Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Single Sign-On for Java 3.3.2 - Administration Guide

Table of Contents

About this guide

Overview

Introducing Single Sign-on for Java

Introduction to Single Sign-on for Java About Kerberos About Active Directory

Active Directory groups

Group types Group scopes Groups and the log on process Groups and Single Sign-on for Java

Active Directory sites Mappings and objects

Names and mappings

User Principal Names (UPNs) Service Principal Names (SPNs)

Active Directory Objects

Single Sign-on and Active Directory

SPNEGO and Internet Explorer Kerberos delegation extensions

Delegation “trust” in authentication

Delegation options Unconstrained delegation Constrained delegation (S4U2Proxy) Protocol transition (S4U2Self)

How does Single Sign-on for Java work? Example domain

Preparing for Single Sign-on for Java

Pre-Installation overview Network infrastructure

Active Directory environment Domain Name Service (DNS) Time Synchronization Service

Configuring Active Directory for Single Sign-on for Java

Setting up the service account

Setup using Active Directory tools

Creating a service account Kerberos Encryption Types for Active Directory Setting Service Principal Name (SPN) Mappings SPN Mapping and DNS Aliases

Setup with Authentication Services

Authentication Services Authentication Services keytabs vastool Configuring Single Sign-on to use the Authentication Services HOST SPN Configuring Single Sign-on to use an Authentication Services HTTP service principal

Enabling delegation

Delegation configuration in different systems

Windows Server 2003 and Windows Server 2008 delegation

Setting up a Java application server host

Creating keytab files

Setting up a client machine

Operating system Browsers and authentication Setting up Internet Explorer for SSO

Windows integrated authentication NTLM authentication

Deploying Single Sign-on for Java

Getting started with Single Sign-on for Java

Obtaining a license for Single Sign-on for Java HTTP header size limits Configuring the Single Sign-on examples

Single Sign-on for Java and your web applications

Deployment options

Deploying in a web application Deploying on the CLASSPATH Deploying in application server-specific path

Creating a deployment descriptor for SSO

Deploying SSO web components

Configuring the Single Sign-On parameters Building a war file for Single Sign-on for Java

Setting up logging Controlling access to resources

Authorization using Active Directory groups

Java EE authorization model for servlets and JSPs Single Sign-on for Java authorization

Compatibility with standard Java EE deployment descriptors How authorization works in Single Sign-on for Java Declarative security using Single Sign-on for Java Programmatic security Active Directory groups as roles Active Directory principals or groups in other realms or domains

Recommendations for Managing Authorization

Writing access policy files

Overview of policy files Preconditions for writing an XML policy file

Identify the resources to be protected Identify the roles that are to access these resources Disable security constraints in existing deployment descriptor

Creating the policy XML file

Create the policy XML file Create the main body of the policy XML file Define security constraints Define roles Set the deployment descriptor parameters

Policy XML Descriptor Elements

Examples

include exclude user security-constraint web-resource-collection auth-constraint

Security Issues

Basic Recommendations Deployment risks

Service unavailability Time synchronization Replication interruptions Resource security

Client issues with security

Cookies Caching of passwords for basic fallback

SPNEGO/Windows authentication

Lifetime of authentication

Session IDs Active Directory permissions Basic fallback Keytabs and passwords Authorization

Do you need authorization Securing LDAP Using the principle of least privilege

Denial of service

Basic fallback Session state

Auditing NTLM authentication

What is NTLM Different versions of NTLM NTLM and Internet Explorer

Maintenance and Troubleshooting

Logging New users and groups Account settings Network topology changes

Troubleshooting

General Active Directory Browsers

Internet Explorer browsers Non-Internet Explorer browsers

Authentication Keytabs Network connections Credential delegation Debugging

Appendix: Configuration Parameters

Single Sign-on Configuration Parameters System properties

Appendix: Using the JKTools

Tool details jkinit

jkinit examples

jklist examples

jktutil example

exclude

Deploying Single Sign-on for Java > Controlling access to resources > Policy XML Descriptor Elements > exclude

List of groups, users or roles that are excluded from being members of a given role.

Note: At least one user, group or role element must be present.

Table 4: Elements: exclude
Element	Required	Description
<group>	Optional	Active Directory group that is excluded from being a member of a given role
<role>	Optional	Role to be excluded from being a member of a given role
<user>	Optional	Active Directory user to be excluded from being a member of a given role

user

Deploying Single Sign-on for Java > Controlling access to resources > Policy XML Descriptor Elements > user

The user element defines an Active Directory user. If the username is unqualified, it is assumed to be in the same domain/realm as the Web application. If you wish to specify a user in a different domain/realm, use the syntax user@REALM to specify the user.

Table 5: Attribute: user
Attribute	Required	Description
name	Yes	name of the group

security-constraint

Deploying Single Sign-on for Java > Controlling access to resources > Policy XML Descriptor Elements > security-constraint

The security-constraint element defines access to one or more resources by one or more roles. The syntax for this element is the same as that used in the Java EE deployment descriptor, only the user-data-constraint and login-config elements are ignored.

Table 6: Elements: security-contraint
Element	Required	Description
<web-resource-collection>	Yes	Lists the resources that are to be protected by the security constraint
<auth-constraint>	Optional	Lists the roles that may have access to the resources protected by the security constraint

web-resource-collection

Deploying Single Sign-on for Java > Controlling access to resources > Policy XML Descriptor Elements > web-resource-collection

The web-resource-collection element defines the resources that are protected by a given security-constraint element.

Table 7: Elements: web-resource-collection
Element	Required	Description
<web-resource-name>	Yes	Name of this collection
<description>	Optional	Description of the resources being protected
<url-pattern>	Optional	One or more url-pattern elements may be used to indicate which resources this security-constraint protects. Note that the URL pattern should exclude the servlet-context.
<http-method>	Optional	Indicates which HTTP methods (for example, GET or POST) are subject to this security-constraint. If no method is indicated, then all methods are protected.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center