SINGLE SIGN ON. The following document describes the configuration of Single Sign On (SSO) using a Windows 2008 R2 or Windows SBS server.

Transcription

1 SINGLE SIGN ON The following document describes the configuration of Single Sign On (SSO) using a Windows 2008 R2 or Windows SBS server.

2 Content 1 Preconditions Required Software Required Information Setting up your Windows Server 2008 R Activating Encryption Types Creating a principal Setting up your firewall Starting the SSO client Creating a Group Policy Windows XP clients Windows Vista and Windows 7 clients Troubleshooting & FAQ Importing the Kerberos key on the firewall failed. What happened? The firewall report contains messages like clock skew too great Can I use the SSO feature on a terminal server? Page: 1 1 / 13

3 1 Preconditions To use SSO on the gateprotect Firewall, you need a Windows Domain structure. Each client computer that should be able to authenticate using the SSO feature needs to be a member of this domain. It is not possible to connect the firewall to multiple domains or multiple domain controllers concurrently. In this document, we describe the setup using a Windows Server 2008 R2 as the domain controller. On the client side, we will show the setup using a Windows XP and a Windows 7 client. 1.1 Required Software Before you start with the setup, please make sure the following tools are available: 1. ktpass.exe (located in %windir%\system32) should be at least version , see file properties to verify the version number 2. the latest version of the gateprotect Single Sign On Tool, currently v Required Information Make sure the following information is available: 1. Hostname of the gateprotect firewall 2. Domain name of the gateprotect firewall (this should be equal to your Windows Domain name) 3. IP address of your primary domain controller Note: You can change the hostname and domain name of your firewall using the administration client. Open the Options User Authentication Advanced tab and change the according values. After changing the values, the firewall has to be restarted. Page: 2 2 / 13

4 2 Setting up your Windows Server 2008 R2 Login to your primary domain controller using the Administrator Account and open up a command shell (cmd) with administrator rights. You have to create a new user which will be used by the firewall to connect to your Active Directory. This user has to be placed in the Users Container of your AD. By using the command shell, the new user will be automatically placed in this container. To create the users, issue the following commands in the cmd: net user gplogin * /ADD /fullname:"gplogin" After issuing the command, open the Active Directory Users and Computers snap-in. Expand the domain tree and click on the Users container (in some SBS Server Systems the user gplogin will be located in the Company Domain Structure please move it to Users). You should see the new user in the container. Please note that the name must be exactly gplogin, whereas the other user can have any name. When the user is in the right place, open the properties for the gplogin user and click on the Account tab. Page: 3 3 / 13

5 In the account options, activate the entries Use Kerberos DES encryption types for this account and Password never expires if they aren t already activated. Save your settings and exit. 2.1 Activating Encryption Types Since Windows 2008 R2 and Windows Vista / Windows 7, Microsoft deactivated certain encryption types in the default group policy. These encryption types are vital for the SSO feature and have to be reactivated. A central place for this is the Active Directory Controller. Thus, we will create a new group policy now. Click Start, click All Programs, click Accessories, and then click Run. Type gpmc.msc in the text box, and then click OK or press ENTER. Navigate to the root of your domain in the tree on the left, do a right click on your domain name. Page: 4 4 / 13

6 A new dialogue will open, where you have to enter a name for the new group policy object. The field Source Starter GPO should be set to <none>. After applying your settings, you should find a new entry in the left tree. Clicking on it will show you some basic information to the right. Make sure the Security Filtering section contains the entry Authenticated Users. If not, add this group now. Now do a right click on the newly created group policy in the left tree and select Edit. This will open the policy editor. In the left tree of the editor navigate to Computer Configuration Windows Settings Security Settings Local Policies Security Options and double click on the entry Network security: Configure encryption types allowed for Kerberos. In the upcoming dialogue, activate the select box Define these policy settings and activate all encryption types including Future encryption types. Page: 5 5 / 13

