AD SSO Technical White Paper

Transcription

1 Issue V1.0 Date Huawei Technologies Co., Ltd.

2 2017. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without prior written consent of Huawei Technologies Co., Ltd. Trademarks and Permissions and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd. All other trademarks and trade names mentioned in this document are the property of their respective holders. Notice The purchased products, services and features are stipulated by the contract made between Huawei and the customer. All or part of the products, services and features described in this document may not be within the purchase scope or the usage scope. Unless otherwise specified in the contract, all statements, information, and recommendations in this document are provided "AS IS" without warranties, guarantees or representations of any kind, either express or implied. The information in this document is subject to change without notice. Every effort has been made in the preparation of this document to ensure accuracy of the contents, but all statements, information, and recommendations in this document do not constitute a warranty of any kind, express or implied. Huawei Technologies Co., Ltd. Address: Website: Huawei Industrial Base Bantian, Longgang Shenzhen People's Republic of China support@huawei.com i

3 Contents Contents 1 Background Concepts and Principles AD SSO Concepts AD SSO Principles Typical Applications AD SSO in Plug-In Mode AD SSO in No-Plug-In Mode Agent NTLM Authentication XFF Authentication Application Implementation AD Domain Authentication Networking for Enterprise Networks ii

4 Keyword: Abstract: Huawei USG6000 NGFW NGFW, AD, SSO This document describes the principle and solution of the AD SSO technology for Huawei NGFW. Abbreviation NGFW AD SSO Full Spelling Next-Generation Firewall Active Directory Single Sign On 1

5 1 Background 1 Background A large enterprise usually has many service management systems to provide management and IT services. For example, the financial system assists financial personnel in finance management, calculation, and report services, and the HR system helps HR departments maintain all personnel in the enterprise. These systems run on different platforms, are deployed at different times, and may be developed by different vendors using different technologies and standards. Over time, each application system becomes an irreplaceable part of the enterprise IT architecture. In addition, each service has its own authentication system that provides an authentication mechanism. For enterprise employees, it is time-consuming if they have to be authenticated every time before they access a service. Instead, accessing all service systems with authentication of only one time is desired. Single Sign-On (SSO) enables a user to log in once and gain access to all trusted application systems without entering user name and password to log in to each of the system. 2

6 2 Concepts and Principles 2 Concepts and Principles 2.1 AD SSO Concepts AD SSO for AD domain scenarios saves the efforts of re-authentication for subsequent access to trusted application systems after users pass AD domain controller-based authentication for the first time. This document uses the FW as a trusted application system. 2.2 AD SSO Principles As shown in the following figure, an SSO authentication process usually involves four basic elements, namely, the client device, AD domain controller, FW gateway, and Internet agent. Figure 2-1 AD SSO AD domain controller Agent (authentication information collection) Client Firewall gateway Internet Client: Before network access, AD domain authentication is performed first. After the authentication is passed, network access is implemented through the FW gateway. AD domain controller: It serves as the authentication system and authenticates all clients before they access the network. FW gateway: It serves as the egress gateway and permits the traffic of authenticated clients. 3

7 2 Concepts and Principles Agent: It collects client authentication results and transmits authentication passing information to the FW gateway. (Or the FW itself serves as the agent and interacts with the AD domain to obtain information about clients that pass the authentication.) Internet: Network resources. The interaction process is as follows: (1) The client first logs in to the AD domain for domain authentication. Domain authentication falls into multiple modes, such as Windows domain authentication, wireless 802.1x AD domain authentication, and wired L2TP access AD domain authentication. (2) The agent collects IP address and user name information of clients that pass the AD domain authentication in real time and notifies the FW of the information. (3) Based on the client information sent from the agent, the FW permits clients that have passed the authentication and block those that have not. 4

8 3 Typical Applications 3 Typical Applications 3.1 AD SSO in Plug-In Mode Figure 3-1 AD SSO in plug-in mode In plug-in mode, the administrator needs to enable an AD SSO service on an AD monitor (an AD domain controller or other devices in the AD domain), set the login and logout scripts on the AD server (AD domain controller), and set parameters on the FW for it to communicate with the AD domain controller and to receive the login and logout messages. 1. The user logs in to the AD domain through the client. 2. The AD server returns a login success message and delivers a login script to the user. 3. The client executes the login script and sends the user login information to the AD monitor. 5

