Saucepan

User Tools

Site Tools

Trace: • globalprotect • edl • bgp • lacp • testing_panos • technical_support_file • logs • user_id
paloaltonetworks:configuration:kerberos

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Next revision		Previous revision
paloaltonetworks:configuration:kerberos [2020/05/19 06:08] – created bstaffordpaloaltonetworks:configuration:kerberos [2025/03/31 19:42] (current) – bstafford
Line 2: Line 2:
 ===== Knowledgebase Articles ===== ===== Knowledgebase Articles =====
 Two good articles on setting up Kerberos SSO for User ID / Access to the Internet are Two good articles on setting up Kerberos SSO for User ID / Access to the Internet are
-  * [https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClUeCAK here]. +  * [[https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClUeCAK|here]]. 
-  * [https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000boBiCAI here].+  * [[https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000boBiCAI|here]].
 ===== KeyTab File ===== ===== KeyTab File =====
 You will need to create a service account on the active directory domain. You need a service account for each gateway you are using (e.g. if you are using a redirect FQDN for Captive Portal and a couple of GlobalProtect gateways, you will need that number of service accounts. This is because a service account is required for each SPN (server Principle Name). You will need to create a service account on the active directory domain. You need a service account for each gateway you are using (e.g. if you are using a redirect FQDN for Captive Portal and a couple of GlobalProtect gateways, you will need that number of service accounts. This is because a service account is required for each SPN (server Principle Name).
Line 20: Line 20:
         http/redirect.example.local         http/redirect.example.local
 Updated object</code> Updated object</code>
 +Windows 2022 keytab file generation
 +<code>ktpass /princ DNS/ns1.example.com/@REALM /mapuser Infobloxsa /pass ######## /out b1ddi.keytab /ptype krb5_nt_principal /crypto ALL</code>
 +older example
 <code>ktpass -princ http/redirect.domain.local@DOMAIN.LOCAL -mapuser DOMAIN\kerberosuser -pass Password123 -crypto aes256-sha1 -ptype KRB5_NT_PRINCIPAL -out keytabfile.keytab</code> <code>ktpass -princ http/redirect.domain.local@DOMAIN.LOCAL -mapuser DOMAIN\kerberosuser -pass Password123 -crypto aes256-sha1 -ptype KRB5_NT_PRINCIPAL -out keytabfile.keytab</code>
-<code>>ktpass -princ http/redirect.example.local@EXAMPLE.LOCAL -mapuser EXAMPLE\kerberosuser1 -pass Password123 -crypto aes256-sha1 -ptype KRB5_NT_PRINCIPAL -out keytabfile_redirect.keytab+<code>ktpass -princ http/redirect.example.local@EXAMPLE.LOCAL -mapuser EXAMPLE\kerberosuser1 -pass Password123 -crypto aes256-sha1 -ptype KRB5_NT_PRINCIPAL -out keytabfile_redirect.keytab
 Targeting domain controller: server1.EXAMPLE.LOCAL Targeting domain controller: server1.EXAMPLE.LOCAL
 Successfully mapped http/redirect.example.local to kerberosuser1. Successfully mapped http/redirect.example.local to kerberosuser1.
paloaltonetworks/configuration/kerberos.1589868524.txt.gz · Last modified: (external edit)