---
title: "Using Active Directory for SSO"
slug: "using-active-directory-for-sso-4"
tags: ["8.2", "Portal"]
updated: 2026-11-05T09:38:50Z
published: 2026-11-05T09:38:50Z
canonical: "kb.ctera.com/using-active-directory-for-sso-4"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.ctera.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Using Active Directory for SSO

You can configure single sign-on for one team portal, for users defined in Microsoft Active Directory, using the Kerberos protocol. When single sign on is configured, CTERA Agents automatically and transparently authenticate to the team portal using their Active Directory credentials, upon first login to the PC on which they are installed.

**Notes**

Users logging on to a PC running a CTERA Agent, with CAC, Common Access Card, are automatically and transparently authenticated to the CTERA Portal. Single sign-on (SSO) to the CTERA Portal must be defined in Microsoft Active Directory, using the Kerberos protocol.

Only one virtual portal can be defined with single sign-on using Kerberos.

A service principal name (SPN) account on Active Directory uniquely identifies an instance of a service. Before the CTERA Portal can use Kerberos authentication, you must register the SPN on the account object that the CTERA Portal uses to log on and then create a keytab file.

**To configure Active Directory for single sign-on with CTERA Portal:**

1. Get **ctera-agent.adm** from CTERA support.  

Example **ctera-agent.adm** file:

```
CLASS MACHINE

CATEGORY !!CteraAgent
    KEYNAME "Software\Policies\CTERA\Agent"

    POLICY !!USESSO
        EXPLAIN !!USESSO_Explain
        VALUENAME "SSO" 
        VALUEON NUMERIC 1
        VALUEOFF NUMERIC 0
        PART !!SSO_Server EDITTEXT REQUIRED
            VALUENAME "SSOServer"
        END PART
        PART !!SSO_Tip TEXT
        END PART 
      END POLICY 
END CATEGORY 

[strings]
USESSO="Enable CTERA Agent automatic deployment"
USESSO_Explain="With this policy you can automatically deploy CTERA Agents.\n\n When this policy is disabled, or not configured, each CTERA agent must be manually connected to a CTERA portal or CTERA Cloud-Attached-Storage appliance.\n\n When this policy is enabled, the CTERA Agent installed on the computer automatically signs into the CTERA portal or appliance designated by the policy. When a user logs on to the machine for the first time, CTERA agent immediately signs into the designated server, using the credentials of that user."
SSO_Server="Sign into server"
SSO_Tip="Use the Fully-Qualified DNS name of a CTERA portal or a CTERA appliance. The target server must be a member of this Active Directory domain."
CteraAgent="CTERA Agent Settings"
```
2. In the **Start** menu on the server where Active Directory runs, select **Administrative Tools > Group Policy Management**.  

The **Group Policy Management** console is displayed:  

![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-YC2GXSV8.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A43%3A41Z&se=2026-11-11T05%3A43%3A41Z&sr=c&sp=r&sig=DFBuTAvK2%2BBb4ga%2Fnt9Fo95oHlzb17kCJnF8eUqwN4s%3D)  

This console enables you to create domain-wide policies or policies for specific organizational units.
  1. In the navigation pane, drill-down to the domain or organizational unit for which you want to create the policy, right-click it and select **Create a new GPO in this domain and Link it here**.  

The **New GPO** window is displayed.
  2. Enter a name for the policy and click **OK**.
  3. In the navigation pane, select the domain and in the right pane, select the **Linked Group Policy Objects** tab.  

![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-BZ3DL78X.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A43%3A41Z&se=2026-11-11T05%3A43%3A41Z&sr=c&sp=r&sig=DFBuTAvK2%2BBb4ga%2Fnt9Fo95oHlzb17kCJnF8eUqwN4s%3D)
  4. Double-click the policy to display it.
**Note**

If a **Group Policy Management Console** message is displayed, click **OK**.

The policy details are displayed:  

![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-Z67E6F7F.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A43%3A41Z&se=2026-11-11T05%3A43%3A41Z&sr=c&sp=r&sig=DFBuTAvK2%2BBb4ga%2Fnt9Fo95oHlzb17kCJnF8eUqwN4s%3D)
  5. Right-click the policy you created and select **Enforced**.
  6. Right-click the policy you created and select **Edit**.  

The **Group Policy Management Editor** is displayed.  

