I have not tried this configuration, however it should work. You need to create krb5.ini (may be krb5.conf on LINUX) for specifying realm(domain) details. And also create bscLogin.conf.
Create SPN for application(tomcat) server. Map the AD groups in CMC and check logging into InfoView and Client tools using AD authentication.
I don’t think there will be straight forward document for doing these steps on LINUX, however you can refer many articles regarding Windows AD authentication on Windows.
We tried these steps already, but probelly I’m makeing a error some ware. So fare I know is that the kerberos installation on the linux machine isn’t working correctly, but I’m not really sure.
I hope that there is someone how has done a installation like this and do have some documentation on it.
Windows / Start / All Programs / Tomcat / Tomcat Configuration / Java Tab
Add folowing options
-Djava.security.auth.login.config=\bscLogin.conf
-Djava.security.krb5.conf=\krb5.ini
-Dsun.security.krb5.debug=true (to trace in Tomcat authentification and « KDC not found » error message)
Then move the config files in the directory as set in these options.
The log of Tomcat is in the <Tomcat_Home>/Logs/stdout.log
When I had not set in AD Plugin in CMC the Default AD Domain with the REALMNAME set in krb5.conf, which is case sensitive, I get the following in stdout.log
Krb5LoginModule] user entered username: userid@domain.corp.com
[ ]
[Krb5LoginModule] authentication failed Cannot get kdc for realm REALMNAME
[ ]
Oh, I’m very sorry
You are right, maybe there is no graphic tool for Tomcat Configuration under Linux
But for some other parts and advices, you could note that I’ve changed for unix users.
Maybe readers had autocorrect these details.
But these were the hardest points I had to dig in the configuration steps : the SPN and the realm which are both case sensitive between BO and AD on one side (field Service Principal Name), and BO and krb5 on the other side (field Default AD Domain).
By the way, I’ve spent 3+ hours by phone with SAP support to resolve the case sensitive issue which was not directly documented.
And the SPN in my 3.1SP1 platform is not set to Tomcat, but to :
BOBJCentralMS/host.domain.corp.com (as said in a doc found in SAP support).
On the application account side, the AD Delegation could be “any service (kerberos only)” or “specified service” + “kerberos” + one BOBJCentralMS service type per CMS host in the list (and also one SPN per CMS host in AD).
(BOB member since 2006-12-19)
and if some one can share the document about their Environment setup then it would be quite helpful.
B!!
