump to: navigation, search

Integrated Windows Authentication (IWA)[1] is a term associated with Microsoft products that refers to the SPNEGO, Kerberos, and NTLMSSP authentication protocols with respect to SSPI functionality introduced with Microsoft Windows 2000 and included with later Windows NT-based operating systems. The term is used more commonly for the automatically authenticated connections between Microsoft Internet Information Services, Internet Explorer, and other Active Directory aware applications.

IWA is also known by several names like HTTP Negotiate authentication, NT Authentication,[2] NTLM Authentication,[3] Domain authentication,[4] Windows Integrated Authentication,[5] Windows NT Challenge/Response authentication,[6] or simply Windows Authentication.

Overview[edit]

Integrated Windows Authentication uses the security features of Windows clients and servers. Unlike Basic or Digest authentication, initially, it does not prompt users for a user name and password. The current Windows user information on the client computer is supplied by the web browser through a cryptographic exchange involving hashing with the Web server. If the authentication exchange initially fails to identify the user, the web browser will prompt the user for a Windows user account user name and password.

Integrated Windows Authentication itself is not a standard or an authentication protocol. When IWA is selected as an option of a program (e.g. within the Directory Security tab of the IIS site properties dialog)[7] this implies that underlying security mechanisms should be used in a preferential order. If the Kerberos provider is functional and a Kerberos ticket can be obtained for the target, and any associated settings permit Kerberos authentication to occur (e.g. Intranet sites settings in Internet Explorer), the Kerberos 5 protocol will be attempted. Otherwise NTLMSSP authentication is attempted. Similarly, if Kerberos authentication is attempted, yet it fails, then NTLMSSP is attempted. IWA uses SPNEGO to allow initiators and acceptors to negotiate either Kerberos or NTLMSSP. Third party utilities have extended the Integrated Windows Authentication paradigm to UNIX, Linux and Mac systems.

For technical information regarding the protocols behind IWA, see the articles for SPNEGO, Kerberos, NTLMSSP, NTLM, SSPI, and GSSAPI.

Supported web browsers[edit]

Integrated Windows Authentication works with most modern web browsers,[8] but does not work over some HTTP proxy servers.[7] Therefore, it is best for use in intranets where all the clients are within a single domain. It may work with other web browsers if they have been configured to pass the user's logon credentials to the server that is requesting authentication. Where a proxy itself requires NTLM authentication, some applications like Java may not work because the protocol is not described in RFC-2069 for proxy authentication.

Supported mobile browsers[edit]

See also[edit]

References[edit]

  1. ^ "Microsoft Security Advisory (974926) - Credential Relaying Attacks on Integrated Windows Authentication". Microsoft Security TechCenter. 2009-12-08. Retrieved 2012-11-16. "This advisory addresses [...] Integrated Windows Authentication (IWA) [...]" 
  2. ^ "Q147706: How to disable LM authentication on Windows NT". Microsoft Support. 2006-09-16. Retrieved 2012-11-16. "[...] Windows NT supported two kinds of challenge/response authentication: [...] LanManager (LM) challenge/response [...] Windows NT challenge/response (also known as NTLM challenge/response) [...] LM authentication is not as strong as Windows NT authentication [...]" 
  3. ^ "IIS Authentication". Microsoft MSDN Library. Retrieved 2012-11-16. "Integrated Windows authentication (formerly known as NTLM authentication [...]) [...]" 
  4. ^ "NTLM Overview". Microsoft TechNet. 2012-02-29. Retrieved 2012-11-16. "When the NTLM protocol is used, a resource server must [...] Contact a domain authentication service" 
  5. ^ "MSKB258063: Internet Explorer May Prompt You for a Password". Microsoft Corporation. Retrieved 2012-11-16. "Windows Integrated authentication, Windows NT Challenge/Response (NTCR), and Windows NT LAN Manager (NTLM) are the same and are used synonymously throughout this article." 
  6. ^ "IIS Authentication". Microsoft MSDN Library. Retrieved 2012-11-16. "Integrated Windows authentication (formerly known as [...] Windows NT Challenge/Response authentication) [...]" 
  7. ^ a b c Microsoft Corporation. "Integrated Windows Authentication (IIS 6.0)". IIS 6.0 Technical Reference. Retrieved 2009-08-30. 
  8. ^ http://confluence.slac.stanford.edu/display/Gino/Integrated+Windows+Authentication
  9. ^ http://kb.mozillazine.org/About:config_entries

External links[edit]