Support Multiple KDC Servers per Kerberos Realm in Devolutions Gateway
Support Multiple KDC Servers per Kerberos Realm in Devolutions Gateway
1 vote
Currently, it is only possible to configure a single KDC Server URL per Kerberos realm.
When attempting to add a second KDC Server URL for an existing realm, the configuration prevents this with the message:
"A KDC server already exists for this Kerberos realm."
This means that Devolutions Gateway relies on a single Active Directory Domain Controller for Kerberos authentication, introducing a single point of failure (SPOF). Since Active Directory is designed to operate with multiple Domain Controllers for redundancy, the KDC Proxy should ideally support the same high-availability principles.
If the configured Domain Controller becomes unavailable due to maintenance, network issues, or an unexpected outage, Kerberos authentication through the KDC Proxy may fail, even when other Domain Controllers within the same domain remain fully operational.
Please allow multiple KDC Server URLs to be configured for the same Kerberos realm, providing redundancy and automatic failover.
Recommended Answer
Hi,
The AD domain name should normally resolve to all the DCs in the domain by default, like this:
ad.example.com. A 10.0.0.10 ← DC1
ad.example.com. A 10.0.0.11 ← DC2
ad.example.com. A 10.0.0.12 ← DC3
We recommend that customers use the DNS domain name like ad.example.com instead of hardcoding individual DCs. As for automatic fallback, I just checked, and we resolve the list of addresses, and pick the first one that responds to the TCP connection. We haven't had issues with customers about the fallback behavior, but we do know that many customer use multiple DCs, so I can only assume the current fallback logic has been sufficient.
Rather than hardcode a list of DCs to pick from, I would rather keep the current configuration where you put in a single DNS hostname that can resolve to 1 or multiple DCs, and work on hardening or improving the robustness and performance of the fallback logic if the outbound connection to the KDC fails.
Marc-André Moreau
All Comments (4)
Hi,
You can use DNS load balancing in front of the multiple domain controllers, and use that DNS name with the KDC proxy configuration. As far as I know, this is how it works with other applications in Active Directory too, not just with Devolutions Gateway.
Best regards,
Marc-André Moreau
Hi,
In my opinion, DNS-based "load balancing" only makes sense if Devolutions Gateway verifies whether the returned KDC is actually reachable and responding.
If a DNS record returns multiple IP addresses, the Gateway may select one of them. But what happens if the selected IP address is unreachable? Does Devolutions Gateway automatically retry the connection using another IP address?
Hi,
The AD domain name should normally resolve to all the DCs in the domain by default, like this:
ad.example.com. A 10.0.0.10 ← DC1
ad.example.com. A 10.0.0.11 ← DC2
ad.example.com. A 10.0.0.12 ← DC3
We recommend that customers use the DNS domain name like ad.example.com instead of hardcoding individual DCs. As for automatic fallback, I just checked, and we resolve the list of addresses, and pick the first one that responds to the TCP connection. We haven't had issues with customers about the fallback behavior, but we do know that many customer use multiple DCs, so I can only assume the current fallback logic has been sufficient.
Rather than hardcode a list of DCs to pick from, I would rather keep the current configuration where you put in a single DNS hostname that can resolve to 1 or multiple DCs, and work on hardening or improving the robustness and performance of the fallback logic if the outbound connection to the KDC fails.
Marc-André Moreau
Hi,
thanks a lot - i think this will be the solution. The knowledge base confused me—I thought "ad.example.com" = "dc1.example.com", but in my case, I just need to use "example.com".