\(Workaround\) Support Kerberos authentication

---
title: \(Workaround\) Support Kerberos authentication
description: A workaround is available for the SAML 2.0 integration that changes the authentication context from forms-based authentication to Windows-based authentication.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/platform-security/authentication/t\_SupportKerberosAuthentication.html
release: brazil
product: Authentication
classification: authentication
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 1
breadcrumb: [ADFS integration with SAML 2.0, Integrating SAML 2.0 with other features, SAML, Multi-Provider single sign-on \(SSO\), Authentication, Access Management]
---

# \(Workaround\) Support Kerberos authentication

A workaround is available for the SAML 2.0 integration that changes the authentication context from forms-based authentication to Windows-based authentication.

## Before you begin

Role required: sso\_config\_admin, business\_rule\_admin, script\_include\_admin

## About this task

Currently, the SAML 2 integration uses a PasswordProtectedTransport or "forms-based authentication" authentication context. This authentication context requires the IdP to present users with a form for authentication credentials. With Kerberos, a SAML session is already active through an established Windows login, so the user does not need to authenticate with the IdP.

## Procedure

1.  Navigate to **All** > **Multi-Provider SSO** > **Identity Providers**.

2.  Open the **SAML2 Update1** IdP record.

3.  Set the **The AuthnContextClassRef method that we will be included in our SAML 2.0 AuthnRequest to the Identity Provider** to one of the following:

<table id="table_kqd_rzg_cs"><tbody><tr><td>

`urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport` \(Default\)

</td></tr><tr><td>

`urn:federation:authentication:windows`

</td></tr></tbody>
</table>4.  Click **Update**.