LSA and trusted domains

[Andrew Bartlett]

MS-LSAD and MS-ADTS discuss trusted domains, but no-where is there a
good protocol overview, showing the actions and impacts from the top
down.  

I had thought I would just work on the details, and look at network
traces for the high level, but in retorpsect this was a poor approach.
Could you please provide an overview of this area?

Thanks,

Andrew Bartlett
--
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Samba Developer, Red Hat Inc.


_______________________________________________
cifs-protocol mailing list
cifs-protocol@...
https://lists.samba.org/mailman/listinfo/cifs-protocol

[Bill Wesse]

Good morning Andrew - thank you for your questions. I have opened a new case for you concerning this (SRX080902600070 [MS-ADTS]: LSA and trusted domains overview); since I am working another case in this area for you (SRX080811600226 [MS-NRPC] 2.2.1.3.12  Trust Account Details), I have taken ownership of the new case, and will begin my investigations as soon as possible.

I will advise you of my progress by close of business tomorrow, at the latest.

Regards,
Bill Wesse
MCSE / Escalation Engineer, US-CSS DSC PROTOCOL TEAM
8055 Microsoft Way
Charlotte, NC 28273
TEL:  [phone]
CELL: [phone]
FAX:  [phone]
We're Hiring http://members.microsoft.com/careers/search/details.aspx?JobID=A976CE32-B0B9-41E3-AF57-05A82B88383E&start=1&interval=10&SortCol=DatePosted


-----Original Message-----
From: Andrew Bartlett [mailto:abartlet@...]
Sent: Monday, September 01, 2008 9:07 PM
To: Interoperability Documentation Help
Cc: pfif@...; cifs-protocol@...
Subject: LSA and trusted domains

MS-LSAD and MS-ADTS discuss trusted domains, but no-where is there a good protocol overview, showing the actions and impacts from the top down.

I had thought I would just work on the details, and look at network traces for the high level, but in retorpsect this was a poor approach.
Could you please provide an overview of this area?

Thanks,

Andrew Bartlett
--
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Samba Developer, Red Hat Inc.
_______________________________________________
cifs-protocol mailing list
cifs-protocol@...
https://lists.samba.org/mailman/listinfo/cifs-protocol

[Bill Wesse]

Good morning again Andrew. I meant to update you yesterday, but was out of the office due to minor illness.

I am currently working on detailing the gaps between the below link/documents and the sort of high level / overview descriptions you are asking after. I hope to have a descriptive format ready for your review within the next several days - and will send you what I have developed as soon as I can, and certainly before our next conference call.

The following links are fairly comprehensive for TechNet content that covers trusts.

Managing Trusts
http://technet.microsoft.com/en-us/library/cc771568.aspx

        (Windows Server 2008)
        Understanding Trusts
        http://technet.microsoft.com/en-us/library/cc731335.aspx

(Active Directory Concepts)
Understanding Trusts
http://technet.microsoft.com/en-us/library/cc736874.aspx

Managing Forest Trusts
http://technet.microsoft.com/en-us/library/cc772440.aspx

Trust Technologies
http://technet.microsoft.com/en-us/library/cc759554.aspx

        How Domain and Forest Trusts Work
        http://technet.microsoft.com/en-us/library/cc773178.aspx
        * Component and trust relationship diagrams

Logon and Authentication Technologies
http://technet.microsoft.com/en-us/library/cc780455.aspx
* LSA Architecture diagram

Regards,
Bill Wesse
MCSE / Escalation Engineer, US-CSS DSC PROTOCOL TEAM
8055 Microsoft Way
Charlotte, NC 28273
TEL:  [phone]
CELL: [phone]
FAX:  [phone]
We're Hiring http://members.microsoft.com/careers/search/details.aspx?JobID=A976CE32-B0B9-41E3-AF57-05A82B88383E&start=1&interval=10&SortCol=DatePosted


-----Original Message-----
From: Bill Wesse
Sent: Tuesday, September 02, 2008 9:08 AM
To: 'Andrew Bartlett'; Interoperability Documentation Help
Cc: pfif@...; cifs-protocol@...
Subject: RE: LSA and trusted domains

Good morning Andrew - thank you for your questions. I have opened a new case for you concerning this (SRX080902600070 [MS-ADTS]: LSA and trusted domains overview); since I am working another case in this area for you (SRX080811600226 [MS-NRPC] 2.2.1.3.12  Trust Account Details), I have taken ownership of the new case, and will begin my investigations as soon as possible.

