topic Re: Kerberos Authentication in General Topics

Kerberos Authentication

u5273 — Mon, 16 Jan 2012 15:40:59 GMT

Hello all,

I'm trying to understand how Kerberos authentication works on the PAN. From what I understand is that Kerberos does not send any passwords over the network but generates tickets.

1) When a user logs on a SSL VPN portal which is configured for Kerberos authentication, the user types in the password. But how handle the PAN the password? The KDC (AD) does not have a plaintext version of the user his password. So how is the ticket generated ?

2) Is there a possibility to use Kerberos delegation? Since the KDC does not have an account of the PAN in directory, there is no mutual authentication.

Any suggestions?

regards

Johan

Re: Kerberos Authentication

jdelio — Wed, 25 Jan 2012 15:59:52 GMT

Johan,

We have an online document here:

https://live.paloaltonetworks.com/docs/DOC-1762

It talks about how to configure and how Kerberos works.

Please review this information and let us know if this answers your question or not.

Re: Kerberos Authentication

u5273 — Thu, 26 Jan 2012 08:00:04 GMT

This document describes how to implement Kerberos. I'm looking for more detailed explanation how it works.

When the end user connects to the SSL Portal, he is prompted to enter his credentials, username and password. Since the PA device plays the role of a Kerberos client, how can the PA 'protect' the password of the client. Does the PA have access to the shared secret key ? And if yes, how does the domain controller knows if the request comes from the PA device. There is no trust between the domain controller and the PA device.

On one of my previous implementations I've used MS ISA server. Kerberos authentication was only possible if the device is a member of the domain. But the PA is no member of the domain. Or more simple, a Windows client needs to be a member of the domain before he can use Kerberos. Then we have a 'trust'.

Secondly, if the ticket is about to expire, who renewes the TGT. The end user or the PA device?

rgds

Johan

Re: Kerberos Authentication

ggarrison — Fri, 17 Feb 2012 17:58:18 GMT

Johan,

The PAN firewall does not directly participate in Kerberos authentication of clients, it relays the requests from the client to the servers that are configured in your Kerberos authentication profile. Consequently, no trust needs to be established with the firewall, as both members will have the keys necessary as they are both in the same domain. Also, TGT renewal requests will be renewed by the end user's workstation.

If you would like more information on Kerberos, please follow this link to Microsoft's TechNet:

http://technet.microsoft.com/en-us/library/cc961976.aspx