Kerberos Authentication

[u5273]

Hello all,

I'm trying to understand how Kerberos authentication works on the PAN. From what I understand is that Kerberos does not send any passwords over the network but generates tickets.

1) When a user logs on a SSL VPN portal which is configured for Kerberos authentication, the user types in the password. But how handle the PAN the password? The KDC (AD) does not have a plaintext version of the user his password. So how is the ticket generated ?

2) Is there a possibility to use Kerberos delegation? Since the KDC does not have an account of the PAN in directory, there is no mutual authentication.

Any suggestions?

regards

Johan

[jdelio]

Johan,

We have an online document here:

https://live.paloaltonetworks.com/docs/DOC-1762

It talks about how to configure and how Kerberos works.

Please review this information and let us know if this answers your question or not.

[u5273]

This document describes how to implement Kerberos. I'm looking for more detailed explanation how it works.

When the end user connects to the SSL Portal, he is prompted to enter his credentials, username and password. Since the PA device plays the role of a Kerberos client, how can the PA 'protect' the password of the client. Does the PA have access to the shared secret key ? And if yes, how does the domain controller knows if the request comes from the PA device. There is no trust between the domain controller and the PA device.

On one of my previous implementations I've used MS ISA server. Kerberos authentication was only possible if the device is a member of the domain. But the PA is no member of the domain. Or more simple, a Windows client needs to be a member of the domain before he can use Kerberos. Then we have a 'trust'.

Secondly, if the ticket is about to expire, who renewes the TGT. The end user or the PA device?

rgds

Johan  

[ggarrison]

Johan,

The PAN firewall does not directly participate in Kerberos authentication of clients, it relays the requests from the client to the servers that are configured in your Kerberos authentication profile.  Consequently, no trust needs to be established with the firewall, as both members will have the keys necessary as they are both in the same domain.  Also, TGT renewal requests will be renewed by the end user's workstation.

If you would like more information on Kerberos, please follow this link to Microsoft's TechNet:

http://technet.microsoft.com/en-us/library/cc961976.aspx