GlobalSign Enterprise Solutions

Transcription

1 GlobalSign Enterprise Solutions Two Factor Authentication for SharePoint User Guide GlobalSign Enterprise PKI for Strong Two Factor Client Authentication using Windows SharePoint

2 INTRODUCTION Microsoft SharePoint is a powerful tool that allows users to access and share a wide array of important information. Protecting this information is essential, ensuring that it is only viewed and shared by users that have been granted access to the information. Passwords alone are a notoriously weak form of security. Unsigned network traffic is susceptible to replay attacks in which an intruder intercepts the authentication attempt and the issuance of a ticket. The intruder can reuse the ticket to impersonate the legitimate user. Additionally, unsigned network traffic is susceptible to man in the middle attacks in which an intruder captures packets between the client and the server, changes the packets, and then forwards them to the server. If this occurs on an LDAP server, an attacker can cause a server to make decisions that are based on forged requests from the LDAP client. Implementing two factor authentication using Active Directory Active Directory can be used to store client certificates, which can then be used to set up dual factor authentication into SharePoint and other Windows products. When a user tries to access a SharePoint site, the server will ask the user to provide a certificate for authentication. The provided certificate is then cross referenced with the certificate stored for that user in Active Directory. If these match, the user is then allowed access to the login screen. GlobalSign Two Factor Authentication for SharePoint Solution Guide v1.0 2

3 Using GlobalSign Enterprise PKI to issue, manage, and implement client certificates for two factor authentication. epki LDIF Active Directory Importing your certificates into Active Directory is an easy process if you have an epki account through GlobalSign. You can create custom templates to export into an LDIF file. The LDAP Data Interchange Format (LDIF) is a standard plain text dataa interchangee format for representing LDAP (Lightweight Directory Access Protocol) directory content and update requests. In other words, it is the standard file format for importing and exporting Active Directory objects. GlobalSign Two Factor Authentication for SharePoint Solution Guide v1.0 3

4 Using the LDIFDE command in Windows command prompt, you can import an LDIF file into Active Directory. This can be used to add/ subtract users, amend current data, etc. LDIF can be used to export and import data, allowing batch operations such as Add, Modify, and Delete to be performed in Active Directory. A utility called LDIFDE is included in the Windows R2 operating systems to support batch operations based on the LDIF standard. Using the LDIFDE Utility The LDAP Data Interchange Format (LDIF) is an Internet draft standard for a file format that can be used for performing batch operations on directories that conform to the LDAP standards. LDIF can be used to export and import data, allowing batch operations such as Add, Modify, and Delete to be performed in Active Directory. A utility called LDIFDE is included in the Windows operating system to support batch operations based on the LDIF standard. It is possible to map (or create an association from) a certificate that has been issued to a user to the user'ss account. A server application can then use public key cryptography to authenticate the user using this certificate. If the user is authenticated, then the user's account is logged on. The end result is the same as if the user provided a user ID and password, yet the process is much more manageable. GlobalSign Two Factor Authentication for SharePoint Solution Guide v1.0 4

5 Traditionally, computer systems have used a centralized accounts database to manage users, their user rights, and their access controls. This technique has worked well and is well understood. However, as systems become more and more distributed with hundreds of thousands to millions of users this form of centralized control becomes unwieldy. The problems range from trying to verify an account against a database located on the other side of the Internet to administering a lengthy list of users. Public key certificates can help simplify these problems. Certificates can be widely distributed, issued by numerous parties, and can be verified by simply examining the certificate, without having to refer to a centralized database. However, existing operating systems and administration tools can only deal with accounts, not certificates. The simple solution one that maintains the advantages of both certificates and user accounts is to create a mapping between a certificate and a user account. This allows the operating system to continue using accounts while the larger "system" and the user use certificates. In this model, when a user presents a certificate, the system looks at the mapping to determine which user account should be logged on. (Note that this should not be confused with logging on with a smart card. Windows Server 2003, Standard Edition; Windows Server 2003, Enterprise Edition; and Windows Server 2003, Datacenter Edition support logging on with a smart card using account mapping that is automatic.) GLOBALSIGN CONTACT INFORMATION GlobalSign Americas Tel: sales us@globalsign.com GlobalSign EU Tel: sales@globalsign.com GlobalSign UK Tel: sales@globalsign.com GlobalSign FR Tel: ventes@globalsign.com GlobalSign DE Tel: verkauf@globalsign.com GlobalSign NL Tel: verkoop@globalsign.com GlobalSign Two Factor Authentication for SharePoint Solution Guide v1.0 5