IPA: Identity Policy Audit

Browser Kerberos SetupFirefox You can configure Firefox to use Kerberos for Single Sign-on. The following instructions will guide you in configuring your web browser to send your Kerberos credentials to the appropriate Key Distribution Center which enables Single Sign-on.

Import Certificate Authority certificate

Make sure you select all three checkboxes.

In the address bar of Firefox, type about:config to display the list of current configuration options.

In the Filter field, type negotiate to restrict the list of options.

Double-click the network.negotiate-auth.trusted-uris entry to display the Enter string value dialog box.

Enter the name of the domain against which you want to authenticate, for example, .example.com.

Return to Web UI

Chrome You can configure Chrome to use Kerberos for Single Sign-on. The following instructions will guide you in configuring your web browser to send your Kerberos credentials to the appropriate Key Distribution Center which enables Single Sign-on. Import CA Certificate

Download the CA certificate. Alternatively, if the host is also an IdM client, you can find the certificate in /etc/ipa/ca.crt.

Click the menu button with the Customize and control Google Chrome tooltip, which is by default in the top right-hand corner of Chrome, and click Settings.

Click Show advanced settings to display more options, and then click the Manage certificates button located under the HTTPS/SSL heading.

In the Authorities tab, click the Import button at the bottom.

Select the CA certificate file that you downloaded in the first step.

Enable SPNEGO (Simple and Protected GSSAPI Negotiation Mechanism) to Use Kerberos Authentication in Chrome

Make sure you have the necessary directory created by running:


                    [root@client]# mkdir -p /etc/opt/chrome/policies/managed/

Create a new /etc/opt/chrome/policies/managed/mydomain.json file with write privileges limited to the system administrator or root, and include the following line:


                    { "AuthServerWhitelist": "*.example.com" }

You can do this by running:


                    [root@server]# echo '{ "AuthServerWhitelist": "*.example.com" }' > /etc/opt/chrome/policies/managed/mydomain.json

Note: If using Chromium, use /etc/chromium/policies/managed/ instead of /etc/opt/chrome/policies/managed/ for the two SPNEGO Chrome configuration steps above.

Internet ExplorerWARNING: Internet Explorer is no longer a supported browser. Once you are able to log into the workstation with your kerberos key you are now able to use that ticket in Internet Explorer. Log into the Windows machine using an account of your Kerberos realm (administrative domain) In Internet Explorer, click Tools, and then click Internet Options.

Click the Security tab
Click Local intranet
Click Sites
Click Advanced
Add your domain to the list

Click the Security tab
Click Local intranet
Click Custom Level
Select Automatic logon only in Intranet zone

Visit a kerberized web site using IE (You must use the fully-qualified Domain Name in the URL)
You are all set.