> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/integrations/authentication/desktop-sso/kerberos-single-sign-on.md).

# Kerberos Single Sign-On

***

### Prerequisites

Before starting, make sure you have:

* **Active Directory** integrated with your 1Kosmos tenant, using an **AD Broker** user directory.
* **AD Broker v1.08.08 or later** — required for Kerberos compatibility.
* **Domain Controller access** — admin privileges to create service accounts and generate keytab files.

### Create a Service Account in Active Directory

{% hint style="info" %}
**Note:** These steps require administrator privileges on the AD member server or domain controller.
{% endhint %}

1. Open **Active Directory Users and Computers (ADUC)**: go to **Start → Run**, type `dsa.msc`, and press Enter.
2. Right-click the target folder and select **New → User**.
3. Fill in the user details and set a **User logon name** (e.g., `spnadmin`).
4. Set a password, uncheck **User must change password at next logon**, and click **Next → Finish**.

   > 💡 Select **Password never expires** to prevent service interruptions. Rotate the password regularly for security.
5. Right-click the new user → **Properties → Account tab**.
6. Under **Account Options**, check either:
   * **This account supports Kerberos AES 128-bit encryption**, or
   * **This account supports Kerberos AES 256-bit encryption**
7. Click **Apply**.
8. Create a group policy to enable AES encryption on the AD server. See Windows Configurations for Kerberos Supported Encryption Type.

### Configure the Service Principal Name (SPN)

Open a command prompt and run:

```shell
setspn -S HTTP/<1Kosmos tenant domain>@<REALM> <ServiceAccountName>
```

**Example:**

```shell
setspn -S HTTP/[email protected] spnadmin
```

**SPN format:** `HTTP/<1Kosmos tenant domain>@<REALM>`

{% hint style="info" icon="lightbulb-exclamation-on" %}
Your REALM is your Active Directory domain in **UPPERCASE**, without the TLD.\
Example: if your AD domain is `blockid.1kosmos`, your REALM is `BLOCKID.1KOSMOS`.
{% endhint %}

#### Find your Kerberos REALM

1. Go to **Administrative Tools → Active Directory Domains and Trusts**.
2. Your AD domain names are listed there.

#### Remove an SPN (if needed)

```shell
setspn -d HTTP/<tenant domain>@<REALM> <hostname>
```

### Generate the Keytab File

{% hint style="info" %}
**Note:** Generate a separate keytab file for each tenant. Treat the keytab like a password — store it securely.
{% endhint %}

After running the `setspn` command, generate the keytab:

```shell
ktpass -out <filename>.keytab -mapuser <AD user> +rndPass -mapOp set +DumpSalt -crypto AES256-SHA1 -ptype KRB5_NT_PRINCIPAL -princ <service principal>
```

**Example:**

```shell
ktpass -out myfile.keytab -mapuser [email protected] +rndPass -mapOp set +DumpSalt -crypto AES256-SHA1 -ptype KRB5_NT_PRINCIPAL -princ HTTP/[email protected]
```

| Option                     | Description                                          |
| -------------------------- | ---------------------------------------------------- |
| `-out <filename.keytab>`   | Output keytab file name                              |
| `-mapuser <AD user>`       | Service account created in Step 1                    |
| `+rndPass`                 | Generates a random password                          |
| `-crypto AES256-SHA1`      | Encryption type (must match Step 1 account settings) |
| `-ptype KRB5_NT_PRINCIPAL` | Kerberos principal type                              |
| `-princ <SPN>`             | Service principal configured in Step 2               |

Save the generated keytab file to a secure location. You will upload it to AdminX in the next step.

### Enable Kerberos SSO in AdminX

#### For a new AD Broker user directory

Enable **Kerberos Single Sign On** under the **Advanced Configuration** tab when creating the AD Broker directory. See [Connect to AD via Broker ](/authentication/authentication-broker/connect-directory-via-the-adminx-broker.md)for details.

#### For an existing AD Broker user directory

1. Sign in to the AdminX portal as a tenant or community administrator.
2. Go to **Directory → Directory Integrations**.
3. Find your AD Broker user directory and click the **pencil icon** to edit.
4. Click the **Advanced Configuration** tab.
5. Enable **Kerberos Single Sign On**.
6. Under **Key Tab file**, click **Upload** and upload the keytab file generated in Step 3.
7. Click **Save Changes**.

### Configure Browsers

Browsers must be configured to trust your 1Kosmos tenant for Kerberos authentication.

#### Firefox

1. Sign in to your Windows AD domain.
2. In Firefox, navigate to `about:config`.
3. Search for `network.n`.
4. Double-click **network.negotiate-auth.trusted-uris** and enter your 1Kosmos tenant domain (comma-separated if multiple).
5. If using Credential Delegation, also set **network.negotiate-auth.delegation-uris** with the same domains.
6. Restart Firefox.

#### Microsoft Edge / Google Chrome

1. Open **Control Panel → Internet Options**.
2. Go to the **Security** tab → **Trusted Sites → Sites**.
3. Add your 1Kosmos tenant URL and click **Add → Apply → OK**.

### Configure Adaptive Authentication for Kerberos (Optional)

You can add a second factor on top of Kerberos using an adaptive authentication journey.

| Method                 | Description                                         |
| ---------------------- | --------------------------------------------------- |
| **Kerberos**           | SSO using active Kerberos token only                |
| **Kerberos + Push**    | Kerberos token followed by push notification        |
| **Kerberos + Any OTP** | Kerberos token followed by OTP from the 1Kosmos app |

To configure:

1. Sign in to AdminX and go to **Authentication → Adaptive Authentication**.
2. Click **Add new adaptive auth journey**.
3. Enter a journey name and set user conditions.
4. In the **Authentication** dropdown, select the appropriate Kerberos method.
5. Click **Save**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.1kosmos.com/integrations/authentication/desktop-sso/kerberos-single-sign-on.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.