Kerberos configuration file

A Kerberos configuration file is required to provide Portal for ArcGIS with information about the Kerberos domain controller. This information must be saved in a text file, for example, krb5.conf. A copy of the text file must be stored in a location where the Portal for ArcGIS service account can access it. Examples of this include the portal installation folder or the portal content directory. The default location for the portal content directory is c:\arcgisportal.

This configuration file is standard for Kerberos and should include default configuration settings and information on one or more Kerberos domain controllers for each Kerberos realm. An example configuration file is shown below.

[libdefaults]
    dns_lookup_realm = false
    ticket_lifetime = 24h
    renew_lifetime = 7d
    forwardable = true
    rdns = false
    default_ccache_name = KEYRING:persistent:%{uid}
    dns_lookup_kdc = true
    default_realm = EXAMPLE.COM
    default_checksum = rsa-md5

[realms]

EXAMPLE.COM = {
    kdc = domaincontroller.example.com
    admin_server = domaincontroller.example.com
}

[domain_realm]
    example.com = EXAMPLE.COM
    .example.com = EXAMPLE.COM

New user and group store properties supported with Windows and LDAP identity store types

• "saslAuthenticationScheme"—Defines the SASL authentication scheme used by Portal for ArcGIS to connect to domain controllers through LDAP. At 10.9, GSSAPI is the only supported SASL authentication scheme. Example: "saslAuthenticationScheme": "GSSAPI"
• "krb5ConfigFilePath"—Defines the path to the Kerberos configuration text file described above. This must reside in a location with read access for the Portal for ArcGIS service account.

  Example: "krb5ConfigFilePath": "c:\\arcgisportal\\krb5.conf"

Portal for ArcGIS identity store configurations

The SASL GSS authentication mechanism can be used with either Windows or LDAP identity store types and will work with both portal-tier and web-tier authentications. This also includes maintaining and refreshing enterprise group membership.

Windows users and groups

When configuring Portal for ArcGIS to use Windows users and groups with SASL authentication, the "saslAuthenticationScheme" and "krb5ConfigFilePath" properties are required. The "user" property must be specified in the format username@realm. The realm will always be uppercase in the krb5.conf file but does not need to be in the json string. The "domainControllerAddress" is also required and must include the fully qualified domain name (FQDN) for one or more Kerberos domain controllers that are used. IP addresses are not supported for SASL authentication. If the enterprise users and groups come from more than one domain, the "domainControllerMapping" property should be used to link the domain name to the domain controller host name. Below is an example for both the user and group store configurations with just a single domain.

{
  "type": "WINDOWS",
  "properties": {
    "saslAuthenticationScheme": "GSSAPI",
    "krb5ConfigFilePath": "C:\\arcgisportal\\krb5.conf",
    "user": "entuser@example.com",
    "userPassword": "encrypted_password",
    "isPasswordEncrypted": "true",
    "caseSensitive": "false",
    "userGivenNameAttribute": "givenName",
    "userSurnameAttribute": "sn",
    "userEmailAttribute": "mail",
    "domainControllerAddress": "domaincontroller.example.com"
  }
}

{
  "type": "WINDOWS",
  "properties": {
    "saslAuthenticationScheme": "GSSAPI",
    "krb5ConfigFilePath": "C:\\arcgisportal\\krb5.conf",
    "user": "entuser@example.com",
    "userPassword": "encrypted_password",
    "isPasswordEncrypted": "true",
    "domainControllerAddress": " domaincontroller.example.com"
  }
}

Kerberos domain controller setting

The domain controller setting for LDAP server channel binding token requirements cannot be set to Always due to Java limitations. For details, see JVM Bug 8245527. It must be set to either When supported or Never.