joedelapaz
asked on
Single Sign on Issues between Windows 2008 R2 and Redhat Enterprise Linux 5
I am having single sign on issues between my W2K8 domain controllers and our appliance running RHEL5.
I have created a single sign on account and imported the keytab successfully. However, when I attempt to connect to the appliance webpage using single sign on I get the following error message:
"Request Entity Too Large
The requested resource
/webinterface/SingleSignOn
does not allow request data with GET requests, or the amount of data provided in the request exceeds the capacity limit.
--------------------------
Apache Server at webserver.fqdn Port 443"
We've since figured out that users signing on (not the single sign on account) that are members of 50 or mode AD groups get this error message.
More research has shown that this may be due to the Kerberos 5 PAC size being too big.
So we have immediate options: (from what I can see)
1) Get RHEL5 to not read the Kerberos PAC
2) Find a way to increase the size limit of what RHEL5 (httpd.conf) can accept
For option 1, I found this http://support.microsoft.com/kb/832572 from Microsoft.
But it only applies to Windows 2003 and I cannot find documents that apply to W2K8.
Maybe that UserAccountControl field is already there but I don't know how to manipulate it (comfortably).
For option 2, I searched around the "Request Entity Too Large" documents around several websites.
I did try amending the httpd.conf file and adding a LimitRequestBody field into the configuration as per below:
<Directory />
Options FollowSymLinks
AllowOverride None
LimitRequestBody 102400000
</Directory>
After restarting the service, the fault was still there. I am unsure whether I put this line in the right spot as there was no LimitRequestBody setting in this file prior to me fiddling with it. Maybe someone can give guidance.
If someone has seen this before, or can assist I would be greatly appreciative.
I have created a single sign on account and imported the keytab successfully. However, when I attempt to connect to the appliance webpage using single sign on I get the following error message:
"Request Entity Too Large
The requested resource
/webinterface/SingleSignOn
does not allow request data with GET requests, or the amount of data provided in the request exceeds the capacity limit.
--------------------------
Apache Server at webserver.fqdn Port 443"
We've since figured out that users signing on (not the single sign on account) that are members of 50 or mode AD groups get this error message.
More research has shown that this may be due to the Kerberos 5 PAC size being too big.
So we have immediate options: (from what I can see)
1) Get RHEL5 to not read the Kerberos PAC
2) Find a way to increase the size limit of what RHEL5 (httpd.conf) can accept
For option 1, I found this http://support.microsoft.com/kb/832572 from Microsoft.
But it only applies to Windows 2003 and I cannot find documents that apply to W2K8.
Maybe that UserAccountControl field is already there but I don't know how to manipulate it (comfortably).
For option 2, I searched around the "Request Entity Too Large" documents around several websites.
I did try amending the httpd.conf file and adding a LimitRequestBody field into the configuration as per below:
<Directory />
Options FollowSymLinks
AllowOverride None
LimitRequestBody 102400000
</Directory>
After restarting the service, the fault was still there. I am unsure whether I put this line in the right spot as there was no LimitRequestBody setting in this file prior to me fiddling with it. Maybe someone can give guidance.
If someone has seen this before, or can assist I would be greatly appreciative.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
this has solved the problem. single sign on is now working.
This question has been classified as abandoned and is being closed as part of the Cleanup Program. See my comment at the end of the question for more details.
ASKER
I would like to try to run my single sign on account without the PAC. Does anyone know how I can set the no_auth_data required flag on this account?
Thanks,
Joe