Skip to main content

## Kerberos Authentication

On the Access > Kerberos Authentication page you can configure Kerberos Servers and Users using for login on the Web GUI.

By default the library has one predefined Administrator user account. When Kerberos servers and users are configured, the users can be used for login on the Web GUI login screens.

Each Kerberos user is assigned to a role, based on the predefined user roles, and this role determines the access level for the Kerberos user.

| NOTE | Using Kerberos does not disable the predefined user accounts. For library security, ensure that the password for the predefined administrator user account is always set. Setting the administrator password is required for any user with administrator role to log in from the Web GUI.

| NOTE | Kerberos server configuration is dependent on the company’s IT environment and security model. See your IT administrator for the settings for your environment. Before adding a server, you will need to know:

- Realm
- Default Domain
- KDC (Key Distribution Center) address and port
- Admin Server address and port

Default Domain and Admin Server is not a required configuration option for Kerberos 5 servers.

1. Navigate to the Access > Kerberos Authentication page.
2. If not already listed, add your Kerberos servers.

1. In the Kerberos Servers area click Add Server.
   The Web GUI displays the Add Server dialog.
2. Enter all of the requested Kerberos configuration settings in dialog.
   See your Kerberos server documentation or local Kerberos administrator for the preferred values for the various Kerberos configuration settings.

- Realm - This is your Kerberos realm, which is usually a domain name in upper case letters. For example, the machine foo.abc.com is in the ABC.COM Kerberos realm.
- Default Domain - The default domain of the Kerberos server.
- KDC, Port - The address and port of the key distribution center.
- Admin Server, Port - The address and port of the admin server.

1. Click Test Connection to verify the configuration.
2. When the library successfully connects to the Kerberos server, click OK.

1. In the Kerberos Users area, click Add User.
   The Web GUI displays the Add User dialog.
2. Enter all of the requested user settings in dialog.

- Principal - Enter the name of the Kerberos Principal in this field. The Principal name consists of a number of components separated using the "/" separator.
- Realm - This is your Kerberos realm. A drop down list offers the realms of the previously conifgured Kerberos servers.
- User Role - Monitor, Superuser or Administrator. The other roles can be assigned by an user having the administrator role.

1. Click OK to add the user.

Kerberos server settings can be modified after the server was added. Selecting a server from the server list and choose Modify Server from the Kerberos Servers action menu, opens the Modify Server dialog.

Removing a server can be done by selecting the server which should be removed and choose Remove Server from the Kerberos Servers action menu. This action must be confirmed. The Kerberos users related to the removed server are automatically removed together with the server.

The user role of an Kerberos user can be modified after the user has been added. This can be done by selecting the specific user and using the Modify User action from the Kerberos Users action menu.

Removing a user can be done by selecting the user which should be removed and choose Remove User from the Kerberos Users action menu. This action must be confirmed.