5.3 Configuring the Access Manager Identity Server to Consume the Kerberos Tickets

You must configure Access Manager to consume the Kerberos tickets from Active Directory. Access Manager can use the authentication information in the Kerberos tickets to enable single sign-on for the SAP Portal.

5.3.1 Enabling Logging for Kerberos Transactions

This helps to troubleshoot authentication issues.

  1. In the Access Manager Administration Console, click Devices > Identity Server > Edit > Logging.

  2. Select the File Logging and Echo to Console options to enable these options.

  3. Under the Component File Loggers Levels heading, set the Application option to debug.

  4. Enable Trace Logging, then select Application, Configuration, and User Store as Component Content Filters.

  5. Click OK, then refresh the Identity Server.

5.3.2 Creating the bcsLogin.conf File

The bcsLogin.conf file is an authentication file for the Java* authentication and authorization service (JAAS).

  1. In an text editor, enter the following lines:

    com.sun.security.jgss.accept {
com.sun.security.auth.module.Krb5LoginModule required
debug="true"
useTicketCache="true"
ticketCache="/opt/novell/java/jre/lib/security/spnegoTicket.cache"
doNotPrompt="true"
principal="HTTP/amser.provo.novell.com@AD.NOVELL.COM"
useKeyTab="true"
keyTab="/opt/novell/java/jre/lib/security/nidpkey.keytab"
storeKey="true";
};

    The file cannot contain any white space, only end-of-line characters.

    ticketCache: The location of the cache file where the Kerberos ticket is stored. In the example, this is the default location on SUSE® Linux Enterprise Server (SLES) 10. If you are using Windows for the cache, the default location is:

    C:\\Program Files\\Novell\\jre\\lib\\security\\spnegoTicket.cache

    The path must contain double slashes.

    principal: Specify the service principal name for the Access Manager Identity Server. This value is unique to your configuration.

    keyTab: Specify the location of the keytab you created in Creating a Keytab File. This value is unique to your configuration. In the example, this is the default location on SLES 10. If you are using Windows for the cache, the default location is:

    C:\\Program Files\\Novell\\jre\\lib\\security\\nidpkey.keytab

    The path must contain double slashes.

  2. Save this file with the name bcsLogin.conf.

  3. Copy this file to the same directory as where the keytab file is stored.

  4. Make sure that the permissions are set correctly. The permissions are set to 644.

  5. Restart Tomcat.

    Linux: /etc/init.d/novell-tomcat5 restart

    Windows: Stop and start the Tomcat service from the control panel.

    When a change is made to the bcsLogin.conf file, Tomcat must be restarted.

5.3.3 Creating a User Store for the Active Directory Domain

You need to either configure your Identity Server to use Active Directory as a user store or verify your existing configuration for your Active Directory user store.

  1. In the Administration Console, click Devices > Identity Servers > Edit.

  2. Click Local to view your user stores.

    If you have already configured your Identity Server to use the Active Directory server, click its name.

    If you haven’t configured a user store for the Active Directory server, click New.

  3. For a new user store, fill in the following fields. For an existing Active Directory user store, verify the values.

    Name: Specify a name for the user store for reference.

    Admin name: Specify the name of the administrator of the Active Directory server. Administrator-level rights are required for setting up a user store. This ensures read/write access to all objects used by Access Manager.

    Directory Type: Select Active Directory.

    Server replica: (Conditional) For a new Active Directory user store, click New to add a replica. Fill in the following fields:

    • Name: Specify a name of the replica for reference. This can be the name of the Active Directory server.

    • IP Address: Specify the IP address of the Active Directory server and the port you want the Identity Server to use when communicating with the Active Directory server.

    • Port: Specify the port that the Active Directory server uses to communicate to the Identity Server. This communication occurs over LDAP. The default non-secure port is 389. The default secure port is 636.

    Search Context: For a new user store, click New and specify the context of the administrator of the Active Directory server. For an existing user store, verify that you have an entry for the context of the administrator. Add a context if it is missing.

  4. Click OK to save the changes.

5.3.4 Creating a Kerberos Authentication Class for the Identity Server

  1. In the Local tab of the Identity Server, click Classes > New.

  2. Fill in the following fields:

    Display name: Specify a name to identify this class.

    Java Class: Select KerberosClass.

  3. Click Next.

  4. Fill in the following fields:

    Service Principal Name: Specify the value of the servicePrincipalName attribute of the Identity Server user. This is the user created in Creating a User Account in Active Directory for the Identity Server.

