Adding another LDAP user federation (Kerberos)

There are 2 primary steps when configuring Kerberos (Domain Authentication) as your authentication method:

• Connect to Windows Active Directory; and

• Sync users to Admin Tool (i.e., the Nintex database)

Connect to Windows Active Directory

To connect Nintex to your Windows Active Directory:

• Access the Nintex User Management Tool

• Configure a Users Federation in Admin Tool

• Sync users to the Users Federation in Aerobase

• Sync users to the Users Federation in Admin Tool

Access the Nintex User Management Tool

To access the Nintex User Management Tool:

1. Open an incognito window in Chrome

2. Enter the following URL: http://{FQDN_RPA_SERVER}/auth/admin/kryon/console/#/realms/kryon

   • Use https:// in the URL if you installed with SSL/TLS

   The following screen will open:
   

   If you receive a Chrome message asking you to sign in, just click Cancel.
   

3. Log in to the Nintex User Management Tool with these credentials:

   • Username: authadmin

   • Temporary password: Kryon123!

     • You will be prompted to change the temporary password upon first login

4. The following screen will open:
   

Configure a Users Federation

Add the User Federation to a Company in Admin Tool:

1. From the left menu, click

2. From the page that opens, click kryon-ldap (the default federation installed with Nintex)
   

   The page for defining the user federation settings will open.

   There's no need to be intimidated by the long list of settings. Domain Administrators and other IT personnel who are experienced in working with Windows Active Directory are generally familiar with settings of this type. If you have questions about connecting to your Active Directory, consult with the Active Directory expert in your organization. If he or she can't answer your questions, get in touch with the Nintex Support team.

Required Settings section

In the Required Settings section, these are the settings that need to be addressed. The other settings in this section can be left "as is" unless you are instructed otherwise:

1. Enabled: Turn this switch ON to enable this user federation to connect with your Active Directory.

2. Connection URL: ldap:// followed by the fully qualified domain address (FQDN) of the domain controller

   • After entering the value in this field, click the Test connection button to confirm that the RPA server can connect to your Active Directory.

3. Users DN: A name that describes the path in the Active Directory where the users to sync are located. This could begin with an organizational unit (OU) or a common name (CN) and ends with one or more DCs (domain components). Learn more about the best practice of separating your Nintex users into a CN container for easier management.

   • Example: If your Nintex users are in an Active Directory container (CN) called users, and your Active Directory domain is galaxyfaraway.com, the entry in this field would be:

   • cn=users,dc=galaxyfaraway,dc=com

4. Bind DN: The domain\username of the the user with rights to run Nintex services on the RPA server

5. Bind Credential: The password of the the user with rights to run Nintex services on the RPA server

   • After entering the Bind DN and the Bind Credential, click the Test authentication button to confirm that the RPA server can log in to your Active Directory.

6. Custom User LDAP Filter: (Optional) If you want to sync only specific users (by name or other attribute) from all users contained in the Users DN, you can set up a Custom User LDAP Filter (see this Microsoft article for examples of LDAP filters and syntax).

7. Search Scope: If your Users DN includes containers within it, set this value as follows:

   • One level → sync users from only the top level defined by the DN

   • Subtree → sync users from the top level defined by the DN and all its sub-levels

Kerberos Integration section

In the Required Settings section, these are the settings that need to be addressed. The other settings in this section can be left "as is" unless you are instructed otherwise:

1. Allow Kerberos authentication: Turn this switch ON.

2. Kerberos Realm: The domain name of your Active Directory

3. Server Principal: HTTP/ followed by the RPA_Server_FQDN@RPA_SERVER_DOMAIN (exactly as defined; FQDN should be exactly as it appears in Control Panel)

   • General format: HTTP/ComputerFullName@DomainName@DOMAIN

   • Example: HTTP/KSChrisLabT490.KSL.Local@ArvesSys.local@ARVESSYSLOCAL

4. KeyTab: The full path of the KEYTAB file on the RPA server. Following RPA server installation, the location should be as follows:

   {InstallFolder}\Kryon\IDP\Aerobase\Configuration\{filename}.keytab

   • If the KEYTAB file was provided or generated during RPA server installation, the installation package will have copied the file to this location

   • If you generated the KEYTAB file following RPA server installation, you should have moved the file to this location as the final step in the process. See Generating a KEYTAB file.

5. Debug: Turn this switch ON to allow logging (enabling you to troubleshoot queries to the Active Directory).

Sync Settings & Cache Settings section

The settings in this section can be left "as is" unless you are instructed otherwise.

Sync users to the Users Federation in Aerobase:

1. After completing all the federation settings, click the Save button. You should receive the following notification:
   

2. You will be presented with additional buttons, allowing you to sync the users from your Active Directory to the user federation:
   

3. Click the Synchronize all users button. You should receive a notification, letting you know the results of the sync:
   

Sync users to Admin Tool

Now that your Active Directory users have been synced to the user federation, you can complete the Kerberos configuration process by syncing users to Admin Tool (i.e., the Nintex database).

• For complete instructions, see Admin Tool User Guide (Syncing from User Federation)