Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Single Sign-On for Java 3.3.2 - Administration Guide

Table of Contents

About this guide

Overview

Introducing Single Sign-on for Java

Introduction to Single Sign-on for Java About Kerberos About Active Directory

Active Directory groups

Group types Group scopes Groups and the log on process Groups and Single Sign-on for Java

Active Directory sites Mappings and objects

Names and mappings

User Principal Names (UPNs) Service Principal Names (SPNs)

Active Directory Objects

Single Sign-on and Active Directory

SPNEGO and Internet Explorer Kerberos delegation extensions

Delegation “trust” in authentication

Delegation options Unconstrained delegation Constrained delegation (S4U2Proxy) Protocol transition (S4U2Self)

How does Single Sign-on for Java work? Example domain

Preparing for Single Sign-on for Java

Pre-Installation overview Network infrastructure

Active Directory environment Domain Name Service (DNS) Time Synchronization Service

Configuring Active Directory for Single Sign-on for Java

Setting up the service account

Setup using Active Directory tools

Creating a service account Kerberos Encryption Types for Active Directory Setting Service Principal Name (SPN) Mappings SPN Mapping and DNS Aliases

Setup with Authentication Services

Authentication Services Authentication Services keytabs vastool Configuring Single Sign-on to use the Authentication Services HOST SPN Configuring Single Sign-on to use an Authentication Services HTTP service principal

Enabling delegation

Delegation configuration in different systems

Windows Server 2003 and Windows Server 2008 delegation

Setting up a Java application server host

Creating keytab files

Setting up a client machine

Operating system Browsers and authentication Setting up Internet Explorer for SSO

Windows integrated authentication NTLM authentication

Deploying Single Sign-on for Java

Getting started with Single Sign-on for Java

Obtaining a license for Single Sign-on for Java HTTP header size limits Configuring the Single Sign-on examples

Single Sign-on for Java and your web applications

Deployment options

Deploying in a web application Deploying on the CLASSPATH Deploying in application server-specific path

Creating a deployment descriptor for SSO

Deploying SSO web components

Configuring the Single Sign-On parameters Building a war file for Single Sign-on for Java

Setting up logging Controlling access to resources

Authorization using Active Directory groups

Java EE authorization model for servlets and JSPs Single Sign-on for Java authorization

Compatibility with standard Java EE deployment descriptors How authorization works in Single Sign-on for Java Declarative security using Single Sign-on for Java Programmatic security Active Directory groups as roles Active Directory principals or groups in other realms or domains

Recommendations for Managing Authorization

Writing access policy files

Overview of policy files Preconditions for writing an XML policy file

Identify the resources to be protected Identify the roles that are to access these resources Disable security constraints in existing deployment descriptor

Creating the policy XML file

Create the policy XML file Create the main body of the policy XML file Define security constraints Define roles Set the deployment descriptor parameters

Policy XML Descriptor Elements

Examples

include exclude user security-constraint web-resource-collection auth-constraint

Security Issues

Basic Recommendations Deployment risks

Service unavailability Time synchronization Replication interruptions Resource security

Client issues with security

Cookies Caching of passwords for basic fallback

SPNEGO/Windows authentication

Lifetime of authentication

Session IDs Active Directory permissions Basic fallback Keytabs and passwords Authorization

Do you need authorization Securing LDAP Using the principle of least privilege

Denial of service

Basic fallback Session state

Auditing NTLM authentication

What is NTLM Different versions of NTLM NTLM and Internet Explorer

Maintenance and Troubleshooting

Logging New users and groups Account settings Network topology changes

Troubleshooting

General Active Directory Browsers

Internet Explorer browsers Non-Internet Explorer browsers

Authentication Keytabs Network connections Credential delegation Debugging

Appendix: Configuration Parameters

Single Sign-on Configuration Parameters System properties

Appendix: Using the JKTools

Tool details jkinit

jkinit examples

jklist examples

jktutil example

auth-constraint

Deploying Single Sign-on for Java > Controlling access to resources > Policy XML Descriptor Elements > auth-constraint

The auth-constraint element is used to list those roles that are authorized to access resources specified in a security-constraint.

Table 8: Elements: auth-constraint
Element	Required	Description
<description>	Optional	Description of the roles that are authorized
<role-name>	Optional	Roles that can access resources defined in the web-resource-collection of this security-constraint. If the idm.access.groupsAsRoles parameter is enabled, groups can be fully qualified with their realm/domain name. See the group element for more details.
<http-method>	Optional	Indicates which HTTP methods (for example, GET or POST) are subject to this security-constraint. If no method is indicated, then all methods are protected.

Security Issues

Security Issues

This section outlines the mechanisms in Single Sign-on for Java used to achieve secure operation, and outlines some areas that may need special attention. It assumes familiarity with basic security concepts, Kerberos, the HTTP protocol and Java EE application configuration.

Basic Recommendations

Security Issues > Basic Recommendations

Limit the use of basic fallback where possible (disabled by default).
Limit the lifetime of sessions, and ensure that session IDs are “unguessable”.
Ensure that the authorization rules limit users to their least privilege.
If using basic fallback, configure Active Directory to lock out users after some specified number of failed logins.
Do not use basic fallback where there is a high risk of Denial of Service attacks, or provide other countermeasures to prevent them.
Enable logging to at least the WARN level.

Deployment risks

Security Issues > Deployment risks

This section discusses some of the deployment risks associated with the implementation of a Single Sign-on for Java-based solution. These risks are not inherent to Single Sign-on for Java, but may impact on Single Sign-on for Java’s service availability or result in false positive/negative authentication.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center