Check Point HARMONY R81 Administration Manual page 179

Notes -
n Make sure that the clock times on the Endpoint Security servers and
the Kerberos server are less than 5 minutes apart. If difference in the
clock times is more than 5 minutes, a runtime exception shows and
Active Directory authentication fails. On Gaia, use NTP or a similar
service.
n To use Capsule Docs with Single Sign-On, disable User Access
Control on Windows Active Directory Servers.
Step 2 of 3: Configuring Authentication Settings
Configure the settings in SmartEndpoint for client to server authentication.
Important - Use the Unauthenticated mode only for evaluation purposes. Never
use this mode for production environments. Configure the authentication settings
before moving to production.
How the Authentication Settings are Used in Deployment Packages
When you configure client package profiles, you choose an authentication account. The
SSO Configuration details are included in the client deployment package, allowing the
server to authenticate the client.
To configure authentication settings:
1. In SmartEndpoint open Manage > Endpoints Authentication Settings.
The Authentication Settings Properties window opens.
2. Click Add.
The New Authentication Principal Properties window opens.
3. Enter the details from the output of ktpass.exe that you configured in
Configuring the Active Directory Server for Authentication" on page 177
Field
Domain
name
Principle
Name
Description
Active Directory domain name.
For example: nac1.com
Authentication service name in the format:
ServiceName/realm@REALM
This value must match the name that was configured in Active
Directory > New Object.
For example: tst/nac1.com@NAC1.COM
R81 Harmony Endpoint Server Administration Guide | 179
Active Directory Authentication
"Step 1 of 3:
: