Change a password over Kerberos through the Network Connector

Change a Windows credential password over Kerberos when Segura® Platform reaches the Active Directory domain only through the Network Connector. This procedure configures the password-change template, the device, and the credential, then runs and verifies the change.

Requirements

• Segura® Platform 4.2.0 or later.
• The kerberos-connect container is deployed on the Network Connector. See Deploy the kerberos-connect container on the Network Connector.
• Administrative permission to create templates and to edit devices and credentials.
• The target Windows device is reachable from the Network Connector agent over WinRM: port 5985 for HTTP, or 5986 for HTTPS.

Steps

Step 1: Create the password-change template

1. On Segura® Platform, open the Grid Menu and select Executions.
2. Go to Settings > Template.
3. Click View actions, represented by the three vertical dots, and select + New.
4. In the Execution template window, complete the following fields:
   • Name: a name that identifies the template.
   • Enabled: select Yes.
   • Executor: select Ansible.
   • Execution type: select Change password.
   • Playbook: select SNC Windows Kerberos change password.
5. Click Save.

Step 2: Configure the device

1. Open the Grid Menu and select Devices.
2. Select the target device, or create a new one. See How to configure devices on Network Connector.
3. On the Information tab:
   • Device name and IP, Hostname or management URL: enter the device FQDN, for example WS2019-KERBEROS.winrm.example.com.
   • Domain: enter the Active Directory domain in uppercase, for example WINRM.EXAMPLE.COM.
   Attention

   Kerberos requires the device addressed by FQDN and the domain in uppercase, matching the case that the Active Directory domain accepts.

4. On the Connectivity tab:
   • In the Network Connector field, select the agent that reaches the device.
   • Add a Windows RM connectivity entry with the WinRM port: 5985 for HTTP, or 5986 for HTTPS.
5. Click Save.

Step 3: Configure the credential

1. Open the Grid Menu and select PAM Core.
2. Go to Credentials > All, then select the credential or create a new one. See How to set up a credential in Segura®.
3. On the Information tab:
   • Username: the domain account.
   • Password type: select Domain user.
   • Device: select the device from Step 2.
   • Domain: enter the realm in uppercase, matching the device domain.
4. On the Additional settings tab, add an extra field:
   • Name: USE_KERBEROS
   • Value: true
5. On the Execution settings tab, under Credential password change settings:
   • Select Enable automatic change.
   • Change plugin: select Ansible.
   • Change template: select the template from Step 1.
6. Click Save.

Step 4: Request and verify the password change

1. In PAM Core, go to Credentials > Password change requests.
2. Click Request password change, then confirm the request.
3. In Executions, go to All operations. Click Filter to refresh the list until the status changes from Executing to Successfully completed.
   Info

   Open the operation details to review the Ansible execution logs for the run.

4. In PAM Core, go to Credentials > All credentials, then click the key icon to confirm the password was updated.

Related topics

• Deploy the kerberos-connect container on the Network Connector: the prerequisite setup.
• For the direct WinRM path without the Network Connector, see How to change a password with Kerberos authentication for Windows RM.

Do you still have questions? Reach out to the Segura® Community.