Claims werden durch eine Erweiterung des Kerberos Protokols realisiert - s.a.:
Microsoft Open Specification - [MS-KILE]: Kerberos Protocol Extensions
1.3.4 Compound Identity
http://msdn.microsoft.com/en-us/library/hh554128.aspx
Des Weiteren:
Windows Server 2012 – Flexible Authentication Secure Tunneling (FAST)
[..]
This new feature enhances Kerberos Authentication. By keeping it from fallback to less-secure legacy protocols and protection against offline dictionary attacks. But what is really important about this, is that it is required if you plan to use Claims within
Dynamic Access Control. This is the enhancement that allows us to put claims into the Kerberos ticket.
[..]
Source:
http://blogs.technet.com/b/bruce_adamczak/archive/2012/10/13/follow-me-and-learn-windows-server-2012-flexible-authentication-secure-tunneling-fast.aspx
[..]
Dynamic Access Control adds Active Directory Claims to the [Kerberos] Ticket. Therefore, calculating the expected ticket sizes is no longer straightforward. The expectation is that tickets that are issued by Windows Server 2012 domain controllers are smaller
than the same tickets that are issued from older operating system versions. Claims add to the ticket size. However, after Windows Server 2012 file servers are using claims broadly, you can expect to phase out a significant number of your groups that control
file access to trim ticket sizes
[..]
Source: http://support.microsoft.com/kb/327825/en-us
Zusätzlich stehen die Hintergründe u.a. hier beschrieben:
[..]
Compound authentication
Compound authentication is an extension to Flexible Authentication Secure Tunneling (FAST), which allows Kerberos clients to provide the device’s TGT. This allows Windows Server 2012 KDCs to create service tickets with device authorization data for services
that are hosted on Windows 8 and configured to support device authorization data. Access tokens that are created from these service tickets include the device’s groups and claims, which can be used for access control.
What value does this change add?
This enables Windows Server 2012 to control access to resources with expressions in terms of:
- Devices
- Device groups
- Device claims, if the device’s domain supports claims and compound authentication for Dynamic Access Control and Kerberos armoring
What works differently?
To support resources by using compound authentication for access control, the resource domains need one of the following:
- All Windows Server 2012 domain controllers
- Sufficient Windows Server 2012 domain controllers to handle all the Windows 8 device authentication requests
Additionally, you will need to configure on the domain controller OU, the new
KDC support for claims, compound authentication and Kerberos armoring policy with “Supported” or higher setting, and if the client is retrieving claims, configure the new
Kerberos client support for claims, compound authentication and Kerberos armoring policy on each client.
Access control based on device claims also require the device’s domain to be provisioned for claims. Access control based on device or device groups, does not.
[..]
Claims
Claims are new authorization data that are provided by Active Directory. When claims are provisioned, Windows Server 2012 KDCs can create service tickets with a principal’s claims. Access tokens that are created from these service tickets include claims
that can be used for access control.
What value does this change add?
This enables Windows Server 2012 to control access to resources with expressions in terms of:
- User claims
- Device claims, if the resource’s domain supports claims and compound authentication for Dynamic Access Control and Kerberos armoring
What works differently?
To support resources that use claims-based access control, the principal’s domains will need to be running one of the following:
- All Windows Server 2012 domain controllers
- Sufficient Windows Server 2012 domain controllers to handle all the Windows 8 device authentication requests
- Sufficient Windows Server 2012 domain controllers to handle all the Windows Server 2012 resource protocol transition requests to support non-Windows 8 devices
Additionally, you will need to configure on the domain controller OU, the new
KDC support for claims, compound authentication and Kerberos armoring policy with “Supported” or higher setting, and if the client is retrieving claims, configure the new
Kerberos client support for claims, compound authentication and Kerberos armoring policy on each client.
[..]
Source: http://technet.microsoft.com/en-us/library/hh831747.aspx
--
Tobias Redelberger
StarNET Services (HomeOffice)
Frankfurter Allee 193
D-10365 Berlin
Tel: +49 (30) 86 87 02 678
Mobil: +49 (163) 84 74 421
Verzeichnis-ACLs: "condtional access" für Gruppe von Computern funktioniert nicht
