powerpoint presentationdownload.microsoft.com/documents/hk/technet... · slc to fabrikam 2)...

AD RMS Key Concepts

Deploying AD RMS in complex Scenarios

Multiple forests

Logically isolated environments

Physically isolated environments

Centralized licensing

Integrating Partners

Extranet

AD RMS Server Active Directory SQL

Protection Consumption

1 Protection Consumption

Protection Consumption 3

AD RMS Server Terminology Certification server (or cluster)

First AD RMS server (cluster) in the enterprise

Provides certification and licensing capabilities

Licensing server (optional)

Provides licensing services only

Relies on a certification server for certification of users

Cluster

Group of equivalent AD RMS servers sharing the same database

Not to be confused with Windows Server Clustering Services

AD RMS Server

Mobile devices

(Windows Mobile 6.0)

RMS Client

RM-enabled application

AD RMS Infrastructure Components

AD RMS Server

Active Directory

Mobile devices

RMS Client

AD RMS Server

Active Directory

Mobile devices

RMS Client

AD RMS Server

Active Directory

Mobile devices

RMS Client

MOSS 2007

AD RMS Server

Active Directory

MOSS 2007

Exchange Server 2007 SP1

Mobile devices

RMS Client

AD RMS Topology

AD RMS

Root Server Database

AD RMS Topology

Database

AD RMS

Certification

Cluster

AD RMS Topology

Database

AD RMS

Certification

Cluster

Database

License-only Server

AD RMS Topology

Database

AD RMS

Certification

Cluster

Database

License-only Server

Database

License-only Server Cluster

AD RMS Server

Runs on Windows Server 2008 inside IIS

It’s a web service!

Typically runs over SSL

Requires IIS with ASP.NET

Stateless

Uses (before Windows 8) Microsoft Message Queuing

Responsible for transactions to be applied to SQL database

Provides tolerance when connectivity is lost between ADRMS server and SQL Server

AD RMS Databases

AD RMS web services are stateless

All persistent information is stored in SQL Server

Three separate databases

Configuration: hosts configuration data, cluster and user keys

Caching: caches AD identities and group membership

Logging: stores logs of licensing operations

Most operations are performed asynchronously

Data is written to MSMQ, flushed to the DB when possible

If DB not available, AD RMS continues to work “almost” normally

Active Directory

Provides authentication

All accounts related to AD RMS must have an email account

Provides Service Connection Point (SCP) for service location

Determines recipient group membership

Active Directory should be in native mode for group propagation

One AD RMS root cluster per forest

AD RMS certification is limited to users in the AD forest

Active Directory

What’s in a Certificate

AD RMS uses certificates for identity and licenses

AD RMS does not use X.509 certificates!

It uses XrML certs instead

Similar to X.509 but with room for policy

Identity certificate: “this is User X and her email is…”

There are also machine and server certificates

What’s in a license An IRM protected document has an embedded

“Publishing License”

List of rights (like an ACL)

Subjects of rights are email addresses Groups or users

Rights are operations View

Forward

AD RMS Certificates and Licenses

AD RMS Certificates and Licenses SLC:

Server

Licensor

Certificate

Identifies

an AD RMS

cluster.

Security

Processor

Certificate:

Identifies a

client

machine

Rights

Account

Certificate

Identifies

an AD RMS

Client Licensor

Certificate

Identifies an author

in AD RMS

Publishing

License

Identifies a

protected

document

and its policy

Publishing

License

Identifies a

protected

document

and its policy

License

Grants

rights over

document

License

Grants

rights over

document

Fabrikam

Fabrikam Adventure

John@fabrikam.com

sends RM content to

Monica@adventure.com

Fabrikam Adventure

John@fabrikam.com

sends RM content to

Fabrikam Adventure

John@fabrikam.com

sends RM content to

Monica@adventure.com sends

PL and RAC with request for

UL from Fabrikam

Fabrikam Adventure

John@fabrikam.com

sends RM content to

Monica@adventure.com sends

UL from Fabrikam

(FAIL)

