Access Rules require the Active Roles Administration Service to support Kerberos authentication. This is because Windows claims are delivered inside Kerberos tickets. To enable Kerberos authentication, the Service Principal Name (SPN) of the Active Roles Administration Service must be added to the service account (domain user account under which the Administration Service runs). For example, suppose that:
SPNs must be added to the service account:
You can add the SPNs to the service account by using the Setspn command line tool:
-
setspn -s aradminsvc/<FQDN> <ServiceAccountName>
For example, setspn -s aradminsvc/arsrv.domain.com domain\arsvcacct
-
setspn -s aradminsvc/<name> <ServiceAccountName>
For example, setspn -s aradminsvc/arsrv domain\arsvcacct
Claims are statements about an authenticated user or device, issued by an Active Directory domain controller running Windows Server 2016 or later. Claims can contain information about the user or device retrieved from Active Directory.
Dynamic Access Control (DAC), a feature of Windows Server 2012, employs claims-based authorization to create versatile and flexible access controls on sensitive resources by using access rules that evaluate information about the user who accesses those resources and about the device from which the user accesses those resources. By leveraging claims in the authentication token of the user, DAC makes it possible to allow or deny access to resources based on the Active Directory attributes of the user or device.
Active Roles uses claims-based access rules to improve authorization management for Active Directory administration. With claims-based access rules, Active Roles adds more flexibility and precision in delegating control of Active Directory objects, such as users, computers or groups, by extending the Active Roles authorization model to recognize and evaluate the claims specific to the user who requests access to those objects or device used to request access.
Claims-based authorization requires:
-
A domain controller (or controllers) running Windows Server 2016 or later, with claim support enabled.
-
(Optional) If you need to use device claims, then a domain-joined client computer (or computers) running Windows 8, Windows Server 2016 or a later version of the Windows operating system.
The claims-based authorization mechanism requires extensions to Active Directory, such as claim type objects intended to store the claim configuration data. By adding a Windows Server domain controller (DC), you extend the Active Directory schema to provide the object classes and attributes required to support claims-based authorization.
Another requirement is the enhancements in the Kerberos Key Distribution Center (KDC) and Security Accounts Manager (SAM) that enable DCs running Windows Server to recognize claim types, retrieve claim information, and transport claims within Kerberos tickets.
A Windows Server DC that supports claim issuance understands claim types published in Active Directory. Claim types define the claim source attributes. When servicing an authentication request, the domain controller reads the source attribute from the claim type and retrieves the attribute data for the authenticating user. Then, the retrieved attribute data is included in the Kerberos ticket and returned to the requestor.
By default, from Windows Server 2012, DCs do not support claim issuance. You need to enable claim issuance by using Group Policy. The Group Policy setting that serves this purpose is located in Computer Configuration > Policies > Administrative Templates > System > KDC > KDC support for claims, compound authentication and Kerberos armoring. Enable this policy setting in a Group Policy Object applied to the Domain Controllers Organizational Unit (for example, in the Default Domain Controllers Policy object), and confirm that this policy setting has the Supported option selected.
Claims-based authorization does not impose domain or forest functional requirements. If your Active Directory domain has a sufficient number of Windows Server DCs to service authentication requests that include claim information, then you can make use of Windows claims even though Windows Server 2008 R2 domain controllers exist in your Active Directory domain.
