Applies to censhare Linux Servers, that are not completely joined to the Active Directory Domain.

Overview

What is needed for Kerberos SSO:

  1. Kerberos enabled Unix-based server running censhare-Server

  2. service user in the directory server

  3. keytab file mapped to the service user

Also note: censhare is using GSSAPI for SingleSign-On, for Windows Clients you need to Allow access to the TGT Session cache, please clarify with your information security first if this is feasible.

Unix Server

    • Install packages for Kerberos

      • RedHat Linux

        yum install krb5-workstation krb5-libs krb5-auth-dialog

      • SuSE Linux

        zypper install krb5-client

      • Solaris 11

        pkg install pkg:/service/security/kerberos-5

    • configure krb5 with /etc/krb5.conf (/etc/krb5/krb5.conf on Solaris)

      
[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = EXAMPLE.COM
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true

[realms]
 EXAMPLE.COM = {
  kdc = kerberos.example.com
  admin_server = kerberos.example.com
 }

[domain_realm]
 .example.com = EXAMPLE.COM
 example.com = EXAMPLE.COM

Directory Server

  1. Create a new Service User in your Active Directory

2. In the password dialogue only activate:

      • User cannot change password

      • Password never expires

3. Open cmd.exe and execute the command:

setspn -A host/censhare-hostname censhare-sso

Please replace "censhare-hostname" with the hostname of your censhare-Server you are connecting to and "censhare-sso" with the Active Directory username you just created.

4. After you set SPN on your user, you will have a new tab for delegations in the user settings for this user.The Delegation for this user is not needed, if you need SSO with the censhare-WebClient this is mandatory. 


5. Open cmd.exe again to create a keytab file, which has to be copied to the censhare-Server. For more information on the ktpass command, see here.

ktpass -princ host/censhare-hostname@EXAMPLE.COM -mapuser censhare-sso@EXAMPLE.COM -pass +rndpass -out cenSSO.keytab -pType KRB5_NT_PRINCIPAL

Again replace "censhare-hostname" with the hostname of your censhare-Server you are connecting to and "censhare-sso" with the Active Directory username you just created

censhare-Server

    • create a custom jaas.conf

      corpus@censhare-server:~$ cp ~/css/app/config/jaas.conf ~/cscs/app/config/

      and edit the principal with the one you used with setspn

         principal="host/censhare-server@EXAMPLE.COM"

      as well as the place where you put the keytab file

         keyTab="/opt/corpus/cscs/app/config/cenSSO.keytab"

    • edit the server.xml file if the path of your krb5.conf is different (e.g. in Solaris OS)

          <sysproperty key="java.security.krb5.conf" value="/etc/krb5.conf" enabled="true"/>

    • Use the censhare-Admin to configure Kerberos at "Configuration - Modules - Internal Server Modules - Login by kerberos/LDAP"