(2011-09-07) Kerberos Authentication Over An External Trust – Is It Possible? (Part 1)

About a year or so ago I read this blog post which leads this Microsoft technical article. My first reaction was “WTF!”, because everybody has always thought, and you can read it anywhere that:

• External Trust –> NTLM AuthN only
• Forest Trust –> Kerberos AuthN and NTLM AuthN

-

I could not believe this and I had to try it out myself of course. Today was that day! So here goes!

-

Before continuing, let’s briefly discuss the infrastructure I used to test this.

• AD forest “ADCORP.LAB”
  • AD domain “ADCORP.LAB”
    • RWDC “R1FSRWDC1.ADCORP.LAB”
      
• AD forest “ADDMZ.LAN”
  • AD domain “ADDMZ.LAN”
    • RWDC “R2FSRWDC1.ADDMZ.LAN”
    • RWDC “R2FSRWDC2.ADDMZ.LAN”
    • RODC “R2FSRODC5.ADDMZ.LAN”
    • SERVER “R2FSMBSVA.ADDMZ.LAN”
      
• TEST1 –> One-way Forest Trust (as shown below)
  • Trusting AD forest = “ADDMZ.LAN”
  • Trusted AD forest = “ADCORP.LAB”
  • Forest Wide Authentication enabled

-

-

-

• TEST2 –> One-way External Trust (as shown below)
  • Trusting AD domain = “ADDMZ.LAN”
  • Trusted AD domain = “ADCORP.LAB”
  • Domain Wide Authentication enabled

-

-

-

In all cases/tests, the application server “R2FSMBSVA” hosted 5 website as shown below

The web sites are configured as follows:

• DELEGCONFIG.ADDMZ.LAN:81 (DelegConfig v2 Beta)
  • Application Pool = Kerberos AppPool
  • Application Pool Account = ADDMZ\SVC_R2_KERBAPP
  • servicePrincipalName on application pool account = HTTP/DELEGCONFIG.ADDMZ.LAN
  • Report option will show which authN protocol is used
• R2FSMBSVA.ADDMZ.LAN:82 (DelegConfig v2 Beta)
  • Application Pool = Kerberos AppPool
  • Application Pool Account = ADDMZ\SVC_R2_KERBAPP
  • servicePrincipalName on application pool account = HTTP/R2FSMBSVA.ADDMZ.LAN
  • Report option will show which authN protocol is used
• SHAREPOINT.ADDMZ.LAN (Windows Sharepoint Services configured with NTLM AuthN)
  • Application Pool = SharePoint – 80
  • Application Pool Account = ADDMZ\SVC_R2_KERBAPP
  • servicePrincipalName on application pool account = HTTP/SHAREPOINT.ADDMZ.LAN
• KERBAPP.ADDMZ.LAN:8080 (Windows Sharepoint Services configured for Kerberos AuthN)
  • Application Pool = SharePoint – KERBAPP.ADDMZ.LAN8080
  • Application Pool Account = ADDMZ\SVC_R2_KERBAPP
  • servicePrincipalName on application pool account = HTTP/KERBAPP.ADDMZ.LAN
• NTLMAPP.ADDMZ.LAN:8081 (Windows Sharepoint Services configured for NTLM AuthN)
  • Application Pool = SharePoint – NTLMAPP.ADDMZ.LAN8081
  • Application Pool Account = ADDMZ\SVC_R2_KERBAPP
  • servicePrincipalName on application pool account = HTTP/NTLMAPP.ADDMZ.LAN

-

For the tests I’m going to only use the websites:

• DELEGCONFIG.ADDMZ.LAN:81 (DelegConfig v2 Beta) –> To prove Kerberos AuthN with a Forest Trust in place
• R2FSMBSVA.ADDMZ.LAN:82 (DelegConfig v2 Beta)–> To prove Kerberos AuthN with an External Trust in place

-

To prove what type of authN is being used, I’m using DelegConfig, which you can download from here. DelegConfig is an ASP.NET application that can be used to help troubleshoot and configure IIS and Active Directory to allow Kerberos and delegating Kerberos credentials. Very handy!!!

-

To prove Kerberos AuthN IS WORKING against BOTH websites on server “R2FSMBSVA” I will target those first with a user account from the AD domain ADDMZ.LAN from a computer also within the AD domain ADDMZ.LAN

• The user account will be “ADDMZ\ADM.ADM_ADLCL_R2FSRODC5” and the computer will be “R2FSMBSVA.ADDMZ.LAN”.
• The user account will be “ADDMZ\ADM.ROOT” and the computer will be “R2FSRWDC1.ADDMZ.LAN”.

-

This continues in PART 2, which is the NEXT post.

-

Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER: http://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
######### http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————