Novell ACCESS MANAGER 3.1 SP2 - README 2010, Manual

Page: 163 / 374

Configuring for Kerberos Authentication 163
n
ov
do
cx (e
n)
16
Ap
ril 20
10
5.2.3 Configuring the Keytab File
The keytab file contains the secret encryption key that is used to decrypt the Kerberos ticket. You
need to generate the keytab file and copy it to the Identity Server.
1 On the Active Directory server, open a command window and enter a
ktpass
command with
the following parameters:
ktpass /out value /princ value /mapuser value /pass value
The command parameters require the following values:
For this configuration example, you would enter the following command to create a keytab file
named
nidpkey
:
ktpass /out nidpkey.keytab /princ HTTP/amser.provo.novell.com@AD.
NOVELL.COM /mapuser amser@AD.NOVELL.COM /pass novell
2 Copy the keytab file to the Identity Server.
Copy the file to the default location on the Identity Server:
Linux:
/opt/novell/java/jre/lib/security
Windows Server 2003:
C:\Program Files\Novell\jre\lib\security
Windows Server 2008:
C:\Program Files (x86)\Novell\jre\lib\security
3 If the cluster contains multiple Identity Servers, copy the keytab file to each member of the
cluster.
5.2.4 Adding the Identity Server to the Forward Lookup Zone
1 In Manage Your Server on your Windows server, click Manage this DNS server .
2
Click Forward Lookup Zone .
3 Click the Active Directory domain.
4
In the right pane, right click, and select New Host (A) .
5 Fill in the following fields:
Name: Specify the hostname of the Identity Server.
Parameter Value Description
/out <outputFilename> Specify a name for the file, with
.keytab
as
the extension. For example: nidpkey.keytab
/princ <servicePrincipalName>
@ <KERBEROS_REALM>
Specify the service principal name for the
Identity Server, then @, followed by the
Kerberos realm. The default value for the
Kerberos realm is the Active Directory domain
name in all capitals. The Kerberos realm value
is case sensitive.
/mapuser <identityServerUser> @ <AD_DOM
AIN>
Specify the username of the Identity Server
user and the Active Directory domain to which
the user belongs.
/pass <userPassword> Specify the password for this user.