ISA Server 2006 addresses the Contoso issues by making applications available over the Internet in a secure way.

No direct access to the server from the Internet

SSL packet inspection

When you create a secure Web publishing rule, you can configure how SSL requests will be redirected as Hypertext Transfer Protocol (HTTP) requests or as SSL requests.

HTTPS-to-HTTPS bridging

HTTPS-to-HTTPS bridging protects against attacks that are hidden in SSL-encrypted connections. For SSL-enabled Web applications, after receiving the client's request, ISA Server 2006 decrypts it, inspects it, and terminates the SSL connection with the client computer. The Web publishing rules determine how ISA Server communicates the request for the object to the publishing Web server. If the secure Web publishing rule is configured to forward the request using Secure HTTP (HTTPS), ISA Server initiates a new SSL connection with the published server. Because the ISA Server computer is now an SSL client, it requires that the publishing Web server responds with a server-side certificate.

HTTPS-to-HTTP bridging (SSL Termination)

HTTPS-to-HTTP bridging (SSL Termination) protects against attacks that are hidden in SSL-encrypted connections. For HTTP-enabled Web applications, after receiving the client's request, ISA Server 2006 decrypts it, inspects it, and terminates the SSL connection with the client computer. The Web publishing rules determine how ISA Server communicates the request for the object to the publishing Web server. If the secure Web publishing rule is configured to forward the request using HTTP (unencrypted), ISA Server initiates a regular HTTP connection with the published server. Because the connection between the ISA Server computer and the published Web server is over HTTP, the SSL processing load is removed from the published Web server. HTTPS-to-HTTP bridging can increase the performance of your published Web servers.

Important:
Because the communication between the ISA Server computer and the published Web server is not encrypted, we recommend that the published Web server be on a separate internal network or located in a perimeter network (also known as DMZ, demilitarized zone, and screened subnet).

Note:
This document discusses HTTPS-to-HTTPS bridging in the walkthroughs.

Authentication

ISA Server 2006 overcomes the difficulties of using client access VPN connections in the following ways:

• Access to published applications is via a Web browser.
  
• Applications are now more widely available and more accessible than remote access VPNs due to the use of SSL. You can access your published applications behind firewalls, from connections using network address translation (NAT), and from other networking devices that might otherwise be blocking remote access VPN connections.
  
• The reconnect process is easier and quicker, due to SSL. If your connection to the Internet is disconnected, you no longer need to reconnect via the remote access VPN dialer. After Internet access is reconnected, you can go back to your published application.
  
• Partners, vendors, and employees who are not in the office can easily access the required information in a secure way.
  

LDAP authentication is similar to Active Directory authentication, except that the ISA Server computer does not have to be a member of the domain. ISA Server 2006 connects to a configured LDAP server over the LDAP protocol to authenticate the user. Every Windows domain controller is also an LDAP server by default, with no additional configuration changes required. By using LDAP authentication, you get the following benefits:

• For an ISA Server 2006 Standard Edition server or for ISA Server 2006 Enterprise Edition array members in workgroup mode, when ISA Server is installed in a perimeter network, you no longer need to open all of the ports required for domain membership.
  
• You can authenticate users in a domain with which there is no trust relationship.
  

For more information about LDAP, see Appendix B: LDAP configuration.

To configure LDAP authentication, you need to:

Create an LDAP server set

Create an LDAP user set

Create an LDAP server set

Create an LDAP user set

To authenticate users through LDAP, you need to determine which users to authenticate and who authenticates the users. To do this, you need to create an LDAP user set.

Perform the following procedure to create an LDAP user set. For Standard Edition, perform the following procedure on computer isa01. For Enterprise Edition, perform the following procedure on computer storage01.

To create an LDAP user set

1. In the console tree of ISA Server Management, click Firewall Policy:

   • For ISA Server 2006 Standard Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand isa01, and then click Firewall Policy.
     
   • For ISA Server 2006 Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, expand main, and then click Firewall Policy.
     

2. On the Toolbox tab, click Users, and then click New. Use the wizard to create the new user set as outlined in the following table.

