Kerberos authentication

[AEK]

Hi FG admins

I thought at one point that it can be a good substitute to FSSO. I didn't try it yet but if I'm not misunderstanding the Kerberos authentication doesn't work in flow based mode. Can anyone explain why?

[atakannatak]

Hi @AEK ,

Flow-based mode processes network traffic based on predefined rules without maintaining the state of individual connections. This means that packets are inspected and forwarded based on their attributes without considering the context of a particular session or connection.

Kerberos authentication relies on the exchange of tickets between clients and servers, which requires maintaining stateful communication between the two parties. In flow-based mode, this stateful communication can be challenging to maintain because packets are processed individually without regard to the ongoing authentication process.

As a result, flow-based mode may not be able to handle the intricacies of Kerberos authentication effectively, leading to authentication failures or security vulnerabilities. It's generally recommended to use proxy-based modes configuration to support Kerberos authentication effectively.

BR.

If my answer provided a solution for you, please mark the reply as solved it so that others can get it easily while searching for similar scenarios.

[AEK]

Thanks Atakan

This actually makes senss.