Re: Authentication filter

Tech-Archive recommends: Fix windows errors by optimizing your registry

From: David Wang [Msft] (someone_at_online.microsoft.com)
Date: 10/07/04 

Date: Thu, 7 Oct 2004 15:51:18 -0700

> Is there a simple way to configure IIS 6.0?
> What about authentication firewall that is available on the
> external trust in windows 2003 domains? How do I
> configure IIS to take advantage of the authentication firewall?

The fundamental conflict is that IIS has no way to determine whether an
authentication attempt is made by an internal or external user until AFTER
authentication is complete, but your security guidelines state that this
authentication attempt must be restricted -- i.e. internal user must go
through internal portal and not external portal.

Thus, it seems that you need to make it impossible for internal users to see
the external WSS portal. Period. This assures you that internal users can
only use the internal WSS portal because they cannot even see (much less
authenticate against) the external portal.

I suggest IP Security Policy to either block internal clients from seeing
the IP of the external WSS portal, or have the external WSS portal block all
internal IPs (or IPs from the proxy server). 

-- 
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"doc pisapati" <docpisapati@discussions.microsoft.com> wrote in message
news:52667544-6D15-43A8-9FAE-9DA9F692D980@microsoft.com...
oops.. I mean that
...All internal users have to access internal virtual server via VPN or
intranet.
sorry about that.
"doc pisapati" wrote:
> Hello David,
>                   I have two WSS virtual servers (one for external and one
> for internal). I have a dedicated domain for the external users
> authentication that trusts internal users domain. Both virtual servers
access
> same content database. However, from our security guidelines, I want to
> restrict the authentication (not just access rights) of internal users on
> external virtual server. All internal users have to come via internal
virtual
> server (that is opened to VPN or internet).
>
> Is there a simple way to configure IIS 6.0? What about authentication
> firewall that is available on the external trust in windows 2003 domains?
How
> do I configure IIS to take advantage of the authentication firewall?
>
> Thanks in advance,
> doc
>
> "David Wang [Msft]" wrote:
>
> > Based on your description, it is not possible.
> >
> > How do you plan to determine the user's identity and domain/forest
> > membership BEFORE IIS authenticates and obtains a user identity?
> >
> > What are you actually trying to do?
> >
> > -- 
> > //David
> > IIS
> > This posting is provided "AS IS" with no warranties, and confers no
rights.
> > //
> > "doc pisapati" <doc pisapati@discussions.microsoft.com> wrote in message
> > news:F8D8C293-D215-4C6C-AAB2-63FB034E1DEC@microsoft.com...
> > I think that we can write an ISAPI filter to do some filtering before
IIS
> > authenticates. I want to restrict a particular domain users in a forest
> > trust. I would appreciate if someone can point me to the right ISAPI
filter
> > code.
> >
> > Thanks
> > doc
> >
> >
> >

Relevant Pages

  • Re: WM5 can not sync to exchange
    ... I checked all the authentication settings and they are as you requested. ... After running the internet connection wizard I had to uncheck the Require ... On the SBS 2003 Server open the Server Management console. ... Open IIS Manager ...
    (microsoft.public.windows.server.sbs)
  • IIS (ASP) -> SQLServer Authentication Issue
    ... IIS 6 machine serving ASP pages, integrated authentication, machine ... I want the ASP pages to access the SQLServer machine using the ... When researching this issue again on the Internet I did not find many people ...
    (microsoft.public.sqlserver.security)
  • Re: 401 error for user that used to logon fine
    ... Was over the Internet and you were right. ... > Why are you getting prompted by NTLM? ... How IIS Authenticates Browser Clients ... > Directory with Integrated Authentication ONLY -or- NTFS permissions ...
    (microsoft.public.inetserver.iis.security)
  • Re: setting up a webshare
    ... >>I have a folder i'd like to make available across the internet. ... >> it connects fine and displays the user authentication dialog box. ... > (A web share is really an IIS virtual directory.) ...
    (microsoft.public.inetserver.iis)
  • Re: Authentication filter
    ... authentication that trusts internal users domain. ... Both virtual servers access ... Is there a simple way to configure IIS 6.0? ...
    (microsoft.public.inetserver.iis)