Page	Field or property	Setting
Welcome	User set name	Type LDAPUsers.
Users	Select the users to include in this user set	Click Add, and select LDAP.
Add LDAP User	LDAP server set User name	Select CorpLDAP, the LDAP server set from the drop-down list. Note: For information about creating an LDAP server set, see Create an LDAP server set in the preceding section. Select All Users in this namespace. Note: You can also specify user groups or specific user accounts if you do not want all users to be part of this LDAP user set.
Completing the New User Set Wizard	Review settings.	Click Back to make changes and Finish to complete the wizard.

ISA Server 2006 works with the Windows SharePoint Services 3.0 technology and the Office SharePoint Server 2007 product to enhance security.

Using the combined collaboration features of Windows SharePoint Services and Office SharePoint Server, users in your organization can easily create, manage, and build their own collaborative Web sites and make them available throughout the organization.

When you publish SharePoint sites to the Internet, you provide employees, who are not in the office, access to the information that they need to complete their jobs, no matter where they are located, without compromising security.

When you publish a SharePoint site through ISA Server, you protect the SharePoint site from direct external access because the name and IP address of the SharePoint site are not accessible to the user. The user accesses the ISA Server computer, which then forwards the request to the published SharePoint site according to the conditions of your Office SharePoint Server publishing rule.

When you publish a SharePoint site, ISA Server enables you to configure forms-based authentication, enforce a required authentication method, enable two-factor authentication, and control centralized logging.

Before you begin

Walkthrough

The following computers are required for this walkthrough:

• dc01
  
• storage01 (Enterprise Edition)
  
• isa01
  
• sp01
  
• router01
  

The following sections describe how to configure the solution:

Create a Web listener

Publish a SharePoint site

Test Office SharePoint Server publishing

Create a Web listener

When you create a Web publishing rule, you must specify a Web listener to be used when creating the rule. The Web listener properties determine the following:

• Which IP address or addresses and ports on the specified networks will listen for Web requests (HTTP or HTTPS)
  
• Which server certificates to use with which IP address
  
• Which authentication method to use
  
• Number of concurrent connections that are allowed
  
• ISA Server single sign on (SSO) settings
  

Use the information on the worksheet that you filled in previously, and perform the following procedure to create a Web listener.

To create a Web listener

1. In the console tree of ISA Server Management, click Firewall Policy:

   • For ISA Server 2006 Standard Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand isa01, and then click Firewall Policy.
     
   • For ISA Server 2006 Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, expand main, and then click Firewall Policy.
     

2. On the Toolbox tab, click Network Objects, click New, and then select Web Listener. Use the wizard to create the Web listener as outlined in the following table.

Page	Field or property	Setting
Welcome	Web listener name	Type FBA.
Client Connection Security	Connection type, either SSL or not SSL.	Select Require SSL secured connections with clients.
Web Listener IP Addresses	Listen for incoming Web requests on these networks ISA Server will compress content Select IP Addresses	Select the External network. Check box should be selected (default). See External Network Listener IP Selection page.
External Network Listener IP Selection	Listen for requests on Available IP Addresses	Select Specified IP addresses on the ISA Server computer in the selected network. Select 172.16.0.103 and click Add.
Listener SSL Certificates	A Web listener can use a single certificate for all of its IP addresses, or a different certificate for each IP address.	Select Assign a certificate for each IP address. Select IP address 172.16.0.103 and click Select Certificate.
Select Certificate	Select a certificate	Select the certificate issued to portal.contoso.com and click Select. The certificate must be installed before running the wizard.
Authentication Settings	Specify how clients will provide credentials to ISA Server Select how ISA Server will validate client credentials	Select HTML Form Authentication. Select LDAP (Active Directory).
Single Sign On Settings	Enable SSO for Web sites published with this Web listener SSO domain name	Confirm that this option is selected. Type .contoso.com.
Completing the New Web Listener Wizard	Review settings.	Click Back to make changes or Finish to complete the wizard.

Note:
If an LDAP server set has not already been created, the Create Web Listener Wizard will prompt you to create the LDAP server set.

Important:
Configure persistent cookies to allow users to open documents from an Office SharePoint Server site without the need for the user to reauthenticate. The following security issues relate to the use of persistent cookies:

• A malicious attacker who obtains a persistent cookie may be able to perform a brute force attack to obtain user credentials from the cookie.
  
