Kantega SSO allows Kerberos to auth can be limited to specific IP address ranges and/or User-Agents.
By default, every client will receive a Kerberos authentication challenge (SPNEGO) when if Kerberos is enabled in KSSO. Not all clients support Kerberos however, and If a given client does not support Kerberos or is not part of the domain, this can result in a bad user experience. The way clients handle a client handles a Kerberos challenge challenges is both application and platform dependenddependent. The most common issue is when you also to have Windows desktop browsers that are not part of the AD domain, for example an employee working from home or external consultants. When a Windows browser is unable to obtain a Kerberos ticket for any reason, it shows an NTLM fallback popup like the following:
...