USER MANUALS

Single Sign-On with Kerberos

With the Kerberos authentication method you only need to authenticate once: when you log in your operating system. The same credentials will be reused across all your Denodo products. In the particular case of the Data Marketplace, the browser is responsible for obtaining your credentials from the system and build a Kerberos ticket that will be used to authenticate you in the Data Marketplace. The Data Marketplace sends that ticket to the Kerberos authentication server, typically an Active Directory, which is the one that validates the ticket.

To configure Kerberos authentication in the Data Marketplace, follow these steps:

  1. Configure a service account for Virtual DataPort in the Active Directory of your organization.

  2. Configure a service account for Data Marketplace in the Active Directory of your organization, in case the Data Marketplace and the Virtual DataPort servers are in different machines.

  3. Indicate a Kerberos realm, if it is different from the one from your domain.

    Note

    This is an uncommon requirement. If you are unsure if you need to do it, go to the next step.

  4. Configure the Kerberos authentication in the Virtual DataPort server you use to connect from the Data Marketplace.

  5. Configure the Kerberos authentication in the Data Marketplace server.

  6. Configure Kerberos on your browser.

Note

Since the Kerberos ticket for authentication is automatically generated by the browser, you should take into account the following considerations:

  • The Service Principal Name that identifies the Data Marketplace should use HTTP as the service class. For example, HTTP/denodo-prod.subnet.acme.com@ACME.COM.

  • To access the Data Marketplace, you should use the Fully Qualified Domain Name of the host, as it is defined in the Service Principal Name. For example, if the Service Principal Name of the Data Marketplace is HTTP/denodo-prod.subnet.acme.com@ACME.COM, you should access the Data Marketplace through the URL http://denodo-prod.subnet.acme.com:9090/denodo-data-catalog.

If there are several Virtual DataPort servers registered in the Data Marketplace, you will see a login page like the one below. You only need to select the server you want to connect to in order to log in the Data Marketplace.

Login page for single sign-on with Kerberos in the Data Marketplace

Login page for single sign-on with Kerberos in the Data Marketplace

If there is only one Virtual DataPort server registered, you will be automatically authenticated in the Data Marketplace.

Add feedback