Understanding ISA’s different Authentication types.

It is important to understand the types of authentication that ISA can use to validate with other servers and applications. This tutorial will outline the authentication methods, but will not focus on the configuration of each. Look out for other tutorials in my section on the configuration side of Authentication. Please note that all of the tests are performed using IE5.5 browsers and above, some browsers do not support other authentication types other than basic authentication.

There are four types of authentication methods supported by ISA server.

Client certificates and server certificates
A server certificate is sent to the client when the server authenticates itself, the server requests identification from the client. The client then needs to send the appropriate client certificate to the server.
During the logon process the user’s web browser submits encrypted identification (or the certificate) for inspection by SSL server. Certificates are used to verify that the users of the server are who they claim to be. The certificate includes all of the credential information linked to that organization or client that is need.

Client certificate (in SSL bridging scenarios)

Please note: Client certificates should be installed in the web proxy service certificate store on the ISA server computer where the requests from the clients are sent to. In an array this can be one machine or multiple machines depending on the configuration for that organization. Certificates should also be mapped to user accounts.

Server certificates
The server is requested to authenticate itself, when SSL objects are request by a client from a server. Any disruption in communication would mean a re-authentication process

Basic authentication
Basic Authentication is the same as the http process of authentication. All transactions are in clear text, but usernames and passwords are encoded. No encryption is used = low overhead on system.

Digest authentication

Note: This method of Authentication will only function in windows 2000 domains.

This method of authentication is safer than basic authentication as the user credentials are hashed or encrypted; where as basic authentication sends the credentials over the wire in clear text.

Integrated authentication

Please Note: Using an IE browser later that 5.5 would be strongly recommended when dabbling with this type of authentication. Using other lower versions or browsers might result in no access to the resource.

This form of authentication is secure, no username or password is sent across the wire at any point. Integrated authentication makes use of Kerbros or the built in (NTLM) Challenge/response authentication protocol.

Pass-through authentication

Please note: Kerberos is not supported in pass through authentication.

Pass-through authentication is when ISA Server passes a client’s authentication information to the server where the resource requested resides. ISA Server supports this authentication method for both outgoing and incoming Web requests.

Summary: I have collated and summarized allot of authentication information and hope this will help you in your quest. It is difficult to troubleshoot a problem when you are not sure of how the browser or application is authenticating. Hopefully this information will help you in you quest.