Documentum 6.6 Kerberos authentication

Hi,

Can anyone implemented user source dm_krb?

I have followed the steps mentioned in Admin User guide for setting up kerberos. But the documentation related kerberos is not clear in that guide.

SPN=service-name/docbase-name@domain

what is service-name here?

Can anyone implemented this. If so can you please provide me the steps.

Thanks in Advance,

Niday

Find more posts tagged with

Documentum

Comments

Niday

Any suggestions?

mszurap

Hi,

I also tried to set up Kerberos support for the Content Server. I assigned the value of the "service" key in the server.ini (tipically dm_YOURREPO) to the service-name.

Anyway, I created the keytab file, copied to the required directory, set up LDAP sync then synchronized AD users to our repo, restarted even Tomcat, but no success with Webtop nor with DA.

I don't know what could be the problem, as the Documentation does not say anything more.

- Should the Content Server be in the AD domain too? I don't think so, as Linux Content Servers can also be set up for Kerberos authentication.

- Maybe my Windows XP machine is missing something?

- Maybe the Domain Controller (AD) is missing some service?

These have not been described anywhere...

Mike

RalfKahrl

If you read the installation guide there is an example:

CS/REPO1@MYDOMAIN.COM

service-name = CS

docbase-name = REPO1

domain = MYDOMAIN.COM

be aware to use capital letters for your domain.

RalfKahrl

If you created your keytab right and placed it to the right location, restart your repository and check server.log and dm_kerberos.log to see if the plugin was loaded and is active.

For Webtop you have to follow the instructions in the Webtop Installation Guide and perform some steps for your App-Server.

mszurap

I missed the webtop deployment guide settings, I'll try it.

Thank you!

Hello,

Did you manage to configure Kerberos SSO at all - if so what was your solution?

I have followed the instrucions in both Webtop and CS installation guides but it is not working and not sure how to trouble shoot

Regards

JCWeferling

Hi there,

I've the same problem. I'd followed the instruction in both guides and it doesent work. Is there anyone out there, with a running solution?

Need help!!

Best regards,

J. Fischer

Daniel.Gutierrez.Rodriguez

Hello,

Is there any update regarding this issue?

I also configured everything according to Content Server and Webtop installation guides and I cannot get the Kerberos authentication to work.

Any hint will be appreciated.

BR,

Daniel.

Hello

I managed to get it tow work and the following are notes I made for future installations. The issue I had was with the way my domain was configured and that I had comments in the config files - which prevents it from working. Also ensure you unregister SPNs that are not being used. Here are my notes

Kerberos SSO Integration notes

Pre- requisites

Ensure the servers and PCs are configured on the same domain.
Ensure it is possible to successfully execute the nslookup command from all servers and all client PCs using the server names, FQDN and IP addresses. This ensures that all the machines can see each other. Simply using the ping command is not sufficient.
Ensure no comments are included in any configuration files that are created during the Kerberos integration process

Useful debug commands

To display registered SPNs execute the following

ldifde -r (servicePrincipalName=HTTP/repserver001.uk.SOMENAME.com*) -v -f c:\somefile.txt

To delete registered SPNS execute the following, pls note this command executes SPNs in the domain UK for user kbuser1. repserver001.uk.SOMENAME.com is the FQDN for the server

setspn -d HTTP/repserver001.uk.SOMENAME.com UK\kbsuser1

*********************************************************************************************************

INSTALLATION STEPS

Configuration for Kerberos integration needs to be completed on the domain controller, content server, application server and client PCs. The following instructions define what needs to be done where.

Creating Service Principal Names

Determine the Kerberos Service Principal Name (SPN) for the content server. The SPN takes the following format:

CS/<docbasename>@<domain>

Example

CS/krep1@UK.SOMENAME.COM

i. CS is a constant and must be present

ii. krep1 is the name of the repository

iii. UK.SOMENAME.COM is the domain and must be in upper case

Determine the Kerberos Service Principal Name (SPN) for the Application Server. The SPN takes the following format:

HTTP/<application server FQDN>@<domain>

Example

HTTP/repserver001.uk.SOMENAME.com@UK.SOMENAME.COM

i. HTTP is a constant and must be present

ii. repserver001.uk.SOMENAME.com is the (FQDN) name of the application server

iii. UK.SOMENAME.COM is the domain and must be in upper case

Domain Controller

Create two users within active directory dedicated to the Kerberos SSO integration. These two users will be mapped to the SPNs.

