In the almost two years of Centrifying we have discussed Identity Consolidation with AD and Single Sign-on at length. 90% of organizations have Active Directory but sometimes over-complicate things when it comes to identity consolidation and SSO.
I had the chance to speak about this in a seminar and these two videos consolidate many entries that we've covered in this blog over the years.
Direct Integration
Name Service Switch, Pluggable Authentication Modules, GSSAPI, Kerberos and Proxies
OpenSSH SSO over an outgoing external non-transitive AD one-way trust
NSS and PAM using Oracle DB as an example (externally identified user)
The idea is to eliminate complexity and promote reuse by committing to Active Directory, let the Centrify DirectControl agent do the heavy-lifting for Direct Integration and use the SPNEGO plugins when needed.
For the full briefing, including marketing slideware go here.
Java application servers like JBOSS, Tomcat, WebSphere
and WebLogic are pervasive in large enterprises. So is Active Directory. Just like with Apache HTTP, Centrify
customers can leverage the tight AD integration in UNIX and Linux platforms and
great support for the Windows platform as well.
We covered the benefits during the Apache HTTP
SSO discussion, and the principles are the same. This post covers how to install the Java
SSO module using Apache Tomcat as an example.
Requirements
A Centrified Unix/Linux system running Apache Tomcat (Tomcat6 in
this example)alternatively, you can follow on JBOSS, WebSphere or WebLogic as well. The system should be joined to a domain either in zone or workstation mode.
Apache Tomcat running and accesible
A domain-joined PC system (or a centrified Mac) to test access from an authenticated
Windows system with a web browser (SPNEGO is not
available on Safari)
Implementation Steps
Information gathering
1.Collect the OS version, architecture, version of Centrify
adclient and if an SPN for HTTP is registered uname -a, adinfo -v and adinfo -C | grep http provide that information
2.Collect the service status, version, architecture and java
version. “service tomcat(x) status, rpm –qa | grep tomcat and java-versiont” should
provide this.
3.Make sure the Tomcat home page (if enabled) is accessible from
the Windows client.
4.Obtain the proper version of the J2EE SSO plugin from the
Centrify Customer Support Center.
Based on the information from steps 1 and 2, you can select which package to
download. For example, in my CentOS 6.x, 64bit, Tomcat6
$ uname -a
Linux engcen8.centrifyimage.vms 2.6.32-504.el6.x86_64 #1 SMP Wed
Oct 15 04:27:16 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux
Configuration of the Java
Server and Sample Application
Centrify provides a script that allows for the configuration of
JBoss, Tomcat, Websphere and Weblogic.
These servers can run on Microsoft Windows, so there are versions of the
plugin for those platforms too. The script
is in /usr/share/centrifydc/java/web and it’s called configure.pl. All you need to do is follow the prompts to
configure Tomcat (options 1-3) and ignore everything about ADFS or
certificates at this time.
Do you want to setup
the Centrify ADFS samples now (y/n) ?
(You must have the
ADFS server's hostname and SSL port to setup the ADFS samples.)
[n] >
Verify that everything is working as expected
1.Sign-in to a Windows client that is a member of your AD Domain
2.Clear your Kerberos ticket cache by opening a command line and
typing "klist purge" C:\Users\dwirth>klist purge
Current LogonId is 0:0x9bb0d
Deleting all tickets:Ticket(s) purged!
3.Open Internet Explorer and go to Internet Options > Security
> Local Intranet > Sites > Advanced and make sure that your browser
has the FQDN or the suffix of the SPN for HTTP registered by the server.
If using Firefox, go to about:config and search
for network.automatic-ntlm-auth.trusted-uris, add the SPNs suffix or FQDN
there.
4.Go browse to http://<your-server>/centrifydc-samples.
This will expose the Centrify Sample pages. Click on Kerberos.
If everything is correct, you should be able to see output that looks
like this:
Now if you
inspect your kerberos ticket cache, you'll something like this (truncated): C:\Users\dwirth>klist
Current LogonId is 0:0x9bb0d
#0> Client: DWirth @
CENTRIFYIMAGE.VMS
Server: krbtgt/CENTRIFYIMAGE.VMS @ CENTRIFYIMAGE.VMS #1>Client: DWirth
@ CENTRIFYIMAGE.VMSServer: HTTP/engcen8.centrifyimage.vms @ CENTRIFYIMAGE.VMS
Ticket # 0 is a Kerberos TGT and #1 is a service ticket that was
requested by Diana to access the Apache HTTP service on engcen8.
Using the Java Plugin
The Java plugin has exposed the methods to leverage AD
authentication via Centrify. For
example, the web.xml file of a server may add directives like these:
