You are here

Home » API reference » LDAP Single Sign On 7.2

MSTMG.notes.txt in LDAP Single Sign On 7.2

Same filename and directory in other branches
  1. 7 MSTMG.notes.txt

Microsoft Forefront Threat Management Gateway
http://technet.microsoft.com/en-us/library/cc441438.aspx

Overview of authentication in Forefront TMG
http://technet.microsoft.com/en-us/library/cc441695.aspx


About authentication in Web publishing
http://technet.microsoft.com/en-us/library/cc441671.aspx
-- third component of TMG authentication for web publishing is: "Delegation of authentication ot web servers behind FTMG".  This is where LDAP modules need to be integrated.  This aspect is configured in the "publishing rule" such that a single listener can have multiple types of delegation.

1) The Web server must be configured to use the authentication scheme that matches the delegation method used by Forefront TMG. Delegation of client credentials is configured on the publishing rule. In the Publishing Rule wizard, configure this on the Authentication Delegation page. In the publishing rule properties, the authentication settings are on the Authentication Delegation tab.

2) Delegation options are (sorted in order of what I think are desireable)
- NTLM/Kerberos (Negotiate).  Tries for Kerberos ticket and goes for credentials via NTLM.
- NTLM. "In NTLM delegation, Forefront TMG delegates the credentials by using the NTLM challenge/response authentication protocol. If authentication fails, Forefront TMG replaces the delegation with the authentication type used by the Web listener. If the server requires a different type of credentials, Forefront TMG triggers an alert."
- No delegation, and client cannot authenticate directly.  Not useful.  Just for avoiding false passing of credentials when not needed.
- No delegation, but client may authenticate directly.  User credentials passed to drupal.  Not desireable.
- Basic.  cleartext passing of credentials to drupal.  Not desireable.
- SecurID
- Kerberos constrained delegation

File

MSTMG.notes.txt
View source 
  1. 

  2. 

  3. Microsoft Forefront Threat Management Gateway

  4. http://technet.microsoft.com/en-us/library/cc441438.aspx

  5. 

  6. Overview of authentication in Forefront TMG

  7. http://technet.microsoft.com/en-us/library/cc441695.aspx

  8. 

  9. 

  10. About authentication in Web publishing

  11. http://technet.microsoft.com/en-us/library/cc441671.aspx

  12. -- third component of TMG authentication for web publishing is: "Delegation of authentication ot web servers behind FTMG".  This is where LDAP modules need to be integrated.  This aspect is configured in the "publishing rule" such that a single listener can have multiple types of delegation.

  13. 

  14. 1) The Web server must be configured to use the authentication scheme that matches the delegation method used by Forefront TMG. Delegation of client credentials is configured on the publishing rule. In the Publishing Rule wizard, configure this on the Authentication Delegation page. In the publishing rule properties, the authentication settings are on the Authentication Delegation tab.

  15. 

  16. 2) Delegation options are (sorted in order of what I think are desireable)

  17. - NTLM/Kerberos (Negotiate).  Tries for Kerberos ticket and goes for credentials via NTLM.

  18. - NTLM. "In NTLM delegation, Forefront TMG delegates the credentials by using the NTLM challenge/response authentication protocol. If authentication fails, Forefront TMG replaces the delegation with the authentication type used by the Web listener. If the server requires a different type of credentials, Forefront TMG triggers an alert."

  19. - No delegation, and client cannot authenticate directly.  Not useful.  Just for avoiding false passing of credentials when not needed.

  20. - No delegation, but client may authenticate directly.  User credentials passed to drupal.  Not desireable.

  21. - Basic.  cleartext passing of credentials to drupal.  Not desireable.

  22. - SecurID

  23. - Kerberos constrained delegation