SSO with Kerberos configuration field description
The following table provides field descriptions for the single sign-on configuration. There are some variations in field names between Ivanti EPMM and Ivanti Neurons for MDM.
Field |
Description |
Name |
Enter a name for this configuration. |
Description |
Enter additional information that describes this configuration. |
User Name |
(Required) Enter the Kerberos user name. Ivanti EPMM: You can also specify the variable $USERID$. Ivanti Neurons for MDM: You can also specify the variable ${samaccountname} |
Realm |
(Required) Ivanti EPMM: The default is $Realm$. This is the only valid variable. $Realm$ is supported for LDAP users only. The realm is calculated by extracting the base DN (e.g. DC=auto, DC=MyCompany, DC=com) and converting to a domain. Example: AUTO.MYCOMPANY.COM. Ivanti Neurons for MDM: Enter a domain name. Example: AUTO.MYCOMPANY.COM. |
Identity Certificate ( Ivanti EPMM) |
(Optional) Select a certificate enrollment setting from the drop-down list to specify an identity certificate. An app uses this identity certificate to authenticate the device user to the KDC server. After the user is authenticated, the KDC server issues a ticket to the user. If the Kerberos ticket has expired, it is silently renewed after the user is authenticated. If you do not provide an identity certificate, the device user is prompted to enter a user ID and password when the Kerberos ticket has expired. |
Certificate |
(Optional) Select the certificate to use. An app uses this identity certificate to authenticate the device user to the KDC server. After the user is authenticated, the KDC server issues a ticket to the user. If the Kerberos ticket has expired, it is silently renewed after the user is authenticated. If you do not provide an identity certificate, the device user is prompted to enter a user ID and password when the Kerberos ticket has expired. |
URL Prefix Matches (Required) Add the URLs or resources that the device user can access using SSO. At least one URL is required. If a bundle ID (application ID) is configured, SSO is enabled for the specified apps only when the apps access the URLs that match the configured URL prefixes. If a bundle ID (application ID) is not configured, SSO is applicable to all apps that support SSO when they access the URLs that match the configured URL prefixes. |
|
+ |
Click to add an URL. |
URL |
Enter the URL that the user can access using SSO.
|
Description |
Enter additional information describing this resource. |
- |
Click to delete the URL. |
Application Identifier Matches (Optional) Add the apps that the device user can use to access the URLs or resources listed in URL Prefix Matches without having to enter their enterprise credentials. You can add up to twenty bundle IDs (application IDs) per configuration. If no apps are entered, the device user can access the URLs or resources from any app without having to enter their enterprise credentials. |
|
+ |
Click to add an app. |
BundleID |
Enter an exact or partial bundle ID (application ID) for the app. Use the following rules for formatting an entry:
|
Description |
Enter additional information describing the app. |
_ |
Click to delete the entry. |