WebSphere Portal V8.0 setup SPNEGO and a small big difference

07 Dec, 2015

Setup SSO with Windows Desktop is not so hard. But when things is not well documented you can get a big headake. A customer ask to implement this SSO. The environment was a WebSphere Portal V.8.0 cluster and the user repository was AD 2012.

I setup the system following several documents from IBM and other blogs. The SSO just not work.

Searching a log for one solution i found the following:

DES Encryption and Kerberos Authentication: Starting with Windows Server 2008 R2, domain controllers (and domain members) will no longer allow DES encryption for Kerberos tickets. DES encryption was cracked last millennium, so it’s time to move on to better encryption mechanisms like AES.

http://blogs.technet.com/b/askpfeplat/archive/2013/06/03/upgrade-active-directory-to-windows-server-2012-phase-1-assessment.aspx

The solution was simple:

Before AD 2008 the keytab generation was:

ktpass –out appserver1.keytab –princ HTTP/appserver1.[email protected] –mapuser wastest –pass password -ptype KRB5_NT_PRINCIPAL

For AD 2012 the keytab command line must include the encryption type other than DES and one supported by WebSphere V8.0.x.

I use the following:

ktpass –out appserver1.keytab –princ HTTP/appserver1.[email protected] –mapuser wastest –pass password -ptype KRB5_NT_PRINCIPAL -crypto RC4-HMAC-NT

The RC4-HMAC-NT did the trick.

This document show the step by step i follow.

PrevNext

Proud to be an HCL Ambassador 2021

15 Dec, 2020

If you have a problem, and no-one else can help, and if you can find them, maybe you can ask an HCL Ambassador… !(http://www.mysphere.com.br/wp-content/uploads/2020/12/HCLAmbassaborlight4x.png) See the HCL Ambassadors Class of 2021(https://hcltechsw.com/about/hcl-ambassadors/class-of-2021)

06 Sep, 2019

The Configuration Comparison Tool (CCT) is a lightweight wsadmin script and Python report generation script which will produce HTML reports on configuration settings for the following types of resources. - Application Servers - Node Agents - Global Security configuration (not Domain Security) - Trust Association (Global and Domain) - SSL Configurations - Data Sources - J2C Resource Adapters - JDBC Drivers - Object Cache instances - Servlet Cache instances - Service Integration Bus instances - Resource Environment Providers - Resource Environment Entries - File system comparisons CCT usage scenarios: - Isolating configuration creep: Periodic configuration snapshots can be gathered and arch

08 Mar, 2018

You can enable Cross Origin Resource Sharing (CORS) for your web applications on a Liberty server. Enabling CORS will allow JavaScript clients to make requests against your application on the Liberty server even if the client and the server are on two different domains. Web browsers prevent these requests due to same-origin policy. I create the following configuration on my local machine on server.xml file:

WebSphere Portal V8.0 setup SPNEGO and a small big difference

Related Posts

Proud to be an HCL Ambassador 2021

WebSphere Application Server Configuration Comparison Tool

Configuring Cross Origin Resource Sharing on a Liberty server