I've tried to figure it out myself, but to no avail. Google offers many tutorials but I couldn't find any for the below case.
We have an external cooperating employee with VPN access to our LAN and he needs to access some of our web applications. His workstation operates under Windows 7 Professional. The web applications can only accept Kerberos-based SSO authentication - password auth is disabled due to security policy and it cannot be changed. Kerberos AS/KDC are provided by Windows Server 2008 R2-level domain, of which his workstation is not a member.
How can we configure Kerberos authentication from his workstation without adding it to the domain? Until now I only used to configure UNIX-based systems with Kerberos. Under Windows I can think of two different solutions:
Install external Kerberos libraries (ie. MIT Kerberos for Windows) - I assume configuration process is similar to UNIX-based (ie. editing krb5.conf, set default realm and enable DNS-based KDC locating).
Configure Windows built-in Kerberos client without adding the workstation to the domain - I'm not sure it is even possible.
We need to make SSO working in Mozilla Firefox. Provided that we use the first solution I assume we should set
network.negotiate-auth.gsslib to external Kerberos DLL path. Can this setup work as expected? From the above options the latter is strongly preferred, as we'd like to avoid external dependencies and possible incompatibilities.