apm aaa kerberos

apm aaa kerberos(1)	      BIG-IP TMSH Manual	   apm aaa kerberos(1)



NAME
       kerberos - Configures a Kerberos server.

MODULE
       apm aaa

SYNTAX
       Configure the kerberos component within the aaa module using the syntax
       shown in the following sections.

   CREATE/MODIFY
	create kerberos [name]
	modify kerberos [name]
	  options
	    auth-realm [[string] | none]
	    app-service [[string] | none]
	    keytab-file-obj [[string] | none]
	    location-specific [true | false]
	    service-name [[string] | none]

	edit kerberos | [glob] | [regex] ] ... ]
	  options:
	    all-properties
	    non-default-properties

   DISPLAY
	 list kerberos
	 list kerberos [ [ [name] | [glob] | [regex] ] ... ]
	   options:
	     all-properties
	     app-service
	     non-default-properties
	     one-line
	     partition

   DELETE
	delete kerberos [name]

DESCRIPTION
       You can use the kerberos component to create and manage AAA Kerberos
       servers. Use the Kerberos authentication server to configure
       authentication for the Access Policy Manager. A client retrieves
       credentials from the domain controller and passes those credentials to
       the Access Policy Manager. Then Access Policy Manager uses the value in
       the keytab-file-obj option of the Kerberos AAA server object to verify
       the credentials. Access Policy Manager system does not have to reside
       in the domain.

EXAMPLES
       delete kerberos my_kerberos
	    Deletes the server named my_kerberos.

OPTIONS
       auth-realm
	    Specifies a Kerberos auth realm name (administrative name), such
	    as user@realm.com to establish the boundaries within which an
	    authentication server has the authority to authenticate a user,
	    host, or service. Kerberos clients manually map DNS domain names
	    to Kerberos realm names. This option is required.

       app-service
	    Specifies the name of the application service to which the object
	    belongs. The default value is none. Note: If the strict-updates
	    option is enabled on the application service that owns the object,
	    you cannot modify or delete the object. Only the application
	    service can modify or delete the object.

       keytab-file-obj
	    Specifies a keytab file that contains the keys (derived from the
	    Kerberos password) that the server uses to authenticate the
	    client. This option is required.

       location-specific
	    Specifies whether or not this object contains one or more
	    attributes with values that are specific to the location where the
	    BIG-IP device resides. The location-specific attribute is either
	    true or false. When using policy sync, mark an object as location-
	    specific to prevent errors that can occur when policies reference
	    objects, such as authentication servers, that are specific to a
	    certain location.

       [name]
	    Specifies the name of an AAA Kerberos server. This option is
	    required.

       partition
	    Displays the partition within which the component resides.

       service-name
	    Specifies the Kerberos service name defined inside KDC in the
	    format service name/hostname@kerberosrealm. This option is
	    required, for example, HTTP.

SEE ALSO
COPYRIGHT
       No part of this program may be reproduced or transmitted in any form or
       by any means, electronic or mechanical, including photocopying,
       recording, or information storage and retrieval systems, for any
       purpose other than the purchaser's personal use, without the express
       written permission of F5 Networks, Inc.

       F5 Networks and BIG-IP (c) Copyright 2011-2012. All rights reserved.



BIG-IP				  2014-10-27		   apm aaa kerberos(1)