I will advise you of my progress by close of business tomorrow, at the latest.

Regards,
Bill Wesse
MCSE / Escalation Engineer, US-CSS DSC PROTOCOL TEAM
8055 Microsoft Way
Charlotte, NC 28273
TEL:  [phone]
CELL: [phone]
FAX:  [phone]
We're Hiring http://members.microsoft.com/careers/search/details.aspx?JobID=A976CE32-B0B9-41E3-AF57-05A82B88383E&start=1&interval=10&SortCol=DatePosted


-----Original Message-----
From: Andrew Bartlett [mailto:abartlet@...]
Sent: Monday, September 01, 2008 9:07 PM
To: Interoperability Documentation Help
Cc: pfif@...; cifs-protocol@...
Subject: LSA and trusted domains

MS-LSAD and MS-ADTS discuss trusted domains, but no-where is there a good protocol overview, showing the actions and impacts from the top down.

I had thought I would just work on the details, and look at network traces for the high level, but in retorpsect this was a poor approach.
Could you please provide an overview of this area?

Thanks,

Andrew Bartlett
--
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Samba Developer, Red Hat Inc.

_______________________________________________
cifs-protocol mailing list
cifs-protocol@...
https://lists.samba.org/mailman/listinfo/cifs-protocol

[Bill Wesse]

Good morning Andrew. I have created the new case as noted in the Subject line. I expect you will be happy to know that we are initiating a strong recommendation that the objectSid definition in [MS-ADA3] be modified as shown below. Thank you for your persistence on this topic.

I will keep you advised of progress!


Change:

2.44 Attribute objectSid
This attribute specifies a binary value that specifies the security identifier (SID) of the user. The SID is a unique value used to identify the user as a security principal. For more information on the SID data type, refer to [MS-DTYP] section 2.4.2. SID usage is also discussed in [MS-ADTS], in particular in section 3.1.1.1.3.

To:

2.44 Attribute objectSid
This attribute specifies a variable-length byte array value that specifies the security identifier (SID) of the user. For more information on the SID data type, refer to [MS-DTYP] section 2.4.2. It also may be represented as a UTF-8 string that is a valid SDDL SID string beginning with "S-" (see [MS-DTYP] sections 2.4.2 and 2.5.1, and [MS-ADTS] 3.1.1.3.1.2.5). The SID is a unique value used to identify the user as a security principal. SID usage is also discussed in [MS-ADTS], in particular in section 3.1.1.1.3.


Regards,
Bill Wesse
MCSE / Escalation Engineer, US-CSS DSC PROTOCOL TEAM
8055 Microsoft Way
Charlotte, NC 28273
TEL:  [phone]
CELL: [phone]
FAX:  [phone]

_______________________________________________
cifs-protocol mailing list
cifs-protocol@...
https://lists.samba.org/mailman/listinfo/cifs-protocol

[Andrew Bartlett]

On Wed, 2008-09-10 at 03:34 -0700, Bill Wesse wrote:
> Good morning Andrew. I have created the new case as noted in the
> Subject line. I expect you will be happy to know that we are
> initiating a strong recommendation that the objectSid definition in
> [MS-ADA3] be modified as shown below. Thank you for your persistence
> on this topic.

No worries.

> I will keep you advised of progress!
>
>
> Change:
>
> 2.44 Attribute objectSid
> This attribute specifies a binary value that specifies the security
> identifier (SID) of the user. The SID is a unique value used to
> identify the user as a security principal. For more information on the
> SID data type, refer to [MS-DTYP] section 2.4.2. SID usage is also
> discussed in [MS-ADTS], in particular in section 3.1.1.1.3.
>
> To:
>
> 2.44 Attribute objectSid
> This attribute specifies a variable-length byte array value that
> specifies the security identifier (SID) of the user. For more
> information on the SID data type, refer to [MS-DTYP] section 2.4.2. It
> also may be represented as a UTF-8 string that is a valid SDDL SID
> string beginning with "S-" (see [MS-DTYP] sections 2.4.2 and 2.5.1,
> and [MS-ADTS] 3.1.1.3.1.2.5). The SID is a unique value used to
> identify the user as a security principal. SID usage is also discussed
> in [MS-ADTS], in particular in section 3.1.1.1.3.

That looks good.  Let me know how you go - I had understood from the
call that we were at a stalemate, so I'm particularly glad to see this
(potentially) moving forward.

