Overview of Internet Authentication Services

Overview

The Internet Authentication Service Properties dialog box allows you to configure Internet Authentication Server (IAS) to suit the specific needs of your dial-in users, your hardware configuration, and the requirements of the computers with which you will connect. For more information about IAS, see the Microsoft Internet Authentication Services Administration Guide.


Setting Internet Authentication service properties

To set Internet Authentication Service properties

  1. Click the Service tab.

  2. In the Maximum threads box, type the maximum number of authentication requests that will be processed concurrently. This value must be between 1 and 63.

  3. If your RADIUS authentication and RADIUS accounting UDP ports differ from the default values provided, type your port setting in the Authentication and Accounting boxes.

  4. Select one or more check boxes under Capture to NT Event Log to capture packet traffic processed by IAS:
    • Click Malformed or invalid packets to capture problematic packets. Packets are generally malformed as a result of password incompatibility between the client and the server.

    • Click Authentication packets to capture authentication requests, access approvals, and access denials. This can help alert you to problems with transaction volume and attempts to access unauthorized resources.

    • Click Accounting packets to capture accounting requests, approvals, and denials. This can help alert you to accounting-software compatibility problems between the NAS and IAS.

Note

  • The authentication and accounting default values are set to the commonly defined RADIUS standards: 1645 for authentication and 1646 for accounting. The most recently defined RADIUS standards are 1812 for authentication and 1813 for accounting. If you are unsure of your port settings, refer to your NAS documentation.


Displaying IAS properties on another computer

To configure IAS properties on another computer

  1. Click Start, point to Programs, and then point to Windows NT 4.0 Option Pack.

  2. Click Internet Information Server, and then click Internet Service Manager. The system displays the Microsoft Management Console (MMC).

  3. In the left pane, double-click Console Root. The tree expands and displays the IIS folder.

  4. Right-click the IIS folder and choose Connect. The remote server will appear in the scope (left) pane of your MMC console.

  5. Right-click RADIUS and then click Properties. Internet Authentication Service Properties appear for the remote machine.

Note

To configure a remote IAS server, you must be logged on with a userID that has administrative privileges to the remote server. You must also be able to communicate with the server by using the Server Message Block (SMB) protocol. Not all firewalls can transfer the SMB protocol; so if you are not sure whether yours can, consult your network administrator.


Registering clients of this server

To register clients of this server

  1. Click the Clients tab.

  2. Click Add.

  3. Click IP address or DNS name, and then enter the appropriate value.

  4. In the Password box, enter the password for the client.

Note

  • Passwords (shared secrets) are case-sensitive. Be sure that the client's password (shared secret) and the password (shared secret) you enter in this field are identical to each other.


Setting up the logging service

To set up the logging service

  1. Click the Logging tab.

  2. Select the Enable accounting log check box.

  3. Select the Automatically open new log check box, and then click the interval that best suits your needs. You will need to back up or delete the logs on a regular basis, regardless of the interval you choose.
    • If you anticipate heavy transaction volume and logging activity, select Daily.

    • If your server experiences very little activity, select Weekly or Monthly.

    • If you are unsure of the transaction volume, enter a log size at which a new log should be opened. The default is 10 MB.
  4. In the Log file directory box, enter a location in which the log file should be stored. The default is the IAS directory.


Specifying attribute information

To specify attribute information

Click Attribute Value, and then type the data that will be sent for this attribute.


Internet Authentication Service authentication providers properties

The Authentication Providers tab allows you to enter a list of authentication servers and associate them with different authentication types. You can register and configure authentication providers and create data sources from this tab.

If you are authenticating against a Windows NT Server, your authentication providers were automatically configured during IAS installation.

Related Topics


Internet Authentication Service client properties

The Clients tab allows you to add, remove, or edit the Internet addresses, DNS names, and passwords (also called shared secrets) of the clients of this IAS server. Clients can be NAS devices or RADIUS proxies.

Related Topics


Registering a Windows NT database

To register a Windows NT database

In the Authentication database description box, type a description for the authentication database you are using.


Selecting a default authentication provider

To select a default authentication provider

  1. Click the User Authentication tab.

  2. Click Edit Provider.

  3. If you decide not to use a default, select the Do not use a default Authentication Provider check box.

  4. In Authentication and authorization, select from the respective lists the authentication provider and profile of your choice for this default realm.

  5. If the default authentication provider is a proxy, select the accounting method of your choice under Accounting options:
    • Click Forward accounting packets to send accounting packets to the server that is performing the authentication.

