Kerberos is the network authentication protocol used by Microsoft Windows Active Directory. When Single Sign-On (SSO) is configured for Cisco Unified Communications applications using an Identity Provider (IdP) like Microsoft ADFS, the IdP can be set to use Integrated Windows Authentication (IWA). IWA leverages the Kerberos ticket that a user receives upon logging into their Windows domain. When the user accesses a Cisco application, the browser automatically uses this Kerberos ticket to authenticate with the IdP, which then grants access to the application without prompting the user for credentials. This provides a seamless login experience based on the initial Windows login.

A. Smart Card: A smart card is a physical token used for authentication, often as part of multi-factor authentication. It is a method of logging in, not the protocol that enables seamless SSO from a Windows session.
B. OAuth: OAuth is an authorization framework that grants applications limited access to user accounts. It is not the primary authentication protocol that enables seamless Windows Integrated Authentication.
C. form-based: Form-based authentication explicitly requires users to manually enter their credentials into a login form, which is the opposite of the seamless experience described in the question.

1. Cisco Collaboration System 12.x Solution Reference Network Designs (SRND)

Chapter 11: Security

Single Sign-On (SSO): "When Integrated Windows Authentication (IWA) is used

the user does not have to enter credentials at all. The user logs into Windows and is then automatically logged into the Cisco applications." This document implicitly refers to Kerberos as the mechanism behind IWA in a Windows domain environment.

2. SAML SSO Deployment Guide for Cisco Unified Communications Applications

Release 12.5(1)

Chapter: Troubleshoot

IdP is Not Using Kerberos Authentication: This section explicitly discusses troubleshooting scenarios where Kerberos fails

preventing seamless login. It states

"For seamless SSO login

the Identity Provider (IdP) must be configured to use Kerberos authentication." This directly links Kerberos to the seamless SSO functionality described in the question.

3. Microsoft Documentation

Kerberos authentication overview: "Kerberos is an authentication protocol that is used to verify the identity of a user or host... In a Windows domain

Kerberos is the default authentication protocol." This official vendor documentation establishes Kerberos as the core protocol for Windows authentication.