Skip to content

End-user authentication and impersonation in Resilio 6.0

When a user signs into the Resilio Agent, Resilio validates the user's SSO identity and then impersonates that user on the Windows domain using Kerberos Constrained Delegation (KCD) with a Kerberos ticket for that specific user. That ticket is what authenticates the SMB connection to the Edge Appliance or a third-party storage server.

Authentication and impersonation flow

  1. User signs in on the Resilio Agent
    The user launches the Resilio Agent on their local machine and is prompted for sign-in.
  2. Agent redirects to the IdP
    The Agent routes the user to the organization's identity provider like Microsoft Entra ID or Okta, via browser, for an OIDC-based SSO sign-in.
  3. IdP authenticates the user and returns claims After the user completes SSO (including MFA, conditional access, etc.), the IdP (Entra/Okta) issues an authorization response to Resilio that includes identity claims about the user: critically, the user's UPN (User Principal Name), e.g. johndoe@nasuni.com.
  4. Management Console validates the SSO authorization
    The Management Console verifies that the OIDC authorization is valid and correctly signed/issued by the configured IdP (Entra/Okta).
  5. Primary Storage Agent requests Kerberos ticket for user impersonation
    Using the validated UPN, the Primary Storage Agent, which is configured for KCD against the Windows domain, requests a Kerberos service ticket on behalf of that specific user (not a shared service account).
  6. Kerberos ticket is presented to the Edge Appliance over SMB
    The Primary Storage Agent uses that user-specific Kerberos ticket to open the SMB session to the Nasuni Edge Appliance, identical to what would happen if the user had authenticated from a domain-joined Windows machine and mapped the share directly.
  7. All reads/writes flow through that SMB session authenticated via that ticket
    Every file/folder listing, read, and write for that session is performed under the identity of that Kerberos ticket, so existing NTFS permissions and AD group membership apply exactly as they would for a native domain login.

Example

  • User signs into the Resilio Agent and provides their Entra ID credentials.
  • Entra ID authenticates the user and returns an authorization containing upn = johndoe@nasuni.com.
  • Resilio Management Console validates the authorization, then the Primary Storage Agent uses KCD to mint a Kerberos ticket for johndoe@nasuni.com.
  • That ticket is handed to the Nasuni Edge Appliance over SMB.
  • The Edge Appliance lists files/folders and enforces reads/writes exactly as it would for a domain-joined session for that user.

Benefits of impersonation via KCD

  • No re-permissioning required
    Because the Edge Appliance sees standard Kerberos/SMB authentication, you don't need to rebuild NTFS permissions or ACLs to support SSO users. Permissions stay tied to the same AD identities you already manage.
  • Per-user delegation, not a shared service account
    KCD generates a ticket scoped to the individual user's UPN for each session; the Resilio Primary Storage Agent is not impersonating a generic "app" identity broadly across the domain. Constrained delegation limits exactly which back-end service (the target SMB/Edge Appliance service) the Primary Storage Agent is allowed to request tickets for, which is a meaningfully more restrictive and auditable model than legacy unconstrained delegation.
  • Enables modern IdP-driven access (MFA, Conditional Access, device compliance) for a workload that's still fundamentally Kerberos/SMB-based Enforce your SSO/MFA policies at sign-in, without needing to modify how the Edge Appliance authenticates.
  • Audit trail continuity
    Because the Edge Appliance-side access still resolves to individual AD identities via Kerberos, existing file access auditing tied to AD accounts continues to work.

FAQ

  • "Does this mean Resilio can impersonate any user on our domain?"
    No, that's precisely what constrained delegation prevents. The Resilio Primary Storage Agent account is explicitly configured (by the customer's domain admin) with permission to delegate only to the specific target service (the Edge Appliance's SMB service), not arbitrary services across the domain.

  • "Do we need to change our file permissions to use Resilio?" No. Since the Edge Appliance ultimately authenticates the same Kerberos-based Windows identity it always has, existing NTFS/AD-based permissions apply without modification.

  • "What if the IdP doesn't return a UPN by default?"
    For Entra ID specifically, UPN is commonly enabled as an optional ID token claim on the app registration; this is a standard, documented configuration step during setup.