Andrew Bartlett

--
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Samba Developer, Red Hat Inc.


_______________________________________________
cifs-protocol mailing list
cifs-protocol@...
https://lists.samba.org/mailman/listinfo/cifs-protocol

[Bill Wesse]

Good morning Andrew. I have attached a PDF document that describes creating an outbound trust account from 'DC.DOMAIN1.COM' to a domain to be trusted by this domain on 'DC.DOMAIN1.COM' only, without verification. Both domain controllers are Windows Server 2008, and both domains are at Windows Server 2008 domain/forest functional level.

The document is a sample, of course, and is not complete by any means; but it does break down the indicated transaction in detail (and includes some basic normative and informative references).

I would like your input concerning whether or not this is the type and level of information you are looking for concerning an overview of domain trust overview / high-level description.

I want to make sure we thoroughly understand the specific details you are asking about.

Thank you in advance for your time.

Regards,
Bill Wesse
MCSE / Escalation Engineer, US-CSS DSC PROTOCOL TEAM
8055 Microsoft Way
Charlotte, NC 28273
TEL:  [phone]
CELL: [phone]
FAX:  [phone]



_______________________________________________
cifs-protocol mailing list
cifs-protocol@...
https://lists.samba.org/mailman/listinfo/cifs-protocol

[Bill Wesse]

Good morning Andrew.

Per your inquiry concerning elaboration on the objectSid definition, I am sending you copy of an update to the documentation as shown below (the second paragraph is new content).

Please let me know if this answers your question satisfactorily; if so, I will consider your question resolved. Thanks for helping us improve our documentation.

==============================================================================
[MS-ADA3]: Active Directory Schema Attributes N-Z
2.44 Attribute objectSid

This attribute specifies a binary value that specifies the security identifier
(SID) of the user. The SID is a unique value used to identify the user as a
security principal. For more information on the SID data type, refer to
[MS-DTYP] section 2.4.2. SID usage is also discussed in [MS-ADTS], in
particular in section 3.1.1.1.3.

Because this is an attribute of String(SID) syntax, an application writing to
this attribute via the LDAP protocol can specify a value for this attribute as
a valid SDDL SID string, as specified in [MS-ADTS] section 3.1.1.3.1.2.5.
The directory service will convert that value to its binary value equivalent.

   cn: Object-Sid
   ldapDisplayName: objectSid
   attributeId: 1.2.840.113556.1.4.146
   attributeSyntax: 2.5.5.17
   omSyntax: 4
   isSingleValued: TRUE
   schemaIdGuid: bf9679e8-0de6-11d0-a285-00aa003049e2
   systemOnly: TRUE
   searchFlags: fPRESERVEONDELETE | fATTINDEX
   rangeLower: 0
   rangeUpper: 28
   attributeSecurityGuid: 59ba2f42-79a2-11d0-9020-00c04fc2d3cf
   mapiID: 32807
   isMemberOfPartialAttributeSet: TRUE
   systemFlags: FLAG_SCHEMA_BASE_OBJECT | FLAG_ATTR_REQ_PARTIAL_SET_MEMBER
   schemaFlagsEx: FLAG_ATTR_IS_CRITICAL

Version-Specific Behavior: Implemented on Windows 2000 Server, Windows Server
2003, Windows Server 2003 R2, and Windows Server 2008.

In Windows 2000 Server, the following attributes are defined differently:

   systemOnly: FALSE

The schemaFlagsEx attribute was added to this attribute definition in Windows
Server 2008.
==============================================================================

Regards,
Bill Wesse
MCSE / Escalation Engineer, US-CSS DSC PROTOCOL TEAM
8055 Microsoft Way
Charlotte, NC 28273
TEL:  [phone]
CELL: [phone]
FAX:  [phone]

-----Original Message-----
From: Andrew Bartlett [mailto:abartlet@...]
Sent: Wednesday, September 10, 2008 8:30 AM
To: Bill Wesse
Cc: pfif@...; cifs-protocol@...
Subject: Re: New case: SRX080910600015: [MS-ADA3]: 2.44 Elaborate on objectSid definition

On Wed, 2008-09-10 at 03:34 -0700, Bill Wesse wrote:
> Good morning Andrew. I have created the new case as noted in the
> Subject line. I expect you will be happy to know that we are
> initiating a strong recommendation that the objectSid definition in
> [MS-ADA3] be modified as shown below. Thank you for your persistence
> on this topic.