7 Click OK to save your settings, close your policy editor and your Group Policy Management Console. To test your settings, login to a domain computer and open a CMD shell with administrator rights. Issue the following command to force a group policy update: gpupdate /force You can also check whether the policy has been applied by generating a report: gpresult /H C:\GPResult.html This command will create an HTML file in C:\ which will show you a list of applied group policies. 2.2 Creating a principal Open a CMD shell with administrator rights and issue the following command: ktpass -out c:\sso.fw -princ gplogin/<firewallname>@<domain> -pass * -mapuser gplogin -mapop set -crypto DES-CBC-CRC -ptype KRB5_NT_PRINCIPAL +desonly Using our example domain and the hostname of our firewall, the resulting command would be: ktpass -out c:\sso.fw -princ gplogin/sso-setup@gateprotect.local -pass * -mapuser gplogin -mapop set -crypto DES-CBC-CRC -ptype KRB5_NT_PRINCIPAL +desonly You will be asked for the password of the gplogin user now and after entering it, the command will create a new file in C:\ called sso.fw. Please be aware that the ktpass options are case sensitive, i.e. the hostname of the firewall needs to be written in lower case letters whereas the domain name has to be written in upper case letters. The same applies to the user name, i.e. gplogin with an upper case L. A successful command will create the following output: C:\Documents and Settings\Administrator>ktpass -out c:\sso.fw -princ gplogin/sso-setup@gateprotect.local -pass * -mapuser gplogin -mapop set -crypto DES-CBC-CRC -ptype KRB5_NT_PRINCIPAL +desonly Targeting domain controller: test-ad.gateprotect.local Using legacy password setting method Successfully mapped gplogin/sso-setup to gplogin. Type the password for gplogin/sso-setup:****** Type the password again to confirm:****** Key created. Output keytab to c:\sso.fw: Keytab version: 0x502 keysize 62 gplogin/sso-setup@gateprotect.local ptype 1 (KRB5_NT_PRINCIPAL) vno 3 etype 0x1 (DES-CBC-CRC) keylength 8 (0x385b73f8b ) Account gplogin has been set for DES-only encryption. The resulting file has to be imported into the firewall using the administration client (see next step). Page: 6 6 / 13

8 3 Setting up your firewall Open your administration client and connect to your firewall. When you are connected, open the Options User Authentication Settings tab. Activate the user authentication and change the Authentication server to Microsoft Activate Directory Server. Now enter the IP address, the user information for the gpad user and the domain name into the corresponding fields. By clicking in the Test the AD settings button, you can validate your settings. If the validation was successful, click on OK. This will save your settings. Open up the User Authentication again, and check the User list tab. This will show you all Active Directory users and groups now. Now open the Advanced tab and check the box for Activate the Kerberos Service. This will enable the button Import the Kerberos Key. The Kerberos key is the file which was created by the ktpass command in step 2. Clicking on the button will open a file browser where you have to select the sso.fw file. If your import has failed, look Page: 7 7 / 13

9 at your firewall reports and the Troubleshooting section for further information. If the import was successful, click on the OK button. Your firewall and your Active Directory are now prepared. In the next step, you have to distribute the SSO client to all domain computers. Page: 8 8 / 13

10 4 Starting the SSO client The following section describes the setup of your domain computers and how to start the SSO client on those computers correctly. The section is split into two parts, one for the setup of Windows XP clients and one for the setup of Windows Vista / Windows 7 clients. The SSO client software is available in three different formats, all included in the download link mentioned in section 1.1 Required Software: 1. UAClientSSO.exe portable binary file which can be used start the client from a network share 2. UAClientSSOSetup.exe Windows Installer which can be used to install the client directly to a domain computer 3. UASSOInstaller.msi MSI package which can be used to distribute the client using a group policy. We recommend using the portable binary and starting it from a network share using a group policy. The advantage here is that you don t need to install the client software on each machine and you have a central place to update the binary in case a new version will be released. To prepare for the next steps, please copy the portable binary (UAClientSSO.exe) to the following folder on your Active Directory server: \\<fully qualified domain name>\sysvol\<fully qualified domain name>\scripts\ For example: \\gateprotect.local\sysvol\gateprotect.local\scripts\ The path is accessible for all domain members by default, so no access rights need to be changed for this folder. Page: 9 9 / 13

11 4.1 Creating a Group Policy On your Active Directory server start the Group Policy Management Console (GPMC). Now browse to your domain name in the GPMC. Right click on the domain name and select Create and Link GPO Here You will be asked to enter a name for the new group policy, e.g. SSO Startup. Select the newly created group policy, do a right click and select Edit. In the newly opened window, navigate to User Configuration Windows Settings Scripts (Logon/Logoff), and double click on the Logon entry in the right pane. This will open the Logon Properties. Page: / 1 3

