Setup SSO with Windows Desktop is not so hard. But when things is not well documented you can get a big headake. A customer ask to implement this SSO. The environment was a WebSphere Portal V.8.0 cluster and the user repository was AD 2012.
I setup the system following several documents from IBM and other blogs. The SSO just not work.
Searching a log for one solution i found the following:
DES Encryption and Kerberos Authentication:
Starting with Windows Server 2008 R2, domain controllers (and domain members) will no longer allow DES encryption for Kerberos tickets. DES encryption was cracked last millennium, so it’s time to move on to better encryption mechanisms like AES.
http://blogs.technet.com/b/askpfeplat/archive/2013/06/03/upgrade-active-directory-to-windows-server-2012-phase-1-assessment.aspx
The solution was simple:
Before AD 2008 the keytab generation was:
ktpass –out appserver1.keytab –princ HTTP/[email protected] –mapuser wastest –pass password -ptype KRB5_NT_PRINCIPAL
For AD 2012 the keytab command line must include the encryption type other than DES and one supported by WebSphere V8.0.x.
I use the following:
ktpass –out appserver1.keytab –princ HTTP/[email protected] –mapuser wastest –pass password -ptype KRB5_NT_PRINCIPAL -crypto RC4-HMAC-NT
The RC4-HMAC-NT did the trick.
This document show the step by step i follow.
There is a vulnerability in IBM WebSphere Application Server that could allow an HTTP response splitting attack in Channel.
More information on this link
Several versions of WebSphere Portar are vulnerable.
BM WebSphere Portal could allow a remote attacker to obtain sensitive information, caused by the failure to restrict access to resources located within web applications. An attacker could exploit this vulnerability to obtain configuration data and other sensitive information.
How to fix this vulnerability ? Go to this link from IBM
I used this tool when i was migrating from V8.0 to V8.5.5. This guide is a must read for WPS Administrators.
This guide provides a comprehensive approach to performing staging to production using Portal Application Archive (PAA) in IBM WebSphere Portal 8.5.
Introduction
Preparing the source environment
Preparing the target environment
Creating the initial release
Deploying the initial release
Updates with syndication
Updates with ReleaseBuilder
Known Problems
Acknowledgments
References
Change History
click here to read the full article