Kerberos for Identity Cloud

Here is an example of a simple journey for our setup - (And here is the Source):

The Kerberos Node is a Script Node Delegate Kerb Login.js that checks if a Signed JWT exist in the request parameter list. If not, then we need to redirect the user to IG for Kerberos Authentication. If the Signed JWT exist, then the node validates the signature, and unpacks the JWT to get the username, which is placed in the sharedState.

The Uid/Pwd Check is a Inner Tree Node, which calls another journey to gather a uid/pwd to checks against an Identity Cloud Data Decision Node.

One additional point to keep in mind - you can always do pre or post-work in regards to the Kerberos node. For example you could check the IP address of the user before sending that user to IG to perform a Kerberos validation. You wouldn’t want to send the user to the Kerberos IG route if the user is coming from an IP address that wasn’t on the network (they of course wouldn’t have a validate Kerberos Ticket).

And when you return from the Kerberos node, you may want to perform MFA.

Here is an example of a simple route for our setup - (And here is the

The ValidateKerberosTicket.groovy is a ScriptableFilter that requests a Kerberos Ticket from the users browser, and validates it. This Groovy script uses a service account setup in AD. See Kerberos Setup.pdf to perform the request and checking of the Kerberos Ticket for details.

Summary

https://docs.google.com/document/d/1axhYU1_51RFWEt1GoYoLGnlv5GUF3yqP-v1-vfI20C8/edit#heading=h.kfqlzlh9y9ny for details)

The Wrap in Signed JWT (SignJWT.groovy) is a ScriptableFilter that creates a SignedJWT with the username from the Kerberos Ticket.

The Redirect-Back-To-Identity-Cloud is a StaticResponseHandler that redirects the user back to Identity Cloud with the SignedJWT as a parameter in the HTTP POST