Windows AD with Java Tomcat with SSO.

system · July 10, 2007, 10:37am

Hi all,

I spend days to try to configured windows AD with Java Tomcat using SSO.

A follow this manual http://support.businessobjects.com/communityCS/TechnicalPapers/boe_xi_r2_AD_authentication_on_Java_App_Servers.pdf

But I have a problem with Infoview, I can login in CMC but not in Infoview, give me this error.

I read 5x that manual and not sucess.
PLEASE HELP ME
I have these files.
c:\windows\krb5.ini
[libdefaults]
default_realm = BUSINESSOBJECTS.DEV
dns_lookup_kdc = true
dns_lookup_realm = true
[realms]
BUSINESSOBJECTS.DEV = {
default_domain = BUSINESSOBJECTS.DEV
kdc = B-OBJECTSDEMO.BUSINESSOBJECTS.DEV
}
c:\windows\bscLogin.conf
com.businessobjects.security.jgss.initiate {
com.sun.security.auth.module.Krb5LoginModule required;
};

And they are configured in Tomcat server.

I use this kinit with the AD user and work.

Anyone help me…

Many thanks

mapinheiro (BOB member since 2006-01-27)

system · July 10, 2007, 7:24pm

Two things to check:

Make sure that your Domain Controller Name is correct. The “kdc” in the krb5.ini file …

must be the name of the server that functions as your domain controller. This is NOT your BO application or web server, this is a remote network server that performs the authentication to Windows AD.

Also, make sure the user running the Tomcat service on your web server(s) (should be a Windows Service Account, not a local user) can query the Domain Controller in krb5.ini file. Your network team will need to set this up, it is not automatic.

Each user account for BO must be the exact Windows AD user (or aliased to it) or the authentication will fail. For example, if the default BO Enterprise user is JBUCKLEY but Windows AD user is JBUCK, when I try to login as JBUCKLEY using Windows AD authentication, it will fail. You will need to add an alias so that JBUCKLEY (Enterprise)=JBUCK (WinAD). This will need to be done for every user when using separate Enterprise Logins.

Good Luck,

Jim

JimBuckRG (BOB member since 2006-07-17)

system · July 11, 2007, 10:45am

Hi Jim,

Thanks for your replay.
But I try to do that but now the Infoview give me this error.

Yes I have the same name in AD and CMC.
Yes the CMS and Tomcat use the AD user to run this services.
Yes I try to use kinit.exe and work.
Yes i use Klist to see them and work.
Yes I can logon with AD user to CMC.
Yes I can create more user in AD and see them in CMC.

But whend I try to use a AD user in Infoview I have this error.

Please help me…

Many thanks
Marco

mapinheiro (BOB member since 2006-01-27)

system · July 11, 2007, 12:26pm

Marco,

That looks like there is something wrong with your Tomcat setup. Can you log into the Java InfoView with an Enterprise user account?

If no, you may be missing some of the InfoView files that make the “Business Objects/desktoplaunch” application work. The best thing to do there is to remove the applications from Tomcat, verify the additional settings required (follow the “Deploying on Tomcat - Chapter 4” instructions from the XI R2 Installation Guide), restart Tomcat and then redeploy all the applications.

If yes, try changing the Authentication Options in the CMC (under Authentication -> Windows AD) to “Use NTLM authentication” instead of Kerberos. This is how our system is setup. We could not get it to work using Kerberos directly.

Hope this helps,

Jim

JimBuckRG (BOB member since 2006-07-17)

system · July 11, 2007, 12:42pm

Hi Jim,

One more time I would like to thank you for your email.

Yes I can logon with Enterprise user
I can logon with AD user only in CMC and not in Infoview.

I try to enable this option (Use NTLM authentication) and give me this error.

Damn I am stuck and jammed

Marco

mapinheiro (BOB member since 2006-01-27)

system · July 11, 2007, 1:01pm

Marco,

I know what you are saying. The documentation looks easy to follow, but there are lots of places where you can make mistakes. It took us almost a full week to get everything working on our system. Keep trying, you will get there.