For this example, user 'cskbs' will be created and mapped to the content server SPN as described in the content server section below.

User 'emckerb1' will be created and mapped to the application server SPN described in section application server below.

Ensure that these user accounts have the following settings configured:

Account is trusted for delegation
Use DES encryption types for this account

Content Server

This is done by executing the KTPASS command from the command prompt on the domain controller. The KTPASS command is located on the domain controller in 'Program Files\Support Tools', you may have to download and install the support tools from the Microsoft website. The command to execute is as follows:

ktpass /pass <password> -out <keytab-file> -princ <SPN> -crypto DES-CBC-MD5 +DumpSalt -ptype KRB5_NT_PRINCIPAL +desOnly /mapOp set /mapUser <user-name>

Example

ktpass /pass password1 -out krep1.kt.keytab -princ CS/krep1@UK.SOMENAME.COM -crypto DES-CBC-MD5 +DumpSalt -ptype KRB5_NT_PRINCIPAL +desOnly /mapOp set /mapUser uk\cskbs@UK.SOMENAME.COM

i. password1 is the password for user cskbs

ii. krep1.kt.keytab is the name for the key tab file, this can be any value as long as it ends in '.<somerandomvalue>.keytab'

iii. CS/krep1@UK.SOMENAME.COM is the SPN for the content server as defined in step 2 above

Copy the generated key tab file krep1.kt.keytab to the content server, folder $DOCUMENTUM/dba/auth/Kerberos/.
Restart the content server.

Application Server Configuration

Configure the Webtop application for Kerberos.

This is achieved by updating the app.xml in the Webtop/custom installation folder. Under the tag <kerberos_sso> change the tag <enabled> to equal true. Under the tag <domain> enter the domain name; for this example the value will be 'UK.SOMENAME.COM' ensure this is in upper case. The xml structure should look similar to the following and sit within the <application> tag:

<kerberos_sso>

</windows>

</browsers>

<docbase_login_fallback>false</docbase_login_fallback>

<domain>UK.SOMENAME.COM</domain>

</kerberos_sso>

</authentication>

Register the SPN on Active Directory and map it to the user 'emckerb1' created in the domain controller section above. This is done by executing the KTPASS command from the command prompt on the domain controller. The KTPASS command is located on the domain controller in 'Program Files\Support Tools', you may have to download and install the support tools from the Microsoft website.

ktpass /pass <password> -out <keytab-file> -princ <SPN> -crypto DES-CBC-MD5 +DumpSalt -ptype KRB5_NT_PRINCIPAL +desOnly /mapOp set /mapUser <user-name>

Example

ktpass /pass password1 -out emckerb1.keytab -princ HTTP/repserver001.uk.SOMENAME.com@UK.SOMENAME.COM -crypto DES-CBC-MD5 +DumpSalt -ptype KRB5_NT_PRINCIPAL +desOnly /mapOp set /mapUser uk\emckerb1

iv. password1 is the password for user emckerb1

v. emckerb1.keytab is the name for the keytab file, this can be any value as long as it ends in '.keytab'

vi. HTTP/repserver001.uk.SOMENAME.com@UK.SOMENAME.COM is the SPN for the application server as defined in step 3 above

Copy the generated key tab file emckerb1.keytab to the application sever, folder '<tomcatinstalldir>/webapps/webtop/WEB-INF'

The next step is to create the JAAS Configuration file. Create a file on the application server in folder '<tomcatinstalldir>/webapps/webtop/WEB-INF' called 'krb5Login.conf' with the following contents:

HTTP-hostName-realm # Example: HTTP-wdkapps-wdkblr-com

{

com.sun.security.auth.module.Krb5LoginModule required

debug=true

principal="<defined SPN>" # Example of an SPN: http/wdkapps.wdkblr.com@WDKBLR.COM

useKeyTab=true

storeKey=true

doNotPrompt=true

useTicketCache=false

isInitiator=false

keyTab="<location of keytab file>"; # Example: <webtop_app_root>/WEB-INF/****.keytab

};

