Kerberos in FortiGate for SSO

2 replies
1879 views

Hi All,

I need to configure my firewall to identify users using Kerberos for single sign on without an use of an explicit proxy. I was only able to find articles with Kerberos authentication with explicit proxy.

My Device : FG-401F

OS Version : 7.0.15

Thank you !...

Atul_SAnswer

Staff & Editor

Hi Sadhi,

You have to have a proxy feature enabled to help intercept the layer 7 handling for the Kerberos authentication since Kerebros is a layer 7 protocol. You may resort to FSSO, local auth using Captive portal but if you want to leverage Kerberos then proxy feature has to be enabled and to my knowledge, this is vendor independent and its the way Kerberos requires the underlay mechanism. With the proxy only, FortiGate can inspect and intercept the HTTP headers and negotiate the Kerberos ticket exchange. You may refer to the below docs to consider using transparent proxy in your device and RFC for a detailed read about Kerberos auth.

https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/15908/transparent-proxy

https://datatracker.ietf.org/doc/html/rfc4120

Thanks,

Atul_SAnswer

Staff & Editor

Hi Sadhi,

You have to have a proxy feature enabled to help intercept the layer 7 handling for the Kerberos authentication since Kerebros is a layer 7 protocol. You may resort to FSSO, local auth using Captive portal but if you want to leverage Kerberos then proxy feature has to be enabled and to my knowledge, this is vendor independent and its the way Kerberos requires the underlay mechanism. With the proxy only, FortiGate can inspect and intercept the HTTP headers and negotiate the Kerberos ticket exchange. You may refer to the below docs to consider using transparent proxy in your device and RFC for a detailed read about Kerberos auth.

https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/15908/transparent-proxy

https://datatracker.ietf.org/doc/html/rfc4120

Thanks,