XenApp XenDesktop 认证方式.ppt

Whitepapers/windows/server/Technical/security/default.asp Windows 2000 Kerberos Authentication Microsoft Windows 2000 Kerberos Interoperability Authentication Function /en-us/library/aa374731(v=VS.85).aspx For More Information Recommended related breakout sessions: SUM509 - Integrating single sign-on and smart card authentication with Access Gateway Enterprise Edition Session surveys are available online at starting Thursday, 7 October Provide your feedback and pick up a complimentary gift card at the registration desk Download presentations starting Friday, 15 October, from your My Organiser Tool located in your My Synergy Microsite event account Before you leave… The Kerberos Authentication protocol uses 2 types of A-ID: A generic A-ID called the Ticket Granting Ticket (TGT). This is obtained when the user initially authenticates to the KDC (Kerberos Authentication Service). Another, a per-service A-ID, is issued each time the user wants to access a specific network service; the user presents its generic A-ID (the TGT) to the Kerberos server (KDC), and she receives a service-specific A-ID called a Service Ticket. A Service Ticket is only valid for the service it is intended for. ? In Windows, Kerberos scales better than its NTLM predecessor because a service that receives an ST ticket doesn’t need to check with the KDC whether the ticket is authentic. All ST tickets are encrypted by the KDC with a key that only the receiver can decrypt. ? In order to access Windows services, Kerberos ST tickets (A-IDs) are passed in a variety of Windows protocols between clients and servers: For example, Kerberos tickets are passed in the SMB/CIFS (file access) protocol when accessing Windows shares, in the RPC/COM+ protocol, in HTTP (between IE and IIS only). Authentication Service (AS): This service runs on the Key Distribution Center (KDC) server. It authenticates a client logon and issues a Ticket Granting Ticket (TGT) for future authentication. Ticket Granting Service