samba - Sep 2020 - Schema version 87 and windows Hello

> I am not that experiences about it^^
> I  think that one first step would be to strip the registration (key
> trust on my side), and once that would have been done submit the results
> to the samba team and see if it is worth funding/implementing.
> As I am not part of the samba team I cannot say more.
>
It sounds like you're suggesting that you're going to strictly focus on
what the regular day to day authentication process looks like for WHFB.  In
other words, just the PC to AD authentication piece and not the initial
self-registration with ADFS.  My guess is that subsequent steps would be to:
- confirm what needs to be stored in LDAP and what format it is stored in
- determine what registry keys and/or other configurations are changed on
the PC, that tell Windows Logon to request a PIN for unlocking the TPM and
then initiate the PKINIT authentication process

I don't have access to a functioning WHFB environment, so I'm not sure
how
to help right now - other than offer encouragement and ideas.

--
Mason

I setup a test environment comporting of a windows 2016 evaluation
server and a windows 10 eval too so you can tag along.

Concerning the provisioning for key trust it looks like the  Enterprise
Device Registration Service is the one doing most of the work, since
there are litte if no documentation about it, I prefer on my side to
focus on the day to day auth flow.

It looks like the easiest to implement would be the certificate trust
(https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning)
since it is installed into the personal store of the user. And it is
probably very similar to a smart key process (if you can believe that
the
https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication
is true)

Vincent


On 9/30/20 1:04 AM, Mason Schmitt via samba wrote:
>> I am not that experiences about it^^
>> I  think that one first step would be to strip the registration (key
>> trust on my side), and once that would have been done submit the
results
>> to the samba team and see if it is worth funding/implementing.
>> As I am not part of the samba team I cannot say more.
>>
> 
> It sounds like you're suggesting that you're going to strictly
focus on
> what the regular day to day authentication process looks like for WHFB.  In
> other words, just the PC to AD authentication piece and not the initial
> self-registration with ADFS.  My guess is that subsequent steps would be
to:
> - confirm what needs to be stored in LDAP and what format it is stored in
> - determine what registry keys and/or other configurations are changed on
> the PC, that tell Windows Logon to request a PIN for unlocking the TPM and
> then initiate the PKINIT authentication process
> 
> I don't have access to a functioning WHFB environment, so I'm not
sure how
> to help right now - other than offer encouragement and ideas.
> 
> --
> Mason
> 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.samba.org/pipermail/samba/attachments/20200930/85ca2d1b/signature.sig>

On Wed, 30 Sep 2020 at 03:20, mailist <mailist at kaminot.xyz> wrote:
> I setup a test environment comporting of a windows 2016 evaluation
> server and a windows 10 eval too so you can tag along.
>
Thanks Vincent.


Concerning the provisioning for key trust it looks like the 
Enterprise
> Device Registration Service is the one doing most of the work, since
> there are litte if no documentation about it, I prefer on my side to
> focus on the day to day auth flow.
>
Makes sense to me.


It looks like the easiest to implement would be the certificate
trust
> (
>
https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning
> )
>
Yes, if you already have a CA, this looks to be the path that will have the
least amount of Samba development required.  The key based auth would
require less infrastructure (no need for a CA), but then it would require
more changes to Samba.


> And it is probably very similar to a smart key process (if you can believe
> that the
>
>
https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication
> is true)
>
That was my impression as well.

--
Mason