---
title: Windows Authentication on the Single Connect GUI
slug: singleconnect-reference-guide-3-1-0/windows-authentication-on-the-single-connect-gui
description: This document guides users on how to enable Windows Authentication for logging in to the Single Connect GUI. It covers configuration steps for the Domain Controller, Single Connect Server, Client Browser, and Single Connect GUI, including creating users, 
docTags: 
createdAt: 2022-07-24T14:27:43.000Z
---

Windows Authentication can be used to log in to the Single Connect GUI. The required settings are outlined in this section. The following terms are used in the configuration steps:

**Domain Controller:** DomainControllerFQDN (Ex: WIN-TEST.singleconnect.com)
**Single Connect Server**: schostnameFQDN (Ex: sc-test.singleconnect.com)
**Domain Name**: DomainName (Ex: singleconnect.com)

### 
Domain Controller Configuration

The following configurations should be set on the Domain Controller:

1. Create a user (Ex: username: win\_auth, password: 123)
2. Create an SPN (Service Principal Name) for this user, using the following command:
   setspn -A HTTP/**SingleServerHostname username**
   (Ex: setspn -A HTTP/ sc-test.singleconnect.com win\_auth)
3. Create an “sc.keytab” file using the following command:
   ktpass /out c:\sc.keytab /mapuser **usernameFQND** /princ HTTP/ **schostnameFQDN\@domainName** /pass password /kvno 0
   (Ex\:ktpass /out c:\sc.keytab /mapuser **win\_auth\@singleconnect.com** /princ HTTP/sc-**test.singleconnect.com\@singleconnect.com** /pass 123 /kvno 0)

### Single Connect Server Configuration

The following configurations should be set on the Single Connect server:

1. Establish an SSH connection to Single Connect as the** pamuser** user.
2. Move the “sc.keytab” file under “$CATALINA\_BASE/conf/”.
   (The default Catalina base directory is “u01/netright-tomcat”)
3. Create the “krb5.ini” file in the Tomcat Server under “$CATALINA\_BASE/conf/” with the following example content:
   \[libdefaults]
   default\_realm = SINGLECONNECT.COM
   default\_keytab\_name = FILE:/u01/netright-tomcat/conf/sc.keytab
   default\_tkt\_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96
   default\_tgs\_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96
   forwardable=true
   \[realms]
   SINGLECONNECT.COM =
   \{ kdc = WIN-TEST.singleconnect.com:88 }
   \[domain\_realm]
   SingleConnect.com= SINGLECONNECT.COM
   .SingleConnect.com= SINGLECONNECT.COM
4. Add the following lines at the end of the “$CATALINA\_BASE/bin/setenv.sh” file:
   export CATALINA\_OPTS=”-Djava.security.krb5.conf=/u01/netright-tomcat/conf/krb5.ini”
   export CATALINA\_OPTS="-Djavax.security.auth.useSubjectCredsOnly=false"

### Client Browser Configuration

The following configurations should be set on the client’s browser. Configurations made for the Internet Explorer (IE) also activate the Edge and Chrome browsers.

**For Internet Explorer (IE):**

1. Go to** Settings** >** Internet Options** > **Security**.
2. Select **Local Intranet Zone**, click the **Sites** button, check all three options, and click the **Advanced **button to add the **Single Connect Server Name** to this zone.
   Ex: http\://sc-test.SingleConnect.com
3. Select **Local Intranet Zone**, click the **Custom Level** button, and select **Automatic logon only intranet**.

**For Firefox:**

1. Type **about\:config** on the address bar, accept the warning, and change the **network.negotiate-auth.trusted-uris** value to **Single Connect Server Hostname**
   Ex: [http://sc-test.singleconnect.com](http://sc-test.singleconnect.com)
2. Restart the computer.
3. Access the application by typing the **Single Connect Server Hostname** on the address bar,** without the IP.**
   Ex: [http://sc-test.singleconnect.com](http://sc-test.singleconnect.com)

### Single Connect GUI Configuration

Add the following parameters in the System Config Manager:

1. Navigate to **Administration** > **System Config. Man**.
2. Add these parameters:
   **windows.auth.keytab.path** = /u01/netright-tomcat/conf/sc.keytab
   **windows.auth.spn** = HTTP/SingleConnectServerName
   Example value: HTTP/sc-test.SingleConnect.com
   **aioc.auth.windows** = true