No worries.

> I will keep you advised of progress!
>
>
> Change:
>
> 2.44 Attribute objectSid
> This attribute specifies a binary value that specifies the security
> identifier (SID) of the user. The SID is a unique value used to
> identify the user as a security principal. For more information on the
> SID data type, refer to [MS-DTYP] section 2.4.2. SID usage is also
> discussed in [MS-ADTS], in particular in section 3.1.1.1.3.
>
> To:
>
> 2.44 Attribute objectSid
> This attribute specifies a variable-length byte array value that
> specifies the security identifier (SID) of the user. For more
> information on the SID data type, refer to [MS-DTYP] section 2.4.2. It
> also may be represented as a UTF-8 string that is a valid SDDL SID
> string beginning with "S-" (see [MS-DTYP] sections 2.4.2 and 2.5.1,
> and [MS-ADTS] 3.1.1.3.1.2.5). The SID is a unique value used to
> identify the user as a security principal. SID usage is also discussed
> in [MS-ADTS], in particular in section 3.1.1.1.3.

That looks good.  Let me know how you go - I had understood from the call that we were at a stalemate, so I'm particularly glad to see this
(potentially) moving forward.

Andrew Bartlett

--
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Samba Developer, Red Hat Inc.
_______________________________________________
cifs-protocol mailing list
cifs-protocol@...
https://lists.samba.org/mailman/listinfo/cifs-protocol

[Andrew Bartlett]

On Wed, 2008-09-24 at 08:46 -0700, Bill Wesse wrote:
> Good morning Andrew.
>
> Per your inquiry concerning elaboration on the objectSid definition, I
> am sending you copy of an update to the documentation as shown below
> (the second paragraph is new content).

Yay!

I like it :-)

Thanks for your persistence.

Andrew Bartlett
--
Andrew Bartlett                                http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Samba Developer, Red Hat Inc.                  http://redhat.com



_______________________________________________
cifs-protocol mailing list
cifs-protocol@...
https://lists.samba.org/mailman/listinfo/cifs-protocol

[Bill Wesse]

You are completely welcome - and thank you for *your* persistence!

Regards,
Bill Wesse
MCSE / Escalation Engineer, US-CSS DSC PROTOCOL TEAM
8055 Microsoft Way
Charlotte, NC 28273
TEL:  [phone]
CELL: [phone]
FAX:  [phone]

-----Original Message-----
From: Andrew Bartlett [mailto:abartlet@...]
Sent: Wednesday, September 24, 2008 12:01 PM
To: Bill Wesse
Cc: pfif@...; cifs-protocol@...
Subject: RE: New case: SRX080910600015: [MS-ADA3]: 2.44 Elaborate on objectSid definition

On Wed, 2008-09-24 at 08:46 -0700, Bill Wesse wrote:
> Good morning Andrew.
>
> Per your inquiry concerning elaboration on the objectSid definition, I
> am sending you copy of an update to the documentation as shown below
> (the second paragraph is new content).

Yay!

I like it :-)

Thanks for your persistence.

Andrew Bartlett
--
Andrew Bartlett                                http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Samba Developer, Red Hat Inc.                  http://redhat.com

_______________________________________________
cifs-protocol mailing list
cifs-protocol@...
https://lists.samba.org/mailman/listinfo/cifs-protocol

[Andrew Bartlett]

On Thu, 2008-09-11 at 09:00 -0700, Bill Wesse wrote:

> Good morning Andrew. I have attached a PDF document that describes
> creating an outbound trust account from 'DC.DOMAIN1.COM' to a domain
> to be trusted by this domain on 'DC.DOMAIN1.COM' only, without
> verification. Both domain controllers are Windows Server 2008, and
> both domains are at Windows Server 2008 domain/forest functional
> level.
>
> The document is a sample, of course, and is not complete by any means;
> but it does break down the indicated transaction in detail (and
> includes some basic normative and informative references).
>
> I would like your input concerning whether or not this is the type and
> level of information you are looking for concerning an overview of
> domain trust overview / high-level description.
>
> I want to make sure we thoroughly understand the specific details you
> are asking about.

This looks like a good start.  I'm not so worried about the specifics of
setting up an SMB session to set up an RPC pipe as the details about the
CreateTrustedDomain call, and the pre-requisites to those calls.

Andrew Bartlet

--
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Samba Developer, Red Hat Inc.