• On a public computer, if the user does not log off, the session cookie can be used by the next user to access published sites. This threat can be mitigated by not enabling persistent cookies for public computers.
  
• Spyware may be able to access the cookie.
  

Publish a SharePoint site

Use the information on the worksheet that you filled in previously, and perform the following procedure to publish a SharePoint site.

To publish a SharePoint site

1. In the console tree of ISA Server Management, click Firewall Policy:

   • For ISA Server 2006 Standard Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand isa01, and then click Firewall Policy.
     
   • For ISA Server 2006 Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, expand main, and then click Firewall Policy.
     

2. On the Tasks tab, click Publish SharePoint Sites. Use the wizard to create a rule as outlined in the following table.

Page	Field or property	Setting
Welcome	SharePoint publishing rule name	Type Publishing SharePoint.
Publishing Type	Publishing type options	Select Publish a single Web site or load balancer. Note: For more information about publishing a server farm of load balanced Web servers, see "Web Server Farm Load Balancing in ISA Server 2006" at the Microsoft TechNet Web site.
Server Connection Security	Choose the type of connections ISA Server will establish with the published server or server farm	Select Use SSL to connect to the published Web server or server farm. Note: For HTTPS-to-HTTP bridging (SSL Termination), you should select Use non-secured connections to connect the published Web server or server farm.
Internal Publishing Details	Internal site name	Type sp01.corp.contoso.com. Important: The internal site name must match the name of the server certificate that is installed on the internal Web servers. Note: If you cannot properly resolve the internal site name, you can select Use a computer name or IP address to connect to the published server, and then type the required IP address or name that is resolvable by the ISA Server computer.
Public Name Details	Accept requests for Public name	This domain name (type below) Type portal.contoso.com.
Select Web Listener	Web listener	Select FBA.
Authentication Delegation	Select the method used by ISA Server to authenticate to the published Web server	Select NTLM authentication.
Alternate Access Mapping Configuration	For complete integration and functionality, you need to configure alternate access mapping on the published SharePoint site.	Select SharePoint AAM is already configured on the SharePoint server.
User Sets	This rule applies to requests from the following user sets	Select All Authenticated Users and click Remove. Click Add, select LDAPUsers, click Add, and then click Close.
Completing the New SharePoint Publishing Rule Wizard	Review settings.	Click Back to make changes and Finish to complete the wizard.

Important:
If publishing the Windows SharePoint Services 3.0 Central Administration site, the link translation feature should be disabled in the Office SharePoint Server publishing rule. Link translation can interfere with management of the alternate access mappings.

Note:
If the Office SharePoint Server computer resides in a perimeter network, you might need to open up communications between the Office SharePoint Server computer and your internal network.

Test Office SharePoint Server publishing

On the router01 computer, perform the following procedure to test the new Office SharePoint Server publishing rule.

Note:
Make sure that you have the root CA certificate of the issuing CA of the portal.contoso.com certificate installed.

To test Office SharePoint Server publishing

1. Open Microsoft Internet Explorer.

2. Browse to the following url: https://portal.contoso.com. Use the following details to log on:

   1. Domain\user name: corp\mberg
      
   2. Password: Passw0rd
      

You should be in the portal now.

When publishing a Web site, we recommend that users open an HTTPS connection between them and the ISA Server computer to protect the sensitive information that is being transferred over the Internet. This requires that users enter a URL such as https://portal.contoso.com. If the user enters portal.contoso.com, the user will receive the following error.

Users have a tendency not to enter the HTTPS portion of the URL even when going to a secured Web site. This behavior has been reinforced by Web administrators who have scripted their Web sites to redirect users to an HTTPS page, even when they enter HTTP. This is done to reduce the number of Help desk calls by users when they cannot open the URL they are trying to open.

To enable HTTP to HTTPS redirection, perform the following procedure.

1. In the console tree of ISA Server Management, click Firewall Policy:

   • For ISA Server 2006 Standard Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Server Name, and then click Firewall Policy.
     
   • For ISA Server 2006 Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, expand Array Name, and then click Firewall Policy.
     

2. On the Toolbox tab, click Network Objects, expand Web Listeners, right-click the Web listener, and then select Properties.