![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-NTZSFA91.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A43%3A41Z&se=2026-11-11T05%3A43%3A41Z&sr=c&sp=r&sig=DFBuTAvK2%2BBb4ga%2Fnt9Fo95oHlzb17kCJnF8eUqwN4s%3D)
  7. In the navigation pane, expand **Computer Configuration > Policies**, right-click **Administrative Templates** and select **Add/Remove Templates**.  

The **Add/Remove Templates** window is displayed.
  8. Click **Add** and select the **ctera-agent.adm** file you received in step 1, above.
  9. Click **Open**.
  10. Click **Close**.
  11. In the navigation pane, expand **Computer Configuration > Policies > Administrative Templates > Classic Administrative Templates** and click the **CTERA Agent Settings** node.  

![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-8GPOXQRL.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A43%3A41Z&se=2026-11-11T05%3A43%3A41Z&sr=c&sp=r&sig=DFBuTAvK2%2BBb4ga%2Fnt9Fo95oHlzb17kCJnF8eUqwN4s%3D)
  12. Right-click **Enable CTERA Agent automatic deployment** and select **Edit**.  

The **Enable CTERA Agent automatic deployment** window is displayed.  

![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-KYT3M1B1.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A43%3A41Z&se=2026-11-11T05%3A43%3A41Z&sr=c&sp=r&sig=DFBuTAvK2%2BBb4ga%2Fnt9Fo95oHlzb17kCJnF8eUqwN4s%3D)
  13. Specify the following:  

**Enabled** – Set the **Enabled** option.  

**Sign into server** – Type the fully qualified DNS name of the CTERA Portal to which the CTERA Agent will connect. For example, `myportal.ctera.com.`
  14. Click **OK**.
3. In the **Start** menu on the server where Active Directory runs, select **Administrative Tools > Active Directory Users and Computers**.
  1. Right-click on the name of the domain to which you want to add the user and click **New > Organizational Unit**.  

The **New Object - Organizational Unit** window is displayed.
  2. Enter a name for the unit and click **OK**.
  3. Right-click on the organizational unit and click **New > User**.  

The **New Object - User** window is displayed.  

![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-53BNFZ30.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A43%3A41Z&se=2026-11-11T05%3A43%3A41Z&sr=c&sp=r&sig=DFBuTAvK2%2BBb4ga%2Fnt9Fo95oHlzb17kCJnF8eUqwN4s%3D)
  4. Fill in the user details: In the **User logon name** area, in the first field enter a user account, such as `cteraportal`, and in the second field select the domain.
  5. Click **Next**.  

![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-949K909H.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A43%3A41Z&se=2026-11-11T05%3A43%3A41Z&sr=c&sp=r&sig=DFBuTAvK2%2BBb4ga%2Fnt9Fo95oHlzb17kCJnF8eUqwN4s%3D)
  6. In the **Password** and **Confirm password** fields, enter a password for the user.  

The password must be at least 8 characters in length and conform to at least 3 out of the following requirements:
    - It must contain at least one English uppercase character (A through Z)
    - It must contain at least one English lowercase character (a through z)
    - It must contain at least one Base 10 digit (0 through 9)
    - It must contain at least one non-alphanumeric character (for example, !, $, #, %)
  7. Clear the **User must change password at next logon** check box.
  8. Check the **User cannot change password** and **Password never expires** check boxes.
  9. Click **Next**.  

The summary for the new user is displayed.
  10. Click **Finish**.
4. Map the service principal name to the user account that you created and generate a *keytab* file, by running the following command on the domain controller:  

`ktpass -princ SPN -out path_to_keytab -mapuser account_name@DOMAIN  -mapOp set -pass account_password /crypto AES256-SHA1 /ptype KRB5_NT_PRINCIPAL`  

Where:
  - *SPN* is the Kerberos service principal name.  

For example: `cttp/portal.example.com@example.com`  

The SPN syntax is `cttp/portal_full_DNS_name@ACTIVE_DIRECTORY_REALM`
**Note**

The principal name used in the keytab **must** match the *userPrincipalName* entry in Active Directory for only the user account. You can verify the principal name in the keytab by running the klist command: `klist -k` The Active Directory Kerberos realm must match the CTERA Portal's DNS suffix. The email pattern must include only uppercase letters.
  - *path_to_keytab* is the path where you want to store the generated keytab file.  

For example, `c:\cteraportal.keytab`.
**Note**

The keytab file name must include only uppercase letters.
  - *DOMAIN* is the domain NetBIOS name.  

