This documentation supports the 9.0 version of BMC Atrium Single Sign-On, which is in "End of Version Support." However, the documentation is available for your convenience. You will not be able to leave comments.Click here to view the documentation for a supported version of Remedy Single Sign-On.

Kerberos authentication

Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.

The Kerberos architecture is designed around messages exchanged between the following entities:

  1. Clients that use kerberos services.
  2. Servers that provide services (The clients and servers are collectively referred to as principals).
  3. Servers that manage the Kerberos protocol itself. These servers are often called KDCs (Key Distribution Centers), and comprise several modular services.

How Kerberos works

The following image and the steps the follow the image provide the Kerberos workflow.

SSO_Kerberos_Architecture_ver3.png

  1. User accesses the protected application from a mobile device or through a web browser.
  2. Web Agent redirects the user to the BMC Atrium Single Sign-On console.
  3. BMC Atrium Single Sign-On sends to web browser/mobile device a 401 un-authorized request setting the header to “www-authenticate:Negotiate”.
  4. Web browser/mobile device requests a session ticket from the Key Distribution Center (KDC).
  5. KDC provides the web browser/mobile device with the necessary Kerberos Ticket (assuming the web browser/mobile device is authorized) wrapped in a SPNEGO (Simple and Protected GSS API Negotiation Mechanism) Token.
  6. Web browser / mobile device sends to BMC Atrium Single Sign-On the user’s access request + the Negotiate SPNEGO Token in an Authorization: Negotiate base64(token) header.
  7. BMC Atrium Single Sign-On validates the token with KDC.
  8. KDC validates the token.
  9. BMC Atrium Single Sign-On creates a session for the user’s access request.
  10. The user accesses the protected application.

Using MIT Kerberos

MIT Kerberos is a trusted third-party authentication service. It provides a centralized authentication server whose function is to authenticate users to servers and servers to users. It uses symmetric encryption with keys shared with the authentication server. Kerberos keeps a database containing the keys of clients and servers, and uses the keys to authenticate one network node to another. Kerberos also generates temporary session keys to be shared by the two parties in a conversation. All communications between the two parties are then encrypted with the session key.

Using Microsoft Active Directory Kerberos

The Microsoft Windows Server operating systems implement the Kerberos version 5 authentication protocol. Windows Server operating systems also implement extensions for public key authentication. The Kerberos authentication client is implemented as a security support provider (SSP) and can be accessed through the Security Support Provider Interface (SSPI). Initial user authentication is integrated with the Winlogon single sign-on architecture. The Kerberos Key Distribution Center (KDC) is integrated with other Windows Server security services running on the domain controller. The KDC uses the domain’s Active Directory directory service database as its security account database. An Active Directory server is required for default Kerberos implementations.

Related topics

Using-Kerberos-for-authentication

End-to-end-steps-for-configuring-MIT-Kerberos-authentication

End-to-end-steps-for-configuring-Active-Directory-Kerberos-authentication

Troubleshooting-Kerberos-authentication

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*