KB - Verify the DNS configuration for back-side Kerberos SSO

Affects product

  • Airlock Gateway

Question or problem

Airlock Gateway requests Kerberos tickets on behalf of a user from the Active Directory domain controllers. In a cross-domain setup, multiple domain controllers could be involved.

With DNS requests Airlock Gateway figures out the correct domain controller to request the Kerberos ticket. This requires that Airlock Gateway has a DNS server configured which can resolve the DNS SRV requests to determine the appropriate Active Directory domain and domain controllers.

Procedure-related prerequisites

  • You must be logged in as an admin in the Airlock Gateway Configuration Center.

Instruction

Test preparation:

  1. Go to:
    System Setup >> Network Services.

Test execution and verification:

  1. Verify the following:
    • The configured DNS server resolves the DNS SRV requests.
    • Run the tool airlock-test-kerberos with the parameter -v and test with the involved user, system user and backend. The output shows that the DNS requests could be resolved. An example of a successful response is shown below: 
    • Sending DNS SRV query for _kerberos._udp.INT.VIRTINC.COM. 
SRV answer: 0 100 88 "srv-dc1.int.virtinc.com." 
Sending DNS SRV query for _kerberos._tcp.INT.VIRTINC.COM. 
SRV answer: 0 100 88 "srv-dc1.int.virtinc.com." 
Resolving hostname srv-dc1.int.virtinc.com. 
Resolving hostname srv-dc1.int.virtinc.com.
  3. The verification steps from the above were successful.
 
Info

In case of failure:

  • Ensure that the configured DNS server can resolve the DNS SRV requests to determine the appropriate Active Directory domain and domain controller.
  • Either configure another DNS server or ensure that the required DNS records are available in the DNS server.

Further information