Windows Authentication on the Single Connect GUI
Windows Authentication can be used to log in to the Single Connect GUI. The required settings are outlined in this section. The following terms are used in the configuration steps:
Domain Controller: DomainControllerFQDN (Ex: WIN-TEST.singleconnect.com) Single Connect Server: schostnameFQDN (Ex: sc-test.singleconnect.com) Domain Name: DomainName (Ex: singleconnect.com)
The following configurations should be set on the Domain Controller:
- Create a user (Ex: username: win_auth, password: 123)
- Create an SPN (Service Principal Name) for this user, using the following command: setspn -A HTTP/SingleServerHostname username (Ex: setspn -A HTTP/ sc-test.singleconnect.com win_auth)
- Create an “sc.keytab” file using the following command: ktpass /out c:\sc.keytab /mapuser usernameFQND /princ HTTP/ schostnameFQDN@domainName /pass password /kvno 0 (Ex:ktpass /out c:\sc.keytab /mapuser [email protected] /princ HTTP/sc-[email protected] /pass 123 /kvno 0)
The following configurations should be set on the Single Connect server:
- Establish an SSH connection to Single Connect as the pamuser user.
- Move the “sc.keytab” file under “$CATALINA_BASE/conf/”. (The default Catalina base directory is “u01/netright-tomcat”)
- Create the “krb5.ini” file in the Tomcat Server under “$CATALINA_BASE/conf/” with the following example content: [libdefaults] default_realm = SINGLECONNECT.COM default_keytab_name = FILE:/u01/netright-tomcat/conf/sc.keytab default_tkt_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96 default_tgs_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96 forwardable=true [realms] SINGLECONNECT.COM = { kdc = WIN-TEST.singleconnect.com:88 } [domain_realm] SingleConnect.com= SINGLECONNECT.COM .SingleConnect.com= SINGLECONNECT.COM
- Add the following lines at the end of the “$CATALINA_BASE/bin/setenv.sh” file: export CATALINA_OPTS=”-Djava.security.krb5.conf=/u01/netright-tomcat/conf/krb5.ini” export CATALINA_OPTS="-Djavax.security.auth.useSubjectCredsOnly=false"
The following configurations should be set on the client’s browser. Configurations made for the Internet Explorer (IE) also activate the Edge and Chrome browsers.
For Internet Explorer (IE):
- Go to Settings > Internet Options > Security.
- Select Local Intranet Zone, click the Sites button, check all three options, and click the Advanced button to add the Single Connect Server Name to this zone. Ex: http://sc-test.SingleConnect.com
- Select Local Intranet Zone, click the Custom Level button, and select Automatic logon only intranet.
For Firefox:
- Type about:config on the address bar, accept the warning, and change the network.negotiate-auth.trusted-uris value to Single Connect Server Hostname Ex: http://sc-test.singleconnect.com
- Restart the computer.
- Access the application by typing the Single Connect Server Hostname on the address bar, without the IP. Ex: http://sc-test.singleconnect.com
Add the following parameters in the System Config Manager:
- Navigate to Administration > System Config. Man.
- Add these parameters: windows.auth.keytab.path = /u01/netright-tomcat/conf/sc.keytab windows.auth.spn = HTTP/SingleConnectServerName Example value: HTTP/sc-test.SingleConnect.com aioc.auth.windows = true