{"id":1531,"date":"2014-07-04T09:26:07","date_gmt":"2014-07-04T09:26:07","guid":{"rendered":"https:\/\/modern-workplace.uk\/\/?p=1531"},"modified":"2014-07-04T09:28:38","modified_gmt":"2014-07-04T09:28:38","slug":"published-linkedin-kerberos-windows-2012-favorite-monster-changed","status":"publish","type":"post","link":"https:\/\/modern-workplace.uk\/?p=1531","title":{"rendered":"Published on LinkedIn: Kerberos and Windows 2012: Our Favorite Monster Is Changed (Again)"},"content":{"rendered":"<p>I have just published an Active Directory \/ Kerberos dedicated post on LinkedIn. <a href=\"https:\/\/www.linkedin.com\/today\/post\/article\/20140704091030-1393501-kerberos-and-windows-2012-our-favorite-monster-is-changed-again\">https:\/\/www.linkedin.com\/today\/post\/article\/20140704091030-1393501-kerberos-and-windows-2012-our-favorite-monster-is-changed-again<\/a> Here you can read the introductive paragraph<\/p>\n<hr \/>\n<p><strong>Kerberos and Windows 2012: Our Favorite Monster Is Changed (Again)<\/strong> Since Windows Server 2000,\u00a0<strong>Kerberos<\/strong>\u00a0protocol has been part of our day-to-day job. Its three heads (Key Distribution Center, the client user and the server hosting resources) are the gears that enable the single sign-on (<strong>SSO<\/strong>) used to authenticate on the domain and to access resources inside our corporate network. It works also outside our network boundaries, reaching the Cloud with DirSync and other additional features. <a href=\"https:\/\/modern-workplace.uk\/\/wp-content\/uploads\/2014\/07\/Kerberos_1.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"alignleft wp-image-1532\" src=\"https:\/\/modern-workplace.uk\/\/wp-content\/uploads\/2014\/07\/Kerberos_1-300x300.jpg\" alt=\"Kerberos_1\" width=\"162\" height=\"162\" srcset=\"https:\/\/modern-workplace.uk\/wp-content\/uploads\/2014\/07\/Kerberos_1-300x300.jpg 300w, https:\/\/modern-workplace.uk\/wp-content\/uploads\/2014\/07\/Kerberos_1-150x150.jpg 150w, https:\/\/modern-workplace.uk\/wp-content\/uploads\/2014\/07\/Kerberos_1.jpg 500w\" sizes=\"auto, (max-width: 162px) 100vw, 162px\" \/><\/a> Windows Server 2012 and Windows Server 2012 R2 have improved some existing features and have added some completely new scenarios related to security. A short list should include\u00a0<strong>Dynamic Access Control<\/strong>(<strong>DAC<\/strong>),\u00a0<strong>Kerberos Armoring<\/strong>\u00a0\/\u00a0<strong>Flexible Authentication Secure Tunneling<\/strong>\u00a0(<strong>FAST<\/strong>),\u00a0<strong>KDC Proxy Service<\/strong>\u00a0and\u00a0<strong>Kerberos Constrainded Delegation<\/strong>. I will use some high level scenarios, to explain what\u2019s new and why you should care about the aforementioned list. The objective here is not to give you the tech details, but just an idea of cool things you could achieve using Windows 2012.<\/p>\n<hr \/>\n<p><strong>Going Beyond\u00a0<\/strong><strong>Limitations in\u00a0<\/strong><strong>NTFS<\/strong> Our system to manage files and folders on a server has (basically) not changed since Windows NT 4. We create users and groups, assign permissions to them and manage sharing and exceptions, Meanwhile, we are trying to keep security alligned with organizations that change on a daily base. Windows 2012 has introduced KDC support for\u00a0<strong>claims<\/strong>\u00a0and the capability to\u00a0<strong>categorize\u00a0<\/strong>resources on our servers. To make an example, it is now possible to:<\/p>\n<ul>\n<li>Have a ticket from the KDC including a user claim like \u201cHe worked in this company for over 3 years\u201d<\/li>\n<li>Authenticate this claim with an\u00a0<span class=\"underline\" style=\"font-weight: inherit; font-style: inherit;\">external authority<\/span><\/li>\n<li>Have an automated classification of files and folders so that some contents are accessible