Kerberos Extensible Single Sign-on (SSO) allows users to authenticate once and access multiple resources without having to re-enter their credentials.

Kerberos Extensible SSO authentication features include mutual authentication, ticket-based authentication, and encryption of authentication messages. These features help to prevent security threats and protect from credential theft and other vulnerabilities.

Do this when:

• Creating a Profile
• Editing a Profile

Details

Extension Data

About this task

Procedure

1. Create/ edit a Reactive iOS/ Shared iPad User profile and add the Kerberos Extensible SSO configuration from the Security & Restrictions configurations list.

   

2. Enter the IP address or hostname of the domain/ administrative network partition that shares a common security policy and authentication database in the Realm field.
3. Select (Add) in the Add Host Names section to identify the host or domain names which the app extension can authenticate through.
4. Enter the Principal Name without including the realm in the Principal Name field.
5. Enter the URL of the Active Directory site used by the Kerberos extension in the Site Code field.
6. Select the Public Key Cryptography for Initial Authentication (PKINIT) certificate for renewing the Kerberos credential from the Certificate list.
7. Turn on Allow Automatic Login to enable automatic logins.
8. Turn on Is Default Realm to set the specified realm as the default when configuring more than one Kerberos extensions.
9. Turn on Require User Presence to ensure the user gives Touch ID, Face ID, or their passcode to access a key-chain entry.
10. Turn on Use Site Auto-Discovery to enable the Kerberos extension to use Lightweight Directory Access Protocol (LDAP) and Domain Name Services (DNS) to determine its AD site name.
11. Select (Add) in the Add Preferred KDCs section to identify each Key Distribution Center (Glossary) to handle Kerberos traffic.
12. In the Add Credential Bundle ID ACL section, identify each bundled ID allowed to access the Ticket Granting Ticket (TGT) by selecting (Add).
13. Save the configuration and assign the profile to your target devices.

Result