Policy Server Guides › Policy Design Guide › User Directories › Windows Directory Connections › WinNT Domain Connection Requirements

WinNT Domain Connection Requirements

In order for the Policy Server to connect to your WinNT domain, it must meet the following requirements:

• A one way trust relationship between the domain containing the Policy Server, and the domain containing users, must exist.
• Every user in the domain that will be authenticated by SiteMinder needs the Access the computer from network user right for the machine where the policy server is running.
• The account that SiteMinder uses to access the User Directory object needs to have access to the IPC$ share on the domain controller machine where the WinNT domain users are located.

  Note: These requirements may be met by default if you use the default configuration for your WinNT domain. Your WinNT domain administrator should verify that the domain meets the above requirements.

• For Windows deployments, SiteMinder establishes the Windows user context by passing the user's fully-qualified Windows id and password to IIS. SiteMinder obtains the fully qualified Windows id from the user's DN entry by concatenating the login name of the authenticated user with the first dc value found in the user's LDAP DN. The login name is usually the same value as the SM_USER header. For example, if the user DN iscn=name,cn=user_group,dc=server,dc=domain,dc=extension, and the username is user_name, the resulting Windows id is server\user_name. IIS requires that the user_name be the same as the Windows user id and that <server> be the logon domain name.

The Policy Server authenticates against WinNT and can authorize users based on their individual identities and group membership.

When authenticating against a WinNT namespace, the Policy Server passes user credentials to WinNT for authentication. The credentials are the user's WinNT user name and password. In a SiteMinder environment, where multiple WinNT namespaces are defined, user authentication is faster if the user name supplied to SiteMinder includes the domain name (i.e. domain\username). In that case, SiteMinder skips all WinNT namespaces that do not match the specified domain name.

WinNT user names and passwords can be used as credentials.

Note: To authenticate users against a WinNT domain, the Policy Server must run on WinNT.