在Active Directory域中为WCF配置加密算法

Question

Scenario: A WCF Client/Server application running on an Active Directory domain using NetTcp, Transport Security, and Windows Authentication. I understand how this works behind the scenes with SSPI, and how it by default does transport layer encryption. It is also my understanding that the encryption parameters, such as what algorithm, are configured in the domain.

Question: How, in this scenario, would I configure my Active Directory domain to use different algorithms? I don't necessarily want my app to specify a specific algorithm; I'm happy with Windows Authentication doing the heavy lifting for me in this scenario. However, I need to be able to tell the customer how to configure their policies to use their selected algorithm, or at least look into their policies to determine what algorithm they're using today.

To be clear: I don't want to use Certificate Authentication. I really want to stay with Windows authentication.

Answer 1

Since kerberos is the default authentication protocol method used with Active Directory, I would focus on adjusting (if need be) the encryption methods used for Kerberos. Since Windows 2008 R2 active-directory , AES256-SHA1 has been the default encryption algorithm for Kerberos. Though with SSPI Windows authentication, it is possible that ntlm might be the authentication protocol used, that is highly unlikely today in 2018.

To tell which authentication and encryption method you are using, and if you are using Windows 10, from a command prompt type: klist . The output will show the resource connected to, and the encryption method used. If you connected via SSO to a network resource and you do not see a matching Kerberos ticket in the klist output, that means NTLM was used. Use a network capture tool like Wireshark to confirm this.

To configure the Kerberos policy to use a particular encryption algorithm, conduct the following:

1. Open up the Group Policy Management Console (GPMC) and edit the Default Domain Policy (after making a backup copy of it first).
2. Navigate to the following location: Computer Configuration\\ Windows Settings\\ Security Settings\\ Local Policies\\ Security Options
3. Click to select the Network security: Configure encryption types allowed for Kerberos option .
4. Click to select Define these policy settings and select the desired check boxes for the encryption type(s).
5. Click OK. Close out of the GPMC.

Reference: Network security: Configure encryption types allowed for Kerberos Win7 only . Note: Article says Win7 only but it applies to Windows 8 and Windows 10 as well.

Note: Since you said you are not using Certificate authentication, then matters like TLS would not apply here.