---
title: Windows Authentication on the Kron PAM Desktop Client
slug: kronpam-reference-guide-3-9-0/windows-authentication-on-the-kron-pam-desktop-client
docTags: 
createdAt: 2024-11-27T13:26:40.029Z
---

Windows Authentication can be used to log in to the Kron PAM Desktop Client as well. 

The required settings are outlined in this section. 

The following terms are used in the configuration steps:

### Domain Controller Configuration

The following configurations should be set on the Domain Controller:

1. Create a user. 
   - (For Example, username: **ssotest**, password: **123**)
2. Create an SPN (Service Principal Name) for this user, using the following command:
   - <font color="#2166ae">setspn -A HTTP/**KronPAMServerHostname** **username** </font>
     (For Example, setspn -A HTTP/testsso.krontech-new\.internal ssotest)
3. Create a **ssotest.keytab&#x20;**&#x66;ile using the following command:

   - <font color="#2166ae">ktpass /out c:\**keytabFileName** /mapuser **username**@**DomainName** /princ HTTP/**KronPAMServerHostname@DomainName** /pass **password** /kvno 0 -ptype KRB5_NT_PRINCIPAL</font>
     (Ex: ktpass /out c:\\**ssotest.keytab** /mapuser **ssotest**@**krontech-new\.internal** /princ HTTP/**testsso.krontech-new\.internal**@**krontech-new\.internal** /pass **123** /kvno 0 -ptype KRB5\_NT\_PRINCIPAL)

### &#x20;Kron PAM Server Configuration

The following configurations should be set on the Kron PAM server:

1. Connect to KronPAM CLI as the pamuser user.
2. Move the “ssotest.keytab” file under “$CATALINA\_BASE/conf/”.
   - The default Catalina base directory is **/pam/gui/**
3. Create the **krb5.ini** file in the Tomcat Server under $**CATALINA\_BASE/conf/** with the following example content:

```ini
[libdefaults]
default_realm = krontech-new.internal
default_keytab_name = FILE:/pam/gui/conf/ssotest.keytab
default_tkt_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96
default_tgs_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96
forwardable=true
allow_weak_crypto=true

[realms]
krontech-new.internal = { kdc = krontech-dc.krontech-new.internal:88 }

[domain_realm]
krontech-new.internal = krontech-new.internal
.krontech-new.internal = krontech-new.internal
```

Add the following lines to the JAVA\_OPTS section of the pam-gui.service file under /usr/lib/systemd/system/ directory:

:::Paragraph{listStyleType="disc" indent="2"}
-Djava.security.krb5.conf=/pam/gui/conf/krb5.ini&#x20;
:::

:::Paragraph{listStyleType="disc" indent="2"}
-Djavax.security.auth.useSubjectCredsOnly=false
:::

**Example:**

Environment="JAVA\_OPTS=**-Djava.security.krb5.conf=/pam/gui/conf/krb5.ini -Djavax.security.auth.useSubjectCredsOnly=false** -agentlib\:jdwp=transport=dt\_socket,server=y,suspend=n,address=8000 -Xmx2048m -Xms256m -Duser.language=en -Duser.region=US -Duser.timezone=Etc/GMT-3 -Dlog4j2.formatMsgNoLookups=true -…..&#x20;

- &#x20;systemctl daemon-reload and then restart pam-gui service.
- For Windows Authentication within Desktop Client, Internet Explorer should be configured as explained in the next section.

### Client Internet Explorer Configuration

The following configurations should be set on the client’s Internet Explorer.&#x20;

1. Go to **Settings > Internet Options > Security**
2. Selec&#x74;**&#x20;Local Intranet Zone,** click the **Sites&#x20;**&#x62;utton, check all three options, and click the **Advanced** button to add the **KronPAMServerHostname with HTTPS &#xA0;**&#x74;o this zone. **Ex:&#x20;**[https://testsso.krontech-new.internal](https://testsso.krontech-new.internal)
3. Select **Local Intranet Zone.**
4. Click the **Custom Level&#x20;**&#x62;utton and select **Automatic logon-only intranet.**

### Kron PAM GUI Configuration

Add the following parameters in the System Config Manager:

1. Navigate to **Administration > System Config. Man.**
2. Add these parameters:&#x20;
   - **windows.auth.keytab.path** = /pam/gui/conf/**ssotest.keytab**
     **windows.auth.spn** = HTTP/**KronPAMServerHostname**
     Example value: HTTP/**testsso.krontech-new\.internal**&#x20;
     **aioc.auth.rdc** = true
3. Restart the pam-gui service.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/jBhOGsdrlcpiWp265_zor_image.png" size="50" caption="Figure- Windows Authentication Checkbox on Kron PAM Desktop Client" isUploading="false" width="457" height="886" darkWidth="457" darkHeight="886" showCaption="true"}