Re: AD/AM userCertificate autoenrolement

From: Dmitri Gavrilov [MSFT] (dmitrig_at_online.microsoft.com)
Date: 05/28/04 

Date: Thu, 27 May 2004 22:15:21 -0600

ADAM users only make sense inside ADAM. Windows does not know about ADAM.
You can not authenticate as an ADAM user and access resources outside of
ADAM.

However, if you have a Windows user that has the same cert, then you can
authenticate to Windows with this cert. But you don't need ADAM in this
case. 

-- 
Dmitri Gavrilov
SDE, Active Directory Core
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
"Sasi" <anonymous@discussions.microsoft.com> wrote in message
news:206EE725-E0BE-4857-B33F-639EBA2FC824@microsoft.com...
>
>      The question is "Can we store user objects in ADAM with their X509
certificates  and use those certificates for access to
>      other Extranet services requiring   client authentication" or "when
some one authenticates the user in ADAM can these
>      certficate verify the authenticity of the user using the certificate
it stored with the certficate on the user machine". We
>      are planning to deploy it but before   deploying I want this
clarified. Sorry if my questions  is not making any sense
>      as I am new to this environment.
>
>      ----- Lee Flight wrote: -----
>
>      Is the question that you are asking "Can we store user objects in
ADAM with
>      their certificates
>      and use those certificates for access to other Extranet services
requiring
>      client authentication?"
>      or "Can we use ADAM to issue (autoenroll) certificates to users?" or
>      something else
>
>      Lee Flight
>
>
>      "Sasi" <anonymous@discussions.microsoft.com> wrote in message
>      news:635FE04A-C757-4394-A5D1-28F7DB37BECC@microsoft.com...
>      > Lee,
>      >> I think what ever you told is relevent, actually we deployed AD/AM
in the
>      Extranet Enviroment and we store the third party users onto the
AD/AM. Now
>      we want to make use of the user certificates. How can we use the user
>      certficates for the third party and the domain users in this scenario
apart
>      from the LDAP certificates.
>      >> Thanks,
>      > Sasi
>
>
>

Relevant Pages

  • Re: ADAM & SASL Bind for Windows Security Principals
    ... There are really three bind authentication things you can do with ADAM: ... - Use simple bind to authenticate an ADAM user ... Use simple bind to authenticate Windows user who is configured as a bind ...
    (microsoft.public.windows.server.active_directory)
  • Re: Security Logging in ADAM
    ... How does an anonymous login authenticate anyone? ... If a bind was performed against ADAM, there should be a matching audit event ... in the security event log on the ADAM machine assuming that logon events are ...
    (microsoft.public.windows.server.active_directory)
  • Re: ADAM Authentication
    ... The client app in question is the Windows Address Book. ... Joe Kaplan wrote: ... The ADAM ADSI editor ... then ADAM would be able to authenticate users from HOME. ...
    (microsoft.public.windows.server.active_directory)
  • Re: ADAM Authentication
    ... The ADAM ADSI editor ... then ADAM would be able to authenticate users from HOME. ... if I attempt to bind to the ADAM instance using that same ... Lets say my domain username is CAMPUS/aaron. ...
    (microsoft.public.windows.server.active_directory)
  • Re: ADAM & SASL Bind for Windows Security Principals
    ... - Use simple bind to authenticate an ADAM user ... Use simple bind to authenticate Windows user who is configured as a bind ... proxy object in ADAM ...
    (microsoft.public.windows.server.active_directory)