{"id":12579,"date":"2026-03-09T01:37:00","date_gmt":"2026-03-08T16:37:00","guid":{"rendered":"https:\/\/chat-messenger.com\/?p=12579"},"modified":"2026-03-12T10:59:43","modified_gmt":"2026-03-12T01:59:43","slug":"windows-authentication","status":"publish","type":"post","link":"https:\/\/chat-messenger.com\/en\/manual\/camserver\/windows-auth","title":{"rendered":"SSO with Integrated Windows Authentication"},"content":{"rendered":"<h2 class=\"wp-block-heading\">summary<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In an Active Directory environment, using Integrated Windows Authentication (Kerberos) allows users to use the same authentication credentials they use to log in to Windows.<span class=\"swl-marker mark_orange\">Automatic single sign-on (SSO) to CAMServer without requiring additional login to C&amp;M.<\/span> can.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Traditionally, this system required building using IIS\/ASP.NET, but with this feature, CAMServer directly handles Kerberos authentication. This allows for a simpler configuration of SSO using integrated Windows authentication without the need for additional servers such as IIS.<\/p>\n\n\n<div class=\"swell-block-postLink\">\t\t\t<div class=\"p-blogCard -internal\" data-type=\"type1\" data-onclick=\"clickLink\">\n\t\t\t\t<div class=\"p-blogCard__inner\">\n\t\t\t\t\t<span class=\"p-blogCard__caption\">I also want to read it<\/span>\n\t\t\t\t\t<div class=\"p-blogCard__thumb c-postThumb\"><figure class=\"c-postThumb__figure\"><img decoding=\"async\" src=\"https:\/\/chat-messenger.com\/wp-content\/themes\/swell\/assets\/img\/no_img.png\" alt=\"\" class=\"c-postThumb__img u-obf-cover\" width=\"320\" height=\"180\"><\/figure><\/div>\t\t\t\t\t<div class=\"p-blogCard__body\">\n\t\t\t\t\t\t<a class=\"p-blogCard__title\" href=\"https:\/\/chat-messenger.com\/en\/manual\/camserver\/iis-sso\">SSO using IIS Integrated Windows Authentication<\/a>\n\t\t\t\t\t\t<span class=\"p-blogCard__excerpt\">Please use the following in your new environment: [Overview of Integrated Windows Authentication] Integrated Windows Authentication (IWA) is a system where IIS and users are in the same domain\u2026<\/span>\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/div>\n\n\n<h2 class=\"wp-block-heading\">SSO flow<\/h2>\n\n\n\n<div class=\"wp-block-columns\">\n<div class=\"wp-block-column\">\n<figure class=\"wp-block-image size-full is-style-border\"><img decoding=\"async\" width=\"1556\" height=\"1505\" src=\"https:\/\/chat-messenger.com\/wp-content\/uploads\/2026\/03\/image-8.png\" alt=\"\" class=\"wp-image-12633\"\/><\/figure>\n<\/div>\n\n\n\n<div class=\"wp-block-column\">\n<p class=\"wp-block-paragraph\">SSO processing flow<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li><strong>Access CAMServer<\/strong><br>The user accesses CAMServer via a browser. Upon access, a temporary token for the application is sent via POST.<\/li><li><strong>Authentication Request<\/strong><br>After verifying the temporary token, CAMServer requests Windows authentication (Negotiate) from the browser.<\/li><li><strong>Obtaining a Kerberos ticket<\/strong><br>The browser uses Windows logon information,<br>Obtain a Kerberos service ticket from the Active Directory KDC.<\/li><li><strong>Sending a Kerberos ticket<\/strong><br>The browser uses the acquired Kerberos ticket<br>The HTTP header is added and the message is resent to CAMServer.<\/li><li><strong>Ticket Verification<\/strong><br>CAMServer uses keytab to verify Kerberos tickets. If verification is successful, it retrieves the Kerberos principal contained in the ticket.<\/li><li><strong>LDAP search and CAM user matching<\/strong><br>The system performs an LADP search using the retrieved Kerberos principal to obtain user information from AD and compares it with the user registered in CAMServer. If a match is found, the login is permitted.<\/li><li><strong>Login complete<\/strong><br>CAMServer issues a login session,<br>Users can use CAMServer without displaying the login screen.<\/li><\/ol>\n<\/div>\n<\/div>\n\n\n\n<p class=\"is-style-big_icon_point wp-block-paragraph\">If you access the site using a domain name other than the FQDN used for Windows authentication, or if you access it from a PC that is not joined to the domain, login authentication will be performed on the command and management server (C&amp;M).