Kerberos is a ticket-based network authentication protocol. In a Windows domain, a user who has already signed in to a domain-joined computer receives Kerberos tickets from Active Directory. With Kerberos Authentication enabled, Monosign accepts these tickets (Windows integrated sign-in, SPNEGO), so users can sign in to the account application without typing their credentials again.
Kerberos Authentication requires additional configuration on both Active Directory and Client Computers. You can find the following information provided by Microsoft. https://learn.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview
Supported Methods
Monofor supports two methods for Kerberos Authentication. Both methods use a service user and a Service Principal Name (SPN) in Active Directory. The difference is how Monosign gets the key to validate Kerberos tickets. You select the method on the Kerberos (Windows SSO) tab of the directory source.
|
Method |
How it works |
Keytab file |
Documentation |
|---|---|---|---|
|
Keytab |
A keytab file is created with |
Required |
|
|
SPN + Password |
Monosign derives the key from the service user password and the SPN. You enter the SPN, the service account name and its password. |
Not required |
Client computer and browser configuration (Windows and macOS) is the same for both methods. Please follow the Configuring a Windows Client and Configuring a macOS Client sections on this page.
Configuring a Windows Client
Please add Trusted-Site configuration for your account application domain name. You can use Group Policy Management or individually add account url directly to the machine.
For Windows machines, Edge, Chrome, Firefox, and Internet Explorer will automatically read the value of Trusted Websites and will share Kerberos Ticket with the Website.
Configuring a macOS Client
Before you continue, please read following documentations provided by Apple.
https://support.apple.com/guide/deployment/kerberos-sso-extension-depe6a1cda64/web
For macOS, every browser needs additional configuration for the Kerberos Authentication.
Safari
Open the terminal and execute the following commands. Do not forget to change your-account-app.domain.com.
defaults write com.apple.Safari 'com.apple.Safari.ContentPageGroupIdentifier.WebKit2HTTPSUpgradeEnabled' -bool false
defaults write com.apple.Safari AuthenticationServerTrustedServers -string "your-account-app.domain.com"
defaults write com.apple.Safari AuthenticationServerWhitelist -string "your-account-app.domain.com"
You need to restart your Safari.
Chrome
Open the terminal and execute the following commands. Do not forget to change your-account-app.domain.com.
# You can use the full account application url or wildcard for your all domain prefixes.
defaults write com.google.Chrome AuthServerAllowlist "*.your-domain.com"
defaults write com.google.Chrome AuthNegotiateDelegateAllowlist "*.your-domain.com"
You need to restart your Chrome Browser.
Other Browsers
Please check other Browser’s Documentation for adding your account application url as Trusted Web Sites.