Using NegotiateStream when domain is unavailable

Question

I'm using a NegotiateStream to authenticate a client/server application. The server side code looks like this:

SecureStream = new NegotiateStream(Stream, true);

SecureStream.AuthenticateAsServer(
    CredentialCache.DefaultNetworkCredentials,
    ProtectionLevel.EncryptAndSign,
    TokenImpersonationLevel.Identification);

if (!SecureStream.IsAuthenticated)
{
    return false;
}
WindowsPrincipal principal = new WindowsPrincipal(
    (WindowsIdentity)SecureStream.RemoteIdentity);

// ExpectedRoles is a string[] of possible roles
foreach (string role in ExpectedRoles)
{
    if (principal.IsInRole(role))
        return true;
}

The client side code looks like this:

SecureStream = new NegotiateStream(Stream, true);
SecureStream.AuthenticateAsClient();
if (!SecureStream.IsAuthenticated)
{
    return false;
}

The client and server can be run on separate network segments of the same domain. So if they're on a different segment than the domain controller is, and the internet connection goes down, they should be able to operate in offline fashion. The problem is, some of the domains are configured so users can't authenticate in a domain disconnected mode (apparently turning that functionality off is a security measure).

So I'm trying to figure out an authentication model that will allow me to authenticate non-domain users as a fallback position when the domain is not available.

Answer 1

Kerberos (and to a lesser degree NTLM) is pretty tolerant of transient network outages between the server and the DC. Once the user has obtained a valid Kerb ticket for the server, the server will continue to authenticate the user even if the server (or the client) can't contact the DC. The default lifetime of such tickets is 10 hours, which usually covers folks for transient outages during a routine business day.

NTLM sessions are cached for more like 15 minutes (last I checked on this, which was 4-5 years ago), so the transient outages would have to be more transient than "an hour or three".

What is the expected outage timeframe between client (or server) and the DCs? [Aside: if it's really bad, why not investigate dropping a lower-powered DC (even a read-only copy, if you're running 2008 AD) on the near side of the lossy network segment?]