    Kerberos Realm: Specify the name of the Kerberos realm. The default value for this realm is the domain name of the Active Directory server, entered in all capitals. The value in this field is case sensitive.

    JAAS config file for Kerberos: Specify the path to the bcsLogin.conf file. This is the created in Creating the bcsLogin.conf File.

    Kerberos KDC: Specify the IP address of the Active Directory server.

    User Attribute: Specify the attribute in the Identity Vault that contains the userPrincipalName from Active Directory. For example, the mail attribute in the Identity Vault can store the userPrincipalName from Active Directory.

    If this attribute does not contain the userPrincipalName from Active Directory, the authentication into the SAP Portal fails.

  5. Click Finish to save the authentication class.

5.3.5 Creating a Kerberos Method for the Identity Server

  1. In the Local tab of the Identity Server, click Method > New.

  2. Fill in the following fields:

    Display name: Specify a name to identify this method.

    Class: Select the Kerberos class created in Creating a Kerberos Authentication Class for the Identity Server.

    User stores: Move the user store for the Identity Vault to the list of User stores. This must be the Identity Vault user store, not the Active Directory user store.

  3. Click Finish to save the method.

5.3.6 Creating a Kerberos Contract for the Identity Server

  1. In the Local tab of the Identity Server, click Contract > New.

  2. Fill in the following fields:

    Display name: Specify a name to identify this contract.

    URI: Specify a value that uniquely identifies the contract from all other contracts.

    The URI cannot begin with a slash, and it must uniquely identify the contract. For example: kerberos/contract.

    Methods: From the list of available methods, move the Kerberos method, created in Creating a Kerberos Method for the Identity Server, to the Methods list.

  3. Click Finish to save the contract.

5.3.7 Verifying the Kerberos Configuration

To view the catalina.out (Linux) or the stdout.log (Windows) file of the Identity Server:

  1. In the Administration Console, click Auditing > General Logging.

  2. In the Identity Servers section, select the catalina.out or stdout.log file.

  3. Download the file and open it in a text editor.

  4. Search for Kerberos and verify that a subsequent line contains a Commit Succeeded phrase. For the configuration example, the lines look similar to the following:

    principal's key obtained from the keytab
principal is HTTP/amser.provo.novell.com@AD.NOVELL.COM
Added server's keyKerberos Principal HTTP/amser.provo.novell.com@AD.NOVELL.COMKey Version 3key EncryptionKey: keyType=3 keyBytes (hex dump)=0000: CB 0E 91 FB 7A 4C 64 FE

[Krb5LoginModule] added Krb5Principal HTTP/amser.provo.novell.com@AD.NOVELL.COM to Subject
Commit Succeeded

  5. If the file does not contain any lines similar to these, verify that you have enabled logging. See Enabling Logging for Kerberos Transactions.

  6. If the commit did not succeed, search backward in the file and verify the following values:

    • Service Principal Name

    • Name of keytab file

    For the example configuration, the file contains lines with text similar to the following:

    Principal is HTTP/amser.provo.novell.com

KeyTab is /usr/lib/java/jre/lib/security/nidpkey.keytab

  7. (Conditional) If you make any modifications to the configuration, either in the Administration Console or to the bcsLogin file, restart Tomcat on the Identity Server.

5.3.8 Creating a SAML Identity Injection Policy

You must create a SAML identity injection policy for Access Manager to use. This allows the authentication information in the Kerberos tickets to be passed to the Role Mapping Application.

  1. In the Administration Console, click Policies > Policies > Master_Container.

    The policy must reside in the master container.

  2. Click New to create a new policy.

  3. Specify a name to identify the policy.

  4. For the policy type, select Access Gateway: Identity Injection.

  5. Click OK.

  6. Fill in the following fields to define the policy:

    Description: Specify a description for the policy.

    Priority: Leave the priority at the default level of 1.

    Actions: Click New > Inject into Authentication Header.

    • User Name: Select Credential Profile, then select LDAP Credentials:LDAP User Name for the username.

    • Password: Select Credential Profile, then select SAML Credentials:SAML Assertion

    • Multi-Value Separator: Leave the default separator as a comma.

    • DN Format: Leave the default DN format as LDAP.

  7. Click OK twice to save the policy.

5.3.9 Refreshing the Identity Server

In order for the changes to the Identity Server to take affect, you must refresh the Identity Server.

  1. In the Administration Console, select Devices > Identity Servers.

  2. Select your Identity Server, then click Refresh.

  3. Click Close.