3. Select the Connections tab.

4. Select Enable HTTP connections on port and confirm that the listening port for HTTP is 80.

5. Confirm that Enable SSL (HTTPS) connections on port is selected and is listening on port 443.

6. Select Redirect all traffic from HTTP to HTTPS.

   

7. Click OK to close the properties of the Web listener.

8. Click the Apply button in the details pane to save the changes and update the configuration.

It is good security policy to require your users to change their passwords on a regular basis. Users who are not in the office on a regular basis need a method to change their passwords when they are not in the office.

When using forms-based authentication, you can inform users that their passwords are going to expire in a specific number of days and you can enable your users to change their passwords so they do not expire. Users will also be able to change an expired password.

To configure the Change Password option when using LDAP authentication, LDAP needs to be configured with the following settings:

• Connection to the LDAP servers must be over a secured connection. This requires an SSL certificate to be installed on the Active Directory server. For more information about enabling LDAP over SSL, see "How to Enable LDAP over SSL with a third-party certification authority" at the Microsoft Help and Support Web site.
  
• The ISA Server computer needs to have the root certificate for the CA that issued the SSL certificate installed on the Active Directory servers.
  
• Connection to the LDAP servers cannot be via a global catalog.
  
• A user name and password that are used for verifying user account status and changing passwords are required.
  

1. In the console tree of ISA Server Management, click Firewall Policy:

   • For ISA Server 2006 Standard Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Server Name, and then click Firewall Policy.
     
   • For ISA Server 2006 Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, expand Array Name, and then click Firewall Policy.
     

2. On the Toolbox tab, click Network Objects, expand Web Listeners, right-click the Web listener, and then select Properties.

3. Select the Forms tab.

4. Select Allow users to change their passwords and Remind users that their password will expire in this number of days. The default number of days is 15.

1. Click OK to close the properties of the Web listener.
   
2. Click the Apply button in the details pane to save the changes and update the configuration.
   

The users will now see the following logon screen. Notice the option I want to change my password after logging on.

When users access two different Web sites, such as an Outlook Web Access site and a SharePoint site, users should not have to provide the same credentials again when they click a link to open another site.

The ISA Server 2006 SSO feature reuses user credentials for another published server, eliminating the need to reenter credentials a second or third time. This will enhance the user experience, because users will click a link that will open another Web application without having to provide their credentials.

For more information about ISA Server SSO, see "Secure Application Publishing" at the Microsoft TechNet Web site.

ISA Server provides granular control over HTTP communication. This control is provided in the form of an HTTP filter, an application-layer filter that examines HTTP commands and data, through which you set HTTP policy. The HTTP filter screens all HTTP traffic that passes through the ISA Server computer, and only allows compliant requests to pass through.

For example, the Verify Normalization feature (enabled by default) specifies that requests with URLs that contain escape characters after normalization will be blocked. Escaped characters include, but are not limited to, the percent sign (%) and a space character (). If this feature is enabled, SharePoint document libraries will fail. URLs for document libraries and files uploaded and downloaded include non-standard characters such as the percent sign (%).

If you are using a language containing high-bit characters (for example, umlauts in German) you should also clear the Block high bit characters check box.

More information about HTTP Filtering is provided in "Using the HTTP Filter to Help Secure HTTP Access" at the Microsoft TechNet Web site.

Note:
The Verify normalization and Block high bit characters features are meant to address potential security exploits. When you turn off these features in ISA Server, you are potentially creating an opening for malicious users.

To properly configure LDAP authentication, you need to configure an LDAP server set and at least one login expression.

LDAP server set

An LDAP server set is a grouping of LDAP servers, which ISA Server uses to perform user authentication. All the servers in an LDAP server set share the same LDAP connection settings.

The following table lists the properties of an LDAP server set.

