From 1b5b991e26684411dd57bc333dea2822e4e1eb27 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 9 Jan 2024 12:58:54 -0500 Subject: [PATCH] Add images for Microsoft Entra hybrid join authentication --- .../how-it-works-authentication.md | 2 + .../hello-for-business/how-it-works.md | 18 +- .../howitworks/auth-haadj-cloudtrust.svg | 876 ++++++++++++++++++ 3 files changed, 888 insertions(+), 8 deletions(-) create mode 100644 windows/security/identity-protection/hello-for-business/images/howitworks/auth-haadj-cloudtrust.svg diff --git a/windows/security/identity-protection/hello-for-business/how-it-works-authentication.md b/windows/security/identity-protection/hello-for-business/how-it-works-authentication.md index 757be1de7a..7c8615eec1 100644 --- a/windows/security/identity-protection/hello-for-business/how-it-works-authentication.md +++ b/windows/security/identity-protection/hello-for-business/how-it-works-authentication.md @@ -64,6 +64,8 @@ Microsoft Entra joined devices authenticate to Microsoft Entra ID during sign-in ![Microsoft Entra hybrid join authentication using Microsoft Entra Kerberos](images/howitworks/auth-haadj-cloudtrust.png) +![Microsoft Entra hybrid join authentication using Microsoft Entra Kerberos](images/howitworks/auth-haadj-cloudtrust.svg) + | Phase | Description | | :----: | :----------- | |A | Authentication begins when the user dismisses the lock screen, which triggers Winlogon to show the Windows Hello for Business credential provider. The user provides their Windows Hello gesture (PIN or biometrics). The credential provider packages these credentials and returns them to Winlogon. Winlogon passes the collected credentials to lsass. Lsass queries Windows Hello for Business policy to check if cloud Kerberos trust is enabled. If cloud Kerberos trust is enabled, Lsass passes the collected credentials to the Cloud Authentication security support provider, or Cloud AP. Cloud AP requests a nonce from Microsoft Entra ID. Microsoft Entra ID returns a nonce. diff --git a/windows/security/identity-protection/hello-for-business/how-it-works.md b/windows/security/identity-protection/hello-for-business/how-it-works.md index 9f4fd3ad5a..adbcb52ee5 100644 --- a/windows/security/identity-protection/hello-for-business/how-it-works.md +++ b/windows/security/identity-protection/hello-for-business/how-it-works.md @@ -7,7 +7,9 @@ ms.topic: concept-article # How Windows Hello for Business works -Windows Hello for Business is a distributed system that requires multiple technologies to work together. To simplify the explanation of how Windows Hello for Business works, let's break it down into five phases. Two of these phases are required only for certain deployment scenarios. +Windows Hello for Business is a distributed system that requires multiple technologies to work together. To simplify the explanation of how Windows Hello for Business works, let's break it down into five phases, which represent the chronological order of the deployment process. + +Two of these phases are required only for certain deployment scenarios. > [!NOTE] > The deployment scenarios are described in the article: [Plan a Windows Hello for Business deployment](deploy/index.md). @@ -38,11 +40,6 @@ Windows Hello for Business is a distributed system that requires multiple techno :::column-end::: :::column span="3"::: During this phase, the user authenticates using one form of authentication (typically, username/password) to request a new Windows Hello for Business credential. The provisioning flow requires a second factor of authentication before it can create a strong, two-factor Windows Hello for Business credential. - - After multi-factor authentication (MFA), the provisioning process: - - 1. **Generates a key pair** bound to the Trusted Platform Module (TPM), if available, or in software. The private key is stored locally and protected by the TPM, and can't be exported - 1. **Registers the public key** with the IdP, mapped to the user account :::column-end::: :::row-end::: :::row::: @@ -120,6 +117,11 @@ Windows Hello provisioning is triggered once device registration completes, and 1. The user *enrolls* in Windows Hello by authenticating to the IdP with MFA 1. After successful MFA, the user must provide a bio gesture (if available) and PIN, which trigger the creation of the Windows Hello container. A public/private key pair is generated and the public key is registered with the IdP. + After multi-factor authentication (MFA), the provisioning process: + + 1. **Generates a key pair** bound to the Trusted Platform Module (TPM), if available, or in software. The private key is stored locally and protected by the TPM, and can't be exported + 1. **Registers the public key** with the IdP, mapped to the user account + ### Key registration The IdP validates the user identity and maps the Windows Hello public key to a user account during the registration step. @@ -158,13 +160,13 @@ The biometric data used to support Windows Hello is stored on the local device o > >Some fingerprint sensors have the capability to complete matching on the fingerprint sensor module instead of in the OS. These sensors store biometric data on the fingerprint module instead of in the database file. -## Key synchronization (optional) +## Key synchronization Key synchronization is required in hybrid environments. After the user provisions