You can use Kerberos authentication when you add and manage a PowerShell host.

With Kerberos authentication, domain users can run commands on remote PowerShell-enabled machines over WinRM.

Procedure

  1. Configure WinRM on the PowerShell host.
    winrm quickconfig
    winrm set winrm/config/service/auth @{Kerberos="true"}
    winrm set winrm/config/service @{AllowUnencrypted="true"}
    winrm set winrm/config/winrs @{MaxMemoryPerShellMB="2048"}
  2. Create or edit the krb5.conf file at /data/vco/usr/lib/vco/app-server/conf/.
    A krb5.conf file has the following structure:
    [libdefaults] 
    default_realm = YOURDOMAIN.COM
    [realms] 
    YOURDOMAIN.COM = { 
    kdc = dc.yourdomain.com 
    default_domain = yourdomain.com 
    } 
    [domain_realm] 
    .yourdomain.com=YOURDOMAIN.COM
    yourdomain.com=YOURDOMAIN.COM
    

    The krb5.conf must contain specific configuration parameters with their values.

    Kerberos configuration tags Details
    default_realm The default Kerberos realm that a client uses to authenticate against an Active Directory server.
    Note: Must be in uppercase letters.
    kdc The domain controller that acts as a Key Distribution Center (KDC) and issues Kerberos tickets.
    default_domain The default domain that is used to produce a fully qualified domain name.
    Note: This tag is used for Kerberos 4 compatibility.
    Note: By default, the Java Kerberos configuration uses the UDP protocol. To use only the TCP protocol, you must specify the udp_preference_limit parameter with a value 1.
    Note: The Kerberos authentication requires a Fully Qualified Domain Name (FQDN) host address.
    Important: When you add or modify the krb5.conf file, you must restart the vRealize Orchestrator server service.

    If you have a clustered vRealize Orchestrator environment, make sure that the krb5.conf file exists in all three appliances with the same configuration before you restart the vRealize Orchestrator pods.

  3. Change permissions by running the following command.
    chmod 644 krb5.conf
  4. Redeploy the vRealize Orchestrator pod.
    kubectl -n prelude get pods
    Look for an entry similar to the following.
    vco-app-<ID>
  5. Destroy the pod.
    kubectl -n prelude delete pod vco-app-<ID>
    A new pod is automatically deployed to replace the pod you destroyed.

What to do next

In the vRealize Orchestrator Client, run the Add PowerShell host workflow.