Setting up SSO by impersonation
You can configure the KCD account for NetScaler appliance SSO by impersonation. In this configuration, the NetScaler appliance obtains the user’s username and passwordwhen the user authenticates to the authentication server and uses those credentials to impersonate the user to obtain a ticket-granting ticket (TGT). If the user’s name is in UPN format, the appliance obtains the user’s realm from UPN. Otherwise, it obtains the user’s name and realm by extracting it from the SSO domain used during initial authentication, or from the session profile.
When configuring the KCD account, you must set the realm parameter to the realm of the service that the user is accessing. The same realm is also used as the user’s realm if the user’s realm cannot be obtained from authentication with the NetScaler appliance or from the session profile.
To create the KCD account for SSO by impersonation with a password
At the command prompt, type the following command:
add aaa kcdaccount <accountname> -realmStr <realm>
For the variables, substitute the following values:
- accountname. The KCD account name.
- realm. The domain assigned to NetScaler appliance SSO.
To add a KCD account named kcdccount1, and use the keytab named kcdvserver.keytab, you would type the following command:
add aaa kcdAccount kcdaccount1 -keytab kcdvserver.keytab
For information on configuring Kerberos impersonation through NetScaler GUI, see Citrix Support.