SSO on WAS 6.20 (unix) using kerberos and Windows Active Directory (AD)

Hi Gurus!!
We are looking for the way to implement the Single Sign On in our R/3 Systems installed on unix of the Active Directory (obviously windows) users using Microsoft Kerberos.
I'm not able to find a documentation about this arquitecture.
Can somebody help me?
Is any documentation related with this topic?
Did Somwbody configure this kind of SSO?
Thank you very much in advanced,
Edorta Ramos

Ramos,
I should have made it clearer. When I referred to AS, I was referring to the SAP ABAP AS (e.g. application server). Of course the KDC (e.g. Microsoft Active Directory) has an AS service as well...
yes, you can Kerberos enable (Kerberize) the SAP ABAP AS and SAP GUI using Kerberos libraries for Windows and AIX. As I mentioned already, since AIX is involved you should consider evaluating and buying SAP certified SNC libraries available from a SAP partner. Your first place to look is in SAP EcoHub (click link at top of this SDN forum to enter EcoHub) and search for SNC or Kerberos.
You asked about gssapi library - as I have said a few times, there is no gssapi (e.g. SNC library) provided by SAP for UNIX or Linux, so if you are using AIX you need to look elsewhere (e.g. SAP partner) and the SAP partner will also provide the compatible/supported library for the Windows workstations as well so you get a complete solution from the vendor.
Thanks,
Tim

Similar Messages

How to create mailboxes under mac os x 10.6.4 either using ldapv3 or windows active directory?

hi,
i'm working on the mail server of our company. the plan is to implement the built in mail server feature of mac mini OS X 10.6.4 using either ldapv3 or preferably our existing window active directory users.
i was able to set the open directory and can view the user accounts from AD. my problem is i do not have any clear documentation or manual on how to create mailboxes using either AD accounts or MAC LDAPv3. i already checked the manual of mac os x mail service administration and have found none pertaining to this case.
i would really appreciate if someone can give me reference on how to do this. as of now im quite desperate because i have a deadline for this project.
thank you in advance for your help.

You said, "A 2014 iMac can't run either Snow Leopard or Lion." I know that. What I want to know is how I can install Lion or Snow Leopard on a peripheral hard drive, NOT on my iMac.
– Larry

Query on SSO using Kerberos and JAAS

We have created a LAN of two computers one being an IIS server (windows 2000 Server) and the other the client (Windows 2000 PRO)
When the server program and the applet is run on the server machine the authentication is done properly and the context is established.
But now we want the other terminal to be the client.
Now we have hosted the applet from the server and we are accessing the hosted page from the client terminal and now we get the following exception:
javax.security.auth.login.LoginException: trainee.Trainee123.Local: trainee.Trainee123.Local
at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:572)
at com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:458)
at sun.reflect.GeneratedMethodAccessor5.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:324)
at javax.security.auth.login.LoginContext.invoke(LoginContext.java:675)
at javax.security.auth.login.LoginContext.access$000(LoginContext.java:129)
at javax.security.auth.login.LoginContext$4.run(LoginContext.java:610)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.login.LoginContext.invokeModule(LoginContext.java:607)
at javax.security.auth.login.LoginContext.login(LoginContext.java:534)
at GSSClient.login(GSSClient.java:110)
at GSSClientApplet.login(GSSClientApplet.java:127)
at GSSClientApplet.access$000(GSSClientApplet.java:14)
at GSSClientApplet$1.actionPerformed(GSSClientApplet.java:74)
at java.awt.Button.processActionEvent(Button.java:381)
at java.awt.Button.processEvent(Button.java:350)
at java.awt.Component.dispatchEventImpl(Component.java:3639)
at java.awt.Component.dispatchEvent(Component.java:3480)
at java.awt.EventQueue.dispatchEvent(EventQueue.java:450)
at java.awt.EventDispatchThread.pumpOneEventForHierarchy(EventDispatchThread.java:197)
at java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:150)
at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:144)
at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:136)
at java.awt.EventDispatchThread.run(EventDispatchThread.java:99)
Caused by: java.net.UnknownHostException: trainee.Trainee123.Local: trainee.Trainee123.Local
at java.net.InetAddress.getAllByName0(InetAddress.java:999)
at java.net.InetAddress.getAllByName0(InetAddress.java:969)
at java.net.InetAddress.getAllByName(InetAddress.java:963)
at java.net.InetAddress.getByName(InetAddress.java:883)
at sun.security.krb5.internal.bg.<init>(DashoA6275:51)
at sun.security.krb5.KrbKdcReq$KdcCommunication.run(DashoA6275:185)
at java.security.AccessController.doPrivileged(Native Method)
at sun.security.krb5.KrbKdcReq.send(DashoA6275:148)
at sun.security.krb5.KrbAsReq.send(DashoA6275:401)
at sun.security.krb5.KrbAsReq.send(DashoA6275:293)
at sun.security.krb5.Credentials.acquireTGT(DashoA6275:332)
at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:559)
... 24 more
--(the server address being trainee.Trainee123.Local.)
we referred the following site:
http://www-128.ibm.com/developerworks/java/library/j-gss-sso/index.html
Suggest some solution to this problem.

