Presentation on theme: "Dynamic Access Control Deep Dive Siddharth Bhai Program Manager, Active Directory Microsoft Corporation Matthias Wollnik Program Manager, File Server Microsoft."— Presentation transcript:
Dynamic Access Control Deep Dive Siddharth Bhai Program Manager, Active Directory Microsoft Corporation Matthias Wollnik Program Manager, File Server Microsoft Corporation
User claims User.Department = Finance User.Clearance = High ACCESS POLICY Applies = High Allow | Read, Write | if AND == True) Device claims Device.Department = Finance Device.Managed = True Resource properties Resource.Department = Finance Resource.Impact = High AD DS 4 Expression-based access policy File Server
User and computer attributes can be used in ACEs User and Device Claims ACEs with conditions, including Boolean logic and relative operators Expression-Based ACEs File classifications can be used in authorization decisions Continuous automatic classification Automatic RMS encryption based on classification Classification Enhancements Central authorization/audit rules defined in AD and applied across multiple file servers Central Access and Audit Policies Allow users to request access Provide detailed troubleshooting info to admins Access Denied Assistance
Restricted to making policy decisions based on the user’s group memberships Shadow groups are often created to reflect existing attributes as groups Groups have rules around who can be members of which types of groups No way to transform groups across AD trust boundaries No way to control access based on characteristics of user’s device Pre-2012: Security Principals Only Selected AD user/computer attributes are included in the security token Claims can be used directly in file server permissions Claims are consistently issued to all users in a forest Claims can be transformed across trust boundaries Enables newer types of policies that weren’t possible before: Example: Allow Write if User.MemberOf(Finance) and User.EmployeeType=FullTime and Device.Managed=True Windows Server 2012: Security Principals, User Claims, Device Claims
Led to group bloat Consider 500 projects, 100 countries, 10 divisions 500,000 total groups to represent every combination: ProjectZ UK Engineering Users ProjectZ Canada Engineering Users [etc…] Pre-2012: ’OR’ of groups only ACE conditions allow multiple groups with Boolean logic Example: Allow modify IF MemberOf(ProjectZ) AND MemberOf(UK) AND MemberOf(Engineering) 610 groups instead of 500,000 Windows Server 2012: ‘AND’ in expressions 3 User Claims Windows Server 2012: with Central Access Policies
Resource Property Definitions
FCI In-box content classifier 3 rd party classification plugin See modified / created file Save classification
Resource Property Definitions FCI In-box content classifier 3 rd party classification plugin See modified / created file Save classification For Security
Resource Property Definitions FCI In-box content classifier 3 rd party classification plugin File Management Task See modified / created file Match file to policy Save classification For Security
Resource Property Definitions FCI In-box content classifier 3 rd party classification plugin File Management Task See modified / created file Save classification For Security Match file to policy
Partner video Strong Classification - with CA Dataminder
Supercharge DAC with automated file classification Enables accurate automated file classification enterprise-wide with both attribute-based and content-based classification Deeply integrated with Windows Server dg classification can also be used to fuel powerful Governance, Compliance and Archiving solutions For more information visit us at Booth 230 (Orlando) / PP17 (Amsterdam) or at A leader in automatic file classification
Partner video Strong Classification - with Dataglobal
Share PermissionsNTFS Permissions Access Control Decision File Access
File/Folder Security Descriptor Central Access Policy Reference NTFS Permissions Active Directory (cached in local Registry) Cached Central Access Policy Definition Access Control Decision: 1)Access Check – Share permissions if applicable 2)Access Check – File permissions 3)Access Check – Every matching Central Access Rule in Central Access Policy Share Security Descriptor Share Permissions Cached Central Access Rule
Rule 4 Rule 1 Rule 3 Rule 2 File Server Policy A Rule 1 Link Rule 2 Link Rule 3 Link Policy B Rule 1 Link Rule 3 Link Policy C Rule 2 Link Rule 4 Link Group Policy Object File Server
Partner video Who has access to what? - easier with DAC & Jiji Technologies
User claims Clearance = High | Med | Low Company = Contoso | Fabrikam User claims Clearance = High | Med | Low Company = Contoso | Fabrikam Resource properties Department = Finance | HR | Engg Impact = High | Med | Low Resource properties Department = Finance | HR | Engg Impact = High | Med | Low Current Central Access policy for high impact data Applies = High Allow | Full Control | == Contoso Current Central Access policy for high impact data Applies = High Allow | Full Control | == Contoso Staging policy Applies = High Allow | Full Control | if == Contoso) AND == High) Staging policy Applies = High Allow | Full Control | if == Contoso) AND == High)
Demo Central Access Policies with Staging Policies
Proposed Central Access Policy does not grant the same access permissions as the current Central Access Policy Subject: Security ID: CONTOSODOM\alice Account Name: alice Account Domain: CONTOSODOM Object: Object Server: Security Object Type: File Object Name: C:\FileShare\Finance\FinanceReports\FinanceReport.xls Current Central Access Policy results: Access Reasons: READ_CONTROL: Granted by Ownership ReadAttributes: Granted by D:(A;ID;FA;;;BA) Proposed Central Access Policy results that differ from the current Central Access Policy results: Access Reasons: READ_CONTROL: NOT Granted by CAR “HBI Rule” ReadAttributes: NOT Granted by CAR “HBI Rule”
Enterprise-wide visibility into server and application health
Pre-2012 Token User Account User Groups [other stuff] 2012 Token User Account UserGroups Claims DeviceGroups Claims [other stuff]
NT Access Token Contoso\Alice User Groups:…. Claims: Title=SDE Kerberos Ticket Contoso\Alice User Groups:…. Claims: Title=SDE File Server UserContoso DC Ad Admin Enable Domain to issue claims Defines claim types Claim type Display Name Source Suggested values Value type User attempts to login Receives a Kerberos ticket Attempt to access resource
User M-TGT Pre-Windows 2012 File Server Contoso DC Pre-Windows 2012
User M-TGT U-TGT Pre-Windows 2012 File Server Contoso DC Pre-Windows 2012
User M-TGT TGS (no claims) U-TGT Pre-Windows 2012 File Server Contoso DC Pre-Windows 2012
User M-TGT TGS (no claims) U-TGT Pre-Windows 2012 File Server Contoso DC Pre-Windows 2012 ?
