Skip to main content

ARIS Technical Help

Set up SSO for LDAP with Kerberos

Kerberos is a distributed authentication service for open and non-secure computer networks. Kerberos only works with on premises installations.

With ARIS 10 from service release 18 on and with the upgrade to JRE 17, the Triple Data Encryption Algorithm (Triple-DES or 3DES) and the Rivest Cipher 4 (RC4) as symmetric-key-algorithms for the encryption of digital data are no longer supported because these algorithms are considered as non-secure for modern applications.

Prerequisite

  • You have the Technical configuration administrator function privilege.

  • The technical user account that is used for Kerberos authentication

    • has a Service Principal Name configured the in format HTTP/<arisservername>, for example, HTTP/arisserver.com.

    • supports Kerberos AES 128/256 bit encryption

  • If you use multiple LDAP systems, the user names must be unique across all LDAP systems. Otherwise, SSO is impossible.

Procedure. Procedure
    1. Enable SSO for the servers (Kerberos).

    1. Click Application launcher Application launcher > Administration Administration. Configuration Configuration is displayed.

    2. Click User Management.

    3. Click the arrow next to Kerberos.

    4. Click General.

    5. Click Edit Edit.

    6. Enable Use Kerberos.

    7. Configure KDC – fully qualified name of the central Key Distribution Center.

    8. Configure the realm of Kerberos tickets. This is usually the fully qualified domain name in uppercase letters.

    9. Configure the principal. Specify the name of the technical user that is used for verifying Kerberos tickets. This is usually the User Principal Name (UPN) of the technical user account that holds the Service Principal Name (SPN).

    10. Click Save Save.

    2. Upload a key table.

    To upload the key table file, click Upload Upload under the Key table field.

    Use the JRE tool ktab.exe to display the content of an existing key table file. To do so, enter the following command on the command line:

    ...jre\bin\ktab -l -e -t -k FILE:C:\<file location of the umc.ktab file>\umc.ktab

    • If you have no key table file available, generate a key table file using the JRE tool ktab.exe (JRE17 or later). To do so, enter the following command on the command line:

    ...jre\bin\ktab -a userPrincipalName@REALM password -n 0 -append -k umc.keytab
    3. Upload a configuration file.

    1. To upload the configuration file, click Upload Upload under the Configuration file field. You find this file on your installation medium under Add-ons\Kerberos. The dialog for uploading a file opens.

    2. Select the relevant file and click Upload.

    You have enabled Kerberos.