# Kerberos Services

## Contents
Overview Kerberos Endpoint Tab Advanced Tab

## Overview
The Enterprise Gateway can act as a Kerberos Service. In this case, Kerberos clients must obtain a Kerberos service ticket in order to authenticate to the Kerberos Service exposed by the Enterprise Gateway. Clients must present this ticket to the Enterprise Gateway in order for their requests to be processed, i.e. to be successfully authenticated. It is the Kerberos Service that is responsible for consuming these tickets. Kerberos Services can be configured globally under the "External Connections" node in the tree view of the Policy Studio. To configure a Kerberos Service, right-click on the "Kerberos Services" node in the tree and select the Add a Kerberos Service option from the context menu. The following sections describe how to configure the various fields on the Kerberos Service dialog. Globally configured Kerberos Services are selected by name as part of the Kerberos Service Authentication filter, which is responsible for validating the tickets consumed by the Kerberos Service. Make sure to enter a descriptive name for the service in the Name field of the Kerberos Service dialog. Please refer to the Kerberos Service Authentication help page for more information on configuring this filter. Having configured the Kerberos Service, it will be available for selection when configuring other Kerberos-related filters. Make sure to select the Enabled checkbox at the bottom of the screen, which is checked by default.
## Kerberos Endpoint Tab
Complete the following fields on this tab: Kerberos Principal: Select the name of the principal that will be associated with the Enterprise Gateway. Clients wishing to authenticate to the Enterprise Gateway must present a service ticket containing a matching principal name to the Enterprise Gateway. Kerberos Principals are configured globally under the "External Connections" node in the tree view of the Policy Studio. Right-click on the "Kerberos Principals" node and select the Add a Kerberos Principal option from the context menu. Alternatively, you can select the Add button beneath the Kerberos Principal dropdown to add a new principal. For more information on configuring a principal, please refer to the Kerberos Principals help page. Secret Key: Use this section to specify the location of the Kerberos Service's secret key, which will be used to decrypt service tickets received from Kerberos clients. Password: The Kerberos Service's secret key is originally created for a specific Principal on the KDC. A password is required to generate this key, which can be entered directly into the Password field here. Keytab: Usually, however, a Keytab file is generated, which contains a mapping between a Principal name and that Principal's secret key. The Keytab file can then be loaded into the Enterprise Gateway configuration using the fields provided on this section. It is possible to load the Principal-to-key mappings into the table by selecting the Load Keytab button and then browsing to the location of an existing Keytab file. A new Keytab Entry can be added by clicking the Add Principal button. Take a look at the Kerberos Keytab Entry help page for more information on configuring the Keytab Entry dialog. A Keytab Entry can be deleted by selecting the entry in the table and clicking on the Delete Entry button. It is also possible to export the entire contents of the Keytab table by clicking on the Export Keytab button. It is important to note that the contents of the Keytab table (whether derived from a Keytab file or manually entered using the Keytab Entry dialog) are stored in the clear in the Enterprise Gateway's underlying configuration. The Keytab contents can be stored encrypted, if required, by setting a passphrase for the Enterprise Gateway configuration data. For more information on how to do this please refer to the Setting the Encryption Passphrase help page. When the server starts up it writes the stored Keytab contents out to the `/conf/plugin/kerberos/keytabs/` folder of your Enterprise Gateway installation. Oracle recommends that you configure directory- or file-based access control for this directory and its contents. Load via Native GSS Library: If you have configured the Enterprise Gateway to Use Native GSS Library on the Process-level Kerberos Configuration settings, you must choose to load the Kerberos Service's secret key from the location preferred by the GSS library. The native GSS library will expect the Kerberos service's secret key to be in the system's default Keytab file. The location of this Keytab file is specified in the "default_keytab_name" setting in the `krb5.conf` file that the native GSS library reads via the `KRB5_CONFIG` environment variable. Note that this Keytab may contain keys for multiple Kerberos services.
## Advanced Tab
Configure the following fields on this tab: Mechanism: Select the mechanism used to establish a context between this Kerberos service and the Kerberos client. The Kerberos client must use the same mechanism selected here. Extract Delegated Credentials: A Kerberos client can set an attribute on the context with the Kerberos service to indicate that they wish to allow the service to act on behalf of the client in subsequent communications. So, for example, this allows the Kerberos service (i.e. the Enterprise Gateway) to assume the identity of the client when communicating with a back-end Kerberos service. In this way the client's credentials are propagated to the back-end service as opposed to the Enterprise Gateway's credentials. This is called credential delegation. In cases where a Kerberos client wishes to delegate its credentials to a Kerberos service you can configure the service to extract the delegated credentials from the context it establishes with the client. Check the Extract Delegated Credentials checkbox to extract the client's delegated credentials and store them in the `gss.delegated.credentials` and `gss.delegated.credentials.client.name` message attributes. The extracted delegated credentials can be forwarded on to the back-end Kerberos service (on behalf of the user) using the Kerberos settings on the Kerberos Client Authentication filter or the Connection filter. When configuring the Kerberos Client used on the Kerberos Authentication tab of the Connection filter, make sure to select the option to retrieve the TGT (Ticket Granting Ticket) from the extracted delegated credentials (i.e. check the Extract from delegated credentials checkbox on the Kerberos Endpoint tab). Take a look at the following help pages for more information on configuring these options: Connection Filter Kerberos Client