Configuring user authentication in PEM

PEM user authentication is delegated to the Postgres backend server. To be able to login to PEM with a given username, there must exist a Postgres user of that name in the backend. Users must have the pem_user role and be permitted by pg_hba.conf to connect to the pem database from the web application host. For more on PEM user roles see Managing PEM authentication .

By default, PEM requires users to authenticate using a password. You can optionally enforce 2FA, or enable passwordless authentication using Kerberos.

• 1. Two-factor authentication (2FA)

• Kerberos authentication on Linux

• Kerberos authentication on Windows

• Configuring the PEM server to use two-factor authentication
  • Mail server configuration
• Configuring the PEM server to use Kerberos authentication
  • 1. Install Kerberos, the PEM server, and the PEM backend database
  • 2. Add principals on Kerberos server
  • 3. Extract key tables from Kerberos server
  • 4. Configure the PEM backend database server
  • 5. Obtain and view the initial ticket
  • 6. Configure the PEM server
  • 7. Browser settings
• Configuring the PEM server to use Windows Active Directory domain services for Kerberos authentication (SSPI)
  • 1. Install Active Directory, the PEM server, and the PEM backend database server
  • 2. Create users in Active Directory to map with service principals
  • 3. Extract key tables from Active Directory
  • 4. Configure the PEM backend database server
  • 5. Obtain and view the initial ticket
  • 6. Configure the PEM server