How does Trust know to request kerberos?

-

i'm trying figure out how trust know use kerberos versus form of auth. here scenario. 

forest - crayons.com
domain - red.crayons.com

forest - markers.com
domain - blue.markers.com

there one-way trust, non-forest trust, between domains blue.markers.com trusts red.crayons.com.

when user in red.crayons.com wants access sharepoint resource in blue.markers.com use kerberos compared accessing secured site on web such support.symantec.com. how red domain know can kerberos ticket blue when support.symantec.com client resolve name in dns , authenticate via symantec web form.

https://technet.microsoft.com/en-us/library/cc773178%28v=ws.10%29.aspx?f=255&mspperror=-2147217396

thanks!

the client/system doesn't "know" going on trust. trusts transparent clients. replies on assigned permissions to objects. for example, symantec.com allows "everyone" view it's homepage. doesn't matter domain/forest coming from, can see website. symantec have restricted area need login website. if active directory integrated site, pass entered credentials into active directory. if username is part of a group, such authenticated users, grant permissions website.

the object model looks like:

client --> website --> object --> permissions or access control list -->  active directory <-- ad trust <-- trusted groups <-- trusted user

please note it's not "user" trusted. it's "groups" trusted. users part of groups means permissions. domain trust tells domain these "groups" trusted, or allow authentication. follows through chain granting permission client itself.

kerberos tickets temporary. last short period of time. means if request "kerberos ticket", it should temporary thing. typically, don't need "request kerberos" ticket done on ldap, layer down, when access object.

you can read more on kerberos tickets here: https://technet.microsoft.com/en-us/library/cc961966.aspx

i need more information trying do, or error message dig in further. thoughts on surface need enable "ldap support" allows communicate active directory structures.

entrepreneur, strategic technical advisor, , sr. consulting engineer - strategic services , solutions check out book - powershell 3.0 - wmi: http://amzn.to/1bnjomo | mastering powershell coming in april 2015!



Windows Server  >  Directory Services



Comments

Post a Comment

Popular posts from this blog

Cannot access Anywhere Access using domain name?

-
after installing anywhere access in windows server 2012 essentials r2, cannot use anywhere access using setup domain name in wizard such remote.mydomain.com? if enter public ip address, example, 72.2.34.5 works. before set anywhere access, created a record pointing public address...pinged , worked...so not sure doing wrong?  is wizard supposed create record etc , make remote.mydomain.com work? if enter public ip address while on lan, takes me router webpage.  shouldn't work on lan if accessed via public ip? thank you, tim. the wizard can configure remote.microsoft_names.com  remote.remotewebaccess.com but cannot configure domains purchased outside wizard.  depends on how domain configured if wildcard.yourdomain.com should work  if try ping remote.your_domain.com afar , not give proper  public ip, need add record mariette said. much have record domain.com www.domain.com , if have website somewhere else www.domain.com , need re...
Read more

server manager error: ADAM.events.xml could not be enumerated.

-
firewall off isnt it. rerun ldap wizard:?  why?  will screw exchange server running on machine?  ldap wizard asks questions don't understand. please dont send generic links to: http://social.technet.microsoft.com/wiki/contents/articles/13444.windows-server-2012-server-manager-troubleshooting-guide-part-ii-troubleshoot-manageability-status-errors-in-server-manager.aspx thanks, john hi john, >> ok. server manager app. these questions refer this. nothing else 2.  do need create app dir or not?  this server manager, shouldnt done? (why did break in first place?) how check if app dir exists server manager or not. 3.  if "lightweight" implementation of anything, sure hate see "heavyweight" version. the waring events can't enumerated. , cause not completing configuration of ad lds. ad lds not related server manager. used provide flexible support directory-enabled applications. if not implementing such application...
Read more

send messages to users

-
i have domain server windows 2000 sp4. my clients using win xp , win 98. when send messages computer management-shared folders-rightclick-all task-send message connected users, message received clients using winxp but not in  win 98 .how send them without winpopup  , net meeting. this forum windows server 2008.   check messenger service running on win98-clients. (haven't seen win 98 in while might not available...) Windows Server  >  Directory Services
Read more