Chatta subito con l'assistenza

Ottieni assistenza in tempo reale
Completa la registrazione

Accedi

Richiedi prezzo

Contatta il supporto vendite

Single Sign-On for Java 3.3.2 - Administration Guide

Table of Contents

About this guide

Overview

Introducing Single Sign-on for Java

Introduction to Single Sign-on for Java About Kerberos About Active Directory

Active Directory groups

Group types Group scopes Groups and the log on process Groups and Single Sign-on for Java

Active Directory sites Mappings and objects

Names and mappings

User Principal Names (UPNs) Service Principal Names (SPNs)

Active Directory Objects

Single Sign-on and Active Directory

SPNEGO and Internet Explorer Kerberos delegation extensions

Delegation “trust” in authentication

Delegation options Unconstrained delegation Constrained delegation (S4U2Proxy) Protocol transition (S4U2Self)

How does Single Sign-on for Java work? Example domain

Preparing for Single Sign-on for Java

Pre-Installation overview Network infrastructure

Active Directory environment Domain Name Service (DNS) Time Synchronization Service

Configuring Active Directory for Single Sign-on for Java

Setting up the service account

Setup using Active Directory tools

Creating a service account Kerberos Encryption Types for Active Directory Setting Service Principal Name (SPN) Mappings SPN Mapping and DNS Aliases

Setup with Authentication Services

Authentication Services Authentication Services keytabs vastool Configuring Single Sign-on to use the Authentication Services HOST SPN Configuring Single Sign-on to use an Authentication Services HTTP service principal

Enabling delegation

Delegation configuration in different systems

Windows Server 2003 and Windows Server 2008 delegation

Setting up a Java application server host

Creating keytab files

Setting up a client machine

Operating system Browsers and authentication Setting up Internet Explorer for SSO

Windows integrated authentication NTLM authentication

Deploying Single Sign-on for Java

Getting started with Single Sign-on for Java

Obtaining a license for Single Sign-on for Java HTTP header size limits Configuring the Single Sign-on examples

Single Sign-on for Java and your web applications

Deployment options

Deploying in a web application Deploying on the CLASSPATH Deploying in application server-specific path

Creating a deployment descriptor for SSO

Deploying SSO web components

Configuring the Single Sign-On parameters Building a war file for Single Sign-on for Java

Setting up logging Controlling access to resources

Authorization using Active Directory groups

Java EE authorization model for servlets and JSPs Single Sign-on for Java authorization

Compatibility with standard Java EE deployment descriptors How authorization works in Single Sign-on for Java Declarative security using Single Sign-on for Java Programmatic security Active Directory groups as roles Active Directory principals or groups in other realms or domains

Recommendations for Managing Authorization

Writing access policy files

Overview of policy files Preconditions for writing an XML policy file

Identify the resources to be protected Identify the roles that are to access these resources Disable security constraints in existing deployment descriptor

Creating the policy XML file

Create the policy XML file Create the main body of the policy XML file Define security constraints Define roles Set the deployment descriptor parameters

Policy XML Descriptor Elements

Examples

include exclude user security-constraint web-resource-collection auth-constraint

Security Issues

Basic Recommendations Deployment risks

Service unavailability Time synchronization Replication interruptions Resource security

Client issues with security

Cookies Caching of passwords for basic fallback

SPNEGO/Windows authentication

Lifetime of authentication

Session IDs Active Directory permissions Basic fallback Keytabs and passwords Authorization

Do you need authorization Securing LDAP Using the principle of least privilege

Denial of service

Basic fallback Session state

Auditing NTLM authentication

What is NTLM Different versions of NTLM NTLM and Internet Explorer

Maintenance and Troubleshooting

Logging New users and groups Account settings Network topology changes

Troubleshooting

General Active Directory Browsers

Internet Explorer browsers Non-Internet Explorer browsers

Authentication Keytabs Network connections Credential delegation Debugging

Appendix: Configuration Parameters

Single Sign-on Configuration Parameters System properties

Appendix: Using the JKTools

Tool details jkinit

jkinit examples

jklist examples

jktutil example

Mappings and objects

Introducing Single Sign-on for Java > About Active Directory > Mappings and objects

Single Sign-on for Java makes use of a number of Active Directory constructs and objects in its Kerberos-related operations that involve:

Objects representing users, groups, organizations, computers, resources and services as registered in Active Directory account records
Mappings or unique name references to these objects, including properties held in the accounts themselves.

Names and mappings

Introducing Single Sign-on for Java > About Active Directory > Mappings and objects > Names and mappings

User Principal Names and Service Principal Names are recorded in Active Directory and can be used as a way of referring to a client or a service within Kerberos. Active Directory can find full user account details for a UPN or SPN by searching its records for the account that has that name property listed as one of its object attributes.

User Principal Names (UPNs)

Introducing Single Sign-on for Java > About Active Directory > Mappings and objects > User Principal Names (UPNs)

A UPN provides a name of a user and is used as the Kerberos client principal name. It consists of an RFC822 or Email-style name and domain, separated by an '@' symbol (thus, fred@EXAMPLE.COM).

The UPN must be unique throughout the Active Directory forest.

The UPN is the name that appears in the Kerberos Ticket Granting Ticket (TGT) returned by Active Directory for a client.

Service Principal Names (SPNs)

Introducing Single Sign-on for Java > About Active Directory > Mappings and objects > Service Principal Names (SPNs)

Most often, an SPN is of the form: <service type>/<host>. For example:

HTTP/appservhost1.example.com

The SPN is used when requesting a Kerberos ticket for a particular service. The client browser uses the hostname from the request URL to construct this SPN value. This SPN value is used to request a service ticket from Active Directory. You will typically need to map an SPN to an Active Directory account using the setspn tool.

Related Documents

The document was helpful.

Seleziona valutazione

I easily found the information I needed.

Seleziona valutazione

© 2024 One Identity LLC. ALL RIGHTS RESERVED. Termini di utilizzo Privacy Cookie Preference Center