Setting up Kerberos SSO for web server login with Microsoft AD

Setting up Kerberos SSO for Web Server Login with Microsoft AD

In this article, we will cover the key concepts and steps required to set up Kerberos Single Sign-On (SSO) for logging onto a web server using Microsoft Active Directory (AD). The goal is to enable users to access the web server without having to type in their credentials each time.

Prerequisites

• Microsoft AD 2016
• KDC (Key Distribution Center) with MS-PKI (Microsoft Public Key Infrastructure)
• Windows 10 RDP (Remote Desktop Protocol)

Kerberos SSO Overview

Kerberos is a network authentication protocol that allows nodes communicating over a non-secure network to prove their identity to one another in a secure manner. In a Windows environment, Kerberos is the default authentication protocol for domain-joined computers and is used to securely authenticate users and services.

SSO is a mechanism that allows users to access multiple services with a single set of credentials. In the context of Kerberos, SSO allows users to access a web server without having to enter their credentials again.

Steps to Set up Kerberos SSO for Web Server Login

To set up Kerberos SSO for web server login, follow these steps:

1. Install and configure a web server on the target machine.
2. Join the target machine to the domain.
3. Configure the SPN (Service Principal Name) for the web server.
4. Configure the Kerberos authentication delegation for the web server.
5. Test the Kerberos SSO authentication.

Step 1: Install and Configure a Web Server

Install and configure a web server on the target machine. This can be done by installing IIS (Internet Information Services) on a Windows machine or Apache on a Linux machine.

Step 2: Join the Target Machine to the Domain

Join the target machine to the domain by following these steps:

1. Open the System Properties dialog box.
2. Click on the Change button under the Computer Name tab.
3. Select the Domain option and enter the domain name.
4. Enter the credentials of a user with permissions to join the domain.
5. Restart the machine.

Step 3: Configure the SPN for the Web Server

The SPN is a unique identifier for a service instance. To configure the SPN for the web server, follow these steps:

1. Open the Command Prompt as an administrator.
2. Run the following command: setspn -S http/ \

Step 4: Configure the Kerberos Authentication Delegation for the Web Server

To configure the Kerberos authentication delegation for the web server, follow these steps:

1. Open the Active Directory Users and Computers console.
2. Find the computer account for the web server.
3. Right-click on the computer account and select Properties.
4. Click on the Delegation tab.
5. Select the Trust this computer for delegation to specified services only option.
6. Select Use Kerberos only.
7. Add the SPN for the web server to the list of services.

Step 5: Test the Kerberos SSO Authentication

To test the Kerberos SSO authentication, follow these steps:

1. Open a web browser and navigate to the web server.
2. Enter the credentials of a user in the domain.
3. Check if the user is automatically logged in without having to enter their credentials again.

In this article, we covered the key concepts and steps required to set up Kerberos SSO for logging onto a web server using Microsoft AD. By following these steps, users can access the web server without having to type in their credentials each time.

References

• Microsoft Docs: Kerberos Authentication
• Microsoft Docs: Single Sign-On
• Microsoft Docs: Configuring Kerberos for Use on Windows Clients