1. In the Manage Domain/Realm window, enter the required information based on the following table.
    Field Description
    Domain/Realm Name The fully-qualified domain or realm name. For example, companydomain.com
    Domain/Realm Username The ID for the domain or realm account name.
    Domain/Realm Password The password for the domain or realm account.
    Retain Previous Keys on Password Change Select this check box and click Save to avoid locking out end users with existing Kerberos tickets when the service account password is updated.

    PingFederate retains each previous key for the period specified in the Key Set Retention Period field on the Manage Domain/Realm Settings tab of the Active Directory Domains/Kerberos Realms window. The default period is 610 minutes. For more information, see Managing domain connectivity settings.


    To clear the previous keys from PingFederate, clear the check box and click Save.

    This check box is selected by default.

    Domain Controller/Key Distribution Center Host Names


    Specify the host name or IP address of your domain controller or KDC, such as dc01-yvr, and then click Add. Repeat this step to add multiple servers.

    If a host name is used, PingFederate appends the domain to the host name to formulate the fully qualified domain name (FQDN) of the server unless the Suppress DC / Domain Concatenation check box is selected.

    If unspecified, PingFederate uses a DNS lookup.

    Suppress DC / Domain Concatenation Select this check box to specify the desired FQDNs under Domain Controller/Key Distribution Center Host Names. When selected, PingFederate does not append the domain to the host names.
    Test Domain/Realm Connectivity Tests access to the domain controller or KDC from the administrative-console server.

    When a connection to any of the configured controllers or KDCs is successful, the message Test Successful appears. Otherwise, the test returns error messages near the top of the window.


    For help resolving connectivity issues, select the Debug Log Output check box on the Manage Domain/Realm Settings window, run the test again, and review the debug messages in the PingFederate server log.

    This test stops at the first successful result when multiple domain controllers or KDCs are specified, so not all servers are necessarily verified. Depending on the network architecture, the engine nodes deployed in a cluster might establish connections differently. As a result, the engine nodes and the console node might connect to different domain controllers or KDCs.