Example

HTTP-repserver001-uk-SOMENAME-com

{

com.sun.security.auth.module.Krb5LoginModule required

debug=true

principal="HTTP/repserver001.uk.SOMENAME.com@UK.SOMENAME.COM"

useKeyTab=true

storeKey=true

doNotPrompt=true

useTicketCache=false

isInitiator=false

keyTab="D:\\Program Files\\Apache Software Foundation\\Tomcat 6.0\\webapps\\webtop\\WEB-INF\\emckerb1.keytab";

};

i. HTTP-repserver001-uk-SOMENAME-com takes the form HTTP-<applicationservername>-<domianseperatedbydashesnotdots>

ii. principal this value is set to the application server

iii. keyTab this value is set to the location of the application server keytab file. Please not that the path MUST contain double slashes and NOT single slashes

PLEASE NOTE: That this file must not contain any comments or additional blank spaces at the end of lines.

Create a configuration file for the application server to connect to the KDC server. In the folder %WINDIR% create a file called krb5.ini with the following content:

[libdefaults]

default_realm = UK.SOMENAME.COM

forwardable = true

ticket_lifetime = 24h

clockskew = 72000

default_tkt_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1

default_tgs_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1

permitted_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1

[realms]

UK.SOMENAME.COM = {

kdc = NAME-domain.uk.SOMENAME.com

admin_server =NAME-domain.uk.SOMENAME.com

}

i. default_realm this is set to the domain name

ii. The section [realms] should be defined as follows

<DOMAINNAME>={

kdc= <domaincontrollerserverFQDN>

admin_server= <domaincontrollerserverFQDN>

}

PLEASE NOTE: That this file must not contain any comments or additional blank spaces at the end of lines.

CLIENT PCs: IE Configurations

Open up internet explorer and navigate to the menu 'Tools/Options'. Select the tab 'Security' before selecting 'local intranet' and then sites. Ensure that all options are selected on the pop, before selecting 'Advanced' on the pop up screen. Enter the Webtop URL using the FQDN for the application server and add it to the zone, ie http://repserver001.uk.SOMENAME.com

On the advanced tab on 'Tools/options' scroll to the security section and ensure the check box for ' Enable Integrated Windows Authentication (requires restart)' is selected

Content Server User Accounts

All users accessing Webtop must have am account created within the domain the where Kerberos has been set up. The user accounts must be configured with option 'Use Des encryption types for this account' selected.

These users must then be created within the repository, the authentication source for the repository accounts must be set to 'dm_krb'

mszurap

Hi all,

We are still investigating our case with EMC Support.

We had small improvements where the gotchas were:

If you use hosts file (instead of registering your appserver machine in the DNS) put only the IP and FQDN (a short name can break the kerberos ticket request)
If ktpass outputs a key which contains a zero in it, then java's klist.exe does not return the correct key value from the keytab file, so you can get "Integrity check failed" messages in the documentum.log ($CATALINA_HOME/bin/documentum). Use other password for the principal user, and there will be no zeros in the key.

If we finally resolve the problem, I will let you know.

Mike

mszurap

Thanks zd!

The final problem was resolved thankfully to your guide, I also had some extra space in the C:\Windows\krb5.ini. Now it works, thanks a lot!

And one more tip to everybody: it's advised to check the "Password never expires" checkbox for your principal user(s).

Cheers,

Mike

Daniel.Gutierrez.Rodriguez

Hello everyone,

I'm still experiencing some problems to get Kerberos authentication to work, although I followed the guide above.

When I try to access Webtop, I do get the first screen to select the repository. Then, I still get the traditional login dialog to enter both username and password. I am not able to see any related message in Tomcat's logs.

Any ideas how to debug the problem? How can I be sure that Tomcat is reading both krb5.ini and krb5Login.conf?

Thank you for your help.

Best regards,

Daniel.

mszurap

Hi,

You can turn on some tracing. Modify the webtop\WEB-INF\classes\com\documentum\debug\TraceProp.properties file and add the following line:

com.documentum.web.common.Trace.SESSIONENABLEDBYDEFAULT=true

and set the com.documentum.web.formext.Trace.SESSION to true.

Besides that install Wireshark and capture kerberos packets (in the filter field type "kerberos") while trying to login. That can help, whether the kerberos ticket request was issued and have you got a valid response for that. If there is any kerberos traffice, most likely the config files were read.

