Zero-click sign-in.
For every domain-joined desktop.
On a domain-joined workstation, the user already authenticated when they unlocked the machine. Kerberos sign-in turns that into silent web SSO: the browser presents a ticket, Monosign validates it, and the sign-in form never appears. Configured per AD source, scoped by client network, with silent fallback everywhere else.
- SPNEGO / Negotiate
- Multiple AD forests
- Keytab or SPN + password
From SPN to silent sign-in.
Four steps on the AD source. Failure is always silent: the form stays.
- 01
Register the SPN and create the credential
Map an HTTP/<sso-host> service principal name to a dedicated AD service account and export a keytab with ktpass, or skip the keytab and use SPN + service account name + password mode. When both are configured, the keytab wins.
Tip — The realm goes in uppercase, and the keytab is stored encrypted in the secret store; it never leaves the API tier. - 02
Enable Kerberos on the AD source in Monosign
On the Active Directory user source, switch Kerberos on and enter the realm plus the keytab (or the SPN/account/password trio). Each source carries its own configuration, so several forests can run Kerberos side by side: tickets resolve to the right source by realm, and users are looked up in that source only.
- 03
Scope the silent attempt by client network
List the IP ranges (exact IPs or CIDR) where domain-joined machines actually live. Clients outside these networks are never offered the Negotiate challenge, which is exactly what prevents the raw browser credential popup on home laptops and phones.
Tip — Empty means all clients; unresolvable addresses fail closed. Scope per source, so each forest can declare its own networks. - 04
Configure browsers and test the fallback
Add the SSO host to the browsers’ trusted-for-SPNEGO list via group policy (Chrome, Edge, and Firefox each have a policy for it), then test three cases: a domain machine signs in with zero clicks, an off-network machine sees the normal form with no popup, and a domain machine with no matching user silently falls back to the form.
Tip — Kerberos is an optimization, never a gate: every failure path must end at the standard sign-in form, invisibly.
The complete walkthrough — with every screenshot, every flag, and version-specific notes — lives in our help center.
Ready to start managing
identities the right way?
Spin up a fully-loaded trial tenant in under five minutes. No credit card. No sales gate.