Configuring for Kerberos Authentication
169
n
ov
do
cx (e
n)
16
Ap
ril 20
10
4
Copy this file to the location specified in the
JAAS config file for Kerberos
field of
Step 4
in
“Creating the Authentication Class, Method, and Contract” on page 165
.
5
Make sure the file permissions are set correctly. They should be set to 644.
6
Restart Tomcat.
Linux Identity Server:
Enter the following command:
/etc/init.d/novell-tomcat5 restart
Windows Identity Server:
Enter the following commands:
net stop Tomcat5
net start Tomcat5
Whenever you make changes to the
bcsLogin.conf
file, you need to restart Tomcat.
7
If the cluster contains multiple Identity Servers, copy the
bcsLogin.conf
file to each member
of the cluster, then restart Tomcat on that member.
5.3.5 Verifying the Kerberos Configuration
To view the
catalina.out
(Linux) or the
stdout.log
(Windows) file of the Identity Server:
1
In the Administration Console, click
Auditin
g >
General Logging
.
2
In the Identity Servers section, select the
catalina.out
or
stdout.log
file.
3
Download the file and open it in a text editor.
4
Search for Kerberos and verify that a subsequent line contains a
Commit Succeeded phrase
.
For the configuration example, the lines look similar to the following:
principal's key obtained from the keytab
principal is HTTP/[email protected]
Added server's keyKerberos Principal HTTP/
[email protected] Version 3key EncryptionKey:
keyType=3 keyBytes (hex dump)=0000: CB 0E 91 FB 7A 4C 64 FE
[Krb5LoginModule] added Krb5Principal HTTP/
[email protected] to Subject
Commit Succeeded
5
If the file does not contain any lines similar to these, verify that you have enabled logging. See
“Enabling Logging for Kerberos Transactions” on page 164
.
6
If the commit did not succeed, search backward in the file and verify the following values:
Service Principal Name
Name of keytab file
For the example configuration, the file should contain lines with text similar to the following:
Principal is HTTP/amser.provo.novell.com
KeyTab is /usr/lib/java/jre/lib/security/nidpkey.keytab
7
(Conditional) If you make any modifications to the configuration, either in the Administration
Console or to the bcsLogin file, restart Tomcat on the Identity Server.
5.4 Configuring the Clients
1
Add the computers of the users to the Active Directory domain.
Summary of Contents for ACCESS MANAGER 3.1 SP2 - README 2010
Page 4: ...4 Novell Access Manager 3 1 SP2 Identity Server Guide novdocx en 16 April 2010...
Page 12: ...12 Novell Access Manager 3 1 SP2 Identity Server Guide novdocx en 16 April 2010...
Page 158: ...158 Novell Access Manager 3 1 SP2 Identity Server Guide novdocx en 16 April 2010...
Page 172: ...172 Novell Access Manager 3 1 SP2 Identity Server Guide novdocx en 16 April 2010...
Page 182: ...182 Novell Access Manager 3 1 SP2 Identity Server Guide novdocx en 16 April 2010...
Page 290: ...290 Novell Access Manager 3 1 SP2 Identity Server Guide novdocx en 16 April 2010...
Page 362: ...362 Novell Access Manager 3 1 SP2 Identity Server Guide novdocx en 16 April 2010...
Page 374: ...374 Novell Access Manager 3 1 SP2 Identity Server Guide novdocx en 16 April 2010...
