# OpenAM Administration Guide
2.2. Configuring Authentication Modules

Sidebar | Prev | Up | Next

### 2.2.21. Hints For the Windows Desktop SSO Authentication Module

The Windows Desktop SSO module uses Kerberos authentication. The user presents a Kerberos token to OpenAM through the Simple and Protected GSS-API Negotiation Mechanism (SPNEGO) protocol. The Windows Desktop SSO authentication module enables desktop single sign on such that a user who has already authenticated with a Kerberos Key Distribution Center can authenticate to OpenAM without having to provide the login information again. Users might need to set up Integrated Windows Authentication in Internet Explorer to benefit from single sign on when logged on to a Windows desktop.

ssoadm service name: `iPlanetAMAuthWindowsDesktopSSOService`

Service Principal

  Specify the Kerberos principal for authentication in the following format.

      HTTP/host.domain@dc-domain-name

  Here, `host` and `domain` correspond to the host and domain names of the OpenAM instance, and `dc-domain-name` is the domain name of the Windows Kerberos domain controller server. The `dc-domain-name` can differ from the domain name for OpenAM.

  You set up the account on the Windows domain controller, creating a computer account for OpenAM and associating the new account with a service provider name.

  ssoadm attribute: `iplanet-am-auth-windowsdesktopsso-principal-name`

Keytab File Name

  Specify the full path of the keytab file for the Service Principal. You generate the keytab file using the Windows ktpass utility.

  ssoadm attribute: `iplanet-am-auth-windowsdesktopsso-keytab-file`

Kerberos Realm

  Specify the Kerberos Key Distribution Center realm. For the Windows Kerberos service this is the domain controller server domain name.

  ssoadm attribute: `iplanet-am-auth-windowsdesktopsso-kerberos-realm`

Kerberos Server Name

  Specify the fully qualified domain name of the Kerberos Key Distribution Center server, such as that of the domain controller server.

  ssoadm attribute: `iplanet-am-auth-windowsdesktopsso-kdc`

Return Principal with Domain Name

  When enabled, OpenAM automatically returns the Kerberos principal with the domain controller's domain name during authentication.

  ssoadm attribute: `iplanet-am-auth-windowsdesktopsso-returnRealm`

Authentication Level

  Sets the authentication level used to indicate the level of security associated with the module. The value can range from 0 to any positive integer.

  ssoadm attribute: `iplanet-am-auth-windowsdesktopsso-auth-level`

Search for the user in the realm

  Validates the user against the configured data stores. If the user from the Kerberos token is not found, authentication will fail. If an authentication chain is set, the user will be able to authenticate through another module.

  ssoadm attribute: `iplanet-am-auth-windowsdesktopsso-lookupUserInRealm`

| Note
Note: For Windows 7 and later, you will need to turn off the "Enable Integrated Windows Authentication" option in Internet Explorer. In addition, you will need to add and activate the DisableNTMLPreAuth key to the Windows Registry. For detailed instructions, see the Microsoft KB article on when You cannot post data to a non-NTLM-authenticated Web site