Kerberos Authentication flow
Video version: Kerberos Authentication flow Whenever you login with Windows Authentication to the sever like SQL Server, in many cases, Kerberos is used as a main authentication type. In short, Kerberos is a secure method for verifying the identity of users and services in a network to authenticate users. So, suppose, Kerberos authentication started to fail and your application cannot login? You started to panic and want to troubleshoot as soon as possible! But you do not know how to do that because you do not understand how this authentication works internally. In this case, if you know how Kerberos functions internally, it becomes much easier for you to troubleshoot this issue. The below is the Kerberos authentication flow at high level: 1. Whenever client tries to login to the server, it should first do Name resolution. If there is no DNS cache, it will connect domain controller and bring IP address for the server DNS name. 2. Afterwards, there will be three-way TCP handshake with the server. 3. Following TCP handshake, servers negotiate on protocol types of authentications: NTLM or KERBEROS. Often Kerberos is chosen as this is new protocol with more performance efficiency. 4. After Kerberos is chosen, Client will do TCP handshake on TCP port 88. 5. Then, client will send AS-REQ packet to KDC center in domain controller. AS-REQ (Authentication Service Request) is the initial message sent by a client to the Key Distribution Center (KDC) in Domain controller to get TGT. This message includes the client's principal name (username) and may include pre-authentication data such as password. If the username is correct and password is valid, domain controller sends AS RESPONSE. This response includes TGT key and session key. Here is the important point: TGT key is encrypted with password of KRBTGT account and session key is encrypted with client's password. If you go to your domain controller, you will see this KRBGT account. TGT is encrypted with this account’s password. When the client receives the TGT, it decrypts the session key with password and this session key is placed in memory along with the TGT. Going forward the account’s password is no longer required. When the client makes subsequent ticket requests it will present the TGT and creates a new authentication using the session key and the system timestamp. 6. After getting TGT and session key, client makes TGS request presenting TGT and service principal name (SPNs) of the service the client wants to access. 7. After getting TGS-REQ, domain controller decrypts TGT ticket, validates the user and SPNs. If the SPNs are correctly registered and user credentials, TGT ticket are valid, domain controller responds with TGS-REP which includes the service ticket and a session key. The service ticket is encrypted with the service's secret key, while the session key is encrypted with the client's session key. Here, important point is service ticket is encrypted with the password of service account attached to the server and session key is encrypted by the client’s session key. Therefore, client cannot decrypt service ticket. 8. Finally, by using this service ticket, client makes AP request to the server. And AP-REP is received. This AP-REP is often not mandatory and does not happen depending on the service type. With this, KERBEROS authentication finishes. Authentication flow in network traces 1. TCP-handshake 2. First, as we learn AS REQUEST is sent. One important point here: first AS-REQ fails with PRE-AUTH REQUIRED error because client did not send pre-authorization, or did not send the appropriate type of pre-authorization, to receive a ticket. The client will retry with the appropriate kind of pre-authorization (the KDC returns the pre-authentication type in the error). Many Kerberos implementations will start off without preauthenticated data and only add it in a subsequent request when it sees this error. This is expected and you should ignore this. 3. Afterwards, client again sends AS-REQUEST with appropriate pre-authorization. 4. Domain controller is responding with AS-REP and providing encrypted TGT ticket and session key. 5. By using this session key and TGT, client is making TGS request. It also includes SPN names. 6. Finally, domain controller responds TGS response and includes service key. By using this service key, client makes authentication request.
