Troubling Shooting Windows AD Authentication

server administration XI Server Discussion
1

We currently have BI 4.1 SP3 installed on working fine. We are now upgrading to BI 4.2 SP5. We are doing this by installing BI 4.2 SP5 onto a new server. Once it’s setup and working we’ll transfer all the content to it and start using it.

We got it installed and working with enterprise authentication. However, we’ve been unable to get Windows AD authentication to work. When we try to login we get the following error.

Following is the setup we’ve done.

The service account for authentication is bus.service. This is the same account we’re using for the current install of BI 4.1 SP3. We’ve added new SPNs to it. bc3busobject4 is the server for BI 4.1 SP3. bc3busobjects42 is the new server for BI 4.2 SP5. So it now looks like the following.

We then created krb5.conf in C:\Windows

And bcsLogin.conf in C:\Windows

We then successfully tested authentication through Java.

We then updated Java settings in Tomcat.

The following is what we found in the Tomcat log stdout.log.

What do we need to do to get this to work?

Thanks,
Skye

SkyeMacMaster (BOB member since 2013-05-15)

2

I think part of AD authentication requires keytab files. Your tomcat log seems to indicate you are not using them. I’ve had problems with AD authentication myself and never could get it to work without the wedgetail entry in the Java option panel of the Tomcat config like this:

-Dcom.wedgetail.idm.sso.password=mypassword

where password is the password for the AD account used to provide the AD authentication. In our case the user account that the SIA runs under.

Also in the CMC use must setup AD auth and have at least one group imported that has your users.

Also be careful creating SPNs against a production user. We had something flaky happen last week when we created an SPN and it somehow changed the login name of the account to HTTP/servername. This created problems later for jobs that use the account.

richardcottave (BOB member since 2006-03-30)

3

Ok, I created a new service account, svc-bus.service. Set the spn so it looks like

I then added that line you suggested to the Tomcat Java settings.

I do have a group mapped in the CMC and about 74 users created from that.

I’m still getting them same error message.

Do you have any more ideas?

Thanks,
Skye

SkyeMacMaster (BOB member since 2013-05-15)

4

See if you can login into the central configuration manager with AD authentication. That will tell you if you are able to authenticate with AD. Once that works then there are several other steps you need to do including: There are more SPNs required. At least 3 listed in the admin guide. You also need keyab files. And you need to configure your BiLaunchPad.properties and Global.Properties files. I would suggest looking in the admin guide theres a bunch of info for setting up AD authentication.

richardcottave (BOB member since 2006-03-30)

5

I can log onto the ‘Manage Servers’ thing on CCM using AD. Is that what you mean by log into the CCM?

The sticky article for the forum, HOWTO BO4 SSO using AD and Kerberos, says only the one spn is needed. So I only added the one. I added the others that the manual lists. So it looks like this now.

I have configured BiLaunchPad.properties. Do I need to change something in Global.Properties? We don’t have any thing configured in Global.Properties for the current working install of BI 4.1 SP3.

The manual indicates that keytab files are needed for SSO. I’m not trying to setup SSO. Do I still need them for AD authentication?

Thanks,
Skye

SkyeMacMaster (BOB member since 2013-05-15)

6

Yes if you can login to Manage Servers using CCM with AD then your AD Plugin is working. If you’re not doing SSO you won’t need keytab files. As far as I know you need entries in the Global.properties file.

richardcottave (BOB member since 2006-03-30)

7

Well, there are entries in global.properties. I meant we didn’t change anything from the defaults.

global.properties

If the AD Plugin is working from CCM then what could be causing authentication to fail when I try to log onto BiLaunchPad?

Thanks,
Skye

SkyeMacMaster (BOB member since 2013-05-15)

8

I don’t think the default settings in the BiLaunchPad and Global properties files will work. They must be customized for your environment.

richardcottave (BOB member since 2006-03-30)

9

Figured out the problem. When I saved the krb file in the windows folder, I named it krb5.conf instead of krb5.ini.

Authentication is working perfectly now.

Skye

SkyeMacMaster (BOB member since 2013-05-15)