Re: How does IAS authenticate using Active Directory

From: Andrew (abartlem_at_vasco.com)
Date: 11/25/04 

Date: 25 Nov 2004 14:45:22 -0800

now since we now know that IAS needs to retreive the user's password
in some form from the operating system, how does IAS retrieve this
password from Active Directory?

"Sam Salhi [MSFT]" <samers@online.microsoft.com> wrote in message news:<uZ#77ok0EHA.2156@TK2MSFTNGP10.phx.gbl>...
> It's well documented how the password is transmitted. Once IAS gets that, it
> uses that password to authenticate the users
>
> from RFC2865:
> For CHAP, the NAS generates a random challenge (preferably 16 octets)
> and sends it to the user, who returns a CHAP response along with a
> CHAP ID and CHAP username. The NAS then sends an Access-Request
> packet to the RADIUS server with the CHAP username as the User-Name
> and with the CHAP ID and CHAP response as the CHAP-Password
> (Attribute 3). The random challenge can either be included in the
> CHAP-Challenge attribute or, if it is 16 octets long, it can be
> placed in the Request Authenticator field of the Access-Request
> packet. The NAS MAY include the Attributes Service-Type = Framed-
> User and Framed-Protocol = PPP as a hint to the RADIUS server that
> PPP service is expected.
>
>
>
> The RADIUS server looks up a password based on the User-Name,
> encrypts the challenge using MD5 on the CHAP ID octet, that password,
> and the CHAP challenge (from the CHAP-Challenge attribute if present,
> otherwise from the Request Authenticator), and compares that result
> to the CHAP-Password. If they match, the server sends back an
> Access-Accept, otherwise it sends back an Access-Reject.
>
>
>
>
> In other words, the RADIUS server MUST have the password at hand to
> authenticate the user. in both cases.
> (in pap Radius has the actual password, in chap, Radius uses the hash, which
> it uses to compare with the hash it knows)
>
> --
> =============================================
> This posting is provided "AS IS" with no warranties, and confers no rights
>
> Join us on Nov 29th 1:00 to 2:00 PM PST, for an online webchat on "Using and
> troubleshooting RADIUS using IAS"
> This chat will help you resolve all of your RADIUS/IAS issues. You can ask
> about RADIUS, IAS, 802.1x, Active directory configuration and Certificate
> services, related to IAS and RADIUS
> Follow this link to join the chat
> http://www.microsoft.com/communities/chats/default.mspx#04_Nov29_IAS_RADIUS
> =============================================
>

Relevant Pages

  • Re: How does IAS authenticate using Active Directory
    ... For CHAP, the NAS generates a random challenge ... packet to the RADIUS server with the CHAP username as the User-Name ... placed in the Request Authenticator field of the Access-Request ... troubleshooting RADIUS using IAS" ...
    (microsoft.public.internet.radius)
  • Re: VPN3005 IPSEC Access Control
    ... do you have an IAS RADIUS server in your forest? ... -- create an AD group called VPN Users ...
    (comp.dcom.sys.cisco)
  • Re: help in using IAS as RADIUS Server
    ... Almost all Radius compliant clients are supported in IAS, ... > standard edition as RADIUS Server ...
    (microsoft.public.internet.radius)
  • Re: How does IAS authenticate using Active Directory
    ... IAS does not, IAS forwards the creds ... troubleshooting RADIUS using IAS" ... >> For CHAP, the NAS generates a random challenge ... >> packet to the RADIUS server with the CHAP username as the User-Name ...
    (microsoft.public.internet.radius)
  • Re: Radius server in a DMZ, how to authenticate AD users ?
    ... requirement - the firewall considerations part of TechNet concerns a firewall between RADIUS clients and IAS. ... There's no need to host IAS on DMZ. ... Windows Server 2003 Technical Library> Planning for IAS as a RADIUS ... Is there a way to add the Radius server in a DMZ without being member ...
    (microsoft.public.windows.server.security)