Enable Kerberos authentication for Windows users on the Kerberos Authentication tab.

Important:

If you have not configured a service account for Kerberos authentication, see Configuring the Active Directory environment.

  1. Select the Configure Kerberos Authentication check box and provide the required information. Click Next.
    For information about each field, refer to the following table.
    Field Description
    Realm Name Enter the fully-qualified domain name.
    Realm Username Enter the service account that PingFederate can use to communicate with Active Directory for the purpose of Kerberos authentication.
    Realm Password Enter the service account password.
    Internal IP Ranges Enter one or more network ranges where PingFederate can try authenticating with the Kerberos protocol when handling requests originating from such IP addresses.

    Typically, these are internal network ranges with access to one or more key distribution centers (KDCs) in your domain.

    To remove an entry, select it from the list and then click Delete.
    KDC Hostnames

    (Optional)

    		 Enter the host name or the IP address of the applicable KDC.

    This field is optional. Multiple hosts are allowed. If left unspecified, PingFederate uses a DNS query to find a list of KDCs.

    To remove an entry, select it from the list and then click Delete.

Kerberos authentication also requires browser-specific configuration. For more information, see Configuring end-user browsers.