Configuring Kerberos on the Virtual Traffic Manager

The Virtual Traffic Manager's Kerberos support allows it to authenticate a user through a TLS client certificate. The Virtual Traffic Manager communicates with a realm's KDC using its own service principal and acquires a ticket to a service running on a back-end node on behalf of a client making a request on a virtual server.

To participate in the Kerberos realm, the Virtual Traffic Manager must have a suitably privileged principal with which to identify itself. You must ensure your identity management system and associated KDC configuration has a Kerberos principal for the Virtual Traffic Manager, and is configured to allow protocol transition and constrained delegation to the services the Virtual Traffic Manager is managing.

For each Virtual Traffic Manager within the cluster, the KDC administrator must configure the KDC to allow the Virtual Traffic Manager’s service principal to delegate to other services, and the service principal name must match the name used by the Virtual Traffic Manager. This is a string in the form:

<service>/<Virtual Traffic Manager hostname>@<REALM>

In this string, use the <service> and <REALM> values from the Kerberos Principal record you want to use from your Kerberos Principals catalog.

For example, if the hostname of the Virtual Traffic Manager is "stm1.example.com", and a connection uses a Kerberos Principal record with service name "HTTP" and realm "EXAMPLE.COM", the KDC must trust the principal named "HTTP/[email protected]" for delegation to your end services.

For Microsoft implementations, this means that you have created a computer account for the Virtual Traffic Managers on the domain, have configured a server principal name for the relevant services on the Virtual Traffic Managers, and have permitted delegation for those services to the Virtual Traffic Managers.

For a Virtual Traffic Manager to authenticate itself as the created principal, you must specify the appropriate credentials. For user principals, you specify your credentials in the form of password entry. Since interactive password entry is not convenient for service principals, you must instead use a "Keytab" file for the credentials of your Virtual Traffic Manager Service Principals. A Keytab file can contain credentials for one or more principals.

To configure the Virtual Traffic Manager to perform protocol transition in a Kerberos realm, upload a Keytab file containing the credentials for all Virtual Traffic Managers in the cluster, and configure a Kerberos Principal to use the Keytab file.

Your Keytab files are stored in the Virtual Traffic Manager Keytab catalog. To upload Keytab files to the catalog, use the Catalog > Kerberos > Kerberos Keytabs page in the Admin UI.

To create a Kerberos principal catalog item, use the Catalog > Kerberos > Kerberos Principals page of the Admin UI. For each principal, specify the following fields:

To use Kerberos Protocol Transition with your virtual server, use the Virtual Servers > Edit > Kerberos Protocol Transition page.

To enable Kerberos, set kerberos_protocol_transition!enabled to Yes. Using this page, you can optionally configure a Kerberos Principal and the principal name for a target service the virtual server is handling.

The Virtual Traffic Manager must acquire the client principal from a client SSL certificate. To enable this, configure your virtual server with ssl_decrypt enabled along with require_cert to ensure a client certificate is solicited from the client. To ensure the client is properly authenticated, configure your virtual server with appropriate certificate authorities and OCSP settings.

You can also configure Kerberos Protocol Transition using the Pool > Edit > Kerberos Protocol Transition page.

If you specify a principal or target here, this configuration overrides any Kerberos configuration present in a virtual server that uses this pool.