Configuring Kerberos Authentication

Configuring Kerberos authentication requires access to the following:

• Domain administrator access to an endpoint computer on which the Imprivata agent is installed.
• The Imprivata Appliance Console.
• The Imprivata Admin Console.

If more than one person is responsible for domain administration, appliance administration, and Enterprise Access Management administration, coordinate with these individuals before beginning.

Configuring Network Protocol Time (NTP) servers makes sure that the Kerberos ticket does not expire before the appliance can extract the user identity from the Kerberos ticket.

Complete the following for each appliance in the enterprise to enable time synchronization.

1. In the Imprivata Appliance Console, go to Network > NTP.

2. Enter the IP address for one or more NTP servers.

3. Click Save.

The endpoint computer from which you run the keytab utility and the primary appliance to which the Imprivata agent communicates must be in the same Active Directory domain.

For example, if the fully qualified domain name (FQDN) of the endpoint computer is endpoint.example.com, then the Imprivata appliance FQDN could be server_name.example.com.

1. Log into the endpoint computer.
2. Open the registry editor and go to the ISXAgent registry key:

   • 64–bit — HKLM\SOFTWARE\SSOProvider\ISXAgent

3. Use the IPTXPrimServer value to confirm that the agent's primary appliance is in the same Active Directory domain as the endpoint computer.

Creating and uploading a keytab file establishes a Kerberos trust relationship between Enterprise Access Management and Microsoft Active Directory. You use the Imprivata key tab utility, which is installed with the Imprivata agent, to create and upload a keytab file. After the keytab file is uploaded to the appliance, it is propagated to all other appliances in the enterprise.

1. As a domain administrator, log into an endpoint computer to which the Imprivata agent is installed and open a command prompt.

2. At the command prompt, type the following and press Enter:
   cd \Program Files (x86)\Imprivata\OneSign Agent\x64

3. Type ISXKerbUtil and press Enter. The utility returns the names of the following:

   • The domain.

   • The domain controller.

   • The appliance host name in the Service Principal Name (SPN) format.

4. Using the User Principal Name (UPN) format, type the username of the domain account that has Super Administrator rights in the Admin Console and press Enter.

   Example: username@example.com

5. Enter the password of the domain account, with the Super Administrator rights you provided above, and press Enter.

6. Enter a password that meets the Active Directory complexity requirements and press Enter. The utility does the following:

   • Creates a domain user account named ssoKerberos.

   • Sets the password.

   • Creates and uploads the keytab file to the appliance.

   NOTE: If the Imprivata keytab utility detects that a domain user account is already mapped to the SPN, it updates the domain account with the password you entered. If the utility detects that multiple domain user accounts are mapped to the SPN, the utility detects which user it previously created and updates it with the password you entered; the remaining users are removed from the SPN.

The Imprivata keytab utility creates the keytab file with all of the supported cryptographic types supported by Windows Server.

1. In the Imprivata Admin Console, go to the Users menu > Directories page.

2. Click the name of the domain from which you created the keytab file.

3. Go to Kerberos authentication and click 5 keytab files.

4. Verify that the keys are using the following cryptographic types:

   • • DES cbc mode with CRC-32

     • DES cbc mode with RSA-MD5

     • ArcFour with HMAC/md5

     • AES-256 CTS mode with 96-bit SHA-1 HMAC

     • AES-128 CTS mode with 96-bit SHA-1 HMAC

Identify the computers to which Kerberos authentication applies and configure a computer policy. Configuring the computer policy enables the computers in the policy for Kerberos authentication.

Step 6a: Create a Computer Policy for Endpoint Computers

1. In the Imprivata Admin Console go to the Computers menu > Computer policies page.

   You can select an existing computer policy from the list, or make a copy of the Default Computer Policy as a starting point. If you want to edit an existing computer policy, click the existing computer policy name, and skip to Step 6b: Configure the Computer Policy for Endpoint Computers.

2. To copy the Default Computer Policy, select Default Computer Policy , then click Copy.

3. Click Default Computer Policy (2).

4. Rename the computer policy.

Step 6b: Configure the Computer Policy for Endpoint Computers

1. Click the General tab, go to the Authentication section, and select Accept Kerberos authentication in place of OneSign authentication.

2. Click Save.

Step 6c: Assign the Computer Policy to Endpoint Computers

Manually Assigning the Computer Policy

To manually assign the computer policy:

1. Go to the Computers menu > Computers page.

2. Select the computers to which you want to apply the computer policy.

3. Select Change policy

4. Select Choose a policy and the name of the policy configured for Kerberos authentication.

5. Click Change Policy.

Automatically Assigning the Computer Policy

Use computer policy assignment rules to assign a computer policy to existing endpoint computers and to automatically assign the policy to endpoint computers added in the future.

1. Go to the Computers menu > Computer policy assignment page.

2. Click Add new rule.

3. Enter a Name for the assignment rule.

4. Select one of the following:

• Computer IP address, and then enter the range of IP addresses to include in the computer policy.

• Computer host name to match the computer policy to a specific computer.

• Imprivata agent type to apply the computer policy to all computers with a specific Imprivata agent.

Disabling (unregistering) the Imprivata agent login module prevents Enterprise Access Management from authenticating users, ensuring that Kerberos authentication is enforced on the endpoint computer.

1. As a domain administrator, log into an endpoint computer that is enabled for Kerberos authentication and open a command prompt.
2. At the command prompt, type:
   • 64–bit — cd \Program Files (x86)\Imprivata\OneSign Agent\x64 and press Enter
3. Type:
   • 64–bit — regsvr32 /u ISXCredProv.dll and press Enter.
4. Type:
   • 64–bit — ISXCredProvDiag.exe /unwrapall and press Enter.
5. Close the command prompt window.

The Imprivata OneSign login module is disabled on the endpoint computer.

While the Imprivata agent login module remains disabled, enabling (registering) the Imprivata credential manager module ensures that Enterprise Access Management continues to manage application single sign–on after users change their password.

1. As a domain administrator, log into an endpoint computer that is enabled for Kerberos authentication and open a command prompt.
2. At the command prompt, type:
   • 64–bit — cd \Program Files (x86)\Imprivata\OneSign Agent\x64 and press Enter.
3. Type:
   • 64–bit — regsvr32 ISXCredMan.dll and press Enter.