Kerberos Settings & Kerberos Suggests

In this section, you configure simplified user authentication (SSO) using the Kerberos protocol through Active Directory. It works in web and desktop applications 3.67 and later, on server software 3.65 and later. Here you can also upload a keytab file with user credentials.

Kerberos Suggests

In the Kerberos Suggests subsection, Active Directory groups are mapped to corporate servers. If the organization has several , users don't have to select the server manually.

What Happens if a User Has Groups/Roles Associated With Different Servers?

If a separate server was configured for each of the user's groups, the user will see a list of those servers to choose from.

For example, several groups are mapped to different servers:

• ad_group_1 > server_1
• ad_group_2 > server_2
• ad_group_3 > server_3

The user belongs to ad_group_1 and ad_group_3. Then the user will see a list of servers:

• server_1
• server_3

Which Browser Policies Are Required for Kerberos Login in the Web App?

To enable Kerberos authentication in the browser, add the following policies:

• AuthServerAllowlist — domains allowed to request a Kerberos ticket
• AuthNegotiateDelegateAllowlist — domains allowed to delegate the ticket

If your organization uses a single domain, listing it once in both policies is sufficient — you do not need to separately list the FQDNs of the web and corporate servers.

Which Encryption Type Is Required for the Keytab File?

AES256-SHA1 is required. Generate a keytab with support for this encryption. The Active Directory account associated with the keytab must also support it. The service principal name (SPN) for the server is registered in Active Directory using the command:

setspn -S HTTP/<server-fqdn> <AD_account>