Hi Dominique, There is an error in the description of the ktpass command. the command is really: ktpass -out c:\keycloak.keytab -princ HTTPS/facultativoskeycloak.sanbox.local(a)SANBOX.LOCAL -mapUser Keycloak(a)SANBOX.LOCAL -pass XXXXX -kvno 0 -ptype KRB5_NT_PRINCIPAL -crypto RC4-HMAC-NT Regards ------------------------------ Message: 5 Date: Tue, 26 Jun 2018 12:46:01 +0000 From: Dominique ARNOU <dominique.arnou(a)cnieg.fr&gt; Subject: Re: [keycloak-user] Kerberos authentication in Windows To: Ota?o Pavo, Cesar <c.otano(a)ibermatica.com&gt;, &quot;keycloak-user(a)lists.jboss.org&quot; <keycloak-user(a)lists.jboss.org&gt; Message-ID: <DB6PR07MB323955D8C4121CCE0FFC686686490(a)DB6PR07MB3239.eurprd07.prod.outlook.com&gt; Content-Type: text/plain; charset="iso-8859-1" Hi Your server principal would be HTTP/facultativoskeycloak.sanbox.local(a)SANBOX.LOCAL, not HTTPS/... Dominique -----Message d'origine----- De?: keycloak-user-bounces(a)lists.jboss.org [mailto:keycloak-user-bounces@lists.jboss.org] De la part de Ota?o Pavo, Cesar Envoy??: mardi 26 juin 2018 14:13 ??: keycloak-user(a)lists.jboss.org Objet?: [keycloak-user] Kerberos authentication in Windows Hi, I'm trying to set up user authentication mechanism for my website using Keycloak and Kerberos protocol. I have followed instructions from here: http://matthewcasperson.blogspot.com/2015/07/authenticating-via-kerberos-... In Keycloak configuration menu I have changed Authentication Flow for Browser Kerberos from alternative to required. settings<http://i.imgur.com/hgAnHJJ.png>;. But after that when I'm going to my web page I got message "Kerberos is not set up. You cannot login." Aditional information: ? Keycloak is installed in Windows Server 2012. ? Command to create keytabfile: ktpass -out c:\keycloak.keytab -princ HTTP/facultativoskeycloak.sanbox.local(a)SANBOX.LOCAL -mapUser Keycloak(a)SANBOX.LOCAL -pass XXXXX -kvno 0 -ptype KRB5_NT_PRINCIPAL -crypto RC4-HMAC-NT ? Configuration KRB5.ini located in c:\windows [domain_realm] .sanbox.local = SANBOX.LOCAL sanbox.local = SANBOX.LOCAL [libdefaults] default_realm = SANBOX.LOCAL permitted_enctypes = aes128-cts aes256-cts arcfour-hmac-md5 default_tgs_enctypes = aes128-cts aes256-cts arcfour-hmac-md5 default_tkt_enctypes = aes128-cts aes256-cts arcfour-hmac-md5 [realms] SANBOX.LOCAL = { kdc = sb-ad.sanbox.local admin_server = sb-ad.sanbox.local default_domain = SANBOX.LOCAL } ? Kerberos Integration: Allow Kerberos authentication: YES Kerberos Realm SANBOX.LOCAL Server Principal HTTPS/facultativoskeycloak.sanbox.local(a)SANBOX.LOCAL KeyTab C:/keycloak.keytab Debug YES Use Kerberos For Password Authentication YES Regards Cesar AVISO LEGAL El contenido de este mensaje de correo electrónico, incluidos los ficheros adjuntos, es confidencial y está protegido por el secreto de las comunicaciones. Si usted recibe este mensaje por error, por favor notifique dicha circunstancia al remitente, borre el mensaje y no use, guarde, divulgue o copie su contenido. LEGAL NOTICE The contents of this email transmission and of any attached documents are confidential and are protected by the secrecy of correspondence. If you have received this message in error, please notify the sender and delete this message without using, storing, disclosing or copying its contents.