Another thing to check would be in the Tomcat Admin tool. Check that your “Java Options” include all the Business Objects extra code. Here is what our Java Options looks like:

-Dcatalina.home=C:\Tomcat
-Djava.endorsed=C:\Tomcat\common\endorsed
-Djava.endorsed.dirs=C:\Tomcat\common\endorsed
-Djava.io.tmpdir=C:\Tomcat
-Dcatalina.base=C:\Tomcat
-Xrs
-Djava.library.path=C:\WINDOWS\system32\;D:\BO\BusinessObjects Enterprise 11.5\win32_x86\;D:\BO\OLAP Intelligence 11.5\DHTML Components\;
-Dbusinessobjects.olap.bin=D:\BO\OLAP Intelligence 11.5\DHTML Components
-Dadhoc.path=D:\BO\adhoc
-Dbusinessobjects.olap.stylesheets=D:\BO\OLAP Intelligence 11.5\stylesheets
-Djava.security.auth.login.config=C:\krb5\bscLogin.conf
-Djava.security.krb5.realm=BOSTON.FIRM
-Djava.security.krb5.kdc=BODC1.BOSTON

Some of these things will be different on your system: we installed Tomcat @ C:\Tomcat, BO XI @ D:\BO and the krb5.ini and bscLogin.conf files @ C:\krb5, you will need to put in the directories on your server that you used.

Also, make sure your default domain (“realm”) and domain controller (“kdc”) match what is in the Authentication tab for Windows AD in the CMC. These are usually case-sensitive, which may be another reason why this fails (BOSTON.FIRM is not the same as boston.firm).

If you find something missing or misspelled, you will need to stop and restart Tomcat.

Good Luck,

Jim

JimBuckRG (BOB member since 2006-07-17)

system · July 11, 2007, 1:14pm

Ohhhhh, Many thanks Jim…

I put this in my Java option.

-Djava.library.path=C:\WINDOWS\system32;C:\Program Files\Business Objects\BusinessObjects Enterprise 11.5\win32_x86
-Dcatalina.base=C:\Program Files\Business Objects\Tomcat
-Dcatalina.home=C:\Program Files\Business Objects\Tomcat
-Djava.endorsed.dirs=C:\Program Files\Business Objects\Tomcat\common\endorsed
-Xrs
-Dbusinessobjects.olap.bin=C:\Program Files\Business Objects\OLAP Intelligence 11.5\DHTML Components
-Dbusinessobjects.olap.stylesheets=C:\Program Files\Business Objects\OLAP Intelligence 11.5\stylesheets
-Daf.configdir=C:/Program Files/Business Objects/Performance Management 11.5/
-Djava.security.krb5.realm=B-OBJECTSDEMO.BUSINESSOBJECTS.DEV
-Djava.security.krb5.kdc=B-OBJECTSDEMO.BUSINESSOBJECTS.DEV
-Djava.security.auth.login.config=C:/winnt/bscLogin.conf
-Dcrystal.enterprise.trace.configuration=verbose

is it correct?

Marco

mapinheiro (BOB member since 2006-01-27)

system · July 11, 2007, 1:24pm

Hi Jim,

Can you tell me what java version do you have in your systems?

Marco

mapinheiro (BOB member since 2006-01-27)

system · July 11, 2007, 1:30pm

Hi Jim,

Sorry one more time.
I create a debugger in java tomcat. Give a quick look in this file.

Marco
stdout.txt (44.0 KB)

mapinheiro (BOB member since 2006-01-27)

system · July 11, 2007, 1:34pm

Marco,

The realm and kdc need to be different.

“Realm” is the name of the Windows Domain that users log into and “kdc” is the name of the actual Domain Controller server. In your case, the default domain (“realm”) would be "BUSINESSOBJECTS.DEV " and the server (“kdc”) should be “B-OBJECTSDEMO.BUSINESSOBJECTS.DEV”.

Only other thing I see is that some lines have directory paths with "" and some with “/”.

Try changing the last few entries to "" (i.e. C:\winnt\bscLogin.conf ), Tomcat may be confused by this.

Otherwise, all the lines look fine.

Good luck,

Jim

JimBuckRG (BOB member since 2006-07-17)

system · July 11, 2007, 1:50pm

Hi Jim…

Bad news…
DAMNNNNNN
Nooooooo, didn’t work…

Damnnnnn…

Give me the same error

About the java version…

I am loseing my mind…

Marco

mapinheiro (BOB member since 2006-01-27)

system · July 11, 2007, 2:23pm

Marco,

I apologize, I did not see the Java questions earlier in the thread before my last message.

We are using Tomcat 5.0.27 with J2SDK 1.4.2.12 and JRE 1.5.0.06.

Looking at the STDER.LOG, one of two things are happening: either the domain controller server (kdc) is not correct or the user trying to query the domain controller does not have access to do so.

Each time the “SecWinAD” authentication is called, it fails. I think you need to find out what the name of the actual Windows Domain Server is. You are trying to hit the BO XI server (B-OBJECTSDEMO.BUSINESSOBJECTS.DEV) as the domain controller, but this may not be correct. Ask one of your network admins what the “Windows AD domain and domain controller server name” are. This will be what need to go in Tomcat and the CMC to make this work. Once you have this domain and domain controller, you will need to change these in the CMC as well as Tomcat.

