The IAS server receives authentication requests from NAS servers, compares the requests to the contents of a Windows NT user database, and returns authentication information to the NAS using the RADIUS protocol. The RADIUS server processes authentication requests by directing the authentication request to the Windows NT Domain Controller.
Windows NT Server user-account databases are stored on Windows NT Domain Controllers. A Domain Controller is installed during Windows NT setup to provide authentication for a domain, a group of computers linked over a local area network (LAN). The Windows NT authentication provider can communicate with a local Windows NT Domain Controller and/or a remote Windows NT Domain Controller across the network.
On receiving a RADIUS Access-Request packet, the IAS server first compares the shared secret between the client and server. If they match, the IAS server then compares the user-identification data forwarded by the NAS against the data in its database to determine whether the password is correct. If the password was entered correctly, the server returns a message to the NAS to allow the user onto the network. This is called an ACCESS-ACCEPT packet. If password authentication fails, the server sends a message to reject the request, and the NAS disconnects the user. This is called an ACCESS-REJECT packet.
IAS compares the name against its Windows NT domain controller. To be authenticated, the user name and password must exactly match data in the file. If the user name matches but the password does not, IAS returns an ACCESS-REJECT packet to the requesting NAS, and the IAS server stops processing the request.
IAS provides administrators with the ability to create a RADIUS profile that applies to all authentication requests. This profile is a collection of RADIUS attributes that perform specific functions. The most common profile is included in IAS, but administrators can edit this profile to suit their needs and the capabilities of their ISP.
The Internet Authentication Server implements RADIUS attributes through a database called Dictionary. This dictionary contains all standard RADIUS attributes at ship time as well as other attributes that have been supplied by hardware vendors. A full list of supported RADIUS attributes can be found in the Appendix of this document.
Some vendors provide functionality that is not supported in standard attributes through Vendor Specific Attributes (VSAs). IAS enables you to create or edit vendor specific attributes to take advantage of proprietary functionality supported by some NAS vendors. For information about vendor specific functionality, see your NAS vendor’s documentation.