_______________________________________________
cifs-protocol mailing list
cifs-protocol@...
https://lists.samba.org/mailman/listinfo/cifs-protocol

[Bill Wesse]

Good morning again Andrew - here is a much more complete version of the document. It is still rough around the edges, and we have not yet determined the ultimate disposition of it. We may use parts of it for forthcoming documents, or keep it as a separate scenario document.

Please note all traffic and detail is against Windows 2008 servers only.

I will await your evaluation of the contents!

Regards,
Bill Wesse
MCSE, MCTS / Escalation Engineer, US-CSS DSC PROTOCOL TEAM
8055 Microsoft Way
Charlotte, NC 28273
TEL:  [phone]
CELL: [phone]
FAX:  [phone]


-----Original Message-----
From: Andrew Bartlett [mailto:abartlet@...]
Sent: Friday, October 10, 2008 1:54 AM
To: Bill Wesse
Cc: Interoperability Documentation Help; pfif@...; cifs-protocol@...
Subject: RE: LSA and trusted domains

On Thu, 2008-09-11 at 09:00 -0700, Bill Wesse wrote:

> Good morning Andrew. I have attached a PDF document that describes
> creating an outbound trust account from 'DC.DOMAIN1.COM' to a domain
> to be trusted by this domain on 'DC.DOMAIN1.COM' only, without
> verification. Both domain controllers are Windows Server 2008, and
> both domains are at Windows Server 2008 domain/forest functional
> level.
>
> The document is a sample, of course, and is not complete by any means;
> but it does break down the indicated transaction in detail (and
> includes some basic normative and informative references).
>
> I would like your input concerning whether or not this is the type and
> level of information you are looking for concerning an overview of
> domain trust overview / high-level description.
>
> I want to make sure we thoroughly understand the specific details you
> are asking about.

This looks like a good start.  I'm not so worried about the specifics of setting up an SMB session to set up an RPC pipe as the details about the CreateTrustedDomain call, and the pre-requisites to those calls.

Andrew Bartlet

--
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Samba Developer, Red Hat Inc.


_______________________________________________
cifs-protocol mailing list
cifs-protocol@...
https://lists.samba.org/mailman/listinfo/cifs-protocol

[Bill Wesse]

Good morning again Andrew. I have (once again) attached the latest copy of the document. This document will not be part of the protocol documentation set.

Aside from the unencrypted versions of the network frames in the document (which I will get to as soon as I can), I would like to know if I have answered all of your questions - and where I may have missed the target.

Regards,
Bill Wesse
MCSE, MCTS / Escalation Engineer, US-CSS DSC PROTOCOL TEAM
8055 Microsoft Way
Charlotte, NC 28273
TEL:  [phone]
CELL: [phone]
FAX:  [phone]

-----Original Message-----
From: Bill Wesse
Sent: Wednesday, October 15, 2008 12:04 PM
To: 'Andrew Bartlett'
Cc: pfif@...; cifs-protocol@...
Subject: RE: LSA and trusted domains

Good morning again Andrew - here is a much more complete version of the document. It is still rough around the edges, and we have not yet determined the ultimate disposition of it. We may use parts of it for forthcoming documents, or keep it as a separate scenario document.

Please note all traffic and detail is against Windows 2008 servers only.

I will await your evaluation of the contents!

Regards,
Bill Wesse
MCSE, MCTS / Escalation Engineer, US-CSS DSC PROTOCOL TEAM
8055 Microsoft Way
Charlotte, NC 28273
TEL:  [phone]
CELL: [phone]
FAX:  [phone]


-----Original Message-----
From: Andrew Bartlett [mailto:abartlet@...]
Sent: Friday, October 10, 2008 1:54 AM
To: Bill Wesse
Cc: Interoperability Documentation Help; pfif@...; cifs-protocol@...
Subject: RE: LSA and trusted domains

On Thu, 2008-09-11 at 09:00 -0700, Bill Wesse wrote:

> Good morning Andrew. I have attached a PDF document that describes
> creating an outbound trust account from 'DC.DOMAIN1.COM' to a domain
> to be trusted by this domain on 'DC.DOMAIN1.COM' only, without
> verification. Both domain controllers are Windows Server 2008, and
> both domains are at Windows Server 2008 domain/forest functional
> level.
>
> The document is a sample, of course, and is not complete by any means;
> but it does break down the indicated transaction in detail (and
> includes some basic normative and informative references).
>
> I would like your input concerning whether or not this is the type and
> level of information you are looking for concerning an overview of
> domain trust overview / high-level description.
>
> I want to make sure we thoroughly understand the specific details you
> are asking about.

This looks like a good start.  I'm not so worried about the specifics of setting up an SMB session to set up an RPC pipe as the details about the CreateTrustedDomain call, and the pre-requisites to those calls.

Andrew Bartlet

--
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Samba Developer, Red Hat Inc.


_______________________________________________
cifs-protocol mailing list
cifs-protocol@...
https://lists.samba.org/mailman/listinfo/cifs-protocol

[Andrew Bartlett]

On Fri, 2008-11-07 at 09:05 -0800, Bill Wesse wrote:
> Good morning again Andrew. I have (once again) attached the latest
> copy of the document. This document will not be part of the protocol
> documentation set.
>
> Aside from the unencrypted versions of the network frames in the
> document (which I will get to as soon as I can), I would like to know
> if I have answered all of your questions - and where I may have missed
> the target.

Sadly, this is way off target.  I meant it when I said it was a good
start - this is the first chapter, not the complete reference.

A trusted domain relationship exists to be used - I need to have a clear
overview of how authentication and other information flows between
trusted domains.  Is DRS synchronisation used?  How is it used and
between what trust types?  How does a domain know which other domain to
contact about an attempted login with a user principal name?  How are
the transitive trust relationships followed to allow access to a
resource in some far-away domain?  When a user (from a trusted domain)
is added to a security descriptor, how is that name resolved?  What
purpose does the global catalog take in trusted domain environments and
how is it consulted when dealing with inter-forest trusts?

These are just some of the questions I would expect an overview of
trusted domains to show (with links to the explicit details of calls,
but 200 pages of packet captures isn't a substitute for real detail).

Andrew Bartlett

--
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Samba Developer, Red Hat Inc.


_______________________________________________
cifs-protocol mailing list
cifs-protocol@...
https://lists.samba.org/mailman/listinfo/cifs-protocol

[Bill Wesse]

Hello Andrew - I agree with you totally, and can't thank you enough for the questions you listed.

So, given the scope of what needs to be accomplished here - and who should perform the work - we have brought a number of internal parties into deciding precisely that. At this time, I cannot hazard a guess as to how much of this will be part of our in-progress system documents, or how much will be authored in my group, and how much in documentation development.

I do, however, expect this will be resolved within the next week, and I will notify you as soon as the determination is made.

Regards,
Bill Wesse
MCSE, MCTS / Escalation Engineer, US-CSS DSC PROTOCOL TEAM
8055 Microsoft Way
Charlotte, NC 28273
TEL:  [phone]
CELL: [phone]
FAX:  [phone]

-----Original Message-----
From: Andrew Bartlett [mailto:abartlet@...]
Sent: Sunday, November 09, 2008 6:06 PM
To: Bill Wesse
Cc: 'pfif@...'; 'cifs-protocol@...'
Subject: RE: LSA and trusted domains overview (SRX080902600070)

On Fri, 2008-11-07 at 09:05 -0800, Bill Wesse wrote:
> Good morning again Andrew. I have (once again) attached the latest
> copy of the document. This document will not be part of the protocol
> documentation set.
>
> Aside from the unencrypted versions of the network frames in the
> document (which I will get to as soon as I can), I would like to know
> if I have answered all of your questions - and where I may have missed
> the target.

Sadly, this is way off target.  I meant it when I said it was a good start - this is the first chapter, not the complete reference.

A trusted domain relationship exists to be used - I need to have a clear overview of how authentication and other information flows between trusted domains.  Is DRS synchronisation used?  How is it used and between what trust types?  How does a domain know which other domain to contact about an attempted login with a user principal name?  How are the transitive trust relationships followed to allow access to a resource in some far-away domain?  When a user (from a trusted domain) is added to a security descriptor, how is that name resolved?  What purpose does the global catalog take in trusted domain environments and how is it consulted when dealing with inter-forest trusts?

These are just some of the questions I would expect an overview of trusted domains to show (with links to the explicit details of calls, but 200 pages of packet captures isn't a substitute for real detail).

Andrew Bartlett

--
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Samba Developer, Red Hat Inc.
_______________________________________________
cifs-protocol mailing list
cifs-protocol@...
https://lists.samba.org/mailman/listinfo/cifs-protocol