{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":40693,"path":"platform-security/authentication/t_SupportKerberosAuthentication.md","title":"\\(Workaround\\) Support Kerberos authentication","bundle":null,"doc_type":null,"release":"australia","body":"\n# \\(Workaround\\) Support Kerberos authentication\n\nA workaround is available for the SAML 2.0 integration that changes the authentication context from forms-based authentication to Windows-based authentication.\n\n## Before you begin\n\nRole required: sso\\_config\\_admin, business\\_rule\\_admin, script\\_include\\_admin\n\n## About this task\n\nCurrently, the SAML 2 integration uses a PasswordProtectedTransport or \"forms-based authentication\" authentication context. This authentication context requires the IdP to present users with a form for authentication credentials. With Kerberos, a SAML session is already active through an established Windows login, so the user does not need to authenticate with the IdP.\n\n## Procedure\n\n1.  Navigate to **All** &gt; **Multi-Provider SSO** &gt; **Identity Providers**.\n\n2.  Open the **SAML2 Update1** IdP record.\n\n3.  Set the **The AuthnContextClassRef method that we will be included in our SAML 2.0 AuthnRequest to the Identity Provider** to one of the following:\n\n<table id=\"table_kqd_rzg_cs\"><tbody><tr><td>\n\n`urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport` \\(Default\\)\n\n</td></tr><tr><td>\n\n`urn:federation:authentication:windows`\n\n</td></tr></tbody>\n</table>4.  Click **Update**.\n\n\n"}}