An Authorization Profile defines the type and properties required for authentication using a specific mechanism. Creating a profile allows the users to save the properties as a group.
SearchAssist currently supports the Kerberos Spnego Authentication mechanism for integration with custom LLM.
Kerberos SPNEGO Authentication
Kerberos authentication is based on a ticket-granting system, primarily used in secure environments such as enterprise networks.
Workflow
- Obtain Ticket Granting Ticket (TGT): The client authenticates with a Key Distribution Center (KDC) using its credentials. If successful, the client receives a Ticket Granting Ticket (TGT).
- Request Service Ticket: Using the TGT, the client requests a Service Ticket from the KDC to access a specific API or service on the server. The KDC returns a service ticket that can be presented to the server.
- Accessing the Server API: The client sends the Service Ticket in the Authorization header using the SPNEGO protocol.
- The server verifies the service ticket with the KDC to confirm the identity and permissions of the client, then grants access to the API if valid.
To create an Auth Profile for this type of authorization, provide the following fields:
Name: Unique name for the profile.
Service Principle URL: This is the URL of the KDC responsible for generating the tickets.
Auth Check URL: This is the URL of the service that is used to communicate with the custom LLM.
Authorization Field(s): Provide one or more authorization fields to be added to the header, request, or as path parameters in the request, depending upon the specific requirements of the service. It is mandatory to add the following authorization field for Kerberos authentication.
This allows the ticket generated to be passed as auth header along with the other fields in the service URL.
Authentication Types: Select one of the following types to set the authentication behaviour.
- Mutual – The Mutual authentication ensures that both the client and the server authenticate each other during the Kerberos SPNEGO authentication process.
- Delegate – In this case, the client can pass its Kerberos credentials to the service. The service can then use these credentials to authenticate to other services on behalf of the client.