0

We have IIB 10.0.0.12 running on Windows Server 2012 R2. We are looking to setup Kerberos -Token based authentication for SOAP services that are exposed to internal/external consumers.

We have around 4 System test servers running on a Same domain. The test servers are not load balanced; can we create a Single User account (Say "IIBTestPrincipal") in Active Directory and map multiple SPN's to this user account and setup the test environments like below. 

setspn -A HTTP/server3.somedomain.co.uk@SOMEDOMAIN.CO.UK IIBADPrincipal 

setspn -A HTTP/server5.somedomain.co.uk@SOMEDOMAIN.CO.UK IIBADPrincipal

Can somebody please advice/ guide on process for setting the same in load balanced environment.?

We have 4 broker servers load balanced via Netscalar. Can the load balancer perform a kerberos passthrough and broker perform all the kerberos authentication work ? If so should we be creating a SPN on Load balancer Host name and map all the prod servers as alias to that SPN ?

Couldn't find much info from Info center,Any thoughts on the above are much appreciated.

JoshMc
  • 10,239
  • 2
  • 19
  • 38
Ram
  • 41
  • 1

1 Answers1

0

Netscaler supports Kerberos impersonation and Kerberos contrained delegation. I'm not that familiar with Kerberos, take a look in their documentation https://support.citrix.com/article/CTX222453

virgula24
  • 523
  • 5
  • 23