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Operating requirements<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The following environment is required to use this feature.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Active Directory environment<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>An Active Directory domain must be established.<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">CAMServer<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/chat-messenger.com\/en\/contactus\/camserver-plan\/\">Ultimate Plan<\/a>Using<\/li><li>The CAMServer must be accessible via its Fully Qualified Domain Name (FQDN).<\/li><li>The Windows Server running CAMServer must be joined to an Active Directory domain.<br>To check which domains an existing Windows Server is joined to, go to &quot;Server Manager&quot; \u2192 click &quot;Local Server&quot; in the left menu \u2192 click &quot;Computer Name&quot; and refer to the domain field.<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Users<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>The user&#039;s PC must be joined to a domain and logged into Windows via the domain.<\/li><li>SSO-eligible users are those whose user ID is <em>UserPrincipalName&nbsp;<\/em>(You must be pre-registered with CAMServer in UPN format (e.g., user@camtest.com))<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Supported browsers<br><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Windows authentication SSO is available in the following browsers.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Microsoft Edge<\/li><li>Google Chrome<\/li><li><a href=\"https:\/\/chat-messenger.com\/en\/manual\/install-discount\/cam-webapp\/\" target=\"_blank\" rel=\"noreferrer noopener\">camapp<\/a><\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Regarding load balancer configuration<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Windows authentication (Kerberos) is an authentication method that uses HTTP authentication headers for negotiation, so CAMServer must remain running on port 443, and the load balancer must be L4 (TLS passthrough).<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Recommended configuration<\/h4>\n\n\n\n<p class=\"is-style-bg_stripe wp-block-paragraph\">User \u2500\u2500HTTPS\u2500\u2500\u25b6 L4 Load Balancer (TLS Passthrough) \u2500\u2500HTTPS\u2500\u2500\u25b6 CAMServer(443)<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">NG configuration<\/h4>\n\n\n\n<p class=\"is-style-bg_stripe wp-block-paragraph\">User\u2500\u2500HTTPS\u2500\u2500\u25b6 L7 Load Balancer (SSL Termination) \u2500\u2500HTTP\u2500\u2500\u25b6 CAMServer(8080)<\/p>\n\n\n\n<p class=\"is-style-icon_info wp-block-paragraph\">In L7 load balancers, TLS termination and HTTP regeneration occur,<br>It seems that many systems do not support Windows authentication (Kerberos) negotiation.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Construction Procedure<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The following setup procedure will be explained based on the &quot;Configuration Example&quot;.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Configuration example<\/h3>\n\n\n\n<ul class=\"wp-block-list\"><li>FQDN for Windows authentication:<code>https:\/\/test.chat-messenger.com<\/code><\/li><li>Active Directory Domain Name:<code>camtest.com<\/code><\/li><li>Service account:<code>cam-svc@camtest.com<\/code> (<code>CAMTEST\\cam-svc<\/code>)<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">SPN Registration Overview<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">SPN (Service Principal Name) is a name that uniquely identifies a specific service on Active Directory in Kerberos authentication. When accessing with FQDN, registering SPN allows the client to correctly request a Kerberos ticket for the service to be accessed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">for example <code>https:\/\/test.chat-messenger.com<\/code> When accessing the service, the client (browser) requests a ticket from Active Directory stating, &quot;I want to connect to the service called HTTP\/test.chat-messenger.com.&quot; Active Directory checks which account the SPN is associated with and issues the corresponding service ticket. If the SPN is not registered correctly, Kerberos authentication will fail.