0

I have a problem regarding RODC forwarding.

There is a WPF Application calling an WCF service configured with Net.Tcp Binding and Windows Authentication (like here) https://learn.microsoft.com/en-us/dotnet/framework/wcf/feature-details/message-security-with-a-windows-client in an off-site scenario.

In that off-site there is only a RODC installed for security reasons. Now the problem is if WCF asks for the Kerberos-Ticket on client-side (WPF) it asks the RODC and this Controller redirects its requests to the RWDC (that is somewhere else with a slow Connection).

So the calls get very slow and sometime also have timeouts because of AD-Communication.

So is there a way to tell WCF to use the RODC with cashed credentials so that the RODC could response with the Kerberos ticket directly

thanks in advance very much for you input

Improve this question
1
  • Please try configuring the RODC IP address in hosts file if possible if DNS is also installed on the same server. Commented Nov 11, 2021 at 18:19

1 Answer 1

Reset to default
0

• When a user/service authenticates to an RODC, a check is performed to see if the password is cached. If the password is cached, the RODC will authenticate the user account locally. If the user’s password is not cached, then the RODC forwards the authentication request to a writable Windows Server Domain Controller which in turn authenticates the account and passes the authenticated request back to the RODC. Once the user account is authenticated, the RODC makes another request for the replication of the user’s password in a unidirectional replication providing the account has been configured to allow replication. Thus, please check your credentials are cached correctly in credential manager/vault in Control Panel.

• In your case, if you want WCF to prioritize authentication requests of cached credentials to send it to RODC, you should configure the weight of the RODC higher than the other DCs for your site as authentication is managed by sites and services in an AD environment. As you said, it is an off-site where you have setup RODC for security reasons, then accordingly configure the respective sites and its related subnets in the Primary Domain Controller correctly for the authentication request priorities in that site to be redirected to the DC in that subnet/site accordingly. This might help you resolve your authentication redirection problem.

You can also do the following for prioritizing RODC for authentication in that site: -

  1. Move the RODC to a new site in Active Sites & Services, then assign the subnets to that new site. Remember to create site links to link the new site to the others.

  2. Set LdapSrvPriority to zero for the RDOC and increase to a higher value for the writable DCs. (HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\LdapSrvPriority)

Improve this answer
Sign up to request clarification or add additional context in comments.

4 Comments

Hi, thanks for you answer and detailed explaination, further checks now seems to that WCF dont support the KRB_AS_REQ that is needed for RODC to get a ticket based on cached User-Password
RODC rather forwarding this TGS ticket to computer directly ,it makes the user to generate a new KRB_AS_REQ because it doesn’t have to rely on RWDC for authentication next time. Now again KRB_AS_REQ is generated for user , since password is already cached, RODC itself responds with KRB_AS_REP with RODC krbtgt account Now again new TGS ticket is generated with KRB_TGS_REQ with user’s KRBTGT account. This time RODC able to issue KRB_TGS_REP allows user to access his computer Source: mohanrav.wordpress.com/2012/03/15/…
Dont know if this is really the case, because for me it seems that WCF SSPI Authentication should als be aware and working with RODC
Then might be this documentation link would be of help to you. Please refer it and determine the issue that you are facing with the WCF SSPI authentication : - learn.microsoft.com/en-us/dotnet/framework/wcf/feature-details/…

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.