Front-Side Kerberos configuration (one-shot flow)

Steps 1–5 in this section describe how the Airlock Gateway configuration must be adapted in order to use Front-side Kerberos with the One-Shot authentication flow. The second half of the steps describe how to use the previously configured Kerberos setting to finalize the one-shot flow in Airlock IAM.

Step 1 – Create a back-end group for IAM

  1. Sign in to Airlock Gateway Configuration Center as an admin.
  2. To add a new back-end group, go to Application Firewall >> Reverse Proxy and click on the + sign at the top of the Back-end Group column.
    • The Back-end Group dialog opens.
  4. In the General section, Name field, enter a suitable name for the new back-end group.
  5. In the Back-end Hosts section,
    • select the correct protocol in the Protocol drop-down list,
    • enter a name for the host in the Back-end Host field, and
    • enter the correct port number in the Port field.

Step 2 - Import a mapping for IAM

  1. In the Mapping column, click the + button and choose New from template.
    • The Mapping Templates list appears.
  3. In the section Airlock IAM, choose Download Mapping Templates.
    • The latest Airlock IAM documentation opens up in the browser.
  5. Go to the “Uploading mapping templates to Airlock Gateway” table. Select and download the IAM Loginapp template that matches your Airlock Gateway version.
  6. Change back to the Airlock Gateway Configuration Center and close the Mapping Templates list.
  7. In the Mapping column, click the + button and choose Import.... Select and import the downloaded mapping template .zip file.
    • The new mapping opens in edit mode.
  9. Switch to the Response Actions tab. Go to the Default Actions section and check that the (default) Remove Negotiate header action is disabled. This is the default setting. If not, disable it.
  10. Switch to the Allow Rules tab and enable the One-Shot Functionality rule.
  11. Change back to the Reverse Proxy view.
    • The new Airlock-IAM-Loginapp mapping is now shown in the Mapping column.
  13. Connect the Airlock-IAM-Loginapp mapping
    • to the same virtual host as the web application mapping, and
    • to the back-end group you just created.

Step 3 – Customize the application mapping

  1. Go to Application Firewall >> Reverse Proxy and edit the Mapping of the web application for which Front-side Kerberos should be used.
  2. Configure the Denied access URL point to the correct instance of Airlock IAM. For the IAM auth instance the URL would be /auth/login-oneshot
  3. Select One-Shot in the Authentication flow drop-down list.
  4. Enter the credential Airlock IAM sets after a successful authentication under Restricted to roles.

Step 4 – Configure the maximal allowed HTTP request header size

  1. Go to Expert Settings >> Security Gate / Apache
  2. Enable the Apache Expert Settings and configure the following setting:
  3.  
    Example
    # Increase the maximal allowed HTTP request header size
LimitRequestFieldSize 16384
  4.  
    Notice
    • Please ensure that the Airlock Gateway setting configured in this step is identical or smaller than the one configured in Airlock IAM. How this can be achieved is described in .
    • For further information about issues caused because of wrong configuration of the allowed HTTP request header size, check .

Step 5 – Activate Airlock Gateway configuration

After going through the previous steps, activate the new configuration.

  1. Click on the Activate button in the Airlock Gateway Configuration Center.

Step 6 – Create krb5.conf file in Airlock IAM

Create a /etc/krb5.conf file and configure it with the correct values for the Windows domain.

/etc/krb5.conf

 
Example
[libdefaults]
default_realm = AIRLOCK.COM

[realms]
AIRLOCK.LOCAL = {
kdc = dc.airlock.com
default_domain = AIRLOCK.COM
}

[domain_realm]
.airlock.local = AIRLOCK.COM
 
Notice
  • The uppercase values are settings to describe the Kerberos realm, while the lowercase values are DNS settings. Configure the settings in the same upper-/lowercase as illustrated above.
  • To make the new settings from the /etc/krb5.conf file active, Airlock IAM must be restarted.

Step 7 – Copy the *.keytab file

Copy the *.keytab file into the IAM instance directory (e.g. /home/airlock/iam/instances/auth/).

Step 8 – Create a One-Shot configuration for authentication flow One-Shot

  1. Go to:
    Loginapp >> One-Shot Authentication
  2. Create a new Target Application/Service
  3. Configure the Kerberos SPNEGO Extractor as the Credential Extractor
  4. Create a new Kerberos Config
  5. Configure the Keytab File which has been copied into the instance directory previously (e.g. instances/auth/airlock.com.keytab)
  6. Configure the Service Principal (e.g. HTTP/a.airlock.com)
  7. Go back and continue editing the Target Application/Service
  8. It is recommended to configure a Lookup and Accept Authenticator as the Authenticator to check whether the user is locked or not and to potentially load context data/roles.
  9. Go back and continue editing the Target Application/Service
  10. Configure the Kerberos SPNEGO Error Mapper as the Failure Responses
  11. Go back and continue editing the Target Application/Service
  12. Click on the Activate button in the Airlock IAM Config Editor.
 
Info

If multiple Service Principal (SPN) have to be supported, either create a new Kerberos Config per SPN (using contexts and with a context extractor to choose the correct context) or specify “*” as the SPN to simply accept all SPNs contained in the *.keytab file.

 
Info

From a Front-side Kerberos perspective, these are all the necessary settings. Nevertheless, ensure that all other important settings for a One-Shot Target Application are set.