    • Click Suppress accounting packets to refrain from sending accounting packets anywhere. Accounting records are captured in the accounting log of IAS but will not be sent to the next server in the authentication sequence.

    • Click Translate accounting packets to logout packets if your RADIUS server does not support the RADIUS standard RFC 2139, "RADIUS Accounting."


Choosing a log file directory

To choose a log file directory

Navigate to the directory in which you want to store log files, and then select that directory.


Internet Authentication Service logging properties

The Logging tab allows you to turn logging on or off, specify logging frequency, and choose a location to store log files.

Related Topics


Creating a RADIUS profile

To create a RADIUS profile

  1. Click the Profiles tab.

  2. Click Add.

  3. In the Profile name box, type a unique name for the new profile.

  4. In the RADIUS attributes list, select a combination of attribute name and attribute value. You can select the attribute name only. The attribute value is assigned on the basis of the name.

  5. Click the right-arrow button to transfer your selection to the Profile attributes list.

  6. If you select an attribute with no specified attribute value, type a value that corresponds to the attribute you have chosen in the Attribute Value Information dialog box. If you select the attribute name Vendor-Specific, see your NAS documentation for the values required in the Vendor ID and Vendor type boxes.

  7. If you select more than one attribute for your profile, rank them. Select the higher-priority item in the Profile attributes list, and then click the up-arrow button.


Internet Authentication Service profile properties

The Profiles tab allows you to create shared profiles for individuals or groups of users and to define the profiles in terms of their RADIUS attributes.


Creating realms

To create realms

  1. Click the User Authentication tab.

  2. Click Add.

  3. In the Realm description box, type a realm description.

  4. Under Prefix or suffix, select the realm identification of your choice.
    • Click Identify realm by a user name prefix if the realm identifier conforms to the syntax BYTECORP/.

    • Click Identify realm by a user name suffix if the realm identifier conforms to the syntax @bytecorp.com.
  5. In the Realm prefix or suffix box, type the prefix or suffix identifier. Prefixes and suffixes are case-sensitive.

  6. If you want the user names to appear at the authentication server without their identifiers, click Strip prefix or suffix from user names before forwarding. You may need to strip the prefix or suffix from user names to conform with the authentication provider. You may need to leave the prefix or suffix as part of the user names if they will be sent to another proxy before reaching the final authentication provider.

  7. In Authentication and authorization, select the authentication provider and profile of your choice for this realm from the respective lists.

  8. If IAS is acting as a proxy, select the accounting method of your choice in Accounting options:
    • Click Forward accounting packets to send accounting packets to the server that is performing the authentication.

    • Click Suppress accounting packets to refrain from sending accounting packets anywhere. Accounting records are captured in the accounting log of IAS but will not be sent to the next server in the authentication sequence.

    • Click Translate accounting packets to logout packets if your RADIUS server does not support the RADIUS standard RFC 2139, "RADIUS Accounting."
  9. To order the realms, select the higher-priority item in the realm information box, then click the up arrow.

Note

  • When ordering realms, if realms are identified by prefixes, the first match of prefix to realm will be used by IAS. For example, if a user entered the prefix abc, the first ranked realm was abcd, and the second ranked realm was abc, the realm abcd would be selected by IAS. For this reason, it is recommended that you rank realms in alphabetical order.


Specifying RADIUS server information

To specify RADIUS Server Information

  1. Click IP address or DNS name, and then enter the appropriate value.

  2. If your RADIUS authentication and RADIUS accounting UDP ports differ from the default values, enter your port setting in the Authentication and Accounting boxes.

  3. In the Password box, enter the password for the RADIUS server you are configuring.

  4. If you enter more than one remote RADIUS server, rank them. Select the higher-priority item in the RADIUS servers box, and then click the up-arrow button.

Notes

  • The authentication and accounting default values are set to the commonly defined RADIUS standards: 1645 for authentication and 1646 for accounting. The most recently defined RADIUS standards are 1812 for authentication and 1813 for accounting. If you are unsure of your port settings, refer to your NAS documentation.

  • Passwords (shared secrets) are case-sensitive. Be sure that the client's password (shared secret) and the password (shared secret) you enter in this field are identical to each other.


Internet Authentication Service properties

The Service tab stores basic settings, including maximum threads, User Datagram Protocol (UDP) port numbers for RADIUS authentication and RADIUS accounting, and packet choices for capture to the Application Log window of the Windows NT Event Viewer.

Related Topics


Internet Authentication Service user authentication properties

The User Authentication tab allows you to define groups of users by a common domain name or individual user ID, link the realm to a profile, assign an authentication provider, and determine accounting behavior.

Related Topics