Kerberos Delegation Overview

Kerberos Delegation means a system and user is configured to request Kerberos tokens on behalf of another user.

Since Unified Access Gateway is not joined to the domain we need to add AD Domain Kerberos support to UAG. This is done with the help of generating a Keytab file. This file contains necessary security tokens/hashes for Unified Access Gateway to interact with Microsoft AD. The Keytab file contains the information about the user delegated to request Kerberos tokens on another users’ behalf.

Microsoft recommends that each internal Web Application has its own delegated user and therefore different Keytab file, technically you can have one delegated user and Keytab file for many different internal apps, but you are taking the risk in case the Keytab file is compromised to give access to all internal apps. When you have one user / Keytab file per application this allows you to disable access to only one system at a time.

While creating the user and keytab file for each application requires more administration it has its clear security benefits.

REALM is often something you hear talking about Kerberos. A REALM is basically your trust boundaries. In AD Kerberos that is your clients, AD servers and application servers all joined to the domain. Each one trusts each other since they are all part of the same Kerberos REALM.

Environment configuration:

1. Authentication Flow

The below diagram describe step by step the authentication flow that you will be configuring in this lab.

Authentication Flow
  1. Client navigates to application URL
  2. Client is redirected to IDP (Workspace One) for authentication ( IDP issue SAML assertion upon authentication.
  3. Client passes SAML assertion to UAG ( UAG validates SAML assertion is from trusted IDP.
  4. UAG extracts the client’s username from the SAML assertion and requests a Kerberos ticket from Active Directory (CORP.LOCAL) on behalf of that user.
  5. Unified Access Gateway authenticates against the internal web server (https://it.corp.local) using the Kerberos ticket obtained from AD.