Documentum 6.5 single sign on => Kerberos

Hello Fellows,

I'm closing a project and customer is asking me to send examples of code developed to integrate Documentum / Webtop / Taskspace 6.5 to Kerberos single sig on.

Do you have any kind of examples, documentation, etc.. to share?

Best Regards,

Find more posts tagged with

Documentum

Comments

RalfKahrl

Hi Ed,

check the Release Notes of D 6.6 there is native support for Kerberos. But imho Webtop Kerberos seems to have a problem retrieving a delegate kerberos ticket...

Best regards

Ralf

Eduardo_Oliveira

Ralf,

There is a way to copy the single sign on code from 6.6 to 6.5 sp3?

The migration to 6.6 will be a big problem to us at this point of the project.

Thank you!

RalfKahrl

Eduardo,

this is something you should ask tech-support. I don't know if backporting kerberos-support is possible (it might) or even it is a supported option...

For Webtop itself I think it isn't that much of code, config, classes, jars. On Content-Server side hm... authentication plugin dm_kerberos... dm_user authentication source kerberos and I don't know what happens inside CS...

But I recently saw a blog with an alternative approache... http://dmdaa.wordpress.com/2010/08/01/single-sign-on-sso-solution-for-webtop-using-spnego/

Best regards

mszurap

Hi Ralf,

So your experience is that SSO is not working flawlessly in D6.6.? I have some problems with it's setup...

Thanks,

Mike

RalfKahrl

Hi Miklos,

so my experience is, after messing around with Windows-AD, KDC, IE and some network stuff, the kerbutil.jar seems to be broken. In detail Internet Explorer sends a kerberos ticket (use a network sniffer) to my app-server, the app-server has its own keytab and authenticates against my kdc (works fine), but the next step fails because the implementation needs to retrieve a delegate ticket for the user (I assume this ticket will be sent to Content Server for authentication and authorization) but this is something that won't happen in the kerbutil.jar as an explicit java call is necessary to retrieve a delegate ticket. As this call is never performed an internal GSSException is thrown which is never printed to the console, even with tracing and logging enabled the exception won't be displayed.

So the solution would be, configure your environment up to this point and open a call with support and try to get a fix.

Regards

Ralf

mszurap

Thank you for the detailed answer.

As you wrote, I've gotten to the point that I got back a 401 Not Authorized for the "GET /webtop/component/main?__dmfClientId=1281687582503&__dmfTzoff=-120" request, then in the next request the authorization header is sent:

Authorization: Negotiate TlRNTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAFAAgKAAAADw==

But nothing happens (the built-in webtop login screen appears).

So you say that there should be a hotfix for this issue? Or we should fight for it?

Thanks,

Miklos

RalfKahrl

Hi Miklos,

your Authorization header is for to short for a kerberos ticket, what you got there is a NTLM ticket. Get sure your IE is configured to have your app-server in the 'lokal intranet' security zone for firefox check the documentation. Also it is very important to use the hostname you used to create your webtop keytab HTTP/myhost.mydomain.com@MYDOMAIN.COM so call http://myhost.mydomain.com:8080/webtop this took me some time as well to figure out when a kerberos ticket is sent, but once you got it, you should see some kerberos output on your app-servers console printout.

I don't think there is a fix already available. It is just my assumption that a fix is necessary to get it working and from my view it applies to wdk and dfs as both use the same krbutil.jar. But this maybe just a packaging issue. I tested it with Developer Edition 6.6, are you trying it with the standard products? Can you check the filesize for krbutil.jar?

My krbutil.jar

size: 8039 bytes

created: July 22, 2010

mszurap

I modified my SPN a little with your description and now the authorization header is much longer and I can see the following in the Tomcat's catalina out:

Debug is true storeKey true useTicketCache false useKeyTab true doNotPrompt true ticketCache is null isInitiator false KeyTab is webtop/WEB-INF/webtop66.123456.keytab refreshKrb5Config is false principal is HTTP/192.168.0.2@MYDOMAIN.LOCAL tryFirstPass is false useFirstPass is false storePass is false clearPass is false

Key for the principal HTTP/192.168.0.2@MYDOMAIN.LOCAL not available in webtop/WEB-INF/webtop66.123456.keytab

[Krb5LoginModule] authentication failed

Unable to obtain password from user

And the following in the localhost.log file:

java.lang.IllegalArgumentException: Unable to obtain password from user

at com.emc.documentum.kerberos.utility.KerberosUtility.getLoginSubject(KerberosUtility.java:157)

at com.emc.documentum.kerberos.utility.KerberosUtility.accept(KerberosUtility.java:45)

at com.documentum.web.formext.session.KerberosSSOAuthenticationScheme.authenticate(KerberosSSOAuthenticationScheme.java:202)

So this the end I suppose.

I'm trying to do it with the standard (Enterprise) Edition, the krbutil.jar file size is also 8039 bytes but it's date is May 28, 2010.

Thank you anyway.

Miklos

RalfKahrl

Hi Miklos,

no this is not the end ;-) you can get a little further than that.

Please check the parameters you used for generating your webtop-keytab (maybe regenerate it) check your ad-webtop-kerberos-user settings. Is DES-Only enabled? It should be. After DES-Only setting is enabled either manually or by ktpass reset the password it might still be stored in the old format. I actually don't know what fixed this step in my try but I guess one of those I mentioned did it ;-)

Regards

Ralf

mszurap

Yesssss! Finally I have no messages in the catalina out, I got the kerberos SSO login screen (I have to choose only the repository) but after that I got back the standard login screen.

It was important that the SPN cannot have IP address in it but it should be an FQDN address. My server is not registered in DNS but I solved it with putting it in the hosts file.

RalfKahrl

Great, now you are at the exact same step my attempt failed.

Next I attached Eclipse-Debugger to figure out what is going on and so I noticed the internal exception which is not reported. It is caused by a call like krb5context.getDelegateCred()...

xueqing

I have not worked with Content Server 6.6, but only Webtop 6.6.

The webtop deployment guide never mentioned 'Delegation' setup.

It also did not specify how to let Webtop know the SPN created for authentication plug-in on CS, even the CS installation guide stated the need to create the SPN.

KipT

Has there been any resolution to this issue yet? I am running into the same situation on a full 6.6 install I am working with.

mszurap

No solution yet, we have an open SR for this.

AndreasPes

Hallo,

I have done a implementation for a customer of Kerberos on DCTM 6.5 in a mixed environment architecure (CS: hp ux, AppSrv: win). This implementation will work for all CS versions starting from 5.3 on Win, Linux and Unix.

If someone is interested, please get in contact with me directly.

Kind regards,

Andreas

info(at)prime-force.com

ufferoenne2

Hi Anyone

Any update on this one? It is an old ticket but I'm experiencing the exact same issue in 6.7 SP1

I get the Kerberos SSO screen where I only need to choose the docbase but after pressing the OK button I get the "java.lang.IllegalArgumentException: Unable to obtain password from user" exception.

Br, Uffe