12 Clicking on the Add button will open a new dialogue asking for the Script Name and Script Parameters. The Script Name is the patch to the UAClientSSO.exe on your Active Directory server. Do not use the Browse button here, as you have to enter the UNC path here. In our example configuration, the path will be: \\gateprotect.local\sysvol\gateprotect.local\scripts\uaclientsso.exe The Script Parameters field needs to contain the hostname of your firewall and the IP address of the firewall in your client network. In our example, the firewall name is sso-setup and has the IP address Save your settings and close the GPMC. 4.2 Windows XP clients Windows XP clients don t need a special configuration when connecting to an Active Directory Server 2003 R2. However, please make sure that there is no time difference between your Active Directory Server, firewall and client computer of more than 5 minutes. Otherwise, the authentication will fail. If you want to test your new group policy, you can force your clients to update their group policy immediately. Open a command line on one of your XP clients and run the following command: gpupdate /force You will likely get a message, stating that there are some new policies which can only be run at startup. If you re asked to reboot the machine, please restart now. After the reboot, please login to your domain. The SSO client should be started automatically in the background. You can check in the taskbar, if everything is working. A green symbol means, you re authenticated, a red symbol indicates an error during authentication. Page: / 1 3

13 4.3 Windows Vista and Windows 7 clients Windows Vista and Windows 7 clients need some additional configuration. In particular, you need to reactivate some specific encryption algorithms used for Kerberos, which have been deactivated by Microsoft. If you have created the Group Policy for Kerberos you can skip this step. You can manually reactivate the encryption algorithms used for Kerberos on Windows Vista or Windows 7. Login as an administrator and run the command secpol.msc. This will open the Local Security Policy editor. Navigate to Security Settings Local Policies Security Options and click on the entry Network Security: Configure encryption types allowed for Kerberos in the right pane. In the following dialogue, activate all available encryption algorithms, including Future encryption types. Save your settings and restart your computer. Attention: You have to activate all encryption types. Otherwise, logins to the domain will not be possible on this client anymore. After restarting the client, the UAClientSSO.exe should be started automatically. Please note: Windows Server 2003 R2 has no group policy object for this policy. This means that you have to create your own policy if you want to reactivate the encryption types using the Active Directory server. Creating a new Group Policy to achieve this is out of the scope of this manual. Please refer for your Microsoft documentation. Page: / 1 3

14 5 Troubleshooting & FAQ 5.1 Importing the Kerberos key on the firewall failed. What happened? This can have multiple reasons. First, please check the firewall reports. The reports usually contain information, why the key import failed. Common errors could be: 1. The hostname has been written in upper case letters, but the firewall expects the hostname in lower case letters. 2. The Fully Qualified Domain Name has been written in lower case letters, but the firewall expects it in upper case letters 3. The key has been created more than once on the Active Directory server, resulting in a higher key version number, but the firewall only accepts the first key created for the gplogin user. 4. The firewall reports the error KerberosService: error in accepting context --- krb5 error --- Decrypt integrity check failed All these errors can only be fixed by completely deleting the gplogin user and recreating it. Please refer to section 2 - Setting up your Windows Server 2008 R2 on how to create the user and the key again. Make sure you enter the correct hostname and FQDN and check the password for the gplogin user again. 5.2 The firewall report contains messages like clock skew too great This error is caused by a time difference of more than 5 minutes between the Active Directory server, your client machines and/or your firewall. Please make sure that the time difference on all machines is less than 5 minutes. Different time zones do not cause this error. To synchronize all machines, we recommend activating the NTP services on the firewall and make it accessible for the internal network. Please refer to section Firewall - Date in the firewall manual. 5.3 Can I use the SSO feature on a terminal server? The SSO feature relies on distinct IP addresses for each user. On a terminal server users usually share a single IP address which makes it impossible for the firewall to distinct the individual users. However, since Windows Server 2008, Terminal Server has a feature called Remote Desktop IP Virtualization. This feature can be configured to assign a unique IP address to every user session. A manual on how to configure this feature can be found here: 1.aspx Please be aware that you might have to change your firewall configuration to include the newly configured subnet of the IP virtualization feature. Page: / 1 3