Domain authentication and SSO - Cronologia

Renato.daverio: /* Create a service.keytab file */

2018-02-05T10:29:17Z

‎Create a service.keytab file

Renato.daverio: /* Create a service.keytab file */

2018-02-05T10:29:00Z

‎Create a service.keytab file

Renato.daverio: /* Create a service.keytab file */

2018-02-05T10:27:21Z

‎Create a service.keytab file

Renato.daverio il 10:26, 5 feb 2018

2018-02-05T10:26:02Z

Renato.daverio: /* Create SPN Account */

2018-02-05T10:13:12Z

‎Create SPN Account

Renato.daverio il 10:11, 5 feb 2018

2018-02-05T10:11:19Z

Renato.daverio: /* Enabling Kerberos authorization in Internet Explorer */

2018-02-05T10:08:26Z

‎Enabling Kerberos authorization in Internet Explorer

Renato.daverio il 10:04, 5 feb 2018

2018-02-05T10:04:23Z

Renato.daverio il 09:54, 5 feb 2018

2018-02-05T09:54:21Z

Renato.daverio il 09:37, 5 feb 2018

2018-02-05T09:37:07Z

@@ Riga 93: / Riga 93: @@
 == Create a service.keytab file ==
 There are two possible ways to generate keytab file: using ktpass command of Windows or ktab of JDK package.
 === Ktpass ===

@@ Riga 94: / Riga 94: @@
 There are two possible ways to generate keytab file: using ktpass command of Windows or ktab of JDK package.
-The first way: run the following command to configure the Service Principal Mapping:
   ktpass -out service.keytab -princ HTTP/[appserver]@[domain].local -pass *
@@ Riga 113: / Riga 115: @@
 This command will modify the login of SPN User into HTTP/[appserver]
-The second way: run the following command to configure the Service Principal Mapping (from <JAVA_HOME>/bin directory):
+=== Ktab ===
   ktab -k service.keytab -a HTTP/[appserver]@[domain].local –n 0
@@ Riga 132: / Riga 135: @@
 Complete the procedure by following steps:
-# Copy file service.keytab to <WILDFLY_HOME>/standalone/configuration
+* 1. Copy file service.keytab to <WILDFLY_HOME>/standalone/configuration
-# Replace all variables with actual values in file <WILDFLY_HOME>/standalone/configuration/standalone.xml:
+* 2. Replace all variables with actual values in file <WILDFLY_HOME>/standalone/configuration/standalone.xml:
   <SERVER> with computer name of WildFly machine

@@ Riga 94: / Riga 94: @@
 There are two possible ways to generate keytab file: using ktpass command of Windows or ktab of JDK package.
-* The first way: run the following command to configure the Service Principal Mapping:
+The first way: run the following command to configure the Service Principal Mapping:
   ktpass -out service.keytab -princ HTTP/[appserver]@[domain].local -pass *
@@ Riga 113: / Riga 113: @@
 This command will modify the login of SPN User into HTTP/[appserver]
-* The second way: run the following command to configure the Service Principal Mapping (from <JAVA_HOME>/bin directory):
+The second way: run the following command to configure the Service Principal Mapping (from <JAVA_HOME>/bin directory):
   ktab -k service.keytab -a HTTP/[appserver]@[domain].local –n 0
@@ Riga 131: / Riga 131: @@
   these commands must be reviewed in order to add some extra options.
-* Copy file service.keytab to <WILDFLY_HOME>/standalone/configuration
+Complete the procedure by following steps:
-* Replace all variables with actual values in file <WILDFLY_HOME>/standalone/configuration/standalone.xml:
+# Replace all variables with actual values in file <WILDFLY_HOME>/standalone/configuration/standalone.xml:
   <SERVER> with computer name of WildFly machine

