Kerberos/SPNEGO for SAML

SSO through a SAML IdP and Kerberos/SPNEGO

Kerberos/SPNEGO allows users to authenticate in Passwork without manually entering a login and password. In this scenario, Passwork is the SP, the external identity provider is the IdP, and the IdP verifies the user through Kerberos integration with the directory service.

Passwork does not perform Kerberos authentication and does not decide whether seamless login should be used. Passwork only sends a SAML AuthnRequest to the IdP and accepts the SAML Response on the ACS.

What must be provided in the infrastructure

• The IdP accepts the AuthnRequest from Passwork and returns a SAML Response to the Passwork ACS.
• The SAML integration with Passwork is configured correctly on the IdP side: Entity ID, ACS URL, certificates/signatures.
• The IdP is connected to a directory service or identity infrastructure that supports Kerberos authentication.
• Kerberos/SPNEGO credentials for the IdP HTTP service are prepared according to the requirements of the specific IdP: service principal, SPN, keytab, service account, or another supported mechanism.
• Users and Kerberos principals are correctly mapped to accounts in the directory service.
• Client devices receive a Kerberos ticket for the IdP address.
• Browsers trust the IdP address for Integrated Authentication/SPNEGO through OS policies, GPO, MDM, or local configuration.
• DNS, TLS, and the network do not break SAML redirects or browser access to the IdP.
• The IdP defines the conditions for using Kerberos/SPNEGO and the fallback behavior when those conditions are not met.

Actions in Passwork

No additional Passwork settings are required for the SAML IdP + Kerberos/SPNEGO scenario.

Passwork must have a standard SAML integration with the IdP configured. All seamless login conditions are defined on the IdP side, in the directory service, in the Kerberos infrastructure, and on client devices.

Directory service requirements

The directory service or related infrastructure must support Kerberos authentication and allow the IdP to verify the user's Kerberos ticket. For example, this can be Active Directory, FreeIPA, or another infrastructure where an LDAP directory is used together with a Kerberos KDC.

If only LDAP is used without a Kerberos KDC, seamless authentication through SPNEGO is not possible. In this case, the IdP will verify the login and password through LDAP.

Universal authentication flow

1. The user clicks Sing in with SSO in Passwork.
2. Passwork creates a SAML AuthnRequest and redirects the browser to the IdP.
3. The IdP checks the conditions and performs Kerberos/SPNEGO authentication (or fallback).
4. The browser sends the Kerberos ticket to the IdP without the user manually entering a login and password.
5. The IdP verifies the ticket, maps the user, and creates a SAML Response.
6. The IdP returns the SAML Response to the Passwork ACS (/api/v1/sso/acs).
7. Passwork validates the response, maps the user, and opens a session.

LLM version