Configuring Integration Server to Use Kerberos

In this field...	Specify...
Realm	The domain name of the Kerberos server, in all uppercase letters. All the computers managed by the KDC and secondary KDCs, if any, constitute the realm. Example: KERBEROS.RNDLAB.LOC This field is optional. Note: A value specified for Realm overwrites the realm set in the KDC configuration file specified in Kerberos Configuration File.
Key Distribution Center Host	The host name of the machine on which the KDC resides. Example: lab.kerberos.rndlab.loc This field is optional. Note: A value specified for Key Distribution Center Host overwrites the default key distribution center set in the KDC configuration file specified in Kerberos Configuration File.
Kerberos Configuration File	The location of the Kerberos configuration file that contains the Kerberos configuration information, including the locations of KDCs, defaults for the realm and for Kerberos applications, and the host names and Kerberos realms mappings.
Use Subject Credentials Only	Specifies whether Integration Server requires a Kerberos V5 Generic Security Services (GSS) mechanism to obtain the necessary credentials from an existing subject set up by the JAAS authentication module. Here, “subject” represents the user or service being authenticated in the JAAS login context. When the Use Subject Credentials Only check box is selected, Integration Server requires a GSS mechanism to obtain the credentials from an existing Subject. Integration Server uses the Ticket Granting Ticket (TGT) stored in the subject to establish a GSS security context. The service ticket is also stored in the subject. When the Use Subject Credentials Only check box is selected, the JVM in which Integration Server runs can use only the credentials found in the Subject in the JAAS authentication module. The JVM cannot use another underlying mechanism to obtain the credentials. When the Use Subject Credentials Only check box is cleared, Integration Server does not require a GSS mechanism to obtain credentials from an existing Subject. Instead, the JVM in which Integration Server runs can use another underlying mechanism of its choice, such as a reading from a protected file on disk, to obtain credentials for the Subject. The JVM first checks the Subject in the JAAS authentication module. If the JVM does not find the credentials in the JAAS Subject, then the JVM uses an alternate credential mechanism to obtain credentials. The Use Subject Credentials Only check box must be selected if you want to use Kerberos authentication for service requests.