9 3 Typical Applications 4. The AD monitor queries user login information on the AD server. If the user login information is displayed, the information is forwarded to the FW. 5. The FW extracts the user-ip address mapping from the user login information and adds the mapping to the IP monitoring table. 6. When the user accesses the Internet through the client, the FW permits or blocks traffic based on the IP monitoring table. 3.2 AD SSO in No-Plug-In Mode Figure 3-2 AD SSO in no-plug-in mode In this mode, the plug-in does not need to be installed on the AD server. The FW listens to and parses the asreply packets in the Keberos authentication packets sent by users during login to the AD server (AD domain controller) to obtain authentication results. If a user is authenticated, the FW adds the mapping between the user name and the user's IP address to the online user list. When the FW is deployed between users and the AD server, the FW can obtain authentication packets. If the authentication packets do not pass through the FW, the messages carrying authentication results from the AD server must be mirrored to the FW. 6

10 3 Typical Applications 3.3 Agent Figure 3-3 AD SSO in agent mode AD domain controller Client 1. The user logs in to the AD domain through the client. 6. Accesses the Internet. FW gateway 4. Parses security logs and sends obtained information to the FW. 2. Generates security logs. 3. Periodically queries security logs. Internet Agent (authentication information collection) In an AD domain scenario, the agent can be deployed on any Windows server reachable to the AD domain controller. Then the administrator account and password used by the agent to query the AD domain security logs and SSO parameters for communicating with the FW are configured. 1. The user logs in to the AD domain through the client. 2. The AD domain controller generates client login and authorization security log information. 3. The agent periodically queries AD domain login and authorization security log information and parses the information to obtain the user name and IP address information. 4. The agent sends the obtained user name and IP address information to the FW. 5. The FW generates an IP monitoring table based on the user name and IP address information. 6. When the user accesses the Internet through the client, the FW permits or blocks traffic based on the IP monitoring table. 7

11 3 Typical Applications 3.4 NTLM Authentication Figure 3-4 NTLM authentication HTTP client FW AD domain Internet 1. Implements AD domain authentication. 3. Triggers authentication. 2. Accesses the Internet. 4. Initiates NTLM authentication. 5. Requests for NTLM negotiation. 6. Initiates NTLM negotiation. 10. Returns the NTLM authentication challenge word to the client. 11. Returns the response message. 16. Sends the authentication result. 7. Parses NTLM negotiation parameters. 8. Initiates NTLM authentication negotiation (SMB). 9. Returns the NTLM authentication challenge word (SMB). 12. Parses the response parameters. 13. Sends the Response (SMB). 14. Returns the authentication result. 15. Assembles the authentication result and creates the IP monitoring table if the authentication succeeds. Accesses the Internet. Procedure: 1. The client goes through AD domain authentication. 2. The user uses a browser on the client to access the Internet through HTTP or HTTPS. 3. The FW redirects the GET request of the client to the portal service of the FW. 4. The client initiates HTTP or HTTPS access to the portal service of the FW. 5. After receiving the HTTP access request from the client, the FW notifies the client of NTLM authentication. 6. After receiving the NTLM authentication information, the client initiates an NTLM authentication negotiation request. 7. After receiving the NTLM negotiation packet from the client, the FW parses the negotiation packet to obtain the negotiation parameters. 8. The FW initiates an NTLM negotiation message (SMB) that carries the NTLM negotiation parameters of the client towards the AD domain 9. After receiving the NTLM negotiation message from the FW, the AD domain controller replies the FW with the challenge word information. 10. The FW parses the challenge word information received from the AD domain controller and returns it to the client through HTTP. 11. After receiving the challenge word information, the client returns a corresponding response message. 8

12 3 Typical Applications 12. After receiving the response message from the client, the FW parses the message to obtain the user name, IP address, domain name, and challenge word hash result. 13. The FW sends the challenge word hash result to the AD domain controller. 14. After receiving the response message, the AD domain controller returns the authentication result to the FW. 15. The FW parses and assembles the authentication result and creates the IP monitoring table if the authentication succeeds. 16. The FW sends the authentication result to the client. 3.5 XFF Authentication Figure 3-5 XFF authentication AD server Non-HTTP HTTP Client Proxy FW AD monitor If a proxy server is deployed on the enterprise network, employees access the Internet through this proxy server. After the traffic passes through the proxy server, the source IP address of the traffic becomes the IP address of the proxy server. The FW can no longer perform user traffic management and control over this client. The HTTP request packet sent from the proxy server carries the X-Forwarded-For field, through which the IP address of the original client can be obtained. Based on the IP address of the original client, the real identity of the user can be further queried, and user information be obtained for user management and control. 9

13 3 Typical Applications Figure 3-6 XFF authentication packet 10

14 4 Application Implementation 4 Application Implementation 4.1 AD Domain Authentication Networking for Enterprise Networks Figure 4-1 AD domain authentication networking for enterprise networks AD domain controller Authentication information synchronization Wired access AD domain authentication Internet Wired device Access switch Internet access Core switch FW gateway Wireless access Wireless device AP In enterprise network scenarios, the FW serves as the egress gateway, and devices access in wireless and wired modes. After access authentication is passed, network access control is performed at the egress gateway. 11