Kerberos Authentication and Websphere

I am trying to implement a web service on WAS 7.0 that uses JNDI to communicate with an Active Directory running Windows Server 2008 R2.

Before I begin, I'd like to mention that I have not much knowledge in Kerberos authentication but have read up on the mechanism.

I have successfully implemented and tested a change password function using a web service call from a client to the AD through WAS.
System.setProperty("javax.net.ssl.trustStore", keystore);
env.setProperty(Context.SECURITY_AUTHENTICATION, "Simple");
env.setProperty(Context.SECURITY_PROTOCOL, "ssl");
env.setProperty(Context.SECURITY_PRINCIPAL, principal);
env.setProperty(Context.SECURITY_CREDENTIALS, credentials);
env.setProperty(Context.PROVIDER_URL, providerUrl);
InitialLdapContext ctx = new InitialLdapContext(env, null);

// Call change password function using ctx

Open in new window

I understand that to implement Kerberos authentication in JNDI, the code below should be used instead.
env.setProperty(Context.SECURITY_AUTHENTICATION, "GSSAPI");

Open in new window

I have also successfully implemented Kerberos authentication without WAS (no web services) by using the kinit command on the client to retrieve the cache and then running the modified code on the console. This can't be the right way to proceed as I cannot expect the client to open the command prompt to key kinit every time he uses the system.
LoginContext lc = new LoginContext("krb5.conf");
lc.login();

Open in new window

I have executed the above code and managed to get a successfully authentication. The krb5.conf, keytab and keystore are stored locally on the client for this testing purpose. I understand that these are supposed to be configured within WAS.

The problem arises when I am trying to integrate WAS with the code I have. I'm not too familiar with the settings within WAS and assuming the settings within have been set up correctly (by someone else), what should I do to within my code to perform the task at hand? I should not be utilizing files such as the keytab directly.

What I have at the moment is very similar to this Link and I believe that WAS should be handling most of it for me, but I am not sure how.

Thanks in advance.
pcssecureAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Radhakrishnan RSenior Technical LeadCommented:
Hi,

I have seen enabling kerberos authentication in IIS but not WAS. I believe that the configuration will be similar. Please check this article and see it makes any shades http://support.microsoft.com/kb/326089

http://www.ibm.com/developerworks/websphere/library/techarticles/0910_jain1/0910_jain1.html
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Application Servers

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.