@@ Riga 49: / Riga 49: @@
 == Create SPN Account ==
 In Domain Server:
-* Go to menu  “Start – Administrative Tools – Active Directory Users and Computers” and create new user [].
+* Go to menu  “Start – Administrative Tools – Active Directory Users and Computers” and create new user [spn_user].
 Set properties:
@@ Riga 58: / Riga 58: @@
 Optionally check following option to enable AES 256 Encryption for Kerberos Ticket
   "This account supports Kerberos AES 256 bit encryption"
 * Run setspn commands:
-  setspn –S HTTP/appserver wildflyuser
+  setspn –S HTTP/[appserver] [spn_user]
-  setspn –S HTTP/appserver.domain.local wildflyuser
+  setspn –S HTTP/[appserver.domain.local] [spn_user]
 where:
-  appserver – computer name of JBoss machine;
+  [appserver] – computer name of JBoss machine
-  domain.local – domain name;
+  [domain.local] – domain name
-  wildflyuser – SPN account login (created on previous step)
+  [spn_user] – SPN account login (created on previous step)
 To check if the settings are right run the next command:
@@ Riga 79: / Riga 92: @@
 == Create a service.keytab file ==
 There are two possible ways to generate keytab file: using ktpass command of Windows or ktab of JDK package.
 * The first way: run the following command to configure the Service Principal Mapping:
-  ktpass -out service.keytab -princ HTTP/APPSERVER@AD.KV4 -pass * -mapuser AD.KV4\SERVICE_ACC
+  ktpass -out service.keytab -princ HTTP/[appserver]@[domain].local -pass *
 Enter the password for the user name, when prompted.
-In this example:
+Where:
-  appserver – computer name of WildFly machine;
+  [appserver] – computer name of WildFly machine
-  ad.kv4 – domain name;
+  [DOMAIN] – domain name
-  service_acc – SPN account login (created on previous step)
+  [spn_user] – SPN account login (created on previous step)
-This command will modify the login of SPN User into HTTP/[App Server]
+Example:
 * The second way: run the following command to configure the Service Principal Mapping (from <JAVA_HOME>/bin directory):
-  ktab -k service.keytab -a HTTP/APPSERVER@AD.KV4 –n 0
+  ktab -k service.keytab -a HTTP/[appserver]@[domain].local –n 0
 Enter the password for the user name, when prompted.
-In this example:
+Where:
-  appserver – computer name of WildFly machine;
+  [appserver] – computer name of WildFly machine;
-  ad.kv4 – domain name
+  [domain] – domain name
-  Kerberos authentication is very complicated thing and depends at first from Active Directory configuration, security politics, etc. These two commands will work with default AD settings.
+  Kerberos authentication is very complicated thing and depends at first from Active Directory
-  In case of there are any modifications in AD (some none-default encryption types for example), these commands must be reviewed in order to add some extra options.
+ configuration, security politics, etc. These two commands will work with default AD settings.
 * Copy file service.keytab to <WILDFLY_HOME>/standalone/configuration

@@ Riga 49: / Riga 49: @@
 == Create SPN Account ==
 In Domain Server:
-* Go to menu  “Start – Administrative Tools – Active Directory Users and Computers” and create new user "wildflyuser".
+* Go to menu  “Start – Administrative Tools – Active Directory Users and Computers” and create new user [].
 Set properties:

@@ Riga 141: / Riga 141: @@
   HTTP/[SPN User]@[Domain].LOCAL
-== Enabling Kerberos authorization in Internet Explorer ==
+== Enabling Kerberos authorization in browser ==
 * 1. Go to menu '''''Internet Options''''', tab <u>''Security''</u> and click on "Local Intranet" option.
@@ Riga 157: / Riga 159: @@
   Enable option <u>Enable Integrated Windows Authentication</u>.
-==== Enabling Kerberos authorization in Mozilla Firefox ====
+=== Enabling Kerberos authorization in Mozilla Firefox ===
 * 1. Type "about:config" in the address bar.
@@ Riga 332: / Riga 334: @@
 |}
 === Enabling NTLM / Kerberos authorization in Internet Explorer ===

