Kerberos Single Sign-On

1Kosmos uses Kerberos with Active Directory (AD) to provide seamless SSO. Users authenticated on their AD network are automatically signed in to 1Kosmos applications without re-entering credentials.

---

Prerequisites

Before starting, make sure you have:

• Active Directory integrated with your 1Kosmos tenant, using an AD Broker user directory.
• AD Broker v1.08.08 or later — required for Kerberos compatibility.
• Domain Controller access — admin privileges to create service accounts and generate keytab files.

Create a Service Account in Active Directory

Note: These steps require administrator privileges on the AD member server or domain controller.

1. Open Active Directory Users and Computers (ADUC): go to Start → Run, type dsa.msc, and press Enter.
2. Right-click the target folder and select New → User.
3. Fill in the user details and set a User logon name (e.g., spnadmin).
4. Set a password, uncheck User must change password at next logon, and click Next → Finish.

   💡 Select Password never expires to prevent service interruptions. Rotate the password regularly for security.

5. Right-click the new user → Properties → Account tab.
6. Under Account Options, check either:

   • This account supports Kerberos AES 128-bit encryption, or
   • This account supports Kerberos AES 256-bit encryption
7. Click Apply.
8. Create a group policy to enable AES encryption on the AD server. See Windows Configurations for Kerberos Supported Encryption Type.

Configure the Service Principal Name (SPN)

Open a command prompt and run:

setspn -S HTTP/<1Kosmos tenant domain>@<REALM> <ServiceAccountName>

Example:

setspn -S HTTP/[email protected] spnadmin

SPN format: HTTP/<1Kosmos tenant domain>@<REALM>

Your REALM is your Active Directory domain in UPPERCASE, without the TLD. Example: if your AD domain is blockid.1kosmos, your REALM is BLOCKID.1KOSMOS.

Find your Kerberos REALM

1. Go to Administrative Tools → Active Directory Domains and Trusts.
2. Your AD domain names are listed there.

Remove an SPN (if needed)

setspn -d HTTP/<tenant domain>@<REALM> <hostname>

Generate the Keytab File

Note: Generate a separate keytab file for each tenant. Treat the keytab like a password — store it securely.

After running the setspn command, generate the keytab:

ktpass -out <filename>.keytab -mapuser <AD user> +rndPass -mapOp set +DumpSalt -crypto AES256-SHA1 -ptype KRB5_NT_PRINCIPAL -princ <service principal>

Example:

ktpass -out myfile.keytab -mapuser [email protected] +rndPass -mapOp set +DumpSalt -crypto AES256-SHA1 -ptype KRB5_NT_PRINCIPAL -princ HTTP/[email protected]

Option	Description
-out <filename.keytab>	Output keytab file name
-mapuser <AD user>	Service account created in Step 1
+rndPass	Generates a random password
-crypto AES256-SHA1	Encryption type (must match Step 1 account settings)
-ptype KRB5_NT_PRINCIPAL	Kerberos principal type
-princ <SPN>	Service principal configured in Step 2

Save the generated keytab file to a secure location. You will upload it to AdminX in the next step.

Enable Kerberos SSO in AdminX

For a new AD Broker user directory

Enable Kerberos Single Sign On under the Advanced Configuration tab when creating the AD Broker directory. See Connect to AD via Broker for details.

For an existing AD Broker user directory

1. Sign in to the AdminX portal as a tenant or community administrator.
2. Go to Directory → Directory Integrations.
3. Find your AD Broker user directory and click the pencil icon to edit.
4. Click the Advanced Configuration tab.
5. Enable Kerberos Single Sign On.
6. Under Key Tab file, click Upload and upload the keytab file generated in Step 3.
7. Click Save Changes.

Configure Browsers

Browsers must be configured to trust your 1Kosmos tenant for Kerberos authentication.

Firefox

1. Sign in to your Windows AD domain.
2. In Firefox, navigate to about:config.
3. Search for network.n.
4. Double-click network.negotiate-auth.trusted-uris and enter your 1Kosmos tenant domain (comma-separated if multiple).
5. If using Credential Delegation, also set network.negotiate-auth.delegation-uris with the same domains.
6. Restart Firefox.

Microsoft Edge / Google Chrome

1. Open Control Panel → Internet Options.
2. Go to the Security tab → Trusted Sites → Sites.
3. Add your 1Kosmos tenant URL and click Add → Apply → OK.

Configure Adaptive Authentication for Kerberos (Optional)

You can add a second factor on top of Kerberos using an adaptive authentication journey.

Method	Description
Kerberos	SSO using active Kerberos token only
Kerberos + Push	Kerberos token followed by push notification
Kerberos + Any OTP	Kerberos token followed by OTP from the 1Kosmos app

To configure:

1. Sign in to AdminX and go to Authentication → Adaptive Authentication.
2. Click Add new adaptive auth journey.
3. Enter a journey name and set user conditions.
4. In the Authentication dropdown, select the appropriate Kerberos method.
5. Click Save.