Client Systems; Cmc; Prerequisites For Single Sign-On Or Smart Card Login; Generating Kerberos Keytab File - Dell PS-M4110 User Manual

Client Systems

• For only Smart Card login, the client system must have the Microsoft Visual C++ 2005 redistributable. For more
information see www.microsoft.com/downloads/details.aspx?FamilyID=
32BC1BEEA3F9-4C13-9C99-220B62A191EE&displaylang=en
• For Single Sign-On or smart card login, the client system must be a part of the Active Directory domain and
Kerberos Realm.

CMC

• CMC must have firmware version 2.10 or later.
• Each CMC must have an Active Directory account.
• CMC must be a part of the Active Directory domain and Kerberos Realm.

Prerequisites For Single Sign-On Or Smart Card Login

The pre-requisites to configure SSO or Smart Card logins are:
• Setup the kerberos realm and Key Distribution Center (KDC) for Active Directory (ksetup).
• A robust NTP and DNS infrastructure to avoid issues with clock drift and reverse lookup.
• Configure CMC with Active Directory standard schema role group with authorized members.
• For smart card, create Active Directory users for each CMC, configured to use Kerberos DES encryption but not
pre-authentication.
• Configure the browser for SSO or smart card login.
• Register the CMC users to the Key Distribution Center with Ktpass (this also outputs a key to upload to CMC).
Related Links
Configuring Standard Schema Active Directory
Configuring Extended Schema Active Directory
Configuring Browser For SSO Login

Generating Kerberos Keytab File

Configuring Browser For Smart Card Login
Generating Kerberos Keytab File
To support the SSO and smart card login authentication, CMC supports Windows Kerberos network. The ktpass tool
(available from Microsoft as part of the server installation CD/DVD) is used to create the Service Principal Name (SPN)
bindings to a user account and export the trust information into a MIT-style Kerberos keytab file. For more information
on the ktpass utility, see the Microsoft website.
Before generating a keytab file, you must create an Active Directory user account for use with the -mapuser option of
the ktpass command. You must use the same name as the CMC DNS name, to which you upload the generated keytab
file.
To generate a keytab file using the ktpass tool:
132