apm aaa kerberos
apm aaa kerberos(1) BIG-IP TMSH Manual apm aaa kerberos(1)
NAME
kerberos - Configures a Kerberos server.
MODULE
apm aaa
SYNTAX
Configure the kerberos component within the aaa module using the syntax
shown in the following sections.
CREATE/MODIFY
create kerberos [name]
modify kerberos [name]
options
auth-realm [[string] | none]
app-service [[string] | none]
keytab-file-obj [[string] | none]
location-specific [true | false]
service-name [[string] | none]
edit kerberos | [glob] | [regex] ] ... ]
options:
all-properties
non-default-properties
DISPLAY
list kerberos
list kerberos [ [ [name] | [glob] | [regex] ] ... ]
options:
all-properties
app-service
non-default-properties
one-line
partition
DELETE
delete kerberos [name]
DESCRIPTION
You can use the kerberos component to create and manage AAA Kerberos
servers. Use the Kerberos authentication server to configure
authentication for the Access Policy Manager. A client retrieves
credentials from the domain controller and passes those credentials to
the Access Policy Manager. Then Access Policy Manager uses the value in
the keytab-file-obj option of the Kerberos AAA server object to verify
the credentials. Access Policy Manager system does not have to reside
in the domain.
EXAMPLES
delete kerberos my_kerberos
Deletes the server named my_kerberos.
OPTIONS
auth-realm
Specifies a Kerberos auth realm name (administrative name), such
as user@realm.com to establish the boundaries within which an
authentication server has the authority to authenticate a user,
host, or service. Kerberos clients manually map DNS domain names
to Kerberos realm names. This option is required.
app-service
Specifies the name of the application service to which the object
belongs. The default value is none. Note: If the strict-updates
option is enabled on the application service that owns the object,
you cannot modify or delete the object. Only the application
service can modify or delete the object.
keytab-file-obj
Specifies a keytab file that contains the keys (derived from the
Kerberos password) that the server uses to authenticate the
client. This option is required.
location-specific
Specifies whether or not this object contains one or more
attributes with values that are specific to the location where the
BIG-IP device resides. The location-specific attribute is either
true or false. When using policy sync, mark an object as location-
specific to prevent errors that can occur when policies reference
objects, such as authentication servers, that are specific to a
certain location.
[name]
Specifies the name of an AAA Kerberos server. This option is
required.
partition
Displays the partition within which the component resides.
service-name
Specifies the Kerberos service name defined inside KDC in the
format service name/hostname@kerberosrealm. This option is
required, for example, HTTP.
SEE ALSO
COPYRIGHT
No part of this program may be reproduced or transmitted in any form or
by any means, electronic or mechanical, including photocopying,
recording, or information storage and retrieval systems, for any
purpose other than the purchaser's personal use, without the express
written permission of F5 Networks, Inc.
F5 Networks and BIG-IP (c) Copyright 2011-2012. All rights reserved.
BIG-IP 2014-10-27 apm aaa kerberos(1)