How to Configure the FCC to Allow Windows Authentication

Contents
sm1252sp1
Contents
The 
CA Single Sign-On
 Forms Credential Collector (FCC) is designed to enable CA Services to trigger custom authentication schemes securely. As such, the FCC can authenticate users against any authentication scheme. However, the FCC does 
not 
authenticate against Windows authentication schemes by default. This behavior prevents an attacker from exploiting the FCC to generate a 
CA Single Sign-On
 session for any valid Windows user in certain configurations.
If your environment requires the FCC to authenticate against the Windows authentication scheme, you can enable it by specifying the EnableFCCWindowsAuth agent configuration parameter. However, before you enable FCC support for Windows authentication, review the risks of doing so and be aware of configurations that expose the vulnerability.
SM--SSO--Configure FCC for Windows Authentication.png
 
Risks of Enabling the FCC to Allow Windows Authentication
By default, the FCC does not authenticate against Windows authentication schemes. You can enable the FCC to allow Windows authentication. However, doing so exposes a vulnerability whereby an attacker could use an FCC to generate a 
CA Single Sign-On
 session for any valid Windows user in certain configurations.
The vulnerability is present in configurations in which the same 
CA Single Sign-On
 Agent name or Agent group name is used in both an HTML Forms-protected realm and a Windows-protected realm. For example, a configuration in which a single Web Agent is configured to protect different realms that are configured with HTML Forms and Windows authentication.
Consider the following example scenario:
  • Resource A is configured in a realm protected using HTML Forms authentication. The FCC challenges users accessing Resource A with an HTML form.
  • Resource B is configured in a realm protected using Windows authentication. Users accessing Resource B complete Windows authentication.
  • Both resources are hosted on the same IIS Server and are protected by the same Web Agent. Both realms are therefore configured with the same Agent name.
The attack occurs as follows:
  1. The attacker modifies the TARGET parameter in the HTML form from "Resource A" to "Resource B."
  2. The attacker submits the form with any valid Windows username.
  3. The FCC passes the username to the Policy Server for authentication. 
    CA Single Sign-On
     executes the Windows authentication scheme instead of the HTML Forms authentication scheme and the username is validated.
The result is a 
CA Single Sign-On
 session returned to the user which enables single sign-on for all following requests where the new session is considered valid. The attacker is now impersonating the user whose Windows username was submitted to the FCC.
Configure the FCC to Allow Windows Authentication
You configure the FCC to allow Windows authentication by specifying the following agent configuration parameter:
  • EnableFCCWindowsAuth
    Specifies whether an agent, acting as an FCC, can authenticate users against resources that the 
    CA Single Sign-On
     Windows authentication scheme protects.
    This parameter uses the following values:
    • Yes—FCCs can authenticate against a Windows authentication scheme.
      When this parameter is set to Yes, an attacker can potentially exploit the FCC to impersonate Windows users without providing required credentials.
    • No—FCCs cannot authenticate against a Windows authentication scheme.
    Default:
     No