only to people that have worked in the aforementioned company for more than 3 years<\/li>\n<\/ul>\n<p>When claims are provisioned, Windows Server 2012 KDCs can create service tickets with a principal\u2019s claims. Access tokens that are created from these service tickets include claims that can be used for access control. Server resources can receive as many classifications (<strong>tags<\/strong>) as we need and you are able to manage access using user claims and resource tags inside regular expressions. Just some notes related to DAC:<\/p>\n<ul>\n<li><span class=\"underline\" style=\"font-weight: inherit; font-style: inherit;\">Claims are supported also for devices<\/span>\u00a0(a Windows 8 client is required)<\/li>\n<li>Resource classification is usable also to apply auditing and encryption with\u00a0<strong>Rights Management Services<\/strong><\/li>\n<li>At least one Windows 2012 Domain Controller is required<\/li>\n<li>DAC permissions are applied after the more traditional security related to shares and NTFS, so they are an additional security layer<\/li>\n<\/ul>\n<p>Continue on LinkedIn&#8230;.. <a href=\"https:\/\/www.linkedin.com\/today\/post\/article\/20140704091030-1393501-kerberos-and-windows-2012-our-favorite-monster-is-changed-again\">https:\/\/www.linkedin.com\/today\/post\/article\/20140704091030-1393501-kerberos-and-windows-2012-our-favorite-monster-is-changed-again<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>I have just published an Active Directory \/ Kerberos dedicated post on LinkedIn. https:\/\/www.linkedin.com\/today\/post\/article\/20140704091030-1393501-kerberos-and-windows-2012-our-favorite-monster-is-changed-again Here you can read the introductive paragraph Kerberos and Windows 2012: Our Favorite Monster Is Changed (Again) Since Windows Server 2000,\u00a0Kerberos\u00a0protocol has been part of our day-to-day job. Its three heads (Key Distribution Center, the client user and the server hosting [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":1535,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_sitemap_exclude":false,"_sitemap_priority":"","_sitemap_frequency":"","twitterCardType":"","cardImageID":0,"cardImage":"","cardTitle":"","cardDesc":"","cardImageAlt":"","cardPlayer":"","cardPlayerWidth":0,"cardPlayerHeight":0,"cardPlayerStream":"","cardPlayerCodec":"","footnotes":""},"categories":[259,18],"tags":[636,628,627,637,631,630,643,632,633,629,634,642,641,640,635,626,638,639,430,178],"class_list":["post-1531","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-259","category-english","tag-categorize-resources","tag-dac","tag-dynamic-access-control","tag-fallback-to-ntlm","tag-fast","tag-flexible-authentication-secure-tunneling","tag-kcd","tag-kdc","tag-kdc-proxy-service","tag-kerberos-armoring","tag-kerberos-constrainded-delegation","tag-kerberos-constrained-delegation","tag-limiting-kerberos-delegation","tag-ms-kkdcp","tag-ntfs","tag-rights-management-services","tag-routing-and-remote-access-server","tag-rras","tag-windows-2012","tag-windows-2012-r2"],"_links":{"self":[{"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=\/wp\/v2\/posts\/1531","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1531"}],"version-history":[{"count":3,"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=\/wp\/v2\/posts\/1531\/revisions"}],"predecessor-version":[{"id":1536,"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=\/wp\/v2\/posts\/1531\/revisions\/1536"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=\/wp\/v2\/media\/1535"}],"wp:attachment":[{"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1531"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1531"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/modern-workplace.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1531"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}