| Info |
|---|
This functionality of merging keytabs is since version 2.8.0 built into Kantega SSO Enterprise. Therefore this guide is only here for historical purposes. The information on the page is still relevant if you need to use ktutil to merge keytab files in other cases. |
Background
Kantega SSO can be used with keytab files containing any number of Kerberos keys.
...
You need to support more than one Active Directory domain, but the domains are not in a trust relationship
You need to support more than one host name hostname / SPN (some clients do not canonicalize CNAMES)
You want to support more than one encryption type
...
If there is a trust relationship between your domains, please read read about Cross-domain trust instead.
Merging keys using Kantega SSO
...
All you need to do is to select "Add to existing keytab" when uploading keytab files.
...
| Info |
|---|
The functionality of merging keytabs is since version 2.8.0 built into Kantega SSO. Therefore the guide below is only here for historical purposes. The page is relevant if you need to merge keytab files for other purposes. |
Merge keytab files using external tools
If you need to merge keytab files for use outside our add-onKantega SSO, here are two ways of doing it:
Merge using ktpass with the /in parameter
In the example below, we want to enable Kerberos SSO for users in the two domains example.local and kerbauth.com
After creating the first keytab the keytab file is transferred to conf the other domain controller where a new key is produced and added to the keytab.
The output is a new keytab file with keys from both domains.
In both domains, we need to create a separate user account (mapuser) for mapping the SPN.
...
First, create a keytab file in the KERBAUTH.COM domain.
|
...
|
Merge using ktutil Linux/Unix command-line tool
ktutil is a linux Linux command most commonly found in the krb5-workstation package. The advantages advantage of using ktutil is that instead of adding SPN to an existing keytab file, it can be used to merge two Keytabs without increasing the version number of the SPN.
It also supports updating the Keytab file with multiple versions of an SPN, which can be useful in cases where multiple versions of the same SPN must coexist, like when changing encryption types.
Merge two or more keys to one keytab file
In the below example we have two keys: issues issues.example.com.keytab and issues-KERBAUTH.keytab
We use ktutil to read both keys (read_kt)
We output the keyts keys to a single file (write_kt)
The output is one merged file: merged_keytab_file.keytab
...