a Windows Hello for Business credential, the key must sync from Microsoft Entra ID to Active Directory. The user's public key is written to the `msDS-KeyCredentialLink` attribute of the user object. The synchronization is handled by Microsoft Entra Connect Sync. -## Certificate enrollment (optional) +## Certificate enrollment For certificate deployments, after registering the key, the client generates a cetificate request. The request is sent to the Certificate Registration Authority (CRA). The CRA is on the Active Directory Federation Services (AD FS) server, which validates the certificate request and fulfills it using the enterprise PKI. diff --git a/windows/security/identity-protection/hello-for-business/images/howitworks/auth-haadj-cloudtrust.svg b/windows/security/identity-protection/hello-for-business/images/howitworks/auth-haadj-cloudtrust.svg new file mode 100644 index 0000000000..65d3e29787 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/images/howitworks/auth-haadj-cloudtrust.svg @@ -0,0 +1,876 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + HAADJ-Auth-CloudTrust + + + + + + + + + + Object lifeline.1005 + Domain Controller + + Sheet.1006 + + + + Sheet.1007 + + + + Sheet.1008 + + + Sheet.1009 + + + + + + + Domain Controller + + + + + + + + Object lifeline.1015 + Winlogon + + Sheet.1016 + + + + Sheet.1017 + + + + Sheet.1018 + + + Sheet.1019 + + + + + + + Winlogon + + + + + + + + Object lifeline.1020 + Microsoft Entra ID + + Sheet.1021 + + + + Sheet.1022 + + + + Sheet.1023 + + + Sheet.1024 + + + + + + + Microsoft Entra ID + + + + + + + + Object lifeline.1025 + LSA + + Sheet.1026 + + + + Sheet.1027 + + + + Sheet.1028 + + + Sheet.1029 + + + + + + + LSA + + + + + + + + Object lifeline.1030 + Credential Provider + + Sheet.1031 + + + + Sheet.1032 + + + + Sheet.1033 + + + Sheet.1034 + + + + + + + CredentialProvider + + + + + + + + Object lifeline.1035 + Cloud Auth provider + + Sheet.1036 + + + + Sheet.1037 + + + + Sheet.1038 + + + Sheet.1039 + + + + + + + Cloud Authprovider + + + + + + + + Object lifeline.1040 + Kerberos provider + + Sheet.1041 + + + + Sheet.1042 + + + + Sheet.1043 + + + Sheet.1044 + + + + + + + Kerberosprovider + + + Self Message.1020 + User provides gesture + + + + + + + + + + + User provides gesture + + Return Message.1028 + Collected Credentials + + + + + + + + + + + Collected Credentials + + Message.1029 + Collected Credentials + + + + + + + + + + + Collected Credentials + + Message.1027 + Show the WHFB Cred Prov + + + + + + + + + + + Show the WHFB Cred Prov + + Return Message.1061 + TGT + + + + + + + + + + + TGT + + Message.1062 + Collected Credentials + + + + + + + + + + + Collected Credentials + + Message.1030 + Request Nonce + + + + + + + + + + + Request Nonce + + Return Message.1033 + Nonce + + + + + + + + + + + Nonce + + Return Message.1034 + PRT w/Session key and Partial TGT + + + + + + + + + + + PRT w/Session key and Partial TGT + + Self Message.1066 + Sign nonce WHFB privkey + + + + + + + + + + + Sign nonce WHFB privkey + + Message.1037 + Signed Nonce + + + + + + + + + + + Signed Nonce + + Self Message.1038 + Validate signature WHFB pubkey + + + + + + + + + + + Validate signature WHFB pubkey + + Self Message.1039 + Validate Nonce + + + + + + + + + + + Validate Nonce + + Self Message.1040 + Decrypt Session key w/ Transport key + + + + + + + + + + + Decrypt Session key w/ Transport key + + Self Message.1041 + Import Session Key to TPM + + + + + + + + + + + Import Session Keyto TPM + + Return Message.1035 + Partial TGT + + + + + + + + + + + Partial TGT + + Self Message.1043 + Load User Desktop + + + + + + + + + + + Load User Desktop + + Return Message.1075 + Success + + + + + + + + + + + Success + + Message.1021 + Partial TGT + + + + + + + + + + + Partial TGT + + Self Message.1036 + Get domain hint from computer + + + + + + + + + + + Get domain hint from computer + + Return Message.1051 + return list of domain controlers + + + + + + + + + + + return list of domain controlers + + Message.1060 + DcLocator via DNS + + + + + + + + + + + DcLocator via DNS + + Return Message.1082 + TGT + + + + + + + + + + + TGT + + Message.1083 + TGS_REQ w/ Partial TGT + + + + + + + + + + + TGS_REQ w/ Partial TGT + + State + B + + + + + + + + + + + + B + + State.1087 + D + + + + + + + + + + + + D + + State.1088 + C + + + + + + + + + + + + C + + State.1089 + E + + + + + + + + + + + + E + + State.1090 + A + + + + + + + + + + + + A + + + + + + + Object lifeline.1126 + Domain Controller + + Sheet.1127 + + + + Sheet.1128 + + + + Sheet.1129 + + + + + + Domain Controller + + + + + + + + Object lifeline.1131 + Winlogon + + Sheet.1132 + + + + Sheet.1133 + + + + Sheet.1134 + + + + + + Winlogon + + + + + + + + Object lifeline.1136 + Microsoft Entra ID + + Sheet.1137 + + + + Sheet.1138 + + + + Sheet.1139 + + + + + + Microsoft Entra ID + + + + + + + + Object lifeline.1141 + LSA + + Sheet.1142 + + + + Sheet.1143 + + + + Sheet.1144 + + + + + + LSA + + + + + + + + Object lifeline.1146 + Credential Provider + + Sheet.1147 + + + + Sheet.1148 + + + + Sheet.1149 + + + + + + CredentialProvider + + + + + + + + Object lifeline.1151 + Cloud Auth provider + + Sheet.1152 + + + + Sheet.1153 + + + + Sheet.1154 + + + + + + Cloud Authprovider + + + + + + + + Object lifeline.1156 + Kerberos provider + + Sheet.1157 + + + + Sheet.1158 + + + + Sheet.1159 + + + + + + Kerberosprovider + + +