Item	Description	Comment
LDAP server set	Listing of LDAP servers available for LDAP user authentication. All servers listed will share the same LDAP connection settings.	Required.
LDAP servers	Listing of LDAP servers available for LDAP user authentication. Note the following: When there is more than one server, the servers are queried in the order in which they are listed. If a server does not respond, it will be in time-out for one minute. If the same server does not respond again after the one minute time-out, the time-out will continue to double until the time-out reaches 32 minutes. At that point, the time-out stays at 32 minutes. When ISA Server connects to the server, the time-out counter is reset. We recommend that you configure more than one LDAP server to provide redundancy for user authentication.	Minimum of one server is required.
Active Directory domain	Enter the domain name of the domain where the user accounts are defined. The name of the domain can be in one of the following formats: FQDN: corp.contoso.com Distinguished name: DC=corp,DC=contoso,DC=com	Optional if Use Global Catalog (GC) has not been selected.
Use global catalog	If your LDAP servers are also configured to be global catalog servers, select the Use Global Catalog (GC) option and you do not need to specify an Active Directory domain name. To use the Change Password option, this option must not be selected.	Optional. Note   The Password Management feature does not work when an LDAP server set is configured with this property.
Connect LDAP servers over secure connection	Select the Connect LDAP servers over secure connection option, if you want the connection between the ISA Server computer and the LDAP server to be encrypted via SSL. For more information about enabling LDAP over SSL, see "How to Enable LDAP over SSL with a third-party certification authority" at the Microsoft Help and Support Web site.	Optional. Note: To use the Change Password option, this option must be selected.
User name and password	This option is only required if you want to use the Password Management option with forms-based authentication. Because the ISA Server computer will not be a member of the domain, you need to specify a user name and password that will be used for verifying user account status. This account can be any domain account, even a restrictive user account. This account is used by the ISA Server computer to bind to the LDAP server and query the properties of the user who is logging on. This account is not involved when changing the user's password.	Optional.

Login expression

Before you begin

Update the following table with information about the LDAP server set and login expressions.

Item	Value
LDAP server set	Name: _________________
Server name	Name: ___________________ or IP address: ___.___.___.___
Active Directory domain name	FQDN or distinguished name: _____________________________
Use global catalog	Yes or no (circle one)
Connect LDAP servers over secure connection	Yes or no (circle one) Note: If you have selected to connect over a secure connection, confirm that the proper certificates have been installed.
User name and password	User name: ______________ Password: ________________
Login expression	__________________ For example: corp\*

To create an LDAP server set, see Create an LDAP server set.

Note:
Use the LDP.exe tool to test the connectivity between the ISA Server computer and the LDAP server. LDP.exe, by default, is located in the following location: %PROGRAMFILES%\Support Tools directory.

Windows SharePoint Services is a technology that allows teams to create Web sites for information sharing and document collaboration, benefits that help increase individual and team productivity. Windows SharePoint Services is a component of the Windows Server 2003 information worker infrastructure and provides team services and sites to the Microsoft Office System and other desktop programs. It also serves as a platform for application development. Including such information technology (IT) resources as portals, team workspaces, e-mail, presence awareness, and Web-based conferencing, Windows SharePoint Services enables users to locate distributed information quickly and efficiently, as well as connect to and work with others more productively.

For more information about Windows SharePoint Services, see "Windows SharePoint Services in Windows Server 2003" at the Microsoft TechNet Web site.

Office SharePoint Server 2007 is a product that enables enterprises to develop an intelligent portal that seamlessly connects users, teams, and knowledge so that people can take advantage of relevant information across business processes to help them work more efficiently. Office SharePoint Server 2007 provides an enterprise business solution that integrates information from various systems into one solution through single sign on and enterprise application integration capabilities, with flexible deployment options and management tools. The portal facilitates end-to-end collaboration by enabling aggregation, organization, and search capabilities for people, teams, and information. Users can find relevant information quickly through customization and personalization of portal content and layout, as well as by audience targeting. Organizations can target information, programs, and updates to audiences based on their organizational role, team membership, interest, security group, or any other membership criteria that can be defined.

Office SharePoint Server 2007 uses Windows SharePoint Services sites to create portal pages for people, information, and organizations. The portal also extends the capabilities of Windows SharePoint Services sites with organization and management tools, and enables teams to publish information in their sites to the entire organization.

For more information about Office SharePoint Server, see the Office SharePoint Server home page.

To properly configure alternate access mapping settings, you need the software versions discussed in the following table.

You can configure alternate access mapping:

• Configuration of alternate access mapping for Windows SharePoint Services can be done from a command prompt with the Stsadm.exe command or from the Windows SharePoint Services 3.0 Central Administration site.
  
• Configuration of alternate access mapping for Office SharePoint Server is done via Central Administration for the Office SharePoint Server Web administration.
  

Scenario