Select Kerberos or HTTP Basic.

Note: You MUST select Kerberos when configuring authentication relay for Kerberos SSO.

Can select HTTPError401 or always.

After a client account authenticates successfully, FortiADC first sends the request to the server and waits for the server's response before performing authentication on its part.

If HTTPErr401 is set, FortiADC will do the authentication only when it has received the 401 response. Furthermore, if the client requests for more information from the web after FortiADC has gotten the authentication service ticket, FortiADC will send the request without the ticket. FortiADC will send another request with the service ticket only when the server returns the 401 unauthorized response.

When always is set, FortiADC always does the authentication no matter what response it receives from the server. If the client requests for more information from the web after FortiADC has gotten the Kerberos service ticket, FortiADC will always send the request with the service ticket.

The KDC server IP address.

The port on which the KDC server listens for Kerberos authentication.

The realm which supports Kerberos authentication.

Note: You must use uppercase letters and ‘.’ in the string.

The identification which shows the service running on the server.

The SPN uses this format: HTTP/sharepoint.ft3.local@FT3.LOCAL

Where

• HTTP— Refers to the service running on the server.
• The string between / and @ —Refers to the host, which supports regexp.
• The string after @ — Refers to the realm that supports the service. It MUST be in upper-case letters.

The FortiADC proxy Kerberos authentication account.

The delegator account password.