---
schema_version: "1"
id: fb339659209f60e56f7ff32fc27f8824a52be3ae3ffe416c396ae14ea45f03a8
title: Kerberos Module 1.0 Reference
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/kerberos-module/latest/kerberos-module-reference.md
canonical_url: https://docs.mulesoft.com/kerberos-module/latest/kerberos-module-reference
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 8a048f03ef963427057a961a8a0f630ce76e2d1ea12d38789910fbaf255b94d8
description: MuleSoft Documentation Site
release: "1.0"
latest: true
---
---
product: Kerberos Module
version: 1.0
is-latest-version: true
---

# Kerberos Module 1.0 Reference

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Kerberos Module adds Kerberos (SPNEGO) proxy authentication support for the Mule HTTP Connector.

## Configuration

### Kerberos Proxy Authentication

Use `<kerberos:proxy-authentication>` to configure Kerberos proxy authentication for the Mule HTTP
Connector.

To use this module, set these system properties when starting Mule:

- HTTP Service Implementation: For Mule 4.10.x, this module requires the Netty HTTP service.

Add this JVM property:

```text
-Dmule.http.service.implementation=NETTY
```

- Kerberos Configuration File: Provide the path to your organization’s krb5.conf file. You can reuse
  an existing path if other modules already use it.

Add this JVM property:

```text
-Djava.security.krb5.conf=/path/to/your/krb5.conf
```

#### Parameters

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Name</th><th>Type</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><p><strong>Host</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Proxy host.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Port</strong></p></td><td><div><div><p>Number</p></div></div></td><td><div><div><p>Proxy port.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Principal</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Kerberos principal, for example, <code>user@EXAMPLE.COM</code>.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Realm</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Kerberos realm, for example, <code>EXAMPLE.COM</code>.</p></div></div></td><td><div></div></td><td><div><div><p>x</p></div></div></td></tr><tr><td><p><strong>Use Ticket Cache</strong></p></td><td><div><div><p>Boolean</p></div></div></td><td><div><div><p>If <code>true</code>, uses the local Kerberos ticket cache. If <code>false</code> (default), requires <code>keytabPath</code>.</p></div></div></td><td><div><div><p>false</p></div></div></td><td><div></div></td></tr><tr><td><p><strong>Keytab Path</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Path to a keytab file.</p></div></div></td><td><div></div></td><td><div><div><p>Required when <code>useTicketCache</code> is <code>false</code> (default).</p></div></div></td></tr><tr><td><p><strong>Ticket Cache Path</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Path to Kerberos credential cache file. Only used when <code>useTicketCache</code> is <code>true</code>. Defaults to system ticket cache location.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Non Proxy Hosts</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Hosts to reach directly, bypassing the proxy.</p></div></div></td><td><div></div></td><td><div></div></td></tr><tr><td><p><strong>Service Type</strong></p></td><td><div><div><p>String</p></div></div></td><td><div><div><p>Kerberos service type for building the SPN.</p></div></div></td><td><div><div><p>HTTP</p></div></div></td><td><div></div></td></tr></tbody></table>

#### XML Example

Use `<kerberos:proxy-authentication>` to configure Kerberos proxy authentication in an HTTP
Connector request configuration. This example shows how to set parameters such as `host`, `port`,
`principal`, `realm`, `useTicketCache`, and `serviceType`.

```xml
<mule xmlns:kerberos="http://www.mulesoft.org/schema/mule/kerberos"
      xmlns:http="http://www.mulesoft.org/schema/mule/http"
      xmlns="http://www.mulesoft.org/schema/mule/core"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://www.mulesoft.org/schema/mule/core http://www.mulesoft.org/schema/mule/core/current/mule.xsd
                          http://www.mulesoft.org/schema/mule/http http://www.mulesoft.org/schema/mule/http/current/mule-http.xsd
                          http://www.mulesoft.org/schema/mule/kerberos http://www.mulesoft.org/schema/mule/kerberos/current/mule-kerberos.xsd">

  <http:request-config name="httpCfg">
    <http:proxy-config>
      <kerberos:proxy-authentication
          host="proxy.example.com"
          port="8080"
          principal="user@EXAMPLE.COM"
          realm="EXAMPLE.COM"
          keytabPath="/path/to/file.keytab"
          serviceType="HTTP"/>
    </http:proxy-config>
  </http:request-config>

</mule>
```

## See Also

- [Salesforce Help](https://help.salesforce.com)