The claims-based authorization mechanism requires extensions to Active Directory, such as claim type objects intended to store the claim configuration data. By adding a Windows Server 2012 domain controller, you extend the Active Directory schema to provide the object classes and attributes required to support claims-based authorization.
Another requirement is the enhancements in the Kerberos Key Distribution Center (KDC) and Security Accounts Manager (SAM) that enable domain controllers running Windows Server 2012 to recognize claim types, retrieve claim information, and transport claims within Kerberos tickets.
A Windows Server 2012 domain controller that supports claim issuance understands claim types published in Active Directory. Claim types define the claim source attributes. When servicing an authentication request, the domain controller reads the source attribute from the claim type and retrieves the attribute data for the authenticating user. Then, the retrieved attribute data is included in the Kerberos ticket and returned to the requestor.
By default, Windows Server 2012 domain controllers do not support claim issuance. You need to enable claim issuance by using Group Policy. The Group Policy setting that serves this purpose is Computer Configuration\Policies\Administrative Templates\System\KDC\KDC support for claims, compound authentication and Kerberos armoring. Enable this policy setting in a Group Policy object applied to the Domain Controllers Organizational Unit (for example, in the Default Domain Controllers Policy object), and confirm that this policy setting has the Supported option selected.
Claims-based authorization does not impose domain or forest functional requirements. If your Active Directory domain has a sufficient number of Windows Server 2012 domain controllers to service authentication requests that include claim information, then you can make use of Windows claims even though Windows Server 2008 R2 domain controllers exist in your Active Directory domain.
Domain-joined client computers running Windows 8 or Windows Server 2012 are required for claims-based authorization when using device claims. A domain controller issues claims in the Kerberos ticket in response to an authentication request created by a client computer, so the computer needs to understand how to request claim information when making authentication requests, and how to locate a claims-aware domain controller. Computers running earlier versions of the Windows operating system don’t have such knowledge, so they can’t request user or device claims upon user authentication. Although applications and services that require claim information can request user claims on their own, this is not the case with the device claims. If you need to use device claims, the user must log on from a computer running Windows 8, Windows Server 2012, or a later version of the Windows operating system. This requirement does not apply to authorization scenarios that employ user claims only.
By default, Windows 8 and Windows Server 2012 based computers don’t request user or device claims upon user authentication. You need to enable claim support on client computers by using Group Policy. The Group Policy setting that serves this purpose is Computer Configuration\Policies\ Administrative Templates\System\Kerberos\Kerberos client support for claims, compound authentication and Kerberos armoring. Enable this policy setting in a Group Policy object applied to the Organizational Unit that holds the computer accounts of client computers.
After you enable the KDC support for claims, compound authentication and Kerberos armoring Group Policy setting, your Windows Server 2012 domain controllers are ready to issue claims in response to authentication requests. However, you need to configure claim types before the domain controller can issue claims.
You can use Active Roles to create attribute-based claim types that source their information from user and computer attributes. The claim types you create are stored in the configuration partition of the Active Directory forest. All domains within that forest share the claim types and domain controllers from those respective domains issue claim information during user authentication.
It is important that the Active Directory attributes intended to source claim types contain accurate information. Incorrect attribute information can lead to unexpected access to data using claims-based authorization. You can ensure the accuracy of information held in claim source attributes by leveraging property generation and validation policies provided by Active Roles.
You can use the Active Roles console to create, modify and delete user and computer claim types. The claim type objects are stored in the configuration partition of the Active Directory forest, and appear under the Active Directory | Claim Types node in the Active Roles console. If you have domains from multiple forests registered with Active Roles, then the console tree provides a separate Claim Types node for each forest. The forest to which a given Claim Types node applies is identified by the name (or a part of the name) of the forest root domain shown in brackets next to the name of the node.
On the Source Attribute page you can select, view or change the source attribute for the claim type. The source attribute is the Active Directory attribute from which the value is obtained for claims of this claim type.
The page provides a list allowing you to select the desired attribute. The list includes the attributes for the User, Computer, InetOrgPerson, ManagedServiceAccount, GroupManagedServiceAccount and Auxiliary classes of object, with the exception of:
For an existing claim type, the page displays the claim type’s current source attribute, and allows you to select a different attribute of the same syntax type. However, changing the source attribute does not change the claim type’s ID.