Kerberos Authentication

[pasmi02]

Hi all,

 

I'm working with a customer to configure Kerberos Authentication for SSO in a pre-production environment. 

 

My question: Is it required that the policy server(s) be in the same domain as the IIS/Webagent and User Directory? 

 

More details: 

 

Policy Server: is Production Domain

IIS/Webagent server: in Stage Domain

AD User Directory: in Stage Domain

 

I wasn't sure if it was required that policy server also be in the Stage Domain since the User Directory object and Policy object in SSO is configured for stage domain... 

 

Thanks for any insight that can be provided. 

 

Michael Pass

[John Schwartz]

Michael, I do not believe so. I have it setup on Linux boxes in all lower and prod environments and all point to the production KDC.  This is where the logged in users creds are.

 

 

Since the authentication is based on the usersbroswer and their logged in creds, the server hosting the authentication does not matter as long as it is communicating with the proper KDC. 

John

[Sarvesh Kumar]

Policy Server, SM Agent, and User should belong to same KDC server i.e. Server Account for policy server and SM Agent and Users Account must lie with KDC server.

As long as the above condition is true you can have the policy server anywhere in the infrastructure.

 

Key Points for Kerberos Authentication

 

SM Web Agent Account Delegation:

Configure SM Web Agent account on the KDC (usually Active Directory) for unconstrained trusted delegation using "Trust this user for delegation to any service (Kerberos only)" first. If it works, try to configure constrained delegation using "Trust this user for delegation to specified services only" and add the "smps" account/service to the list.

 

CA Single Sign-On Agent Configuration Object

ACO Option	ACO Value Format	Description
HttpServicePrincipal	HTTP/[e-mail]	This option is used by the web agent when authenticating to the KDC. It is always in the form HTTP/web-server-name@kerberos-realm where web-server-name is the name of the web server (as used by the HTTP user agent), and kerberos-realm is the Kerberos realm. For example, there might be multiple web servers behind a load balancer virtual IP. In that case, you would specify the name of the load balancer rather than a specific server.
KCCExt	.kcc	Extension for the CA SSO Kerberos credential collector, typically .kcc.
SmpsServicePrincipal	[e-mail]	This option is used by the web agent when delegating authentication credentials to the policy server. It is always in the form smps@policy-server-name where policy-server-name is the name of the CA SSO policy server. As with the HttpServicePrincipal setting, this might be a name shared among multiple policy servers.

CA Single Sign-On Kerberos Authentication Scheme

Authentication Scheme Option	Authentication Scheme Value Format	Description
Principal Name	smps/[e-mail]	This option is used by the policy server when authenticating to the KDC. It is always in the form smps/policy-server-name@kerberos-realm where policy-server-name is the name of the CA SSO policy server and MUST match the value in the ACO's SmpsServicePrincipal option.

 

Other Key Points

1. We can’t use multiple Keytab and SM Policy server account on KDC server for Kerberos Authentication. i.e.we need to create a common account on KDC server for policy server.
2. For Web Agent, we can have multiple KeyTab or AM Agent account on KDC server.
3. We should fine-tune the Delegation. i.e. We need delegation only for SM Web Agent account (HTTP/***) and not for SM Policy server Account ( smps/****).  Also, we should configure constraint-based delegation “Trust this user for delegation to specified services only - add smps”  instead of on unconstrained delegation for “Trust this user for delegation to any service (Kerberos only)”

 

Reference:

1. Kerberos Troubleshooting:

https://communities.ca.com/docs/DOC-231172118-kerberosauthenticationwithcasinglesignonreferenceconfigv2pdf

1. Kerberos Troubleshooting

https://communities.ca.com/docs/DOC-231177811-kerberos-troubleshooting#jive_content_id_Listing_Keytabs_on_Windows_with_KTPASSEXE

 

Thanks & Regards,

-Sarvesh

[John Schwartz]

I don't know what you mean by "belong" to the same KDC.  Yes, all services accounts used for the keytabs would be in the same domain as the us etc..  The question was, does the server itself need to be part of the domain and I do not think that is necessary.