Dell Chassis Management Controller Version 4.50 Manual
Dell Power Edge M1000e Chassis Management Controller
Version 4.5 - Single Sign-On and Kerberos Model
This technical brief highlights the working of Single Sign- On and Kerberos
Authentication Model in CMC 4.5
Dell Engineering
January 2014
Author
Yogeshwar Bisht
A Dell Technical White Paper
Date
Description
January 2014
Initial Release
Revisions
THIS WHITE PAPER IS FOR INFORMATIONAL PURPOSES ONLY, AND MAY CONTAIN TYPOGRAPHICAL ERRORS AND
TECHNICAL INACCURACIES. THE CONTENT IS PROVIDED AS IS, WITHOUT EXPRESS OR IMPLIED WARRANTIES OF
ANY KIND.
© 2014 Dell Inc. All rights reserved. Reproduction of this material in any manner whatsoever without the express
written permission of Dell Inc. is strictly forbidden. For more information, contact Dell.
PRODUCT WARRANTIES APPLICABLE TO THE DELL PRODUCTS DESCRIBED IN THIS DOCUMENT MAY BE FOUND
AT: http://www.dell.com/learn/us/en/19/terms- of-sale- commercial- and-public- sector
Performance of network
reference architectures discussed in this document may vary with differing deployment conditions, network loads, and
the like. Third party products may be included in reference architectures for the convenience of the reader. Inclusion
of such third party products does not necessarily constitute Dell’s recommendation of those products. Please consult
your Dell representative for additional information.
Trademarks used in this text:
Dell™, the Dell logo, Dell Boomi™, Dell Precision™ ,OptiPlex™, Latitude™, PowerEdge™, PowerVault™,
PowerConnect™, OpenManage™, EqualLogic™, Compellent™, KACE™, FlexAddress™, Force10™ and Vostro™ are
trademarks of Dell Inc. Other Dell trademarks may be used in this document. Cisco Nexus®, Cisco MDS
®
0S
, and other Cisco Catalyst® are registered trademarks of Cisco System Inc. EMC VNX®, and EMC Unisphere® are
registered trademarks of EMC Corporation. Intel
Intel Corporation in the U.S. and other countries. AMD
Phenom™ and AMD Sempron™ are trademarks of Advanced Micro Devices, Inc. Microsoft
®
Server
, Internet Explorer®, MS- DOS®, Windows Vista® and Active Directory® are either trademarks or registered
trademarks of Microsoft Corporation in the United States and/or other countries. Red Hat
®
Linux
are registered trademarks of Red Hat, Inc. in the United States and/or other countries. Novell® and SUSE® are
registered trademarks of Novell Inc. in the United States and other countries. Oracle
Oracle Corporation and/or its affiliates. Citrix
®
, Pentium®, Xeon®, Core® and Celeron® are registered trademarks of
®
is a registered trademark and AMD Opteron™, AMD
®
, Xen®, XenServer® and XenMotion® are either registered trademarks or
®
, Windows®, Windows
®
and Red Hat® Enterprise
®
is a registered trademark of
®
, Cisco NX-
2 Dell Power Edge M1000e Chassis Management Controller Version 4.5 - Single Sign- On and Kerberos Model
trademarks of Citrix Systems, Inc. in the United States and/or other countries. VMware®, Virtual SMP®, vMotion®,
vCenter
countries. IBM
NetXtreme
®
and vSphere® are registered trademarks or trademarks of VMware, Inc. in the United States or other
®
is a registered trademark of International Business Machines Corporation. Broadcom® and
®
are registered trademarks of Broadcom Corporation. Qlogic is a registered trademark of QLogic
Corporation. Other trademarks and trade names may be used in this document to refer to either the entities claiming
the marks and/or names or their products and are the property of their respective owners. Dell disclaims proprietary
interest in the marks and names of others.
3 Dell Power Edge M1000e Chassis Management Controller Version 4.5 - Single Sign- On and Kerberos Model
Table of contents
Revisions .................................................................................................................................................................................................. 2
Executive summary ............................................................................................................................................................................... 5
Background ..................................................................................................................................................................................... 5
About Single Sign- On .................................................................................................................................................................... 5
1. Kerberos Model .............................................................................................................................................................................. 6
2. Kerberos Workflow ........................................................................................................................................................................ 7
3. Pre- requisites for Kerberos Authentication ........................................................................................................................... 10
Network Pre- requisites .............................................................................................................................................................. 10
CMC Pre- requisites ...................................................................................................................................................................... 11
4. Configuring CMC for SSO .......................................................................................................................................................... 11
5. References ..................................................................................................................................................................................... 17
4 Dell Power Edge M1000e Chassis Management Controller Version 4.5 - Single Sign- On and Kerberos Model
Executive summary
This document explains the following:
• Working of Single Sign-On(SSO) using Kerberos, a network authentication protocol
• Kerberos security mechanism
• Configuring the Dell Chassis Management Controller for SSO.
The Dell Chassis Management Controller uses Kerberos to support single- sign on and Active directory account
credentials to log in.
Background
It all started in early 1990, when some organizations moved to a combination of some authentication protocols,
commonly known as Enterprise SSO (ESSO). These protocols later developed to more advanced browser- based
plugin, Web Access Management (WAM).
Some protocols like Kerberos contain SSO features. However, the emphasis was to integrate applications within
the network perimeter only. Later, SSO was alligned to cloud based services also including Software as a Service
(SaaS).
In 2012, SSO technologies were developed to accommodate enterprises of all sizes, This was mainly due to
Security Assertion Markup Language 2.0 (SAML) protocol, which became an Organization for the Advancement of
Structured Information Standards (OASIS) standard in 2005. The Simple Cloud Identity Management (SCIM) is the
latest protocol available. This defines a simple, RESTful protocol for identity account management operations.
About Single Sign- On
Single sign- on is an authentication process that allows network users to access all authorized network resources
without having to log in separately to each resource. Single sign-on allows the user to validate usernames and
passwords against the corporate user database or other client application rather than having separate user names
and passwords.
The idea of today’s SSO is simple. The process authenticates the user for all the applications they have been given
rights to. This eliminates further prompts when they switch applications during a particular session., There are
various types of SSO. However, the preferred architecture is for a user to authenticate to a centrally managed
system, and for applications to trust that central system for identity information about the user rather than reauthenticating.
5 Dell Power Edge M1000e Chassis Management Controller Version 4.5 - Single Sign- On and Kerberos Model
1. Kerberos Model
Operating systems such as Windows (2000 and above), Windows server (2003 and above) use Kerberos as
an authentication protocol, allowing users who signed into the domain to access Chassis Management
Controller (CMC) auomatically. This means, users can access CMC without entering user name and
password in a secure way.
Kerberos model is based on three pillars:
• Key Distribution Center (KDC): A trusted third party and a domain service, which uses Active Directory
to access user accounts. KDC basically provides two services.
- Authentication Service (AS): Issues Ticket Granting Ticket to access Ticket Granting Service.
- Ticket-Granting Service (TGS): Issues tickets for connection to computers in its domain.
• Account Database: Active directory is a source of account database that KDC uses to access user
information.
• Kerberos Policy: It is defined at the domain and is implemented by the domain’s KDC and is stored in
Active Directory
All traditional protocols, such as Internet message access protocol (IMAP), Simple Mail Transfer
Protocol (SMTP), and so on, support Kerberos
Note: There is no communication between the Key Distribution Center (KDC) and server
throughout the process.
6 Dell Power Edge M1000e Chassis Management Controller Version 4.5 - Single Sign- On and Kerberos Model
Loading...