Configuring Basic, Ntlm, And Kerberos Resources (Nsm Procedure) - Juniper NETWORK AND SECURITY MANAGER 2010.4 - CONFIGURING SECURE ACCESS DEVICES GUIDE REV 01 Manual

Configuring Secure Access Devices Guide
Related
Documentation

Configuring Basic, NTLM, and Kerberos Resources (NSM Procedure)

Table 59: Configuring Basic, NTLM, and Kerberos Resources
Options
General > Kerberos tab
Enable Kerberos SSO
General > Kerberos > Realm Definition > New Realm Definition
Realm
Site Name
Pattern
218
Basic authentication intermediation page—Displays username and password fields.
NTLM intermediation page—Displays username, password, and domain fields.
Kerberos intermediation page—Displays username, password, and realm fields.
When upgrading a Secure Access device or performing a new installation, the default
SSO BasicAuthNoSSO policy is preserved. If you have enabled all options of the General
tab, SSO will not be enabled until you have deleted the BasicAuthNoSSO policy.
Configuring Basic, NTLM, and Kerberos Resources (NSM Procedure) on page 218
Defining a Basic Authentication, NTLM, or Kerberos Intermediation Resource Policy
(NSM Procedure) on page 221
Configuring a SAML Access Control Resource Policy (NSM Procedure) on page 223
To configure basic, NT LAN Manager (NTLM), and Kerberos resources:
In the navigation tree, select Device Manager > Devices.
1.
Click the Device Tree tab, and then double-click the Secure Access device for which
2.
you want to configure the basic, NTLM, and Kerberos resources.
Click the Configuration tab. Select Users > Resource Policies > Web > General.
3.
Click the New icon to configure the options as described in Table 59 on page 218.
4.
Click OK to save the changes.
5.
Your Action
Select the Enable Kerberos SSO check box to enable Kerberos SSO.
Enter the Kerberos realm name. For example, enter http://www.kerber.net. The
device uses kerber.net to obtain the list of key distribution centers (KDCs).
Enter the Active Directory site names. Use this field to have the device contact the
KDC at a specific site. For example, if site name is Sunnyvale and realm is
http://www.kerber.net, then the device uses Sunnyvale.KERBER.NET to get the list
of KDCs.
NOTE: The Active Directory must have the sites defined and DNS must be configured
to return the KDCs in the site.
Enter the hostnames mapped to the Kerberos realm. You can enter wildcard
characters such as *.y.com, *.kerber.net, or *.* .
Copyright © 2010, Juniper Networks, Inc.