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"serviceAccounts\">Service Account<\/h4>\n\n\n\n<div class=\"wp-block-columns\">\n<div class=\"wp-block-column\">\n<p class=\"wp-block-paragraph\">Create a service account for Kerberos authentication. While this is possible with a domain user, it&#039;s generally recommended to separate user and service accounts to prevent accidental errors and clarify the scope of password policy application.<code>OU=ServiceAccounts<\/code> Like, OU <code>Users<\/code> In distinction from Active Directory domain controllers,<code>cam-svc<\/code> Create a new one.<\/p>\n\n\n\n<p class=\"is-style-icon_pen wp-block-paragraph\"><span class=\"swl-fz u-fz-xs\">If you specified a service account when starting CAMServer as a Windows service, you can use the same user.<\/span><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Please check the following in your account options.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Make your password never expire<\/li><li>This account supports Kerberos AES 256-bit encryption.<\/li><\/ul>\n\n\n\n<p class=\"is-style-icon_pen wp-block-paragraph\"><span class=\"swl-fz u-fz-xs\">As described below <code>ktpass<\/code> To specify AES256-SHA1, you need to enable support for AES 256-bit encryption. If you don&#039;t specify it, it will default to RC4, which will be deprecated in the future due to security vulnerabilities.<\/span><\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-column\">\n<figure class=\"wp-block-image size-full is-resized is-style-border\"><img decoding=\"async\" src=\"https:\/\/chat-messenger.com\/wp-content\/uploads\/2026\/03\/image-4.png\" alt=\"\" class=\"wp-image-12586\" width=\"379\" height=\"189\"\/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img decoding=\"async\" src=\"https:\/\/chat-messenger.com\/wp-content\/uploads\/2026\/03\/image-7.png\" alt=\"\" class=\"wp-image-12613\" width=\"312\" height=\"387\"\/><\/figure>\n<\/div>\n<\/div>\n\n\n\n<h4 class=\"wp-block-heading\">Register SPN with service account<\/h4>\n\n\n\n<div class=\"hcb_wrap\" data-no-translation=\"\"><pre class=\"prism line-numbers lang-plain\"><code>setspn -S HTTP\/test.chat-messenger.com CAMTEST\\cam-svc<\/code><\/pre><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Register the SPN using the service account created above.<\/p>\n\n\n\n<p class=\"is-style-crease wp-block-paragraph\">- Any terminal that is part of the domain can be used. However, domain administrator privileges are required.<br>\u30fbThe SPN is also used in HTTPS communication.<code>HTTP\/hostname<\/code>You must register in the format:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Use the following command to verify that the SPN is registered.<\/p>\n\n\n\n<div class=\"hcb_wrap\" data-no-translation=\"\"><pre class=\"prism line-numbers lang-plain\"><code>setspn -L CAMTEST\\cam-svc<\/code><\/pre><\/div>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"keytab\">Create keytab<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">To enable CAMServer to validate Kerberos tickets, create a keytab file for the service account. Run the following command on the Active Directory management server:<\/p>\n\n\n\n<div class=\"hcb_wrap\" data-no-translation=\"\"><pre class=\"prism line-numbers lang-plain\"><code>ktpass \/out CAMServer\\config\\windowsAuth\\cam.keytab \/princ HTTP\/test.chat-messenger.com@CAMTEST.COM \/mapuser CAMTEST\\cam-svc \/ptype KRB5_NT_PRINCIPAL \/crypto AES256-SHA1 \/pass &quot;*******&quot;<\/code><\/pre><\/div>\n\n\n\n<p class=\"is-style-icon_info wp-block-paragraph\">- \/out: Creates a folder named windowsAuth and outputs to CAMServer\\config\\windowsAuth\\cam.keytab.<br>\/princ: HTTP\/ Set in the format @&lt;domain name in uppercase&gt;<br>- The password specified in \/pass: should be the password for the service account.<br>If you change the service account password, you will need to regenerate the keytab file.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">CAMServer Settings<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">To use Windows authentication, add the following to the CAMServer configuration file (boot.ini). Please replace each value according to your environment.