For example, `DOMAIN.LOCAL`  

The domain name must include only uppercase letters.
  - *account_name* is the service account name.  

For example, `cteraportal`
  - *account_password* is the password associated with the service account.  

For example, Password12E4.
5. Change network security under local group policy on Active Directory and the CTERA Agent workstation.

**To configure Kerberos for single sign-on with a portal:**

- Kerberos requires the clocks of the relevant hosts to be synchronized. Ensure that the CTERA Portal server's clock is synchronized with the Active Directory clock, preferably by synchronizing the portal server's underlying clock, for example, via VMware Tools for a portal running on ESXi, with an NTP server.
- In order to authenticate with aes256-cts-hmac-sha1-96, make sure that the Active Directory domain controller policy supports this authentication. If this is not the case, change the **ssouser** configuration in the Active Directory server, so that the account supports AES 128 bit and AES 256 bit encryption.
- Make sure that using only DES encryption is not set.
- Generate a new keytab with AES256 encryption using the `ktpass` command described above. Copy this keytab to the portal and then run `portal-keytab.sh` with the new keytab on the portal and `klist purge` in the CTERA Agent workstation.
- Verify the following in the *libdefaults* section of the **krb5.conf**:  

`default_tkt_enctypes = aes256-cts-hmac-sha1-96`  

`default_tgs_enctypes = aes256-cts-hmac-sha1-96`
- Connect the portal to Active Directory.

**Note**

Only one virtual portal can be defined with single sign-on using Kerberos. If the global administrator has set up SSO using Kerebos on another virtual portal, you cannot set SSO using Kerebos on this portal.

**To configure SSO on the portal:**

**Note**

Part of this procedure includes stopping the portal, which will result in some downtime.

1. Enable the keytab file on the portal:
  1. Log in to the CTERA Portal as root, using SSH.
  2. Run the following command to stop the portal: `portal-manage.sh stop`
  3. Copy the keytab file from the Active Directory server to `/usr/local/ctera/apache_tomcat` on the CTERA Portal server.
  4. Run the following command: `portal-keytab.sh keytabfile` where *keytabfile* is the full name and path of the keytab file.
  5. Run the following command to start the portal: portal-manage.sh start
2. Add the Active Directory server to the portal:
  1. Log in to the portal.
  2. Select **Settings** in the navigation pane.  

The **Control Panel** page is displayed.  

![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-W6Q5JAN1.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A43%3A41Z&se=2026-11-11T05%3A43%3A41Z&sr=c&sp=r&sig=DFBuTAvK2%2BBb4ga%2Fnt9Fo95oHlzb17kCJnF8eUqwN4s%3D)
  3. Select **Directory Services**, under **USERS** in the **Control Panel** page.  

The **Directory Services** page is displayed.  

![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-AHNSEPW8.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A43%3A41Z&se=2026-11-11T05%3A43%3A41Z&sr=c&sp=r&sig=DFBuTAvK2%2BBb4ga%2Fnt9Fo95oHlzb17kCJnF8eUqwN4s%3D)
  4. Click **Settings**.  

The **Directory Services Settings** window is displayed.  

![image.png](https://cdn.document360.io/30792387-cdcb-4791-aa14-94929bbcd3fe/Images/Documentation/image-84AF5E3P.png?sv=2026-02-06&spr=https&st=2026-11-11T04%3A43%3A41Z&se=2026-11-11T05%3A43%3A41Z&sr=c&sp=r&sig=DFBuTAvK2%2BBb4ga%2Fnt9Fo95oHlzb17kCJnF8eUqwN4s%3D)
  5. Specify the following:  

Check **Enable directory synchronization**.  

In **Directory Type**, select Active Directory.  

Check **Use Kerberos**.  

In **Domain**, enter the Active Directory domain.  

In **Username**, enter the username for the Active Directory URL.  

In **Password**, enter the password for the Active Directory URL.
  6. Click **Next** to the end of the wizard.
  7. Click **FINISH**.

SSO is now configured on the CTERA Portal.

**Note**

A single virtual portal can be configured to enable SSO access using WebDAV SPNEGO, described in [Enabling WebDAV Access Without Additional Authentication (Using SPNEGO)](/v1/docs/enabling-webdav-access-without-additional-authentication-4) or simultaneous SSO access via both Kerberos SSO and WebDAV SPNEGO, described in [Using Kerberos and SPNEGO Together](/v1/docs/using-kerberos-and-spnego-together-5).