Daniel.Gutierrez.Rodriguez

Hello,

I turned on the session trace and installed Wireshark to analyze the traffic. I got the following error:

10:41:54,446 DEBUG [http-8080-2] com.documentum.web.common.Trace - com.documentum.web.formext.session.KerberosSSOAuthenticationScheme:Failed to get service token from SPNEGO token :null

10:41:54,462 DEBUG [http-8080-2] com.documentum.web.common.Trace - com.documentum.web.formext.session.KerberosSSOAuthenticationScheme:java.lang.IndexOutOfBoundsException

In addition, I cannot see any kerberos traffic coming out of the application server.

I attached the whole Tomcat log.

Any ideas? I think that something is not being properly read from my configuration files.

BR,

Daniel.

mszurap

1. "Integrated Windows Authentication" is turned on in Internet Explorer?

2. Have you checked that nslookup resolves the application server's FQDN? In the browser have you referring to the application server host with FQDN?

Daniel.Gutierrez.Rodriguez

I checked both again and yes:

Windows authentication is enabled in Internet Explorer.
I can resolve the application server FQN.

I am still thinking that Tomcat is not reading properly the configuration files as I cannot capture any keberos traffic going from the application server to the domain controller. My krb5Login.conf file contains the following:

HTTP-cs4sap-demo-documentum-com

{

com.sun.security.auth.module.Krb5LoginModule required

debug=true

principal="HTTP/cs4sap-demo.documentum.com@DOCUMENTUM.COM"

useKeyTab=true

storeKey=true

doNotPrompt=true

useTicketCache=false

isInitiator=false

keyTab="C:\\apache-tomcat\\webapps\\webtop\\WEB-INF\\demokerb.keytab";

};

Hostname of my application server is cs4sap-demo and the domain is called documentum.com. As it is said in the documentation and the guide above, you have to start with your principal name, changing both "/" and "." with "-". What should I do in my case that the hostname is "cs4sap-demo"? Could this be a limitation?

Thanks lots for your help so far.

Best regards,

Daniel.

SuperMAG--6NVI

Hi all,

we are stuck at the same errormessage.

I think that there is no one out there who made it work....

Any help is appreciated.....

Thx

mszurap

Daniel, have you tried to use an application server hostname without dashes (-) ?

I think it could be a limitation.

Anyway, try to use the klist tool (Download "Windows Resource Kit" for Windows 2003, that works for XP and Wind7 as well) and issue "klist tickets". That should list the kerberos tickets. If you have some tickets, you can purge them with "klist purge", and after that your computer should get the kerberos tickets once again, try to capture the traffic in that Webtop request.

Does your tomcet gets the two required environment variables well?

I've put the following line on the beginning of the startup.bat:

set JAVA_OPTS=%JAVA_OPTS% -Djava.security.krb5.conf=C:\Windows\krb5.ini -Djava.security.auth.login.config=C:\Tomcat6020\webapps\webtop\WEB-INF\krb5Login.conf -Djavax.security.auth.useSubjectCredsOnly=false

Mike

SuperMAG--6NVI

Sorry that I interfer,

The dashes "-" is the syntax that is required for the REALM (See installtion guide)

Without the tomcat settings nothing would work.

Any other hints?

Thx

Martin

mszurap

Hello Martin,

We meant that the hostname really is "cs4sap-demo" and in the krb5Login.conf file the "HTTP-cs4sap-demo-documentum-com" maybe is interpreted back as "HTTP/cs4sap.demo.documentum.com" because dashes are meaning dots.

SuperMAG--6NVI

ah ok. good point. I agree

Daniel.Gutierrez.Rodriguez

Hello Mike,

Thank you for the answer. We are experiencing some additional problems with the domain controller and I haven't been able to test the issue.

We decided to change the host name and remove any additional "-". Just to avoid any possible limitation of the implementation.

As soon as I have some more results I'll post them.

Best regards,

Daniel.

JustinR

Hi All,

Daniel - did you maybe get some results from removing the dashes, or is there a workaround?

This is my biggest issue with SSO as my client has a mandatory requirement that servers contain dashes eg: site-servername.

Any feedback or refferals will be appreciated.

Thanks

Justin

Daniel.Gutierrez.Rodriguez

Hello Justin,

We removed the dashes from the hostname but still got the same error, so I would say this is not the problem.

Nevertheless, we haven't done much regarding this issue in the last two months as we are more focused in some other projects.

Sorry that I'm not of much help.

BR,

Daniel.

