Single Sign-On for Java 3.3.2 - Administration Guide

Chatta subito con l'assistenza

Ottieni assistenza in tempo reale
Completa la registrazione

Accedi

Richiedi prezzo

Contatta il supporto vendite

Table of Contents

About this guide

Overview

Introducing Single Sign-on for Java

Introduction to Single Sign-on for Java About Kerberos About Active Directory

Active Directory groups

Group types Group scopes Groups and the log on process Groups and Single Sign-on for Java

Active Directory sites Mappings and objects

Names and mappings

User Principal Names (UPNs) Service Principal Names (SPNs)

Active Directory Objects

Single Sign-on and Active Directory

SPNEGO and Internet Explorer Kerberos delegation extensions

Why delegate?

Delegation “trust” in authentication

Delegation options Unconstrained delegation Constrained delegation (S4U2Proxy) Protocol transition (S4U2Self)

How does Single Sign-on for Java work? Example domain

Preparing for Single Sign-on for Java

Pre-Installation overview Network infrastructure

Active Directory environment Domain Name Service (DNS) Time Synchronization Service

Configuring Active Directory for Single Sign-on for Java

Setting up the service account

Setup using Active Directory tools

Creating a service account Kerberos Encryption Types for Active Directory Setting Service Principal Name (SPN) Mappings SPN Mapping and DNS Aliases

Setup with Authentication Services

Authentication Services Authentication Services keytabs vastool Configuring Single Sign-on to use the Authentication Services HOST SPN Configuring Single Sign-on to use an Authentication Services HTTP service principal

Enabling delegation

Delegation configuration in different systems

Windows Server 2003 and Windows Server 2008 delegation

Setting up a Java application server host

Creating keytab files

Setting up a client machine

Operating system Browsers and authentication Setting up Internet Explorer for SSO

Windows integrated authentication NTLM authentication

Deploying Single Sign-on for Java

Getting started with Single Sign-on for Java

Obtaining a license for Single Sign-on for Java HTTP header size limits Configuring the Single Sign-on examples

Single Sign-on for Java and your web applications

Deployment options

Deploying in a web application Deploying on the CLASSPATH Deploying in application server-specific path

Creating a deployment descriptor for SSO

Deploying SSO web components

Configuring the Single Sign-On parameters Building a war file for Single Sign-on for Java

Setting up logging Controlling access to resources

Authorization using Active Directory groups

Java EE authorization model for servlets and JSPs Single Sign-on for Java authorization

Compatibility with standard Java EE deployment descriptors How authorization works in Single Sign-on for Java Declarative security using Single Sign-on for Java Programmatic security Active Directory groups as roles Active Directory principals or groups in other realms or domains

Recommendations for Managing Authorization

Writing access policy files

Overview of policy files Preconditions for writing an XML policy file

Identify the resources to be protected Identify the roles that are to access these resources Disable security constraints in existing deployment descriptor

Creating the policy XML file

Create the policy XML file Create the main body of the policy XML file Define security constraints Define roles Set the deployment descriptor parameters

Policy XML Descriptor Elements

role

Examples

include exclude user security-constraint web-resource-collection auth-constraint

Security Issues

Basic Recommendations Deployment risks

Service unavailability Time synchronization Replication interruptions Resource security

Client issues with security

Cookies Caching of passwords for basic fallback

SPNEGO/Windows authentication

Lifetime of authentication

Session IDs Active Directory permissions Basic fallback Keytabs and passwords Authorization

Do you need authorization Securing LDAP Using the principle of least privilege

Denial of service

Basic fallback Session state

Auditing NTLM authentication

What is NTLM Different versions of NTLM NTLM and Internet Explorer

Maintenance and Troubleshooting

Maintenance

Logging New users and groups Account settings Network topology changes

Troubleshooting

General Active Directory Browsers

Internet Explorer browsers Non-Internet Explorer browsers

Authentication Keytabs Network connections Credential delegation Debugging

Appendix: Configuration Parameters

Single Sign-on Configuration Parameters System properties

Appendix: Using the JKTools

Tool details jkinit

jkinit examples

jklist

jklist examples

jktutil

jktutil example

Appendix: Using the JKTools > jktutil > jktutil example

The following example shows a jktutil session, in which a keytab is read, its contents listed, and a new key is added:

$ jktutil

jktutil (type '?' for help): l

Slot KVNO Principal

---- ---- --------------------

jktutil (type '?' for help): read_kt barney.kt

jktutil (type '?' for help): l

Slot KVNO Principal

---- ---- --------------------

1 255 barney@EXAMPLE.COM

jktutil (type '?' for help): addent -password -p fred@EXAMPLE.COM -k 255 -e rc4-hmac

Password for fred@EXAMPLE.COM:

jktutil (type '?' for help): l

Slot KVNO Principal

---- ---- --------------------

1 255 barney@EXAMPLE.COM

2 255 fred@EXAMPLE.COM

jktutil (type '?' for help): write_kt -o barney.kt

jktutil (type '?' for help): clear

jktutil (type '?' for help): l

Slot KVNO Principal

---- ---- --------------------

jktutil (type '?' for help): read_kt barney.kt

jktutil (type '?' for help): l

Slot KVNO Principal

---- ---- --------------------

1 255 barney@EXAMPLE.COM

2 255 fred@EXAMPLE.COM

Seleziona il prodotto:

Per una maggiore efficacia, compilare l'Obiettivo della chat:

Soluzioni consigliate per il problema

Single Sign-On for Java 3.3.2 - Administration Guide

jktutil example