<\/p>\n\n\n\n<div class=\"hcb_wrap\" data-no-translation=\"\"><pre class=\"prism line-numbers lang-plain\"><code># Kerberos \u30ec\u30eb\u30e0\uff08\u901a\u5e38\u306f Active Directory \u30c9\u30e1\u30a4\u30f3\u540d\u3092\u5927\u6587\u5b57\u3067\u6307\u5b9a\uff09\n# \u4f8b: camtest.com \u30c9\u30e1\u30a4\u30f3 \u2192 CAMTEST.COM\ncam.windowsAuth.realm=CAMTEST.COM\n\n# Windows\u8a8d\u8a3c\u3092\u884c\u3046FQDN\ncam.windowsAuth.FQDN=test.chat-messenger.com\n\n# Kerberos KDC\n# \u901a\u5e38\u306f Active Directory \u306e\u30c9\u30e1\u30a4\u30f3\u30b3\u30f3\u30c8\u30ed\u30fc\u30e9\u306eFQDN\u3002\u30dd\u30fc\u30c8TCP\/UDP 88 \u306f Kerberos \u6a19\u6e96\u30dd\u30fc\u30c8\u3067\u30ea\u30c3\u30b9\u30f3\u3055\u308c\u3066\u3044\u308b\ncam.windowsAuth.kdc=ad.camtest.com:88\n<\/code><\/pre><\/div>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"internet-options-settings\">Internet Options Settings<\/h3>\n\n\n\n<div class=\"wp-block-columns\">\n<div class=\"wp-block-column\">\n<h4 class=\"wp-block-heading\">Add the CAMServer&#039;s FQDN to the intranet zone. <\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Select Internet Options, click the &quot;Security&quot; tab, and select &quot;Local intranet.&quot; Click the &quot;Sites&quot; button, select &quot;Advanced,&quot; and add the site&#039;s URL (https:\/\/test.chat-messenger.com).<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Check for automatic logon <\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Click &quot;Custom Level&quot; and make sure that &quot;Automatic logon in Intranet zone&quot; is selected under &quot;User Authentication&quot; -&gt; &quot;Logon&quot;.<\/p>\n\n\n\n<p class=\"is-style-icon_pen wp-block-paragraph\"><span class=\"swl-fz u-fz-s\">This setting is required on all C&amp;M user client terminals, but it can be centrally managed using the Group Policy Management Console.<\/span><\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-column\">\n<figure class=\"wp-block-image size-full is-resized is-style-border\"><img decoding=\"async\" src=\"https:\/\/chat-messenger.com\/wp-content\/uploads\/2025\/01\/image-9.png\" alt=\"\" class=\"wp-image-11464\" width=\"279\" height=\"214\"\/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full is-resized is-style-border\"><img decoding=\"async\" src=\"https:\/\/chat-messenger.com\/wp-content\/uploads\/2025\/01\/image-10.png\" alt=\"\" class=\"wp-image-11465\" width=\"247\" height=\"309\"\/><\/figure>\n<\/div>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Migration from SSO using IIS Integrated Windows Authentication<\/h2>\n\n\n\n<ol class=\"wp-block-list\"><li>Uninstalling IIS functionality (Server Manager &gt; Admin &gt; Remove Roles and Features)<\/li><li>Uninstalling the ASP.NET Core Hosting Bundle<\/li><li>The service account is<a href=\"https:\/\/chat-messenger.com\/en\/manual\/camserver\/windows-authentication\/#serviceAccounts\" data-type=\"post\">This account supports Kerberos AES 256-bit encryption.<\/a>&quot;check<\/li><li><a href=\"https:\/\/chat-messenger.com\/en\/manual\/camserver\/windows-authentication\/#keytab\" data-type=\"post\">keytab <\/a>create<\/li><li>In the Internet Options settings, add the FQDN of CAMServer to the Intranet zone (if it hasn&#039;t been added yet).<\/li><li>\u00a0If the load balancer was connected to CAMServer at L7, place an SSL certificate on CAMServer and connect at L4.<\/li><\/ol>","protected":false},"excerpt":{"rendered":"<p>\u6982\u8981 Active Directory \u74b0\u5883\u3067\u306f\u3001\u7d71\u5408 Windows \u8a8d\u8a3c\uff08Kerberos\uff09 \u3092\u5229\u7528\u3059\u308b\u3053 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"swell_btn_cv_data":"","footnotes":""},"categories":[17],"tags":[],"class_list":["post-12579","post","type-post","status-publish","format-standard","hentry","category-camserver"],"_links":{"self":[{"href":"https:\/\/chat-messenger.com\/en\/wp-json\/wp\/v2\/posts\/12579","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/chat-messenger.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/chat-messenger.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/chat-messenger.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/chat-messenger.com\/en\/wp-json\/wp\/v2\/comments?post=12579"}],"version-history":[{"count":10,"href":"https:\/\/chat-messenger.com\/en\/wp-json\/wp\/v2\/posts\/12579\/revisions"}],"predecessor-version":[{"id":12676,"href":"https:\/\/chat-messenger.com\/en\/wp-json\/wp\/v2\/posts\/12579\/revisions\/12676"}],"wp:attachment":[{"href":"https:\/\/chat-messenger.com\/en\/wp-json\/wp\/v2\/media?parent=12579"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/chat-messenger.com\/en\/wp-json\/wp\/v2\/categories?post=12579"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/chat-messenger.com\/en\/wp-json\/wp\/v2\/tags?post=12579"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}