Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

IBM WAS - Accepting Kerberos tokens from two different AD KDCs

Posted on 2010-08-30
6
Medium Priority
?
1,064 Views
Last Modified: 2013-12-11
How does one configure an IBM WAS cell (RHLinux) to accept Kerberos tokens from two different KDCs.  The KDCs are both Win2008R2 ADs, and they have a transitive forest trust between them.  Is it possible to put SPNs into both ADs so we can accept tickets from either?  If so, do we just "merge" the keytabs from the two ADs into one?
0
Comment
Question by:midlman
  • 3
  • 3
6 Comments
 
LVL 8

Expert Comment

by:AdminRAM
ID: 33563327
I am assuming Example scenario topology
---------------------------
                                                                       
WAS machine -- WAS.domain1.com
                                         
websphere security using AD -- AD1.domain1.com

same AD using one of KDC server keytab created -- AD1.domain1.com

KDC server2 Ketab created -- KDC.domain1.com  
                       
url hiting  -- ‘webserver.domain1.com’ is a DNS entry that routes to the Web Server

My sugestion
-------------

1) First they need to trust these domains AD1.domain1.com and KDC.domain4.com

The following scenarios are supported for trust relation between domains.                                  
Support information for SPNEGO Web authentication with a browser client  
The following scenarios are supported:                                  
Cross-forest trusts                                                      
Domain trust within the same forest                                      
Kerberos realm trust                                                    
                                                                         
The following scenarios are not supported:                              
Forest external trusts                                                  
Domain external trusts        

2) They need to configure Websphere security to use federated repository so that customer use option referral --> follow

Select the type of referral.  A referral is an entity that is used to redirect a client request to another LDAP server. A referral contains the names and locations of other objects. It is sent by the server to indicate that the information that the client requested can be found at another location, possibly at another server or several servers. The default value is ignore.

follow
    Referrals are followed automatically.

3) I believe you need to merge these two keytab created from KDC servers keytab  -- AD1.domain1.com and  server2 Ketab  -- KDC.domain1.com
0
 

Author Comment

by:midlman
ID: 33566857
Not sure about this.  I understand KDC referrals, but in this case, I don't need a referral.  I have users authenticated in two different ADs.  (By the way, these ADs are NOT used for authorization, so don't need to be federated for access by WAS.  They are never directly accessed, only produce tickets that are consumed by WAS.)  Upon authentication, the separate ADs will produce tickets for server access themselves, since both must have an SPN for the service registered in them.
0
 
LVL 8

Expert Comment

by:AdminRAM
ID: 33577251
What version of websphere ?

Additional check the following comment from the following link

http://www.ibm.com/developerworks/websphere/library/techarticles/0809_lansche/0809_lansche.html

  *  You do not need to configure the WebSphere registry to be Microsoft Active Directory via the Lightweight Directory Access Protocol (LDAP). In general, the user ID obtained from the service ticket is known as the Kerberos UserPrincipalName. Specifically Microsoft calls it the ClientPrincipalName. This user ID must map to a meaningful name in the WebSphere security registry. The simplest mapping is where the WebSphere registry is the LDAP provided by Active Directory. We have considerable experience deploying the SPNEGO TAI with trivial and non-trivial mappings, including where the WebSphere registry was a:
          o WebSphere Federated repository composed of one or more underlying LDAP registries
          o Single Active Directory domain LDAP
          o Set of Active Directory LDAP servers configured as an Active Directory Forest
          o IBM Tivoli Directory Server LDAP
          o Domino LDAP
          o z/OS® RACF registry
          o Custom User Registry (various types)

These mapping solutions require the creation of customer-specific custom code, typically in the form of a LoginModule to morph the Java Subject built by the TAI that contains the Windows identity, into a new Java Subject containing the mapped-to user ID valid in the WebSphere registry. The mechanics of these LoginModules are beyond the scope of this article and require an expert to create.
0
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

 

Author Comment

by:midlman
ID: 33577912
WAS 6.1
The registry is not an issue in this question.  We know how to handle that.
The issue is being able to configure WAS to accept tickets from two different ticket servers for the same service.  
Does the app need to be addressable via two different URLs, that match to the two kerberos realms?
Do we just register SPNs in both KDCs and merge the resulting keytabs?
How does this affect the .conf file?
Has anyone actually done this and seen it work?
0
 
LVL 8

Expert Comment

by:AdminRAM
ID: 33619776
Do we just register SPNs in both KDCs and merge the resulting keytabs?

---> You need to merge the both keytab files

How does this affect the .conf file?

---> In WAS v6.1 I am not sure  if you can merge conf file if you have  single jvm. because conf file contains default domain contains one kdc name.. not sure how we can define multiple domains to use... on single conf file..

I am researching on this...

Has anyone actually done this and seen it work?

--> I haven't tried this...

0
 

Accepted Solution

by:
midlman earned 0 total points
ID: 33727558
No solution forthcoming.  Abandoning question.
0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

-Xmx and -Xms are the two JVM options often used to tune JVM heap size.   Here are some common mistakes made when using them:   Assume BigApp is a java class file for the below examples. 1.         Missing m, M, g or G at the end …
There are numerous questions about how to setup an IBM HTTP Server to be administered from WebSphere Application Server administrative console. I do hope this article will wrap things up and become a reference for this task. You need three things…
When cloud platforms entered the scene, users and companies jumped on board to take advantage of the many benefits, like the ability to work and connect with company information from various locations. What many didn't foresee was the increased risk…
As many of you are aware about Scanpst.exe utility which is owned by Microsoft itself to repair inaccessible or damaged PST files, but the question is do you really think Scanpst.exe is capable to repair all sorts of PST related corruption issues?
Suggested Courses

580 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question