User's Manual

TD 92579EN
15 February 2012 / Ver. H
Installation and Operation Manual
IP-DECT Base Station & IP-DECT Gateway (software version 5.0.x)
64
The password used in the script is now possible to change to a more secret password from
the Kerberos server page.
It shall now be possible login to the Radio using the Kerberos login credentials, see Log in
using Kerberos on page 64.
Configure IPBS/IPBL as a client in a new system
Precondition: The IPBS/IPBL must have software version 4.1.x or higher.
The idea is to use the Device Overview -> Add to configure the Radios and the Kerberos
Client. By using this feature it is not needed to browse into each Radio for configuration.
The Radios are in broadcast mode which means none of them are attached to the Master
and configured. If any of the Radios are attached to the master and configured, the Radios
must be detached from the Master if this procedure shall work.
1 Select Device Overview > Radios.
2 Click "Add" to add the Radio to the Master.
3In the Add Radio window, enter a name for the device. You can also add a Standby
Master IP Address.
4Go to the Kerberos section and enter the following in the text fields:
Realm: Enter the realm name of the Kerberos server.
Host name: Optional.
User: Enter the same user name defined in the Kerberos server.
Password: Enter the same password defined in the Kerberos server.
Disable local authentication: Select the Disable local authentication check box
(recommended).
Overwrite existing: Select the Overwrite existing check box (optional).
5Go to the Authentication Servers section.
6In the Realm/Domain text field, enter the realm name specified in the Kerberos
server.
7In the Address text field, enter the IP address of the Kerberos server. In the Kerberos
server enter 127.0.0.1 (localhost) as the IP address. The Port text field is filled out
automatically.
8 Click "OK".
Log in using Kerberos
1 Make sure that secure HTTPS protocol is used when logging in.
2 Login on the client using a server account. When prompted for user name, the
name of the realm has to be entered in front of the user name, separated by a
backslash in the following way: REALM\username.
Disable local authentication
It is recommended to disable local authentication after Kerberos authentication is
configured. It provides additional security and it is much easier to change the password of
a user account or delete a compromises user account on the Kerberos server than
changing the local user accounts on each IPBS/IPBL.
IMPORTANT: Make sure that the Kerberos authentication is working properly before
disabling local authentication. If the Kerberos authentication is not
working and local authentication is disabled it is not possible to access the
IPBS/IPBL in any other way.