File Server UserContoso DC M-TGT TGS (with User Claims) U-TGT
File Server UserContoso DC M-TGT TGS (with User Claims) U-TGT ?
File Server Pre-Windows 8 User Contoso DC Set Policy to enable claims
File Server Contoso DC M-TGT TGS (no claims) U-TGT Pre-Windows 8 User
File Server Contoso DC M-TGT TGS (no claims) U-TGT Pre-Windows 8 User
File Server Contoso DC M-TGTU-TGT TGS (with User Claims) TGS (no claims) Pre-Windows 8 User ?
File Server UserContoso DC M-TGT TGS (User and Device Groups/Claims) U-TGT
File Server UserContoso DC M-TGT TGS (User and Device Groups/Claims) U-TGT ?
File Server UserContoso DC Other Forest DC Publish Cross- Forest transformation Policy
File Server UserContoso DC M-TGT Referral TGT U-TGT Other Forest DC
File Server UserContoso DC M-TGT TGS (with claims) U-TGT Referral TGT Other Forest DC
File Server UserContoso DC M-TGT TGS (with claims) U-TGT Other Forest DC ?
UserContoso DC M-TGT TGS U-TGT ADFS Cloud App
UserContoso DC M-TGTU-TGT ADFS Cloud App
UserContoso DC M-TGTU-TGT ADFS Cloud App SAML TGS
UserContoso DC M-TGT SAML U-TGT ADFS Cloud App ?
First Claim 1 Boolean Claim Adds 242 Bytes User Claims Set 5 Claims: 1 Boolean 1 Integer 2 String – Single Valued Avg Len/value: 12 chars 1 String – Multi Valued Avg Len/value: 12 chars Avg #Values: 6 values Adds 970 Bytes Compound-ID Claims Sets User - 5 Claims: 1 Boolean 1 Integer 2 String – Single Valued Avg Len/value: 12 chars 1 String – Multi Valued Avg Len/value: 12 chars Avg #Values: 6 values Device - 2 Claims: 1 Boolean 1 String – Single Valued Avg Len/value: 12 chars Adds 1374 Bytes of Claims Data + Computer Group’s AuthZ Data Worst-Case Analysis (assumes no compression): Gives us confidence that claims and compound-ID should not result in huge spikes of ticket sizes in most environments. Bytes Before Compression 120user overhead 120device overhead 114per int/bool claim 8per int/bool value 138 per string claim 2 per string character
Windows Server 2012 Active Directory Windows Server 2012 File Server End User Microsoft SharePoint 2010 Access Policy ? ?
Partner video Using Central Access Policies beyond File Server: Sharepoint
Policy AuthorFile Server Active Directory User 1. Author policy & export to AD 2. Convert XACML to SDDL & import 3. Push out imported rules based on group policy 4. Access files 5. Check access based on rules previously defined in APS Axiomatics Policy Server (APS)
Partner video Using Central Access Policies beyond Windows: XACML
Current infrastructure Windows Server 2012 File Servers Access and Audit Policies based on security groups and file tagging Windows Server 2012 DCs Centrally defined access and audit policies User claims can be used by access and audit policies Windows 8 clients Add device claims to access and audit policies Better access denied experience Partner solutions and line of business applications
Reduce group complexity
Enable Information Governance on File Servers
Implement effective access control
QnA Siddharth Bhai Matthias Ask away!
SIA 207 – Windows Server 2012 Dynamic Access Control Overview SIA 341 – Windows Server 2012 Dynamic Access Control Deep Dive for Active Directory and Central Authorization Policies SIA 316 – Windows Server 2012 Dynamic Access Control Best Practices and Case Study Deployments in Microsoft IT WSV334 – Windows Server 2012 File and Storage Services Management SIA21-HOL – Using Dynamic Access Control to Automatically and Centrally Secure Data in Windows Server 2012 SIA02-TLC – Windows Server 2012 Active Directory and Dynamic Access Control Find Me Later At…
Talk to our Experts at the TLC #TE(sessioncode) DOWNLOAD Windows Server 2012 Release Candidate microsoft.com/windowsserver Hands-On Labs DOWNLOAD Windows Azure Windowsazure.com/ teched
Connect. Share. Discuss. Learning Microsoft Certification & Training Resources TechNet Resources for IT Professionals Resources for Developers
Required Slide Complete an evaluation on CommNet and enter to win!
Scan the Tag to evaluate this session now on myTechEd Mobile