Cisco Cisco ASA 5555-X Adaptive Security Appliance 發佈版本通知

Kerberos Constrained 
Delegation (KCD)

This release implements the KCD protocol transition and constrained delegation extensions on 
the ASA. KCD provides Clientless SSL VPN (also known as WebVPN) users with SSO access 
to any web services protected by Kerberos. Examples of such services or applications include 
Outlook Web Access (OWA), Sharepoint, and Internet Information Server (IIS).

Implementing protocol transition allows the ASA to obtain Kerberos service tickets on behalf 
of remote access users without requiring them to authenticate to the KDC (through Kerberos). 
Instead, a user authenticates to ASA using any of the supported authentication mechanisms, 
including digital certificates and Smartcards, for Clientless SSL VPN (also known as 
WebVPN). When user authentication is complete, the ASA requests and obtains an 
impersonate ticket, which is a service ticket for ASA on behalf of the user. The ASA may then 
use the impersonate ticket to obtain other service tickets for the remote access user.

Constrained delegation provides a way for domain administrators to limit the network 
resources that a service trusted for delegation (for example, the ASA) can access. This task is 
accomplished by configuring the account under which the service is running to be trusted for 
delegation to a specific instance of a service running on a specific computer.

We modified the following screen: Configuration > Remote Access VPN > Clientless SSL 
VPN Access > Advanced > Microsoft KCD Server.

Clientless SSL VPN browser 
support

The ASA now supports clientless SSL VPN with Apple Safari 5.

Clientless VPN Auto 
Sign-on Enhancement

Smart tunnel now supports HTTP-based auto sign-on on Firefox as well as Internet Explorer. 
Similar to when Internet Explorer is used, the administrator decides to which hosts a Firefox 
browser will automatically send credentials. For some authentication methods, if may be 
necessary for the administrator to specify a realm string on the ASA to match that on the web 
application (in the Add Smart Tunnel Auto Sign-on Server window). You can now use 
bookmarks with macro substitutions for auto sign-on with Smart tunnel as well.

The POST plug-in is now obsolete. The former POST plug-in was created so that 
administrators could specify a bookmark with sign-on macros and receive a kick-off page to 
load prior to posting the the POST request. The POST plug-in approach allows requests that 
required the presence of cookies, and other header items, fetched ahead of time to go through. 
The administrator can now specify pre-load pages when creating bookmarks to achieve the 
same functionality. Same as the POST plug-in, the administrator specifies the pre-load page 
URL and the URL to send the POST request to.

You can now replace the default preconfigured SSL VPN portal with your own portal. The 
administrators do this by specifying a URL as an External Portal. Unlike the group-policy 
home page, the External Portal supports POST requests with macro substitution (for auto 
sign-on) as well as pre-load pages.

We introduced or modified the following screens:
Configuration > Remote Access VPN > Clientless SSL VPN Access > Portal > Customization.
Configuration > Remote Access VPN > Clientless SSL VPN Access > Portal > Bookmarks > 
Edit > Edit Bookmark