backoffice

Hi,

thanks a lot - i think this will be the solution. The knowledge base confused me—I thought "ad.example.com" = "dc1.example.com", but in my case, I just need to use "example.com".

Hi,

In my opinion, DNS-based "load balancing" only makes sense if Devolutions Gateway verifies whether the returned KDC is actually reachable and responding.

If a DNS record returns multiple IP addresses, the Gateway may select one of them. But what happens if the selected IP address is unreachable? Does Devolutions Gateway automatically retry the connection using another IP address?

Currently, it is only possible to configure a single KDC Server URL per Kerberos realm.

When attempting to add a second KDC Server URL for an existing realm, the configuration prevents this with the message:

"A KDC server already exists for this Kerberos realm."

This means that Devolutions Gateway relies on a single Active Directory Domain Controller for Kerberos authentication, introducing a single point of failure (SPOF). Since Active Directory is designed to operate with multiple Domain Controllers for redundancy, the KDC Proxy should ideally support the same high-availability principles.

If the configured Domain Controller becomes unavailable due to maintenance, network issues, or an unexpected outage, Kerberos authentication through the KDC Proxy may fail, even when other Domain Controllers within the same domain remain fully operational.

Please allow multiple KDC Server URLs to be configured for the same Kerberos realm, providing redundancy and automatic failover.