---
title: "Enabling WebDAV Access Without Additional Authentication"
slug: "enabling-webdav-access-without-additional-authentication-4-1"
tags: ["Portal", "8.3"]
updated: 2025-06-24T15:37:17Z
published: 2025-06-24T15:37:17Z
canonical: "kb.ctera.com/enabling-webdav-access-without-additional-authentication-4-1"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.ctera.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enabling WebDAV Access Without Additional Authentication

When using WebDAV to access files from the portal global file system, the files must be accessible without requiring additional authentication. This functionality is enabled using SPNEGO. SPNEGO is a standard specification defined in the Simple and Protected GSS-API Negotiation Mechanism (IETF RFC 2478).

          **Note**

          

Access to the CTERA Portal using [CTERA Drive Connect](/v1/docs/ctera-drive-connect) also uses WebDAV to display the content in a file manager.

## CTERA Portal Support For SPEGNO Authentication

The following configuration is required to enable using WebDAV to access files from the portal global file system without requiring additional authentication, using SPNEGO:

1. On all Windows clients that connect to the portal, as the Active Directory user:
  1. Change the `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains` registry entry:
    1. Add a new key: *portalSuffix*, for example `myportal.com`.
    2. In the new key add a new `DWORD (32-bit) Value` entry, called `https` and set the value to `1`.
  2. Change the `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1` registry entry:  

Add a new `DWORD (32-bit) Value` entry, called `1A00` and set the value to `0`.
  3. Save the registry.
2. On all Windows clients that connect to the portal, as a Windows administrator user:
  1. Change the `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient\Parameters` registry entry:
    1. Add a new entry of type `Multi-String Value`
    2. Change the name of the entry to `AuthForwardServerList`
    3. Modify the entry by adding the URL for the portal, specifying just the DNS suffix, for example, `https://*.myportal.com`
  2. Save the registry.
3. On Mac clients that connect to the portal, configure Kerberos for authentication in the /etc/krb5.conf file.  

For example:

```
[domain_realm]
    .DOMAIN.COM = DOMAIN.COM
    DOMAIN.COM = DOMAIN.COM
[libdefaults]
    default_realm = DOMAIN.COM
    dns_lookup.kdc = true
    forwardable = true
    noaddresses = true
[realms]
DOMAIN.COM = {
    kdc = domain.com:88
}
```
4. Restart all clients.
5. Configure the ADFS/Kerberos server as described in [https://gusto77.wordpress.com/2015/09/02/apache-tomcat-spnego-authentication-configuration](https://gusto77.wordpress.com/2015/09/02/apache-tomcat-spnego-authentication-configuration).  

Register the SPN using the portal DNS: `setspn -A HTTP/portalname.myportal.com user`  

Create a keytab file: `ktpass /out c:\tomcat.keytab /mapuser user@DOMAIN.COM /princ HTTP/portalname.myportal.com@DOMAIN.COM /pass user_password /kvno 0 /pType KRB5_NT_PRINCIPAL`  

Move the keytab file to the tomcat server: `/usr/local/ctera/apache-tomcat/SPNEGO_KEYTAB`
6. Configure the portal application servers.
  1. Edit `/usr/local/ctera/apache-tomcat/jaas.config` to match the SPN configured in the Kerberos server.

```
...
com.sun.security.jgss.accept {
com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true keyTab="/usr/local/ctera/apache-tomcat/SPNEGO_KEYTAB" principal="HTTP/portalname.myportal.com@DOMAIN.COM" storeKey=true doNotPrompt=true;
};
...
```
  2. Set the portal to support SPNEGO: `set /settings/supportSPNEGO true`
  3. Restart the servers.