How To Configure Kerberos Authentication

RapidIdentity Platform Documentation
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

Traditionally, a user has always been required to enter their username and password in order to log in to RapidIdentity. Customers may deem this process redundant when a user has already logged into their domain-joined Windows workstation.

Kerberos Authentication is supported in RapidIdentity 3.5 for On-premise and 2022.4.5 for Cloud - verify that you are running a version that supports Kerberos Authentication. This process eliminates the username and password requirement when a user is logging in from a domain-joined Windows workstation.

Requirements
  • Ensure that you are licensed for Kerberos Authentication
  • When using RapidIdentity Cloud, install an identity bridge, configuring TCP port 88 at a minimum. (This is the Kerberos v5 port; Kerberos v4 is not recommended.)
  1. Configure Active Directory:
    1. Create a user in Active Directory to handle Kerberos Authentication with these settings:
      • Select the option to prevent the user from changing their password
      • Select the option to indicate that the user's password never expires
      • Select the option to not require Kerberos pre-authentication
    2. In Powershell, execute the following command:

      setspn -a HTTP/{RapidIdentityURL} {KerberosUsername}

      • RapidIdentityURL: The FQDN of your RapidIdentity server, for example, "idauto.us001-rapididentity.com"
      • KerberosUsername: The username created in previous step
    3. For RapidIdentity Cloud customers using a Vanity URL, execute this additional command:

      setspn -a HTTP/{RapidIdentityVanityURL} {KerberosUsername}

  2. Configure Group Policy:
    1. Add your RapidIdentity URL to the Internet Sites list:

      Navigate to User Configuration > Policies > Administrative Templates > Windows Components > Microsoft Edge > Internet Control Panel > Security Page > Site to Zone Assignments List

      • Set this policy to Enabled
      • Add an assignment for your RapidIdentity server to Intranet Sites:
        • Value Name: https://my.example.com
        • Value: 1
    2. Configure a batch script and store it in \\test.local\NETLOGON\kerberos.bat
    3. Set the Group Policy to run this batch script on user logon at Computer Configuration > Policies > Windows Settings > Scripts > Startup
  3. Configure the Appliance (For RapidIdentity On-Premise Only):
    Note:This section will need to be completed in coordination with a RapidIdentity System Administrator in Support.
    1. Ensure the RapidIdentity Appliance can resolve your domain through DNS
    2. Configure Kerberos settings in RapidIdentity Appliance Configuration:

      Navigate to Core Configuration > Authentication > Kerberos Configuration and set:

      • Domain: test.local
      • KDC Address: test.local
      • Service Principal: HTTP/my.example.com@test.local
      • Service Principal Password: [Password configured in Active Directory]
    3. Create an authentication policy for Kerberos Authentication
      • Criteria > Kerberos > Enabled: Checked
      • Authentication Methods > Kerberos > Required: Checked
Note:On your Windows workstations, Internet Properties | Advanced should be configured to Enable Integrated Windows Authentication. This should be enabled by default but can be verified by opening Settings and finding the setting on the Advanced tab.
Best Practice:

Current Limitations:

  • Cloud Hosted Active Directories: It is currently unsupported to attempt Kerberos Authentication against a Cloud Hosted Active Directory.
  • UPN Suffix: It is currently unsupported to attempt Kerberos Authentication using UPN Suffixes.
  • Trusts: It is currently unsupported to attempt Kerberos Authentication against a trusted domain.
  • Multiple Domains: It is currently unsupported to attempt Kerberos Authentication against multiple domains.