Set Up Kerberos Authentication

Create a server profile.
The server profile identifies the external authentication service and instructs the firewall how to connect to that authentication service and access the authentication credentials for your users.
Select
Device
Server Profiles
and select the
Kerberos
profile.
Click
Add
and enter a Profile
Name
, such as GP-User-Auth.
If this profile is for a firewall with multiple virtual systems capability, select a virtual system or
Shared
as the Location where the profile is available.
Click
Add
in the Servers section and then enter the necessary information for connecting to the authentication server, including the server
Name
, IP address or FQDN of the
Server
, and
Port
.
Click
OK
to save the server profile.
(
Optional
) Create an authentication profile.
The authentication profile specifies the server profile for the portal or gateways to use when they authenticate users. On a portal or gateway, you can assign one or more authentication profiles in one or more client authentication profiles. For descriptions of how an authentication profile within a client authentication profile supports granular user authentication, see Configure a GlobalProtect Gateway and Set Up Access to the GlobalProtect Portal.
To enable users to connect and change their own expired passwords without administrative intervention, consider using a pre-logon connect method. See Remote Access VPN with Pre-Logon for details.
Select
Device
Authentication Profile
and
Add
a new profile.
Enter a
Name
for the profile and then select
Kerberos
as the authentication
Type
.
Select the Kerberos authentication
Server Profile
that you created in 1 from the drop-down.
Specify the domain name and username format. The device combines the
User Domain
and
Username Modifier
values to modify the domain/username string that a user enters during login. The device uses the modified string for authentication and uses the
User Domain
value for User-ID group mapping. Modifying user input is useful when the authentication service requires domain/username strings in a particular format and you don’t want to rely on users to correctly enter the domain. You can select from the following options:
To send only the unmodified user input, leave the
User Domain
blank (the default) and set the
Username Modifier
to the variable
%USERINPUT%
(the default).
To prepend a domain to the user input, enter a
User Domain
and set the
Username Modifier
to
%USERDOMAIN%\%USERINPUT%
.
To append a domain to the user input, enter a
User Domain
and set the
Username Modifier
to
%USERINPUT%@%USERDOMAIN%
.
If the
Username Modifier
includes the
%USERDOMAIN%
variable, the
User Domain
value replaces any domain string that the user enters. If the
User Domain
is blank, that means the device removes any user-entered domain string.
Configure Kerberos single sign-on (SSO) if your network supports it:
Enter the
Kerberos Realm
(up to 127 characters). This is the hostname portion of the user login name. For example, the user account name user@EXAMPLE.LOCAL has the realm EXAMPLE.LOCAL.
Specify a
Kerberos Keytab
file: click the
Import
link,
Browse
to the keytab file, and click
OK
. During authentication, the endpoint first tries to use the keytab to establish SSO. If it succeeds, and the user attempting access is in the
Allow List
, authentication succeeds immediately. Otherwise, the authentication process falls back to manual (username/password) authentication of the specified
Type
. The
Type
doesn’t have to be Kerberos. To change this behavior so that users can authenticate only using Kerberos, set
Use Default Authentication on Kerberos Authentication Failure
to
No
in a GlobalProtect portal agent configuration.
Select the
Advanced
tab.
In the Allow List,
Add
and then select the users and groups that are allowed to authenticate with this profile. Selecting the predefined
all
option allows every user to authenticate. By default, the list has no entries, which means no users can authenticate.
Save your changes and commit the configuration.
Click
OK
, and then
Commit
.