Kerberos delegation

Microsoft Provisioning Framework (MPF) can be configured to use Kerberos delegation for authentication in domain deployments. Kerberos delegation is a form of impersonation. Microsoft documentation distinguishes between delegation and impersonation, using the term delegation to refer to impersonation involving multiple computers that communicate over a network. In MPF, delegation refers to the ability of a calling process to execute based on the COM security credentials of the calling user.

MPF can use Kerberos delegation under the following conditions:

• When clients submit requests to provisioning servers.
• When requests call providers that interact with external services such as Active Directory.

Important

• For an MPF server to delegate to another server, it must run under an identity marked as trusted for delegation in Active Directory. Impersonation will not work if the client account is either marked as sensitive, cannot be delegated, or both conditions apply.

To configure MPF to support Kerberos delegation, dynamic cloaking, and delegation must be set up on the client during MPF setup, and the MPFServiceAcct must be marked as trusted for delegation in Active Directory. You can do this in one of two ways, depending on the installation mode.

• During installation, select the Impersonation check box (if using the Setup Wizard) or specify the MPF MPF_IMPERSONATE=1 parameter (if installing from the command line).
• After installation, in Provisioning Manager set the Capabilities property for provisioning engine clients to Dynamic cloaking and set the Impersonation level property to Delegate, and then do the same for queue manager clients.

After impersonation is set up, impersonation for procedure calls is specified in requests using the impersonate attribute of the individual execute and queue nodes. For Kerberos authentication, impersonate must be set to 1 and the request must not contain a \securityContext\authentication\basic node. Otherwise, MPF assumes that the call uses basic authentication rather than Kerberos.