Kerberos configuration files - Kerberos configuration files - Alfresco - Identity Service - Alfresco/Identity-Service/1.7/Identity-Service/Identity-Service/Tutorials/Single-Sign-On-SSO-Guide/Kerberos/Optional-Containerized-deployment/Kerberos-configuration-files - 1.7

In Step 1 the keytab and krb5.conf files need to be edited if the Active Directory instance is in a separate domain.

1. The keytab file can be configured to refer to an Active Directory instance in a separate domain if necessary.

   For example:

   ktpass -princ HTTP/alfresco.example.com@AD-SSO.EXAMPLE.COM -pass PASSWORD -mapuser 
   ad-sso\httpsalfresco -crypto all -ptype KRB5_NT_PRINCIPAL -out 
   c:\temp\httpalfresco.keytab -kvno 0
   

   Where alfresco.example.com is the load balancer address, AD-SSO.EXAMPLE.COM is the domain of the Active Directory instance and ad-sso is the domainnetbios of the Active Directory instance.

2. The krb5.conf uses the internal IP address of the Active Directory container.

   For example:

   [libdefaults]
   default_realm = AD-SSO.EXAMPLE.COM
   default_tkt_enctypes = rc4-hmac
   default_tgs_enctypes = rc4-hmac
   
   [realms]
   AD-SSO.EXAMPLE.COM = {
             kdc = ec2amaz-5gk9lmd.ad-sso.example.com
             }
   
   [domain_realm]
   ec2amaz-5gk9lmd.ad-sso.example.com = AD-SSO.EXAMPLE.COM
   .ec2amaz-5gk9lmd.ad-sso.example.com = AD-SSO.EXAMPLE.COM