Windows Identity

Windows Integrated Authentication lets users authenticate with Windows Identity using their existing Windows sign-in. Depending on the configured protocol, authentication uses Kerberos tickets or an NTLM challenge-response exchange, without sending the user's password to the web server. When authentication succeeds, the user receives the Windows Identity authentication token.

Note

We recommend using a group Managed Service Account (gMSA) when installing Gatekeepers. For more information, see gMSA.

By default, Integrated Authentication is disabled for new customers. To enable Integrated Authentication, do the following:

1. Click Windows Identity.
2. In the Integrated Authentication Settings field, click Edit.

3. In the Select authentication protocol dropdown, select Kerberos, or NTLM if available.

   Note

   NTLM is a legacy protocol that provides less security and is only available to older Specops customers. New customers will have the identity service disabled by default, and will only be able to choose between Disabled or Kerberos. It is not recommended to use the NTLM protocol. Please consider using Kerberos instead.

4. Click OK.

5. Locate the Integrated Authentication url under Integrated Authentication Settings and add it to the Local Intranet zone on every client computer. It can be done in two ways:

   • Add the URL in Windows Control Panel > Internet Options > Security Tab > Local Intranet > Site.
   • Add the URL through the registry, see Alternate Ways to Update Trusted Sites. The blog post uses a different URL, but the process is the same.

For more information on the Windows Identity identity service, please see Windows Identity.