How to configure kerberos SSO
Kerberos SSO allow local users to log-in in the appliance web-interface automatically (without asking you to insert any credentials). The outlook-addin uses Exchange-based SSO, you don't need to configure kerberos to make it working.
NOTE: Kerberos SSO is not compatible with multi-tenant appliances.
- Configure an LDAP set to authenticate users. The LDAP configuration must be configured to authenticate user using their sAMAccountName. You can use this query: (|(mail={username})(sAMAccountName={username})) . This query will search users by the primary email address and their sAMAccountName. It makes Kerberos Authentication working and allow users to continue loggin-in through the web interface (when kerberos is not available, like from a non-windows computer)
- Go to Settings -> Authentication -> SSO/SAML Configuration
- Make sure you are in the Kerberos tab
- Select the LDAP set you created before and click Continue
- Enter your AD domain and click Verify then Continue
- Follow the inline documentation to create the HTTP.keytab and HOST.keytab files. You'll need them to join the archiver appliance in the AD domain. Once the files are ready upload them to the specific fields and validate them
- Review the configuration and apply it
- You should now see an "SSO Login" button in the web interface, use it to login with Kerberos.