8.6 Authentication

8.6 Authentication

1. The process of identity verification

   • When a user attempts to log on, the logon process interacts with the Local Security Authority (LSA) and Active Directory in order to determine if the user is legitimate
     • If so the LSA generates an access token for that user
       • User may need to use a number of system resources or applications and the validity of requests is determined by the security reference monitor and its decision is enforced by the object manager

2. Windows uses Kerberos as the default authentication mechanism for domain logon and network authentication

   • A kerberos key distribution centre is installed on every domain controller
     • Every windows machine includes a Kerberos client

3. Interactive logon

   • Requires an individual to enter credentials based on a shared secret, IE username / password, biometric or token
   • Uses the Winlogon process and an authentocation package to talk to AD
     • Example of an authentication package is GINA DLL (Graphical Identification and Authentcation Dynamic Link Library
       • GINA collects authentication info and performs authentication checks
         • Passes auth information to the LSA, LSA talks to Kerberos auth package and interrogates AD to confirm the login credentials
           • If successful the LSA creates the token which is subsequently used for any process the user runs in order to perform access checks
   • See diagram on pg 16

4. Kerberos

   • Steps + Diagram on Pg 16,17, Detail from NetSec 4.11,12
   • Used to authenticate users and facilitate access to network resources
   • Provides either 1 way or mutual authentication between parties