About delegation of credentials
[This topic is pre-release documentation and is subject to change in future releases. Blank topics are included as placeholders.]
In Web publishing scenarios, Forefront TMG can validate the client's credentials and then forward or delegate the credentials to the published server for authentication. The following authentication delegation options are available:
No delegation, and client cannot authenticate directly
No delegation, but client may authenticate directly
Basic authentication
NTLM authentication
Negotiate (Kerberos/NTLM)
RSA SecurID
Kerberos constrained delegation
Note
The delegation methods available vary according to the type of publishing rule you create and the type of authentication used by the Web listener.
No delegation, and client cannot authenticate directly
No credentials are passed to the published server. If the published server requires authentication, a Forefront TMG alert is triggered.
No delegation, but client may authenticate directly
Forefront TMG passes the user's credentials to the published server without performing any additional action. The client and the published server then negotiate the authentication. This is typically used in a scenario where the published server requires some proprietary form of authentication.
Note
When this option is selected in a Web publishing rule and the Web listener is configured to apply no authentication and not to require all users to authenticate, Forefront TMG blocks HTTP requests for the published Web site and returns error 403 (Forbidden), even if the Web site does not require authentication.
Basic authentication
In Basic authentication, credentials are forwarded in plaintext to the published server that requires credentials. If authentication fails, Forefront TMG prompts the user for authentication according to the authentication type configured on the Web listener. If the published server requires a different type of credentials, a Forefront TMG alert is triggered.
NTLM authentication
In NTLM delegation, Forefront TMG delegates the credentials by using the NTLM challenge/response authentication protocol. If authentication fails, Forefront TMG provides the Web server's failure notice to the client. If the published server requires a different type of credentials, a Forefront TMG alert is triggered.
Negotiate (Kerberos/NTLM)
When you select Negotiate as a delegation method, Forefront TMG first attempts to obtain a Kerberos ticket for the client from the domain controller. If Forefront TMG does not receive the Kerberos ticket, it uses the negotiate scheme to delegate the credentials by using NTLM. If Forefront TMG receives the Kerberos ticket, it uses the negotiate scheme to delegate the credentials by using Kerberos. If authentication fails, Forefront TMG provides the Web server's failure notice to the client. If the published server requires a different type of credentials, a Forefront TMG alert is triggered.
Note
The default service principal name used to obtain the ticket is http/internalsitename. In the case of a server farm, the service principal name is the name of the farm. The default service principal name can be changed in Forefront TMG Management on the Authentication Delegation tab of the rule.
RSA SecurID
When a client provides SecurID credentials, you can use SecurID delegation. Forefront TMG passes the proprietary SecurID cookie to the published server. Note that Forefront TMG and the published server must have the same domain secret and cookie name.
Kerberos constrained delegation
With the other types of delegation, Forefront TMG can delegate credentials only when client credentials are received by using Basic or forms-based authentication. With Kerberos constrained delegation, Forefront TMG can accept other types of client credentials, such as client certificates. Forefront TMG must be enabled on the domain controller in order to use Kerberos constrained delegation (constrained to a specific service principal name).
If authentication fails, Forefront TMG provides the Web server's failure notice to the client. If the published server requires a different type of credentials, a Forefront TMG alert is triggered.
Note
Use of Kerberos constrained delegation requires that you configure Active Directory to recognize Forefront TMG as trusted for delegation.
The default service principal name used to obtain the ticket is http/internalsitename. In the case of a server farm, the service principal name is the name of the farm. The default service principal name can be changed in Forefront TMG Management on the Authentication Delegation tab of the rule.Valid combinations of client credentials and delegation methods
Specific delegation methods are valid for different types of client credentials. The following table summarizes the valid combinations.
| Receipt of client credentials | Authentication provider | Delegation | Comments |
|---|---|---|---|
Forms-based authentication Basic |
Active Directory LDAP (Active Directory) RADIUS |
No delegation, but client may authenticate directly No delegation, and client cannot authenticate directly Basic NTLM Negotiate Kerberos constrained delegation |
Single sign-on is supported for forms-based authentication, but not for Basic authentication. An additional client certificate can be required (two-factor authentication). |
Digest Integrated |
Active Directory |
No delegation - allow end-to-end delegation No delegation - do not allow end-to-end delegation Kerberos constrained delegation |
None |
HTML form with one-time password |
SecurID RADIUS one-time password |
No delegation, but client may authenticate directly No delegation, and client cannot authenticate directly Kerberos constrained delegation |
Single sign-on is supported. |
HTML form with collection of additional credentials |
SecurID RADIUS one-time password |
No delegation, but client may authenticate directly No delegation, and client cannot authenticate directly Basic NTLM Negotiate Kerberos constrained delegation |
Single sign-on is supported. |
Client certificate |
Active Directory |
No delegation, but client may authenticate directly No delegation, and client cannot authenticate directly Kerberos constrained delegation |
none |
For more information about authentication in Forefront TMG, see
Overview of client authentication.
Copyright © 2009 by Microsoft Corporation. All rights reserved.