Windows AD Trusts, AD FS SSO, and Enterprise PKI: Eckert Chapters 4 and 11

What is the first step in establishing trust between two domains?

Configure DNS conditional forwarders between the two domains.

What is a trust in Active Directory?

An authentication path, not an access grant.

What type of trust is targeted in this course's objectives?

External trust.

What does AD FS stand for?

Active Directory Federation Services.

What is the purpose of a conditional forwarder in DNS?

To allow one domain to resolve the names of another domain.

What is the significance of the trust password in Active Directory trusts?

It is a shared secret used by both domains to authenticate each other's requests.

What does AD FS allow organizations to do?

Extend single sign-on to external, non-domain-joined applications.

What is the role of claims in AD FS?

Claims are statements about a user that a relying application trusts.

What is the procedure to create a conditional forwarder on corpa.local's DC?

Open DNS Manager, right-click Conditional Forwarders, create a new forwarder for corpb.local pointing to 10.10.10.20.

What does the trust wizard create in each domain?

A trust account.

How do you verify that a trust between domains is working?

Check if the other domain appears as a selectable location in security settings.

What is the difference between Domain-wide authentication and Selective Authentication?

Domain-wide authentication allows all users access, while Selective Authentication requires explicit permissions per user/computer.

What is a potential vulnerability of external trusts?

They are vulnerable to SID history spoofing attacks.

What is the purpose of SID filtering in external trusts?

To prevent SID history spoofing attacks.

What happens when a user tries to access a web application using AD FS?

The user is redirected to the AD FS server for authentication and receives a security token.

What does a security token contain in the context of AD FS?

Claims about the user, such as their email and group membership.

What is the first action taken by AD FS when a user accesses a relying party?

AD FS prompts for credentials and validates them against the local Active Directory.

What is the role of the relying party in the SSO flow?

It is the external application that the user is trying to access.

What is the purpose of the trust type selection in the trust wizard?

To define the nature of the trust relationship between the two domains.

What does the term 'federated trust' refer to?

A trust type that allows for claims-based authentication across different domains.

What is the significance of the security token being digitally signed?

It ensures the integrity and authenticity of the claims contained within it.

What does the term 'relying party' mean in the context of AD FS?

An application that relies on AD FS for user authentication.

What is the purpose of the 'Trusts' tab in Active Directory Domains and Trusts?

To manage and configure trust relationships between domains.

What is the expected outcome after successfully creating an external trust?

Users from one domain can authenticate and access resources in the other domain.

What does the term 'two-way trust' mean?

Both domains trust each other, allowing for mutual authentication.

What is the main difference between Kerberos trust and claims-based trust?

Kerberos trust involves domain controllers vouching for each other, while claims-based trust involves issuing security tokens.

Why is it important to verify DNS resolution before establishing a trust?

Because the trust wizard needs to locate the target domain to complete the trust setup.

What is the primary advantage of the relying party not touching the password?

It enhances security by preventing direct sharing of domain credentials.

What does SAML stand for?

Security Assertion Markup Language

What is OAuth 2.0 primarily used for?

It is used for authorization in web applications.

What is OpenID Connect built on?

It is built on OAuth 2.0.

What is the main difference between AD FS and Azure AD's OAuth/OpenID Connect?

AD FS is an on-premises solution, while Azure AD's OAuth/OIDC is a managed cloud service.

What is the role of a Certificate Authority (CA)?

A CA issues digital certificates that verify the identity of entities.

What does a digital certificate bundle together?

It bundles a public key with identity information, signed by the CA's private key.

What is the purpose of a Certificate Revocation List (CRL)?

To list certificates that should no longer be trusted.

What is OCSP used for?

To check the real-time validity of a specific certificate.

What is the significance of the Root CA in a PKI hierarchy?

It issues certificates to Subordinate CAs and is kept offline after issuance to reduce risk.

What happened in the DigiNotar breach of 2011?

A public CA was breached and issued fraudulent certificates, leading to its collapse.

What is Let's Encrypt known for?

It is a free, automated public CA that promotes short-lived, auto-renewing certificates.

What is the primary use of TLS in web security?

To secure communications over the internet using HTTPS.

How does S/MIME relate to PKI?

It uses certificates for signing and encrypting emails.

What is the first step in building a Root CA?

Install the Active Directory Certificate Services role on a server.

What does the setup type 'Enterprise CA' allow?

It enables auto-enrollment via Group Policy.

What is the purpose of the Certification Authority console?

To manage the CA and view issued, revoked, and pending certificates.

What is the validity period in a certificate?

The time frame during which the certificate is considered valid.

What is the significance of the CA's digital signature on a certificate?

It verifies that the CA vouches for the identity associated with the public key.

What is the main function of symmetric encryption in TLS?

To encrypt the actual data after securely exchanging a temporary session key.

What does the term 'asymmetric encryption' refer to?

A cryptographic method using a public/private key pair for secure communications.

What is the main challenge that PKI addresses?

Ensuring secure and trusted communication over potentially insecure networks.

What does the term 'man-in-the-middle' refer to?

An attack where an unauthorized party intercepts communications between two parties.

What is the role of Group Policy in an Enterprise CA setup?

To distribute the trusted root CA to the organization's computers.

What is the purpose of Key Usage and Enhanced Key Usage extensions in a certificate?

To define the specific purposes for which the certificate can be used.

What is the difference between a public CA and an Enterprise CA?

A public CA is trusted by all browsers, while an Enterprise CA is trusted only within its own organization.