AD SSO allows users logging into AD on their Windows systems to automatically go through authentication and posture assessment without ever having to log in via the Agent.
Note AD SSO is supported in cross-forest configurations with two-way trust established between the forests. After the user authentication download ktpass windows free validated, authorization role-mapping is then performed as a download ktpass windows free lookup in Active Directory using Download ktpass windows free. Figure shows the general process for Kerberos ticket exchange. The general sequence is as follows:. As shown in Figurethe sales domain sales-name-domain.
Taking the cca-eng domain as an example, the CAS user only needs to be created and configured on the cca-eng-test. Users under cca-eng-domain. Administrators should start with a good understanding of their network layout with respect to their AD servers prior to configuring Active Directory SSO.
Note The host principal name in the KTPass command i. See Run the ktpass. Step 8 Enabling a Login Script Optional. Optionally configure LDAP lookup servers to map users to multiple roles after authentication. Step 1 0 Refer to Troubleshooting if necessary. Step 3 Choose a Default Role from the dropdown menu.
If no additional lookup is required to map users to roles, all users performing authentication via Active Directory single sign-on will be assigned to the default role. Do not use spaces or special characters in the name. Step 6 Click Add Server. Only when the CAS validates the authentication is the user allowed network access, and there is no need for a separate user login through the Agent.
As Figure illustrates, the CAS is configured to read the login credentials of user machines as they authenticate download ktpass windows free the Active Directory AD server. Configure traffic policies for the Unauthenticated role to allow these ports on the trusted-side IP address of the AD server. You may be required to open other ports to support AD services not included in this list. IP address DC Port 1. This allows for a more efficient search of all directory partitions in both single and multi domain environments.
If you experience slow performance during Windows login, you can open the following ports in addition to the ports listed in Table This brings up the IP traffic policy form for the Unauthenticated Role.
The Add Policy form appears Figure Step 3 Leave the following fields at their defaults:. For example: Step 5 Type an optional Description. Step 6 Click Add Policy. When logging into download ktpass windows free client Download ktpass windows free, make sure to log into the domain using Windows domain credentials not Local Account. To configure the CAS corresponding to the domain of the users, follow these steps:.
You can configure the other fields of this page and click Updateas described below. Please check the configuration. For details, see Run the ktpass. For example:. Note The password is case sensitive. From the CAS side, there is no limitation on the number of characters, and standard characters are allowed.
Since this password is based of the mapping created using the KTPass command, observe any limitations from the Windows server side e. Step 8 Click Update. In either case you must create the CAS user download ktpass windows free then set up encryption according to the following sections:.
Step 1 Login as the administrator on the Active Directory server machine. Step 3 From the left-hand pane of the Active Directory Users and Computers window, navigate to the domain for which you want to configure the CAS, for example, cca-eng-domain.
Step 4 Right-click the Users folder. Enter the name you want the CAS to use in download ktpass windows free First name field, for example: casuser. This automatically populates the Full name and User logon name fields. The User logon name must be one word. Step 9 Confirm the properties for the CAS user and click Finish to conclude, or click Back download ktpass windows free you need to make corrections. The ktpass. To determine the correct version of ktpass. Note To ensure successful KTPass operation, obtain and install the correct version of ktpass.
Windows Server SP2 23. Windows Server R2 2. Windows Server Enterprise SP1 4. Make download ktpass windows free Windows Hotfix KB is installed. Server running at functional level. To install the ktpass. Figure Support Tools for Windows Server. Step 3 Click the Download button. Step 4 Do one of the following:. See Figure Figure Support Tools—ktpass. Step 6 Execute the download ktpass windows free. Note Do not double-click the ktpass. The information in the KTPass command operation is then automatically propagated to the other members of download ktpass windows free AD domain.
Note When running ktpass. To run ktpass. Step 2 Enter one of the following commands:. If your Active Directory domain consists of only one server. For example see also Figure :. If your Active Directory domain consists of multiple servers. While adding new servers to an already existing multi-server download ktpass windows free, it is not required to run the ktpass command again.
This includes adding a server to an existing multi-server domain running in a domain functional level. The output of the command should be as follows see also Figure :. Download ktpass windows freeis the key to ensuring that any AD server within a managed domain can appropriately resolve user credentials passed from the CAS.
Step 3 Save the exact command you ran and the output to a text file you do not need to save the CAS user password. For troubleshooting purposes, this will facilitate TAC support. Figure Execute ktpass. Figure ktpass. Table provides further parameter details. Table ktpass. The Download ktpass windows free provided is of this type.
By default Download ktpass windows free servers should use this type, but some do not. Note that the values in this figure are example values only; they do not match the configuration example steps outlined in this chapter. The following procedure guides you through the process necessary to configure an AD SSO user account for both Windows Server and Windows Server Active Directory entities operating at their respective full functional levels without having to run KTPass.
This method does not support a Server AD operating at a domain functional level. The following steps apply for DES only encryption type. See Figure and Figure Figure Server Example—Account Properties. An additional Ldp application window opens. Note If you do not have a local copy of the ldp. For example, in the Connect dialog, enter You can specify the same ID that you used to create the user account. Figure Expanded Tree View.
Step 9 Locate the user account you created in Step 1right-click on the account entry, and click Modify Figure The account Modify dialog box opens. Figure Modify the User Account Entry. COM Figure
