Microsoft Security Advisory: Extended protection for authentication

Microsoft has released security advisory 973811. To view the complete security advisory, visit the following Microsoft website:

How to obtain help and support for this security update

Help installing updates: Support for Microsoft Update (http://support.microsoft.com/ph/6527)

Security solutions for IT professionals: TechNet Security Troubleshooting and Support (http://technet.microsoft.com/security/bb980617.aspx)

Help protect your computer that is running Windows from viruses and malware: Virus Solution and Security Center (http://support.microsoft.com/contactus/cu_sc_virsec_master)

Local support according to your country: International Support (http://support.microsoft.com/common/international.aspx)

How do I configure .NET to utilize Extended Protection for Authentication?

Here are the steps for enabling Extended Protection for the Microsoft .NET Framework 2.0 Service Pack 2, .NET Framework 3.0 Service Pack 2, and .NET Framework 3.5 SP1.

For .NET Framework 2.0 Service Pack 2 (Network Class Library)

Extended protection can be turned on by setting properties on HttpListener. For more information, visit the following Microsoft MSDN websites: If NegotiateStream is used, then the appropriate overloads of [Begin]AuthenticateAsServer and [Begin]AuthenticateAsClient need to be used: For more information, visit the following Microsoft MSDN websites:

In addition to the recommendations in these Microsoft websites, follow these steps:

1. On the client side, install the Extended Protection for Authentication update for Security Support Provider Interface (SSPI). This update changes SSPI to improve Windows authentication. Additionally, this update prevents credentials from being forwarded. After you install this update, you must implement the registry settings that are described in Microsoft Knowledge Base (KB) article 968389 to enable extended protection. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
   968389  (http://support.microsoft.com/kb/968389/ ) Extended Protection for Authentication
2. On the server side, install the Extended Protection for Authentication update for the HTTP Protocol Stack.

For .NET Framework 2.0 Service Pack 2 (ASP.NET)

No special action is required in order to use Extended Protection.

For .NET Framework 3.0 Service Pack 2 (WCF)

To enable the Extended Protection for Authentication feature in WCF, follow these steps: To do this, follow these steps:

1. On the client side, install the Extended Protection for Authentication update for Security Support Provider Interface (SSPI). This update changes SSPI to improve Windows authentication. Additionally, this update prevents credentials from being forwarded. After you install this update, you must implement the registry settings that are described in Microsoft Knowledge Base (KB) article 968389 to enable extended protection. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
   968389  (http://support.microsoft.com/kb/968389/ ) Extended Protection for Authentication
2. On the server side, install the Extended Protection for Authentication update for the HTTP Protocol Stack.
3. Install the Extended Protection for Authentication update for Internet Information Services (IIS) when IIS is installed.
   
   After you install the update, follow the instructions in KB article 973917 to configure extended protection in IIS. For more information, click the following article numbers to view the article in the Microsoft Knowledge Base:
   973917  (http://support.microsoft.com/kb/973917/ ) Description of the update that implements Extended Protection for Authentication in Internet Information Services (IIS)
   970430  (http://support.microsoft.com/kb/970430/ ) Description of the update that implements Extended Protection for Authentication in the HTTP Protocol Stack (http.sys)
4. Use the ExtendedProtectionPolicy class in WCF to represent the extended protection policy that the server uses to validate incoming client connections. The class can be applied only when the security mode is set to Transport mode or to TransportWithMessageCredential mode. The following is a sample code that shows the configuration in a binding element of a service config file:

   
   <binding>
   ……………
      <security mode="Transport">
              <transport ……………>                     
                <extendedProtectionPolicy policyEnforcement ="WhenSupported"/>
              </transport > 
            </security>
   </binding>
   
   

   For more information about the Extended Protection for Authentication feature, visit the following Microsoft TechNet website:
   Extended Protection for Authentication (http://blogs.technet.com/b/srd/archive/2009/12/08/extended-protection-for-authentication.aspx)

For more configuration information, click the following article numbers to view the articles in the Microsoft Knowledge Base:

For more information about known issues with this software, click the following article number to view the article in the Microsoft Knowledge Base: