Understanding Delegation of authentication

When we discuss authentication, or the process of verifying identity in order to grant access, we usually think about users and computers needing to be authenticated. However, when services (programs that provide functionality to support other programs) need to access network resources to do their jobs, they also must be authenticated. If they didn’t, this would create a huge security hole that could be exploited.

Service can impersonate user or computer accounts to gain the access they need; when they are allowed to do so, they’re said to be trusted for delegation. Then that service can use other network services by impersonating a user. 

Only administrators who have the privilege Enable computer and user accounts to be trusted for delegation can set up delegation. Domain admins and Enterprise admins have this privilege. The procedure for allowing a user to be trusted for delegation depends on the functionality level of the domain. In either a Windows 2000 native or Windows Server 2003 functional level, you do this in Active Directory Users and Computers (ADUC) tool by selecting the Users container, right clicking the user account you want to trust for delegation, and clicking Properties. The difference lies in the tab that is used: in a Windows Server 2003 domain, it is the Delegation tab; in a Windows 2000 native domain, it is the Account tab. In either case, you simply check the Account is trusted for delegation checkbox.

Where’s the Delegation tab?

In the case of Windows Server 2003 functional level, you won’t see a Delegation tab if there is no Service Principal Name (SPN) registered for the account. Normally, SPNs are only registered for service accounts. Regular user accounts don’t have an SPN by default, but you can register one using the Setspn tool that is included in the Support Tools on the Windows Server 2003 installation CD.

To do this, you’ll need to first install the Support Tools if you haven’t already done so. Then open a command prompt and type setspn. This will show you the syntax and switches for the command.

You’ll need to use the –A switch to add an arbitrary SPN, and select a name for the SPN to be registered, and then type the account name, as in this example:

Setspn –A http/bobjones bob

In this example, “http/bobjones” is the SPN and bob is the user’s account name in Active Directory.

The output of this command is shown in Figure A.

FIGURE A

Trusting the Account for Delegation

You can trust the account for delegation to any service, or to one or more specific services, as shown in Figure B. If you trust the account for delegation to a specific service, you can specify that only Kerberos authentication be used, or you can allow any authentication protocol to be used.

FIGURE B

If you choose to trust to specific services, you’ll need to add the service(s) by clicking the Add button. Then select the computer name of the computer on which the service is running, and select the service(s) to which you want to delegate from the list, as shown in Figure C.

FIGURE C