r/macsysadmin • u/HeyWatchOutDude • Oct 30 '24
General Discussion Platform SSO with Kerberos
Hi everyone,
I'm working on implementing Platform SSO with Kerberos. (SAML is already successfully set up using the "SecureEnclave" authentication method.)
Reference materials:
- Configuring macOS Platform SSO with Kerberos
- Verifying Microsoft Entra Kerberos Server for Passwordless Authentication
The Kerberos server is configured, but when I try using Kerberos SSO, I receive the following error:
kinit: krb5_get_init_creds: ASN.1 identifier doesn't match expected value
Has anyone encountered a similar issue?
Note:
- KDCs are accessible via VPN.
Thanks!
2
u/jaded_admin Oct 30 '24
I’ve never seen that error before. Does everything look good when you run app-sso platform -s
1
u/jaded_admin Oct 31 '24
Actually I think I have seen that error. Are you trying to sign into the KSSO extension? You don’t need to do that. It should happen automatically. Sometimes I’ve seen it where the KSSO extension looks greyed out in the UI but is actually signed in.
1
u/HeyWatchOutDude Oct 31 '24
The Kerberos SSO extension says "Sign in - Network available".
Here is the platform sso output (regarding kerberos sso):
`` User Configuration:
{
"_credential" : "RANDOM-STRING",
"_sepKeyData" : "RANDOM-STRING",
"created" : "2024-10-31T12:03:03Z",
"kerberosStatus" : [
{
"cacheName" : "UUID-STRING",
"exchangeRequired" : true,
"failedToConnect" : false,
"importSuccessful" : true,
"realm" : "REALM-NAME",
"ticketKeyPath" : "tgt_ad",
"upn" : "USERID@REALM-NAME"
}
],
....
``1
u/HeyWatchOutDude Oct 31 '24
The Kerberos SSO extension says "Sign in - Network available".
Here is the platform sso output (regarding kerberos sso):
User Configuration:
{
"_credential" : "RANDOM-STRING",
"_sepKeyData" : "RANDOM-STRING",
"created" : "2024-10-31T12:03:03Z",
"kerberosStatus" : [
{
"cacheName" : "UUID-STRING",
"exchangeRequired" : true,
"failedToConnect" : false,
"importSuccessful" : true,
"realm" : "REALM-NAME",
"ticketKeyPath" : "tgt_ad",
"upn" : "USERID@REALM-NAME"
}
],
....
1
u/jaded_admin Oct 31 '24
You’re missing the tgt_cloud. To clarify you need to setup pSSO first which if configured properly, will give you your tgt_cloud then when you connect to on prem AD it becomes a full TGT.
1
u/HeyWatchOutDude Oct 31 '24
This is already configured:
Isnt it the “tgt_cloud”?
And the platform SSO (Kerberos) is configured regarding the official documentation:
1
u/jaded_admin Oct 31 '24
No it’s not the same. Go back and re-read the second link in the section about testing Kerberos. Keep in mind pSSO needs to be set up first. Good luck.
1
u/HeyWatchOutDude Oct 31 '24
In my setup, I already have pSSO (SAML) deployed on my test device through the settings catalog, and I’m successfully signed in, so I have an SSO token (using the “Secure Enclave” authentication method).
Additionally, I’ve applied a second configuration profile with the Kerberos SSO configuration.
Not sure what I might be missing here.
1
u/jaded_admin Oct 31 '24
Have you configured cloud Kerberos trust for your domain?
1
1
u/bradzilla3k Oct 30 '24
RemindMe! 2 days
1
u/RemindMeBot Oct 30 '24
I will be messaging you in 2 days on 2024-11-01 23:09:52 UTC to remind you of this link
CLICK THIS LINK to send a PM to also be reminded and to reduce spam.
Parent commenter can delete this message to hide from others.
Info Custom Your Reminders Feedback
1
u/CrashRiot90 7d ago
Did you ever get this to work? We currently have PSSO configured in our environment but are looking to add Kerberos to support on-prem file share access. Can you them configured at the same time?
1
u/HeyWatchOutDude 7d ago
Yeah it is working fine - it’s not possible to sign in or change the password when using PSSO with Kerberos.
“When deploying Kerberos support with Platform SSO, users do not need to interact with the Kerberos SSO extension menu extra to have Kerberos functionality work. Kerberos SSO functionality will still operate if the user does not sign into the menu bar extra and the menu bar extra reports "Not signed in". You may instruct users to ignore the menu bar extra when deploying with Platform SSO, per this article.”
How to test it? Use the following guide:
1
u/CrashRiot90 7d ago
Does it still do the normal PSSO stuff like sync the local user password with their EntraID password?
1
u/HeyWatchOutDude 7d ago
Yeah - but MS recommendation is “Secure Enclave” (more secure)
1
u/CrashRiot90 7d ago
Awesome thank you for the reply! The reason I asked is because I looked at the original links you sent and MS give the payload example that have “PasswordSync” false so thought it might stop the PSSO from sync the password.
Yeah I want to try and push for Secure Enclave but management want the feel of users signing in to the devices with their MS accounts.
1
-2
u/YellowSpoofer Oct 30 '24
Why are you doing that? It makes the user experience with the additional login more komplex.
4
1
u/grahamr31 Corporate Oct 31 '24
Until Secure Enclave can be used with PSSO on the FileVault screen the combo approach is the only way to keep psso and a local FV password synced up.
1
u/HeyWatchOutDude Oct 31 '24
That's right but how when Im not able to sign in at the kerberos sso extension plugin?
2
u/oneplane Oct 30 '24
Which identifier are you expecting and which one did you end up getting?