Integrated Windows login, IWA

Used to leverage Windows login already done from a domain-connected client. Requires module AuthN to be deployed.

Configuration

Common Authenticator configuration can be found here.

Properties
Example

Name Description Default value Mandatory

package Negotiate false

error_url Where to redirect the user if authentication fails. N/A false

Name	Description	Default value	Mandatory
`package`		Negotiate	false
`error_url`	Where to redirect the user if authentication fails.	`N/A`	false
`custom_identifier`	Tag used for event separation	`N/A`	false

custom_identifier

Tag used for event separation

N/A

false

{
            "id": "iwa",
            "type": "IwaAuthentication",
            "config": {
              "base_path": "/saml/authn",
              "context_path": "/saml/authn/iwa"
            }
}

Logging

Apart from system logging, event logging is done when starting, completing, and failing a transaction.

Event ids are:

WEB_100015("Authenticated using Integrated Windows Authentication")
- IDENTIFIER (user trace id)
- CUSTOMER_IDENTIFIER (if configured)
- SOURCE_USER_NAME (Windows username)
- SOURCE_ADDRESS (ip of the remote session)
- AUTHENTICATOR_IDENTIFIER (id and display name)
WEB_100016("Failed authentication using Integrated Windows Authentication")
- IDENTIFIER (user trace id)
- CUSTOMER_IDENTIFIER (if configured)
- SOURCE_ADDRESS (ip of the remote session)
- AUTHENTICATOR_IDENTIFIER (id and display name)

Data exposed to global state

After a user completes a transaction, the authenticator is marked as done. Data from the authentication response is then put into the global state replacing existing values:

username

Prerequisite

Integrity must be running on a Windows server joined to the domain where IWA is to take place.
Integrity must run using an actual domain account belonging to the same domain as the server is joined.
Ensure that there is a DNS A record present for the host. Be sure the record is of A type.
A SPN registration must be done connecting the DNS name, protocol & account. This is done using the command setspn:

setspn -s HTTP/webserver.example.com DOMAIN\ServiceAccount
setspn -s HTTPS/webserver.example.com DOMAIN\ServiceAccount

API

This authenticator has no user interface and therefore exposes no Web Authenticator API. It negotiates with the browser over HTTP and completes without any dialogue of its own.