Policy Server Guides › Policy Design Guide › SiteMinder Kerberos Authentication › Kerberos Configuration Examples › Kerberos Configuration at the Policy Server on Windows Example

Kerberos Configuration at the Policy Server on Windows Example

The process listed following exemplifies how to configure a Policy Server on Windows to support SiteMinder Kerberos authentication.

Note: If the Policy Server is installed on Windows and the KDC is deployed on UNIX, be sure to perform additional required configuration on the Policy Server host using the Ksetup utility.

1. Install and configure SiteMinder Policy Server.
2. Install and configure policy store directory services.
3. Log in to the Policy Server host with the service account (for example, polsrvwin2kps) created in Active Directory on the Windows domain controller.
4. Add a Host Configuration Object referencing the Policy Server.
5. Create an Agent Configuration Object and add these three new parameters:

1. Create a user directory.
2. Create a user, for example, testkrb, in the user directory.
3. Configure a new Authentication Scheme using the SiteMinder Admin UI:
   1. Create the scheme using the custom template.
   2. Specify the SiteMinder Kerberos Authentication Scheme library.
   3. Select the parameter field and specify the following three values in same order delimited by a semicolon:
      • Server name and target fields.
      • Policy Server principal name from the Windows 2003 Kerberos realm.
      • Mapping between the user principal and an LDAP search filter.

      Sample parameter field:

      http://win2k3iis6.test.com/siteminderagent/Kerberos/creds.kcc;smps/win2kps.test.com@TES.COM;(uid=%{UID})
      

4. Configure a policy domain.
5. Add a realm to protect a resource using the Authentication Scheme.
6. Add Rules and Policies to allow access for the user, testkrb.
7. Configure a Kerberos configuration file (krb5.ini) and place krb5.ini in Windows system root path:
   • Configure the KDC for the Windows 2003 Kerberos realm (domain) to use the Windows 2003 domain controller.
   • Configure krb5.ini to use the Windows 2003 KDC keytab file containing the Policy Server principal credentials.

     See the sample krb5.ini listed following.

     [libdefaults]
     default_realm = TEST.COM
     default_keytab_name = C:\WINDOWS\krb5.keytab
     default_tkt_enctypes = rc4-hmac des-cbc-md5
     default_tgs_enctypes = rc4-hmac des-cbc-md5
     [realms]
     TEST.COM = {
     kdc = winkdc.test.com:88
     default_domain = test.com        
     }
     [domain_realm]
     .test.com = TEST.COM
     

8. Deploy the Windows KDC keytab file containing the Policy Server principal credentials to a secure location on the Policy Server.

The Policy Server on a Windows host is configured for Kerberos authentication.