Fabrikam

Fabrikam Adventure

1) Adventure sends

SLC to Fabrikam

Fabrikam Adventure

1) Adventure sends

SLC to Fabrikam

Fabrikam Adventure

1) Adventure sends

SLC to Fabrikam

Fabrikam Adventure

1) Adventure sends

SLC to Fabrikam 2) Fabrikam

imports SLC

Fabrikam Adventure

1) Adventure sends

imports SLC

Fabrikam Adventure

1) Adventure sends

imports SLC

3) John@fabrikam.com

sends RM content to

Fabrikam Adventure

1) Adventure sends

imports SLC

sends RM content to

Fabrikam Adventure

1) Adventure sends

imports SLC

sends RM content to

4) Monica@adventure.com sends

UL from Fabrikam

Fabrikam Adventure

1) Adventure sends

imports SLC

sends RM content to

UL from Fabrikam

5) Server uses imported SLC

to verify Monica’s RAC

and returns UL

Fabrikam Adventure

1) Adventure sends

imports SLC

sends RM content to

UL from Fabrikam

and returns UL

Fabrikam Adventure

1) Adventure sends

imports SLC

sends RM content to

UL from Fabrikam

and returns UL

Fabrikam

Fabrikam Adventure

John@fabrikam.com

sends ADRMS content to

Mary@adventure.com

Fabrikam Adventure

John@fabrikam.com

Mary@adventure.com

Fabrikam Adventure

John@fabrikam.com

Mary@adventure.com

Mary@adventure.com sends

UL from local licensing server

Fabrikam Adventure

John@fabrikam.com

Mary@adventure.com

Fabrikam Adventure

John@fabrikam.com

Mary@adventure.com

(FAIL)

Fabrikam

Fabrikam Adventure

Fabrikam Adventure 1) Fabrikam

exports

private key

and SLC

exports

private key

and SLC

2) Adventure

imports private

key and SLC

exports

private key

and SLC

2) Adventure

imports private

key and SLC

exports

private key

and SLC

2) Adventure

imports private

key and SLC

exports

private key

and SLC

2) Adventure

imports private

key and SLC

Mary@adventure.com

exports

private key

and SLC

2) Adventure

imports private

key and SLC

Mary@adventure.com

exports

private key

and SLC

2) Adventure

imports private

key and SLC

Mary@adventure.com

4) Mary@adventure.com sends

exports

private key

and SLC

2) Adventure

imports private

key and SLC

Mary@adventure.com

exports

private key

and SLC

2) Adventure

imports private

key and SLC

Mary@adventure.com

5) Adventure uses imported

private key to decrypt PL

and issues UL

exports

private key

and SLC

2) Adventure

imports private

key and SLC

Mary@adventure.com

and issues UL

exports

private key

and SLC

2) Adventure

imports private

key and SLC

Mary@adventure.com

and issues UL

Fabrikam Adventure

AD RMS

FS-A FS-R

Fabrikam Adventure

AD RMS

FS-A FS-R

1. Assume author is already bootstrapped

Fabrikam Adventure

AD RMS

FS-A FS-R

2. Author sends protected email to recipient at Adventure

Fabrikam Adventure

AD RMS

FS-A FS-R

3. Recipient contacts published Fabrikam AD RMS server to get bootstrapped

Fabrikam Adventure

AD RMS

FS-A FS-R

4. WebSSO agent intercepts request

Fabrikam Adventure

AD RMS

FS-A FS-R

Fabrikam Adventure

AD RMS

FS-A FS-R

5. AD RMS client is redirected to Federation Server (FS)-R for home realm discovery through ISA Server

Fabrikam Adventure

AD RMS

FS-A FS-R

6. AD RMS client is redirected to FS-A for authentication

Fabrikam Adventure

AD RMS

FS-A FS-R

7. AD RMS client is redirected back to FS-R for authentication

Fabrikam Adventure

AD RMS

FS-A FS-R

8. AD RMS client makes request to AD RMS server for bootstrapping

Fabrikam Adventure

AD RMS

FS-A FS-R

9. WebSSO agent intercepts request, checks authentication, and sends request to AD RMS server

Fabrikam Adventure

AD RMS

FS-A FS-R

10. AD RMS server returns bootstrapping certificates to recipient

RAC CLC

Fabrikam Adventure

AD RMS

FS-A FS-R

11. AD RMS server returns use license to recipient

RAC CLC

Fabrikam Adventure

AD RMS

FS-A FS-R

11. AD RMS server returns use license to recipient

12. Recipient accesses protected content

RAC CLC

Cross-Forest Group Expansion

Another forest (contosocorp.com)User’s Domain (contosobranch.com)

Outlook or other

client

AD RMSAD RMS

ADRMS.contosobranch.com

Outlook or other

client

AD RMSAD RMS

Hi, I’m John. Can I get a

license for this

document?

Outlook or other

client

AD RMSAD RMS

Content is protected for

marketing@contosobranch.com,

who’s that?

Outlook or other

client

AD RMSAD RMS

I have a contact for

marketing@contosobranch.com,

and it points to domain

contosobranch.com (duh!)

Outlook or other

client

AD RMSAD RMS

Hey, what’s your RMS

Outlook or other

client

AD RMSAD RMS

It’s adrms.contosobranch.com

Outlook or other

client

AD RMSAD RMS

adrms.contosobranch.com/.../

groupexpansion.asmx, is John a

member of the marketing group?

Outlook or other

client

AD RMSAD RMS

Give me

Marketing

group’s

members

Outlook or other

client

AD RMSAD RMS

It’s John,

Peter and

Outlook or other

client

AD RMSAD RMS

He is, indeed.

Outlook or other

client

AD RMSAD RMS

Here’s your license!

Outlook or other

client

AD RMSAD RMS

Certification ClusterSQL Server (Cluster)

Multi Region

ForestCore forest

forests

Certification

Licensing

Multi Region

ForestCore forest

forests

Certification

Licensing

Multi Region

ForestCore forest

forests

Certification

Licensing

Multi Region

ForestCore forest

forests

Certification

Licensing

Multi Region

ForestCore forest

forests

Certification

Licensing

Licensing-only Cluster

Multi Region

ForestCore forest

forests

Certification

Licensing

Multi Region

ForestCore forest

forests

Certification

Licensing

Multi Region

ForestCore forest

forests

Certification

Licensing

Users in

isolated

sub-org.

Multi Region

ForestCore forest

forests

Certification

Licensing

Users in

isolated

sub-org.

Multi Region

ForestCore forest

forests

Certification

Licensing

Users in

isolated

sub-org.

Multi Region

ForestCore forest

forests

Certification

Licensing

Users in

isolated

sub-org.

Licensing-Only Cluster

Multi Region

ForestCore forest

forests

Certification

Licensing

Users in

isolated

sub-org.

Multi Region

ForestCore forest

forests

Certification

Licensing

Users in

isolated

sub-org.

Multi Region

ForestCore forest

forests

Users in

isolated

sub-org.

Certification

Licensing

External

Organization or

Isolated forest

(with TUD)

External

Organization

(with AD FS)

AD FS trust

Multi Region

ForestCore forest

forests

Users in

isolated

sub-org.

Certification

Licensing

External

Organization or

Isolated forest

(with TUD)

External

Organization

(with AD FS)

AD FS trust

Multi Region

ForestCore forest

forests

Users in

isolated

sub-org.

Certification

Licensing

External

Organization or

Isolated forest

(with TUD)

External

Organization

(with AD FS)

AD FS trust

Mobile

internal user

Home user

Customer

Internet

Inside

Firewall

Internal users

Outside FirewallHTTP 80/tcp

HTTPS 443/tcp

HTTP 80/tcp

Kerberos 88/tcp, 88/udp

NTP 123/tcp

DCE RPC 135/tcp

NetBIOS 137 – 139 tcp and udp

LDAP 389/tcp

HTTPS 443/tcp

SMB 445/tcp

LDAP GC 3268/tcp

Dynamic DCE RPC ports

Domain Controller and

Global Catalog

AD RMS

ServerSQL Server

Mobile

Internal User

Home user

Customer

Internet

Internal

Firewall

Internal users

External FirewallHTTP 80/tcp

HTTPS 443/tcp

HTTP 80/tcp

Kerberos 88/tcp, 88/udp

NTP 123/tcp

DCE RPC 135/tcp

NetBIOS 137 – 139 tcp and udp

LDAP 389/tcp

HTTPS 443/tcp

SMB 445/tcp

LDAP GC 3268/tcp

Dynamic DCE RPC ports

Global Catalog

AD RMS

Licensing

Server

SQL Server

AD RMS

Certification

Server

SQL Server

Mobile

internal user

Home user

Customer

Internet

Internal users

FirewallHTTP 80/tcp

HTTPS 443/tcp

AD RMS

Server

SQL Server

Global Catalog

powerpoint presentationdownload.microsoft.com/documents/hk/technet... · slc to fabrikam 2)...

Documents

microsoft - pdf.maitiku.com · topic 1, fabrikam, inc...

1761-6.3es, controladores programables micrologix...

slc brochure

fabrikam - neca

sim401. a. datum account forest trey research resource...

order entry and fulfillment at fabrikam: an erp...

slc lf20ca

carlos slc

1747-in009b-en-p slc 5/03, slc 5/04, and slc … slc 5/03,...

slc lf18cd

slc cube3+ - deutsche messe...

revolution slc - elta fans slc.… · revolution slc...

slc catalog

microsoft 70-385 exam · microsoft 70-385 exam leading the...

slc500 800 maint instr€¦ · s1557707 (slc.500) s2557749...

slc advisory

solar charge controller样页 · 2020. 4. 6. · note:...

procesadores slc 503 slc 504 y slc 505

microsoft - maitiku · topic 1, fabrikam, inc overview...

slc - rvusa.com