FelikK

Hi guys,

I was wondering if there's additional things that I have to do in app.xml inside /webtop/custom/app.xml

This is my app.xml :

<?xml version="1.0" encoding="UTF-8" standalone="no"?>

<config>
   <scope>
      <application extends="webtop/app.xml">
          <authentication>                                    
                    <!-- Kerberos SSO authentication scheme configuration -->

            <kerberos_sso>
                <enabled>true</enabled>

                <browsers>
                    <windows>
                       <ieversions>6.0,7.0,8.0</ieversions>
                       <firefoxversions>2.0,3.0,3.5</firefoxversions>
                    </windows>
                </browsers>

                <!-- Enable login fall back to DocbaseLogin scheme -->
                <docbase_login_fallback>false</docbase_login_fallback>
                <!-- Mandatory configuration:Provide the kerberos realm / domian name.-->
                <domain>MY.DOMAIN</domain>
            </kerberos_sso>

                    
                </authentication>      
      </application>
   </scope>
</config>

and I've tried to complete all others settings. Whenever I go to the webtop, it returns me below error:

com.documentum.web.common.WrapperRuntimeException:  application.authentication.class not specified in app.xml

Anybody can help me please?

I'm using Webtop 6.6

m.jedrzej

Hello,

I made everything like zd wrote and when I am going to webtop site I have to choose repository that I want to log in after clicking login button I get this error:

An error has occurred.

invokeMethod() failed while calling: onLogin

Missing users.properties file.

Stack Trace:

java.lang.IllegalArgumentException: Missing users.properties file.

at com.emc.documentum.kerberos.utility.KerberosUtility.getLoginSubject(KerberosUtility.java:157)

at com.emc.documentum.kerberos.utility.KerberosUtility.accept(KerberosUtility.java:45)

at com.documentum.web.formext.session.KerberosSSOAuthenticationScheme.authenticate(KerberosSSOAuthenticationScheme.java:202)

at com.documentum.web.formext.session.AuthenticationService.authenticate(AuthenticationService.java:142)

at com.documentum.web.formext.session.KerberosSSOLogin.authenticate(KerberosSSOLogin.java:178)

at com.documentum.web.formext.session.KerberosSSOLogin.onLogin(KerberosSSOLogin.java:131)

at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)

at java.lang.reflect.Method.invoke(Method.java:597)

at com.documentum.web.form.FormProcessor.invokeMethod(FormProcessor.java:1633)

at com.documentum.web.form.FormProcessor.invokeMethod(FormProcessor.java:1487)

at com.documentum.web.form.FormProcessor.fireActionEvent(FormProcessor.java:1303)

at com.documentum.web.form.RecallOperation.execute(RecallOperation.java:101)

at com.documentum.web.form.FormProcessor.processAction(FormProcessor.java:113)

at com.documentum.web.form.FormAction.processAction(FormAction.java:107)

at com.documentum.web.env.WDKController.doStartRequest(WDKController.java:194)

at com.documentum.web.env.WDKController.processRequest(WDKController.java:95)

at com.documentum.web.env.WDKController.doFilter(WDKController.java:86)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)

at org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:96)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)

at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:230)

at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:173)

at org.jboss.web.tomcat.security.SecurityAssociationValve.invoke(SecurityAssociationValve.java:182)

at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:84)

at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)

at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:104)

at org.jboss.web.tomcat.service.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:157)

at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)

at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:241)

at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:844)

at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)

at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447)

at java.lang.Thread.run(Thread.java:619)

Caused by: javax.security.auth.login.LoginException: Missing users.properties file.

at org.jboss.security.auth.spi.UsersRolesLoginModule.login(UsersRolesLoginModule.java:148)

at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)

at java.lang.reflect.Method.invoke(Method.java:597)

at javax.security.auth.login.LoginContext.invoke(LoginContext.java:769)

at javax.security.auth.login.LoginContext.access$000(LoginContext.java:186)

at javax.security.auth.login.LoginContext$4.run(LoginContext.java:683)

at java.security.AccessController.doPrivileged(Native Method)

at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)

at javax.security.auth.login.LoginContext.login(LoginContext.java:579)

at com.emc.documentum.kerberos.utility.KerberosUtility.getLoginSubject(KerberosUtility.java:151)

... 36 more

javax.security.auth.login.LoginException: Missing users.properties file.