How Active Directory Works?

 

Active Directory (AD) plays a crucial role in authentication and authorization in Windows-based networks. Here's how it works for authentication and authorization, along with an example and use case:

Authentication:

Authentication is the process of verifying the identity of a user or system attempting to access network resources. Active Directory uses various authentication protocols, with the most common being the Kerberos protocol.

Example:

Let's say a user named "John" wants to log in to his computer within the Example Corp network. Here's how Active Directory authentication works:

1. User Credentials: John enters his username and password at the Windows login screen.

2. Authentication Request: The computer sends an authentication request to a domain controller in the "example.com" domain, where Active Directory is hosted.

3. Verification: The domain controller checks John's credentials against the user accounts stored in its database. If the username and password match, the user is considered authenticated.

4. Kerberos Authentication: Active Directory uses the Kerberos authentication protocol to securely validate John's identity. This involves creating and exchanging tickets between the client (John's computer) and the domain controller.

5. Access Granted: Once John's identity is verified, he is granted access to his computer, along with the resources and permissions associated with his user account.

Use Case:

Imagine a corporate network where employees need access to various resources like shared files, printers, and email. Active Directory authentication is crucial for ensuring that only authorized users can access these resources.

Use Case Scenario:

1. File Share Access: The company has a file server where sensitive documents are stored. Access to these documents is restricted to specific departments. Active Directory is used to manage user accounts and group memberships.

   • Authorization: Active Directory groups are created for each department (e.g., "Sales," "Marketing"). Users are added to the appropriate groups based on their roles.
   • Resource Access: Access control lists (ACLs) on the file server's shared folders are configured to allow only members of the respective groups to access department-specific files.

2. Printers: There are network printers throughout the office. Different departments need access to specific printers.

   • Authorization: Active Directory groups are created for printer access (e.g., "Finance_Printers," "HR_Printers").
   • Resource Access: Printers are shared on the network and configured to allow access only to members of the corresponding Active Directory groups.

3. Email Access: The company uses Microsoft Exchange for email. Employees' email accounts are integrated with Active Directory.

   • Authentication: When employees access their email, Active Directory verifies their credentials to ensure only authorized users can access their email accounts.
   • Authorization: Mailbox permissions and distribution groups in Active Directory are used to control who can send emails to specific groups or access shared mailboxes.
   •  
   • ========================================================
   • Notes :

   • Authentication:Purpose: Authentication is the process of verifying the identity of a user, system, or entity attempting to access a particular resource or system. It answers the question, "Who are you?"

     Example: When you log in to your computer using your username and password, the system verifies that the provided credentials match those stored in its database. If they match, you are authenticated, and access to your user account is granted. 

     Authorization:Purpose: Authorization is the process of determining what actions or resources a properly authenticated entity is allowed to access or perform within a system. It answers the question, "What are you allowed to do?"

     Example: After successfully logging in to your computer (authentication), you are granted specific permissions based on your user account's role or group membership (authorization). For example, as an authorized user, you may have permission to read and write files in certain folders but not others 

   • 
     

   •  

      

   • 
     
   •