Access Rules require the Active Roles Administration Service to support Kerberos authentication. This is because Windows claims are delivered inside Kerberos tickets. To enable Kerberos authentication, the Service Principal Name (SPN) of the Active Roles Administration Service must be added to the service account (domain user account under which the Administration Service runs). For example, suppose that:
arsrv.domain.comis the FQDN of the computer running the Administration Service
arsrvis the name of the computer running the Administration Service
In this example, the following SPNs must be added to the service account:
You can add the SPNs to the service account by using the Setspn command line tool:
setspn -s aradminsvc/<FQDN> <ServiceAccountName>
setspn -s aradminsvc/arsrv.domain.com domain\arsvcacct
setspn -s aradminsvc/<name> <ServiceAccountName>
setspn -s aradminsvc/arsrv domain\arsvcacct
Claims are statements about an authenticated user or device, issued by an Active Directory domain controller running Windows Server 2012 or later. Claims can contain information about the user or device retrieved from Active Directory.
Dynamic Access Control (DAC), a feature of Windows Server 2012, employs claims-based authorization to create versatile and flexible access controls on sensitive resources by using access rules that evaluate information about the user who accesses those resources and about the device from which the user accesses those resources. By leveraging claims in the user's authentication token, DAC makes it possible to allow or deny access to resources based on the Active Directory attributes of the user or device.
Active Roles uses claims-based access rules to improve authorization management for Active Directory administration. With claims-based access rules, Active Roles adds more flexibility and precision in delegating control of Active Directory objects, such as users, computers or groups, by extending the Active Roles authorization model to recognize and evaluate the claims specific to the user who requests access to those objects or device used to request access.
Claims-based authorization requires: