Web Agent Guides › Web Agent Configuration Guide › Forms Authentication › How to Configure a CA SiteMinder® Agent to Support HTML Forms Authentication › Configure Advanced FCC Settings › How to Configure the FCC to Allow Windows Authentication

How to Configure the FCC to Allow Windows Authentication

The CA SiteMinder® Forms Credential Collector (FCC) is designed to enable CA Services to trigger custom authentication schemes securely. As such, the FCC can authenticate users against any authentication scheme. However, the FCC does not authenticate against Windows authentication schemes by default. This behavior prevents an attacker from exploiting the FCC to generate a CA SiteMinder® session for any valid Windows user in certain configurations.

If your environment requires the FCC to authenticate against the Windows authentication scheme, you can enable it by specifying the EnableFCCWindowsAuth agent configuration parameter. However, before you enable FCC support for Windows authentication, review the risks of doing so and be aware of configurations that expose the vulnerability.

1. Review the risks of enabling the FCC to allow Windows authentication.
2. Configure the FCC to allow Windows authentication.

Risks of Enabling the FCC to Allow Windows Authentication

By default, the FCC does not authenticate against Windows authentication schemes. You can enable the FCC to allow Windows authentication. However, doing so exposes a vulnerability whereby an attacker could use an FCC to generate a CA SiteMinder® session for any valid Windows user in certain configurations.

The vulnerability is present in configurations in which the same CA SiteMinder® Agent name or Agent group name is used in both an HTML Forms-protected realm and a Windows-protected realm. For example, a configuration in which a single Web Agent is configured to protect different realms that are configured with HTML Forms and Windows authentication.

Consider the following example scenario:

• Resource A is configured in a realm protected using HTML Forms authentication. The FCC challenges users accessing Resource A with an HTML form.
• Resource B is configured in a realm protected using Windows authentication. Users accessing Resource B complete Windows authentication.
• Both resources are hosted on the same IIS Server and are protected by the same Web Agent. Both realms are therefore configured with the same Agent name.

The attack occurs as follows:

1. The attacker modifies the TARGET parameter in the HTML form from "Resource A" to "Resource B."
2. The attacker submits the form with any valid Windows username.
3. The FCC passes the username to the Policy Server for authentication. CA SiteMinder® executes the Windows authentication scheme instead of the HTML Forms authentication scheme and the username is validated.

The result is a CA SiteMinder® session returned to the user which enables single sign-on for all following requests where the new session is considered valid. The attacker is now impersonating the user whose Windows username was submitted to the FCC.

Configure the FCC to Allow Windows Authentication

You configure the FCC to allow Windows authentication by specifying the following agent configuration parameter:

EnableFCCWindowsAuth

Specifies whether an agent, acting as an FCC, can authenticate users against resources that the CA SiteMinder® Windows authentication scheme protects.

This parameter uses the following values:

• Yes—FCCs can authenticate against a Windows authentication scheme.

  Important! When this parameter is set to Yes, an attacker can potentially exploit the FCC to impersonate Windows users without providing required credentials.

• No—FCCs cannot authenticate against a Windows authentication scheme.

Default: No