Set Up Kerberos Authentication
Kerberos is a computer network authentication
protocol that uses tickets to allow nodes that communicate
over a non-secure network to prove their identity to one another
in a secure manner.
Kerberos authentication is supported
on Windows (7, 8, and 10) and macOS (10.10 and later releases) endpoints.
Kerberos authentication for macOS endpoints requires a minimum GlobalProtect
app version of 4.1.0.
- Create a server profile.The server profile identifies the external authentication service and instructs the firewall on how to connect to that authentication service and access the authentication credentials for your users.
- Select, and thenDeviceServer ProfilesKerberosAdda Kerberos server profile.
- Enter aProfile Name, such asGP-User-Auth.
- If this profile is for a firewall with multiple virtual systems capability, select a virtual system orSharedas theLocationwhere the profile is available.
- ClickAddin theServersarea, and then enter the following information for connecting to the authentication server:
- ServerName
- IP address or FQDN of theKerberos Server
- Port
- ClickOKto save the server profile.
- (Optional) Create an authentication profile.The authentication profile specifies the server profile that the portal or gateways use when they authenticate users. On a portal or gateway, you can assign one or more authentication profiles in one or more client authentication profile. For information on how an authentication profile within a client authentication profile supports granular user authentication, see Configure a GlobalProtect Gateway and Set Up Access to the GlobalProtect Portal.To enable users to connect and change their expired passwords without administrative intervention, consider using Remote Access VPN with Pre-Logon.
- Select, and thenDeviceAuthentication ProfileAdda new profile.
- Enter aNamefor the profile, and then selectKerberosas the authenticationType.
- Select the Kerberos authenticationServer Profilethat you created in step 1.
- Specify theUser DomainandUsername Modifier. The endpoint combines these values to modify the domain/username string that a user enters during login. The endpoint uses the modified string for authentication and theUser Domainvalue for User-ID group mapping. Modifying user inputs is useful when the authentication service requires domain/username strings in a particular format but you do not want to rely on users entering the domain correctly. You can select from the following options:
- To send the unmodified user input, leave theUser Domainblank (default) and set theUsername Modifierto the variable%USERINPUT%(default).
- To prepend a domain to the user input, enter aUser Domainand set theUsername Modifierto%USERDOMAIN%\%USERINPUT%.
- To append a domain to the user input, enter aUser Domainand set theUsername Modifierto%USERINPUT%@%USERDOMAIN%.
If theUsername Modifierincludes the%USERDOMAIN%variable, theUser Domainvalue replaces any domain string that the user enters. If theUser Domainis blank, the device removes any user-entered domain string. - Configure Kerberos single sign-on (SSO) if your network supports it.
- Enter theKerberos Realm(up to 127 characters) to specify the hostname portion of the user login name. For example, the user account name user@EXAMPLE.LOCAL has the realm EXAMPLE.LOCAL.
- ImportaKerberos Keytabfile. When prompted,Browsefor the keytab file, and then clickOK. During authentication, the endpoint first attempts to establish SSO using the keytab. If it is successful, and the user attempting access is in theAllow List, authentication succeeds immediately. Otherwise, the authentication process falls back to manual (username/password) authentication using the specified authenticationType. TheTypedoes not have to be Kerberos. To change this behavior so users can authenticate using only Kerberos, setUse Default Authentication on Kerberos Authentication FailuretoNoin the GlobalProtect portal agent configuration.
- On theAdvancedtab,AddanAllow Listto select the users and user groups that are allowed to authenticate with this profile. Thealloption allows every user to authenticate with this profile. By default, the list has no entries, which means no users can authenticate.
- ClickOK.
- Commit the configuration.ClickCommit.
Recommended For You
Recommended Videos
Recommended videos not found.