Remove red overdue date from recurring tasks
Some tasks, which are set to be recurring everyday, do not need to be highlighted red with an overdue date if not completed. Can this be turned off? I want the task to appear every day, but I don't want it to be flagged as overdue, and definitely not in a red font. e.g. task: 'Take a 20 minute walk' doesn't need to be flagged as overdue if it hasn't been done that day, but it is helpful to be in my task list each day.Introducing Project Robin | New Feature
this one is a new flag you can enable: edge://flags/#edge-robin Microsoft Edge Version 91.0.852.0 (Official build) canary (64-bit) I think, Project Robin is a way to show Windows Defender Application Guard windows as tabs, next to other regular tabs. because right now, when you open a new WDAG window, it has its own protected window, backed up by Windows Defender engine. this Project Robin might be a way to bring the 2 environments together in the same window. so far the feature doesn't seem to be fully implemented yet. when I try it, it takes me to https://dev.browse.trafficmanager.net/?header=0&url=https%3A%2F%2Fwww.bing.com%2F&escape=newdomain&titlePrefix=0 and then nothing. it's exciting, waiting for future versions to see more changes.New Feature for Web Capture - Subscroller area selection
Normally you can't use Web Capture or Smart Copy in Edge to capture the contents of the 2nd scrollbar, but now you can with this new feature added under this flag in Edge Version 91.0.844.0 (Official build) canary (64-bit) Subscroller area selection. When enabled, users will be able to select sections of subscrollers when using WebCapture or SmartCopy. – Mac, Windows, Linux #edge-subscroller-area-selection edge://flags/#edge-subscroller-area-selectionYou can turn on Math Solver feature on-demand now
Make sure you are at least on Edge version 91.0.831.0 (Official build) canary (64-bit) and then enable this new flag: edge://flags/#edge-math-solver You can learn more about Math Solver feature here: https://techcommunity.microsoft.com/t5/articles/learn-how-to-solve-math-problems-with-math-solver-in-microsoft/m-p/2195689Microsoft Edge Kids! - Kids mode added to Edge - What an Amazing feature! (●'◡'●)
Microsoft Edge version 90.0.800.0 (Official build) canary (64-bit) introducing Kids mode which can be accessed from the browser settings: edge://settings/family you can learn all about it here in this official page a brief description: Kids Mode is a convenient browsing mode inside Microsoft Edge that’s designed for kids. With its kid-friendly features and safety guardrails in place, Kids Mode is a great place for children to safely explore the web. Kids Mode includes features like custom browser themes, kid-friendly content, browsing based on an allow list, Bing SafeSearch set to strict, and a password requirement to exit. Also, Kids Mode doesn't require a child account or profile. Currently, Kids Mode is limited to US English on Windows and MacOS. Kids mode is full screen mode, in order to exit it, kids need to have Windows Pin or Password and you can see, all the appropriate content and links are added to the home page ^^ Bonus content:Some parts of the Privacy Sandbox land on Edge Canary
This flag edge://flags/#use-first-party-set which was added today to Edge Version 89.0.749.0 (Official build) canary (64-bit) it's one of many privacy-related features for Privacy Sandbox, the goal of which is to ultimately get rid of 3rd party cookies. Use First-Party Sets First-Party Sets are sets of registrable domains (or origins). The browser uses these sets to allow websites that have multiple domains to treat their related domains as if they were first-party domains. This enables less restricted cross-domain communication across all the domains in a First-Party Set. – Mac, Windows, Linux Enable domains to belong to the same first party Goal: Enable entities to declare that related domain names are owned by the same first party. Many organizations own sites across multiple domains. This can become a problem if restrictions are imposed on tracking user identity across sites that are seen as 'third-party' but actually belong to the same organization. First Party Sets aims to make the web's concept of first and third parties more closely aligned with the real world's by enabling multiple domains to declare themselves as belonging to the same first party. more info: Digging into the Privacy Sandbox (web.dev) privacycg/first-party-sets (github.com)Alt + Tab experience can now be turned off from the browser using this newly added flag
This flag that was just added today to Edge Version 89.0.736.0 (Official build) canary (64-bit) edge://flags/#edge-window-tab-manager can disable Alt + Tab experience the description says: "Allows Windows to show open Microsoft Edge tabs in OS experiences like Alt + Tab, pinned sites, and more. – Windows" so regardless of what your settings are in Windows you can stop Edge tabs to appear as separate windows in Alt + Tab view.
