Kerberos authentication using SPNego

[#1]

Hi all,

I am trying to make integrated authentication using SPNego in the following landscape.

SAP Portal EP 7.0 SP9 on Solaris 10 on Sparc

Microsoft ADS LDAP on windows domain.

The Ldap (Microsoft ADS) connection is working fine and i am able to get all the

users in the portal.I am able to enter in the portal through portal login screen using

the windows (internal network login) login credentials.

I am facing the following challenges..

1. In the UME LDAP DATA in Config tool, if i press "Test Authentication" button

and enter the user credentials it is showing the following error

authentication failed : [LDAP: error code 49 - 80090308: LdapErr: DSID-
0C09030B, comment:AcceptSecurityContext error, data 525, v893

2. The keytab file generated is not recognised by the klist, when i tried with the

following command

klist -e -f -k -K keytab

3. The integrated authentication is not working. The Portal URL is showing the

login screen. <b>Can the configuration be made using spnego if the Portal server and

the LDAP server are in different domains??</b>

Any suggestions welcome......

Regards

Geogi Luke

[Former Member · Accepted solution]

> 1. In the UME LDAP DATA in Config tool, if i press "Test Authentication" button

> and enter the user credentials it is showing the following error

Are you using LDAPS? The "Test Authentication" function doesn't speak SSL: temporarily uncheck the box for SSL and change to port 389, to ensure that the LDAP connection is OK.

> 2. The keytab file generated is not recognised by the

> klist, when i tried with the following command

I got that intermittently sometimes too. Never found out why, but it's easy enough to regenerate the keytab file and replace the one made by the wizard (that wizard's magic is black, but not very strong):

[code]$JAVA_HOME/bin/ktab -A host/<host_fqdn>@<REALM_NAME> -k keytab_file>[/code]

e.g.,

[code]ktab -A [email protected] -k keytab[/code]

Then klist should work.

3) should be OK since the Kerberos check isn't cookie-based (cookie transfer to multiple servers is much easier if they're on the same domain).

[Former Member · Accepted solution]

Hi Morgan

Thanks for the answers.

I am using only one MS- ADS as ldap and is not in the SSL mode.

Can you provide some more info about the regenaration of the keytab file. Whether this has to be done on the Portal server. I am not able to find the <b>ktab</b> executable in the server.

Thanks and Regards

Geogi Luke

[Former Member · Accepted solution]

ktab should be in \j2sdk\bin\ - same place as klist

I regenerated the keytab on the server, but that shouldn't be required since it only needs the j2sdk.

[Former Member · Accepted solution]

Hi Morgan

I am using the Solaris 10 OS. The j2sdk-1_4_2_11 i am using is not having the ketab exe.

I am using the klist shipped with the Solaris OS. I am not able to find the ktab on the server.

I am getting the following when i am using the klist comment.

End of credential cache reached

Regards

Geogi

[Former Member · Accepted solution]

How about download the j2sdk for Windows to a workstation and generating it there instead?

Solaris /j2sdk/bin/keytool has options for -keygen, and -list. I don't know if that's the same.

[Former Member · Accepted solution]

Hi Geogi,

Have you deployed and configured the login modules for SPNEGO and changed the authentication template to SPNEGO.

The security library update also needs to be installed for the j2ee engine

Regards

Prakash

[Former Member · Accepted solution]

Hi Praksah

I have done the deployment and configuration of the login module. The selection to SPNEGO is also made.

I am not aware of the security library update...could you please explain more on this.

Thanks & Regards

Geogi Luke

[Former Member · Accepted solution]

Hi Geogi,

I have implemented the same scenario for one of my clients and we also had a problem with single sign on even though all the settings were correct. SAP told us to put an update on the j2ee engine security library.

There is a problem with the 6.40 J2EE engine and the IE browser due to which the kerberos ticket is not interpreted correctly by the login module. So after updating the library the signle-sign on worked. I am not sure if this is the case for your problem but you can give it a try. The details are in the note 1007227.

Regards

Prakash

[Former Member · Accepted solution]

Hi Prakash

I tried after deploying the "SAPJEECOR09P_14-10003466.SCA" file. But the login page is coming when the user opens the portal URL.

Whether any specific configuration has to be done if the Portal server is in another domain. In my case all the users, MS ADS and the Windows Domain controller is in same domain. But Portal server is in Solaris OS and is in another domain.

The following is the config file generated by the wizard

[domain_realm] 
[libdefaults]  
  default_keytab_name = /usr/sap/PRD/SYS/global/kerberos/keytab 
  default_realm = ABC.LOCAL 
  dns_lookup_kdc = true 
  default_tgs_enctypes=des-cbc-crc;des-cbc-md5  
  default_tkt_enctypes=des-cbc-crc;des-cbc-md5  
[logging]
[realms]
  ABC.LOCAL = { 
    kdc = <adsserverip>:<port>
  }

Domain of Portal Server :

abc.org

Domain Realm :

ABC.LOCAL

I have set spn as

setspn –A HTTP/<portalserver>.abc.org  <serviceuser>

Regards

Geogi Luke

[Former Member · Accepted solution]

Hi

I think the missing part is from the network setup in the intranet. The Solaris machine on which the Portal j2ee engine is running is not part of the windows domain and the ldap and the users are is in the windows domain.

Any patricular steps to be done on the network side for this to work.

Regards

Geogi Luke

[Former Member · Accepted solution]

Hi Geogi,

Thats not necessary. As long as from the solaris machine the ADS server can be pinged and vice versa it should be ok. One thing you might check is in the ADS the logical host name of the portal server should be entered in the host file of the ADS server and vice-versa.That might help.

Regards

Prakash

[Former Member · Accepted solution]

Hi Prakash

I am getting the following error while running the diagtool.

Error creating GSS context.

[EXCEPTION]

GSSException: No valid credentials provided (Mechanism level: Attempt to obtain new ACCEPT credentials failed!)

Caused by: javax.security.auth.login.LoginException: Pre-authentication information was invalid (24)

Caused by: KrbException: Pre-authentication information was invalid (24)

Caused by: KrbException: Identifier doesn't match expected value (906)

Regards

Geogi Luke

[Former Member · Accepted solution]

Hi Geogi,

It seems the credentials are not going through. I think it would be better to raise an OSS message with SAP.

Regards

Prakash

[Former Member · Accepted solution]

Hi,

Try this. Re-enter the same password of the service user. Then restart the J2EE engine. It should help you in resolving this issue.

Cheers!!

[Former Member · Accepted solution]

Hi Prakash

The problem was with the name of the service user. The service user name is created with a space between the name.

I tried with a new service user without any space.

I havent seen anywhere it is mentioned in the document.

Thanks for the help to all.

Regards

Geogi Luke

[Former Member · Accepted solution]

Hi Geogi,

Congratulations. Glad to know your problem is solved.