Kerberos Authentication Settings¶

Note

Kerberos is used by the following components: Active Directory external authentication, user synchronization with the directory service (User Directory), Discovery operations, secret changers and secret verifiers, and authentication against the server during RDP sessions.
The Active Directory external authentication method uses the Kerberos protocol as the first step.
If Active Directory authentication is successfully completed using Kerberos, the configured certificate will not be applied, as it is only used when a fallback to LDAP is required.
You no longer need to specify the domain in the Fudo hostname for Kerberos authentication to work correctly. This also allows Kerberos authentication to be used across multiple domains.

Configure Kerberos Authentication¶

The Kerberos section on the Global tab lets you enable Kerberos authentication independently for individual components and disable fallback to less secure protocols.

Note

Enabling the Enable Kerberos for external authentication option together with disabling the fallback mechanisms is particularly useful when authenticating members of the Active Directory Protected Users group. For accounts in this group, less secure protocols (such as NTLM) are blocked by the Windows domain controller and Kerberos authentication is required, so disabling the fallback in Fudo Enterprise aligns its behavior with the policy enforced by the domain.

Select Settings > Authentication > Global tab and go to the Kerberos section.

Option	Description
Enable Kerberos for external authentication	Uses the Kerberos protocol as the first authentication step in the Active Directory external authentication method.
Disable LDAP fallback	Disables the fallback to LDAP simple bind authentication when Kerberos is unavailable. Active Directory authentication then fails. See Disable Authentication Fallback.
Enable Kerberos for LDAP synchronization	Uses the Kerberos protocol when synchronizing users with the directory service (User Directory).
Enable Kerberos for RDP sessions	Uses the Kerberos protocol to authenticate against the RDP server when establishing a session.
Disable NTLM fallback	Disables the fallback to NTLM authentication in RDP (NLA) sessions when Kerberos is unavailable. See Disable Authentication Fallback.

To save the changes, click Save in the Kerberos section.

Note

To completely disable Kerberos authentication for a given component, deselect the corresponding option (e.g. Enable Kerberos for RDP sessions) and save the changes.

Disable Authentication Fallback¶

To enforce the use of the Kerberos protocol only, you can disable the fallback to less secure authentication protocols:

NTLM (RDP sessions) — select the Disable NTLM fallback option. If Kerberos is unavailable, authentication fails and the following message appears in the debug log:
```
Kerberos authentication failed, NTLM fallback is disabled.
```
LDAP simple bind (Active Directory authentication) — select the Disable LDAP fallback option. If Kerberos is unavailable, authentication fails and the following message appears in the debug log:
```
Kerberos authentication failed for user %s (domain %s), LDAP fallback is disabled.
```

Add KDC Servers¶

Fudo Enterprise supports configuring Key Distribution Servers (KDC) and mapping domains to KDC servers. Kerberos authentication in multi-domain Active Directory environments is also supported.

Note

Configuring KDC servers is optional. In multi-domain Active Directory environments you do not need to add KDC entries manually or include the domain in the Fudo hostname. See DNS Configuration.

To add a KDC server:

Select Settings > Authentication > Global tab.
Go to the Kerberos > KDC servers section.
Click Add server.

Provide the fully qualified domain name (FQDN) in the Domain field (e.g., fudo.com, .fudo.com).
Provide the KDC server address in the Address field (e.g., 192.168.1.1, foo.bar, tcp/foo.bar, udp/192.168.1.1:88).

Related topics: