5.1 Kerberos

Please also note the FAQ, chapter "Upgrade AGW Version 3.0 to 3.1".

First, the AGW must join the AD (see Chapter 5).

After joining the AD, the AGW will be visible in the AD under ‘Computers’. Please do not move the AGW. Next, you must ensure that Kerberos is enabled for the AGW.

For Kerberos to work from the browser, the browsers must be configured accordingly (see Chapter 6).

Each of the variants below should then be tested for functionality. The following lines can then be found in the AGW log:

  • got a kerberos token from the client
  • Kerberos auth for user myuser@MYAGW.EXAMPLE.COM (myuser) successful domain MYAGW.EXAMPLE.COM
  • Session auth (http://auth.hin.ch/REST/v1/authSession) for myuser successful

Option 1

In the settings of the AGW AD object, activate Kerberos delegation only for specific services. To do this, the http service must be authorised for the AGW object.

Option 2

This option is less secure than options 1 and 3. It should be used only in exceptional cases.

In the settings of the AGW AD object, activate Kerberos delegation for all services.

For more information, click here: https://netwrix.com/en/resources/blog/unconstrained-delegation/

Option 3

This option is the safest and is recommended only for experienced AD administrators (and is therefore not explained in detail).

Kerberos delegation can be dispensed with, provided that it is ensured that the correct SPNs are available for the clients so that they can obtain a Kerberos ticket for the http service of the AGW.

For more information, click here: https://netwrix.com/en/resources/blog/what-is-spn/