Problems with AD/Kerberos/Java Authentication (CMC and InfoV

security CMC
1

Need some help. We are having issues using AD Authentication.

The environment includes: Crystal Reports 2008 and TomCat.

Here is what we have doen so far:

  1. Ran SETSPN and verified svcacct has associated SPN
  2. Setup CMC AD Authentication tab
  3. Created krb5 and bsclogin files with debug=true
  4. Ran kinit with no errors
  5. Tried to log into both CMC and InfoView
  6. Had AD Admin verify that there are not duplicate SPN’s
  7. Are logging in with the service account
  8. Have tried the user name with/without FQDN as suggested

Results:

  1. No entries in stdout or jce_verbose.log from the login attempts
  2. From CMC and InfoView, we get the following message when we try to login: Account Information Not Recognized: Active Directory Authentication failed to log you on. Please contact your system administrator to make sure you are a member of a valid mapped group and try again. If you are not a member of the default domain, enter your user name as UserName@DNS)DomainName, and then try again.

Here are the krb5 and bsclogin files:

Krb5.ini

[libdefaults]
default_realm = DEV.XXX.COM
dns_lookup_kdc = true
dns_lookup_realm = true
[realms]
DEV.XXX.COM = {
default_domain = DEV.XXX.COM
kdc = dcname.DEV.XXX.COM
}

bsclogin.conf

com.businessobjects.security.jgss.initiate {
com.sun.security.auth.module.Krb5LoginModule required debug=true;
};

ranger124 (BOB member since 2010-06-11)

2

Krb5.ini and bscLogin.conf files looks ok. I am just wondering about the Result 1 - why there isn’t any logs generated in stdout.log even after adding the debug=true in bscLogin.conf

Might be you missed to correctly add the below two lines in Tomcat Java parameter:
-Djava.security.auth.login.config=C:\winnt\bscLogin.conf
-Djava.security.krb5.conf=C:\winnt\krb5.ini

Check for any small mistake as it is Case sensitive.

Alternate option is try logging on to BO Client tools (such as Deski, Designer) with AD user and see if that works. This will narrow down the issue and we will just concentrate on Tomcat and AD part.

:wave:

nicholas (BOB member since 2008-07-31)