---
title: Windows Authentication on the Kron PAM GUI
slug: kronpam-reference-guide-3-4-0/windows-authentication-on-the-kron-pam-gui
description: Learn how to configure Windows Authentication to access the Kron PAM GUI with this helpful document. From adjusting settings on the Domain Controller and Kron PAM Server to configuring browser and system parameters, discover the key steps necessary for su
docTags: 
createdAt: 2022-07-24T14:27:43.000Z
---

Windows Authentication can be used to log in to the Kron PAM GUI. The required settings are outlined in this section. The following terms are used in the configuration steps:

**Domain Controller:** DomainControllerFQDN (Ex: WIN-TEST.singleconnect.com)
**Kron PAM Server**: schostnameFQDN (Ex: sc-test.singleconnect.com)
**Domain Name**: DomainName (Ex: singleconnect.com)

### 
Domain Controller Configuration

The following configurations should be set on the Domain Controller:

1. Create a user (Ex: username: win\_auth, password: 123)
2. Create an SPN (Service Principal Name) for this user, using the following command:
   setspn -A HTTP/**SingleServerHostname username**
   (Ex: setspn -A HTTP/ sc-test.singleconnect.com win\_auth)
3. Create an “sc.keytab” file using the following command:
   ktpass /out c:\sc.keytab /mapuser **usernameFQND** /princ HTTP/ **schostnameFQDN\@domainName** /pass password /kvno 0-ptype KRB5\_NT\_PRINCIPAL
   (Ex\:ktpass /out c:\sc.keytab /mapuser **win\_auth\@singleconnect.com** /princ HTTP/sc-**test.singleconnect.com\@singleconnect.com** /pass 123 /kvno-ptype KRB5\_NT\_PRINCIPAL)

### Kron PAMServer Configuration

The following configurations should be set on the Single Connect server:

1. Establish an SSH connection to Kron PAM as the **pamuser** user.
2. Move the “sc.keytab” file under “$CATALINA\_BASE/conf/”.
   (The default Catalina base directory is “u01/netright-tomcat”)
3. Create the “krb5.ini” file in the Tomcat Server under “$CATALINA\_BASE/conf/” with the following example content:
   \[libdefaults]
   default\_realm = SINGLECONNECT.COM
   default\_keytab\_name = FILE:/u01/netright-tomcat/conf/sc.keytab
   default\_tkt\_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96
   default\_tgs\_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96
   forwardable=true                                                                                                                                                                   allow\_weak\_crypto=true
   \[realms]
   SINGLECONNECT.COM =
   \{ kdc = WIN-TEST.singleconnect.com:88 }
   \[domain\_realm]
   SingleConnect.com= SINGLECONNECT.COM
   .SingleConnect.com= SINGLECONNECT.COM
4. Add the following lines in pam-gui.service file under /usr/lib/systemd/system directory
   -Djava.security.krb5.conf=/u01/netright-tomcat/conf/krb5.ini
   -Djavax.security.auth.useSubjectCredsOnly=false                                                      Example
   Environment="JAVA\_OPTS=-Djava.security.krb5.conf=/u01/netright-tomcat/conf/krb5.ini -Djavax.security.auth.useSubjectCredsOnly=false -agentlib\:jdwp=transport=dt\_socket,server=y,suspend=n,address=8000 -Xmx2048m -Xms256m -Duser.language=en -Duser.region=US -Duser.timezone=Etc/GMT-3 -Dlog4j2.formatMsgNoLookups=true -Djava.security.properties=/u01/kron/security/java.security -Dlog4j.configurationFile=/u01/netright-tomcat/conf/log4j2.xml -Dlog4j.configurationFile=/u01/netright-tomcat/conf/log4j2.xml -Dlog4j.configurationFile=/u01/netright-tomcat/conf/log4j2.xml -Dlog4j.configurationFile=/u01/netright-tomcat/conf/log4j2.xml -Dlog4j.configurationFile=/u01/netright-tomcat/conf/log4j2.xml -Dlog4j.configurationFile=/u01/netright-tomcat/conf/log4j2.xml"

### Client Browser Configuration

The following configurations should be set on the client’s browser. Configurations made for Internet Explorer (IE) also activate the Edge and Chrome browsers.

**For Internet Explorer (IE):**

1. Go to** Settings** >** Internet Options** > **Security**.
2. Select **Local Intranet Zone**, click the **Sites** button, check all three options, and click the **Advanced **button to add the Kron PAM** Server Name** to this zone.
   Ex: http\://sc-test.SingleConnect.com
3. Select **Local Intranet Zone**, click the **Custom Level** button, and select **Automatic logon only intranet**.

**For Firefox:**

1. Type **about\:config** on the address bar, accept the warning and change the **network.negotiate-auth.trusted-uris** value to Kron PAM** Server Hostname**
   Ex: [http://sc-test.singleconnect.com](http://sc-test.singleconnect.com)
2. Restart the computer.
3. Access the application by typing the Kron PAM** Server Hostname** on the address bar,** without the IP.**
   Ex: [http://sc-test.singleconnect.com](http://sc-test.singleconnect.com)

### Kron PAM GUI Configuration

Add the following parameters in the System Config Manager:

1. Navigate to **Administration** > **System Config. Man**.
2. Add these parameters:
   **windows.auth.keytab.path** = /u01/netright-tomcat/conf/sc.keytab
   **windows.auth.spn** = HTTP/SingleConnectServerName
   Example value: HTTP/sc-test.SingleConnect.com
   **aioc.auth.windows** = true