thanks for the link.
Steps in SAP Note are very similar. I added the right “Replace a Process Level Token” as requested in your link. I don’t use keytab, because I’m waiting to see all is running ok.
One question about this sentence,
ktpass -out BOSSO.keytab princ BOSSO/bo.service.power.internal@POWER.INTERNAL -mapuser bo.service@POWER.INTERNAL -pass admin -kvno 255 -ptype KRB5_NT_PRINCIPAL -crypto RC4-HMAC-NT
if bo.service is the service account, why do you reference it as bo.service.power.internal@POWER.INTERNAL ? bo.service@POWER.INTERNAL is valid?
My service account is boadmin. My domain is ADDOMAIN (FQDN: CUSTOMER.NET) and SPN is BOCMS …then the correct ktpass command can be:
ktpass -out BOSSO.keytab princ BOCMS/BOADMIN@CUSTOMER.NET -mapuser BOADMIN@CUSTOMER.NET -pass admin -kvno 255 -ptype KRB5_NT_PRINCIPAL -crypto RC4-HMAC-NT
My SPN is “setspn.exe -a BOCMS/ADDOMAIN BOAdmin” so in Step 8, I’ve tried with in CMC with Service principal name= BOADMIN, and Service principal name= BOCMS/ADDOMAIN
Both allow me to manual login.
in web.xml
I’ve tried also as idm.princ = BOADMIN and BOCMS/ADDOMAIN
<init-param>
<param-name>idm.princ</param-name>
<param-value>BOADMIN</param-value>
</init-param>
when I try SSO, with idm.princ = BOADMIN
in log I can read:
[DEBUG] jcsi.kerberos: ** creating AS request .. **
for client: BOADMIN
at realm: CUSTOMER.NET
and I get the ticket:
++++++++++++++++++++++++++++
Credential
client: BOADMIN@CUSTOMER.NET
session key: [23, 39 45 b e0 73 dd 62 54 a3 55 16 82 34 5a 9c 9e ]
service principal: krbtgt/CUSTOMER.NET@CUSTOMER.NET
valid from: Tue Dec 21 12:13:06 CET 2010
valid till: Tue Dec 21 22:13:04 CET 2010
Ticket:
encryption type: 23
service principal: krbtgt/CUSTOMER.NET@CUSTOMER.NET
ticket flags: forwardable forwarded
valid for: all addresses
++++++++++++++++++++++++++++
and error:
message com.wedgetail.idm.sso.ProtocolException: com.wedgetail.idm.spnego.server.SpnegoException: com.dstc.security.util.asn1.Asn1Exception: Bad tag encountered: 78
description The server encountered an internal error (com.wedgetail.idm.sso.ProtocolException: com.wedgetail.idm.spnego.server.SpnegoException: com.dstc.security.util.asn1.Asn1Exception: Bad tag encountered: 78) that prevented it from fulfilling this request.
when I try SSO, with idm.princ = BOCMS/ADDOMAIN
in log I can read
[DEBUG] jcsi.kerberos: ** creating AS request .. **
for client: BOCMS/ADDOMAIN
at realm: CUSTOMER.NET
and throws:
"{ERROR} [localhost].[/InfoViewApp] Thread [Thread-1]; Exception starting filter authFilter
com.wedgetail.idm.sso.ConfigException: Configured service principal name could not be found [caused by: GSSException: Failure unspecified at GSS-API level (Mechanism level: com.dstc.security.kerberos.KerberosError: Client not found in Kerberos database"
I will try with keytab.
Thanks.
xavibo (BOB member since 2007-06-11)
