an Active Directory client or the host name for a client that is not an Active Directory
client, ie. not logged onto the domain.
Some versions of the
ktpass
command will add the SPN for the principal so you may
only need to add the NetBIOS/short name versions of the SPNs. Use the
setspn -l
<account-name>
command to check if the
ktpass
command set the SPN.
4. Copy the
cifs.keytab
file to the server where the JLAN Server will run. Copy the
file to a protected are such as C:\etc\ or /etc.
5. Setup the Kerberos ini file on the server that the JLAN Server will run, the
default location is C:\winnt\krb5.ini or /etc/krb5.conf. A sample krb5.ini is
shown below.
[libdefaults]
default-realm = ALFRESCO.ORG
[realms]
ALFRESCO.ORG = {
kdc = adsrv.alfresco.org
admin-server = adsrv.alfresco.org
}
[domain-realm]
adsrv.alfresco.org = ALFRESCO.ORG
.adsrv.alfresco.org = ALFRESCO.ORG
Note: The realm should be specified in uppercase.
6. Setup the Java login configuration file. This would usually be in the
JRE\lib\security
folder. Create a file named
jlan.login.config
with the following
entry :-
JLANServerCIFS {
com.sun.security.auth.module.Krb5LoginModule required
storeKey=true
useKeyTab=true
keytab=”
C:/etc/cifs.keytab
”
principal=”cifs/<jlan-server-name>.<domain>”;
};
7. Enable the login config file in the main Java security configuration file, usually
at
JRE\lib\security\java.security
. Add the following line :-
login.config.url.1=
file:$
{java.home}/lib/security/jlan.login.config
8. Configure the JLAN CIFS server to use the Enterprise authenticator with
Kerberos enabled :-
<authenticator>
<class>
org.alfresco.jlan.server.auth.EnterpriseCifsAuthenticator
</class>
<mode>USER</mode>
<allowGuest/>
<Debug/>
<KDC>adsrv.starlasoft.co.uk</KDC>
<Realm>STARLASOFT.CO.UK</Realm>
<Password>...</Password>
<Principal>cifs/<cifs-server-name>.<domain></Principal>
</authenticator>
48