@@ Riga 146: / Riga 146: @@
 * 2. Click on '''Sites''' button. In opened window make sure that the last three boxes are checked and click on the '''Advanced''' button.
 Add you domain name into the list of Websites (example: "itmSUITE.local"):
 * 3. Back to "Local Intranet" option: click on '''Custom Level'''. In opened window activate the next option:
-'''''User authentication\Logon\Automatic logon only in Intranet zone'''''
+ '''''User authentication\Logon\Automatic logon only in Intranet zone'''''
-* 5. Go to menu '''''Settings''''', tab <u>''Advanced''</u> and enable option <u>Enable Integrated Windows Authentication</u>.
+ Enable option <u>Enable Integrated Windows Authentication</u>.
 ==== Enabling Kerberos authorization in Mozilla Firefox ====

@@ Riga 47: / Riga 47: @@
 # Clocks on computer with Windows Server and on computer with WildFly should be synchronized
 TBC
 == Enabling Kerberos authorization in Internet Explorer ==
@@ Riga 238: / Riga 312: @@
 |}
-=== Enabling NTLM / Kerberos authorization in Internet Explorer ====
+=== Enabling NTLM / Kerberos authorization in Internet Explorer ===
 * 1. Go to menu '''''Internet Options''''', tab <u>''Security''</u> and click on "Local Intranet" option.

@@ Riga 1: / Riga 1: @@
-= Configuration in itmSUITE PMSM 8.X =
+= Configuration of Domain authentication in itmSUITE PMSM 8.X =
 The following configuration will enable the use of domain credentials to login in itmSUITE PMSM as an alternative of local credentials.
@@ Riga 39: / Riga 39: @@
 |}
-== Configure Single Sign On with Kerberos in itmSUITE PMSM 8.X ==
+= Configuration of Single Sign On with Kerberos in itmSUITE PMSM 8.X =
 Prerequisites
@@ Riga 48: / Riga 48: @@
 TBC
 = Import domain user in itmSUITE PMSM 8.X =
@@ Riga 53: / Riga 72: @@
 TBC
+= Configuration of Domain authentication in itmSUITE PMSM 7.X =
 The following configuration will enable the use of domain credentials to login in itmSUITE PMSM as an alternative of local credentials.
@@ Riga 149: / Riga 167: @@
 More than one connection to domain(s) can be active at the same time: in this case the above step 2 is executed on each active connection.
-== Configure Single Sign On with NTLM in itmSUITE PMSM 7.X ==
+= Configuration of Single Sign On with NTLM in itmSUITE PMSM 7.X =
 TBC
-== Configure Single Sign On with Kerberos in itmSUITE PMSM 7.X ==
+= Configuration of Single Sign On with Kerberos in itmSUITE PMSM 7.X =
 Prerequisites:
@@ Riga 160: / Riga 199: @@
 * Clocks on Domain Server and Server with JBoss AS should be synchronized
-=== Create SPN Account ===
+== Create SPN Account ==
 In Domain Server:
 * Go to menu  “Start – Administrative Tools – Active Directory Users and Computers” and create new user.
@@ Riga 179: / Riga 218: @@
 Is necessary to edit the setspn commands into cmd window.
-== Use of SSO (Single Sign On) ==
+== Connect itmSUITE PMSM to Domain through SPN ==
-SSO (Single Sign On) can be managed in '''''General\System\LM Settings with superadmin role'''''.
+SSO (Single Sign On) via <u>'''Kerberos'''</u> and Microsoft <u>'''AD'''</u> ( <u>'''Active Directory'''</u> ) can be managed in '''''General\System\LM Settings''''' with superadmin role in Tab ''''NTLM2''''.
 {| class="wikitable"
@@ Riga 226: / Riga 238: @@
 |}
-==== Enabling NTLM / Kerberos authorization in Internet Explorer ====
+=== Enabling NTLM / Kerberos authorization in Internet Explorer ====
 * 1. Go to menu '''''Internet Options''''', tab <u>''Security''</u> and click on "Local Intranet" option.