| Web Interface Mod: Take Smart Card Authentication to the DMZ |
| Friday, 08 September 2006 by Michel Roth | |||
|
"For several versions now Web Interface has included a feature that allows users to authenticate using a smart card instead of entering their username and password. It works like this: 1. During the SSL handshake, IIS metabase settings trigger a request for the client certificate 2. IIS Directory service mapping associates the user certificate with a user account in Active Directory 3. After a successful mapping IIS impersonates the user account, allowing Web Interface to deduce the groups to which the user belongs 4. That list of groups (actually a list of group SIDs) is sent to the Presentation Server XML service instead of a username and password 5. The XML service returns the list of published applications that are available to those groups As you can see, the process depends entirely on IIS for doing the authentication and mapping the user’s certificate to their domain account. This only works when the IIS server is a domain member, and since nobody wants to put a domain member server in their DMZ we’ve always said that this is a solution for internal (or VPN) users only. But what if there were another way?" Read on here.
Show/Hide comment form
 |
|||