Also, the user trying to initiate contact with the domain controller, appears to not be able to. Here is the error that shows this:

Again, ask the network admins to make sure this user has read access to the Windows AD domain.

Jim

JimBuckRG (BOB member since 2006-07-17)

system · July 11, 2007, 2:40pm

Hi Jim,

I have a virtual machine with Windows 2003 using AD and BO install in the same machine.
So the B-OBJECTSDEMO.BUSINESSOBJECTS.DEV is the same.
DOMAIN is BUSINESSOBJECTS.DEV
server name is B-OBJECTSDEMO

Thanks

Marco

Do you have MSN?

mapinheiro (BOB member since 2006-01-27)

system · July 11, 2007, 2:56pm

Marco,

Then my issues with the kdc are no longer issues.

Next, check that the “mpinheiro@BUSINESSOBJECTS.DEV” user is populated in your AD domain user list and has access to query the domain controller. If you copied the AD user list from your actual domain, those users will still have the original domain listed, not BUSINESSOBJECTS.DEV.

Other than that, I am not sure where else to check. Maybe you have a Tomcat expert in house that could help. When we got stuck, we had to bring one in (it is not me, I just remember what we learned but am not an expert).

Good Luck,

Jim

P.S. Unfortunately, my company doesn’t allow IM at all.

JimBuckRG (BOB member since 2006-07-17)

system · July 11, 2007, 2:59pm

Hi Jim…

Thank you for everything.

I will download the J2SDK 1.4.2.12 and try one more time to do that.

please this is my personal email.
malexandrepinheiro@gmail.com

Many thanks Jim

Marco

mapinheiro (BOB member since 2006-01-27)

system · July 11, 2007, 4:20pm

Goood news Jim.

It’s done… It’s working…

I can now logon in Infoview… But I am trying to use SSO. It is possible.

example, when I logon in AD account, windows and call infoview I don’t need to logon one more time here.

Marco

mapinheiro (BOB member since 2006-01-27)

system · July 23, 2007, 7:52pm

Hi Marco,

Did you have SSO and Windows AD authentication working fine? We are facing similar issues at our end. Did you apply SP2 in your BOXIR2 enviroment to get this working?

I appreciate your feedback.

Thanks
Bachi

dbkar (BOB member since 2003-11-10)

system · July 23, 2007, 8:10pm

Create the krb5.ini and bscLogin.conf Java configuration files. File contents are as follows, please note these are Case Sensitive

krb5.ini
With the following values:

[libdefaults]
default_realm = .COM
dns_lookup_kdc = true
dns_lookup_realm = true
[realms]
.COM = {
kdc = AD..COM
default_domain = .COM
}

bscLogin.conf
With the following values:

com.businessobjects.security.jgss.initiate {
com.sun.security.auth.module.Krb5LoginModule required;
};

Here are some steps to troble shoot the problem:

Create a folder on the C:\ drive of the Web server called WINNT. Place both files in that folder. This will be used for kinit connectivity testing and that folder is where the utility will look for these files.

Also, place both of these files in the
\\d$\Program Files\Business Objects\Tomcat\conf directory on the Web server.

Test the formatting and functionality of your Java configuration files on the Tomcat web application server by using the kinit command.

The general format is kinit username@BCBSNC.COM secretpassword (without the quotes).
If this works properly, you will not see any error messages.
The next command you should enter is klist (without the quotes).
You should see a Default principal confirmation reply.

Place the following two entries at the bottom of the Tomcat Configuration / Java tab / Java Options section.

-Djava.security.auth.login.config=D:\Program Files\Business Objects\Tomcat\conf\bscLogin.conf
-Djava.security.krb5.conf=D:\Program Files\Business Objects\Tomcat\conf\Krb5.ini

Stop and re-start the Tomcat web application server in the CCM or in the Services application.

EnterpriseArchitect (BOB member since 2006-03-23)

system · July 24, 2007, 5:16pm

Marco,

I have the same problem that you post in this forum: My InfoView doen’t work with AD authentication and my CMC works.

I woul like to know what do you did in post dated 11 Jul 2007 16:20 to solve your problem. I believe that I have with the same situation.

More: Did you use a domain account to star your Tomcat service?

Thank you,

powerpuff (BOB member since 2007-07-24)

system · July 24, 2007, 5:57pm

Hi all,

Yes is correct about to link BO with AD, I spend hours to try to find to issue to use SSO, and at the moment I have no succeed.

I think I will have the answer next week.

Regards
Marco

mapinheiro (BOB member since 2006-01-27)