Security - Kerberos for Content Platform Engine

Introduction to Kerberos
Kerberos facilitates user authentication over an untrusted network of disparate systems. Content Platform Engine running on Windows or UNIX / Linux® servers can use Kerberos for single sign-on (SSO) authentication. This is also known as integrated login since Content Platform Engine takes advantage of an earlier Windows login to securely establish a user's identity without asking the user for a password again.

Kerberos prerequisites
Since Kerberos can be difficult to get working correctly, the first step is to make sure that a number of prerequisites are met.

Creating the Kerberos Service Principal Name (SPN) identity
A Kerberos Service Principal Name (SPN) is simply a name chosen to represent some service (Content Platform Engine on a particular server in our case).

Enabling Kerberos on the application server
Kerberos support is available to clients of the Content Platform Engine Web Services API, the Content Platform Engine .NET API, and the Content Platform Engine COM API. Many third-party COM and Web-service-based applications are also available that can take advantage of this Kerberos support.

Using RC4-HMAC Security
You can change default encryption security to the more secure RC4-HMAC standard, if you fulfill certain prerequisites.

KrbServiceLoginModule options
The KrbServiceLoginModule (or WebLogic Engine Kerberos Authentication Provider) does the Kerberos service authentication on the Content Platform Engine server. This login module has several options that can change its behavior.

Using Kerberos on the client
Kerberos security can be configured on the client.

Using Kerberos with a cluster of Content Platform Engine servers
The SPN used for a cluster is different than that used for individual Content Platform Engine servers.

Cross-realm Kerberos authentication
Multiple Windows domains, where the clients are in one or more domains and the Content Platform Engine server is in another, can be made to work with Kerberos if you take into account some special considerations. The first is that the domains (or realms in Kerberos terminology) must accept the identity established in another domain. This means that one domain trusts another.

Implementation on Windows 2008 R2