Configure Kerberos Authentication

You can use Kerberos authentication when you add and manage a PowerShell host.

With Kerberos authentication, domain users can run commands on remote PowerShell-enabled machines over WinRM.

Procedure

Configure WinRM on the PowerShell host.

winrm quickconfig
winrm set winrm/config/service/auth @{Kerberos="true"}
winrm set winrm/config/service @{AllowUnencrypted="true"}
winrm set winrm/config/winrs @{MaxMemoryPerShellMB="2048"}

Create or edit the krb5.conf file at /data/vco/usr/lib/vco/app-server/conf/.

A krb5.conf file has the following structure:

[libdefaults] 
default_realm = YOURDOMAIN.COM
[realms] 
YOURDOMAIN.COM = { 
kdc = dc.yourdomain.com 
default_domain = yourdomain.com 
} 
[domain_realm] 
.yourdomain.com=YOURDOMAIN.COM
yourdomain.com=YOURDOMAIN.COM

The krb5.conf must contain specific configuration parameters with their values.

Kerberos configuration tags	Details
default_realm	The default Kerberos realm that a client uses to authenticate against an Active Directory server. Note: Must be in uppercase letters.
kdc	The domain controller that acts as a Key Distribution Center (KDC) and issues Kerberos tickets.
default_domain	The default domain that is used to produce a fully qualified domain name. Note: This tag is used for Kerberos 4 compatibility.

Note: By default, the Java Kerberos configuration uses the UDP protocol. To use only the TCP protocol, you must specify the udp_preference_limit parameter with a value 1.

Note: The Kerberos authentication requires a Fully Qualified Domain Name (FQDN) host address.

Important: When you add or modify the krb5.conf file, you must restart the vRealize Orchestrator server service.

If you have a clustered vRealize Orchestrator environment, make sure that the krb5.conf file exists in all three appliances with the same configuration before you restart the vRealize Orchestrator pods.

Change permissions by running the following command.
```
chmod 644 krb5.conf
```
Redeploy the vRealize Orchestrator pod.
```
kubectl -n prelude get pods
```
Look for an entry similar to the following.
```
vco-app-<ID>
```
Destroy the pod.
```
kubectl -n prelude delete pod vco-app-<ID>
```
A new pod is automatically deployed to replace the pod you destroyed.

What to do next

In the vRealize Orchestrator Client, run the Add PowerShell host workflow.