Hi there,
I need to implement a J2ee struts based web application where the authentication should be against the user profiles in the Windows Active Directory Services using JAAS.
I do not know how to start and is it possible for you to throw some light on this. Like how kerberos works with ADS and others.
Thanks,
Diva

Kerberos authentication with Active Directory

I have tried using JAAS to authenticate to MS Active Directory and keep getting "javax.security.auth.login.LoginException: Pre-Authentication Information was invalid"
I have tried authenticating with multiple user accounts and on three different realms (Active Directory domains).
How do I need to format the username? I know that when using JNDI to access Active Directory I have to use the format "[email protected]" or the RDN. I have tried it both ways with JAAS kerberos authentication as well as with just the username by itself. I don't think that the username format is the problem though because if I set the account lockout policy to 5 failed attempts, sure enough my account will be locked out after running my code 5 times. If I give a username that doesn't exist in Active Directory I get the error "javax.security.auth.login.loginexception: Client not found in Kerberos database" Is there something special that I have to do to the password?
I know that there is just something stupid that I'm missing. Here is the simplest example of code that I'm working with:
import java.io.*;
import javax.security.auth.callback.*;
import javax.security.auth.login.*;
import javax.security.auth.Subject;
import com.sun.security.auth.callback.TextCallbackHandler;
public class krb5ADLogin1 {
public static void main(String[] args){
LoginContext lc = null;
try {
lc=new LoginContext("krb5ADLogin1", new TextCallbackHandler());
lc.login();
catch(Exception e){
e.printStackTrace();
Here is my config file:
krb5ADLogin1 {
com.sun.security.auth.module.Krb5LoginModule required;
The command I use to start the program is:
java -Djava.security.krb5.realm=mydomain.com
-Djava.security.krb5.kdc=DomainController.mydomain.com
-Djava.security.auth.login.config=sample.conf krb5ADLogin1

Hi there ... the Sun web site has the following snippet:
http://java.sun.com/j2se/1.4/docs/guide/security/jgss/tutorials/Troubleshooting.html
+ javax.security.auth.login.LoginException: KrbException::
Pre-authentication information was invalid (24) - Preauthentication failed
Cause 1: The password entered is incorrect.
Solution 1: Verify the password.
Cause 2: If you are using the keytab to get the key (e.g., by
setting the useKeyTab option to true in the Krb5LoginModule entry
in the JAAS login configuration file), then the key might have
changed since you updated the keytab.
Solution 2: Consult your Kerberos documentation to generate a new
keytab and use that keytab.
Cause 3: Clock skew - If the time on the KDC and on the client
differ significanlty (typically 5 minutes), this error can be
returned.
Solution 3: Synchronize the clocks (or have a system administrator
do so).
Good luck,
-Derek

Filtering Groups on Windows Active Directory using LDAP Authentication

Hi All,
I have small module that filters the groups from the Windows AD using LDAP attributes and flushes the data into the DB[code below].
This module was developed and tested on weblogic 8.1[on windows]and works fine.
Now the same is moved to another environment- Websphere on Linux Suse. The code fails to retreieve any value from the Windows AD.
Please note no exception is aslo thrown.
env.put(Context.INITIAL_CONTEXT_FACTORY,ldapCtxFactory);
          //set security credentials, note using simple cleartext authentication
          env.put(Context.SECURITY_AUTHENTICATION,authentication);
          env.put(Context.SECURITY_PRINCIPAL,adminName);
          env.put(Context.SECURITY_CREDENTIALS,adminPassword);
          //connect to my domain controller
          env.put(Context.PROVIDER_URL, domainController);
          // Create the initial directory context
          try {
                              dirCtx = new InitialDirContext(env);
               // Create the search controls
               SearchControls searchCtls = new SearchControls();
               //Specify the attributes to return
               String returnedAtts[]={"member"};
               searchCtls.setReturningAttributes(returnedAtts);
               //Specify the search scope
               searchCtls.setSearchScope(SearchControls.SUBTREE_SCOPE);
               int totalResults = 0;
               int iteration=0;
               // Search for objects using the filter
               NamingEnumeration results = ctx.search(searchBase, searchFilter, searchCtls);
In the above code the method exits even before the try block[i could detect this using Sysout's]
Below is the property file from which the values are read.
admin=username
password=password
#AD search attributes
searchBase=DC=domainname,DC=domainname
searchFilter=(&(objectClass=group) (CN=value*))
#JNDI context attributes
ldapCtxFactory=com.sun.jndi.ldap.LdapCtxFactory
authentication=simple
domainController=ldap://address
groupPattern=pattern
Please Assit,
Thanks in Advance
Message was edited by:
radiant
Message was edited by:
radiant

Assuming it is the same Active Directory environment and only your Java platform has changed, the I can only assume that if no exception is thrown, and no data is returned, then the credentials you are using on the new Java platform are being mapped to an anonymous user (perhaps a blank password ?). By default, Windows Server 2003 domains, do not return any results to anonymous users.

Setting up a small business network using mac and windows pcs

Setting up a small business network using mac and windows??

Ok that sounds great. What is your actual question as it relates to AirPort networking? Is it: Can I set up a wired/wireless network with an AirPort base station that support multiple Mac & PC clients? If so the answer is yes.
If, instead, it is how to I configure an AirPort network to support a small business you will have to provide more details on both your networking & computing equipment in order for any of us to help you.

Just transferred data to iMac from working Mac Pro that is using Parallels and Windows 7 and the Biblesoft 5 and it will not open on the iMac the only change is the my new iPhone number is OS. Any ideas?

Just transferred data to iMac from working Mac Pro that is using Parallels and Windows 7 and the Biblesoft 5 and it will not open on the iMac the only change is the new Maverick OS from the macpro Lion OS. Any ideas?
<Personal Information Edited by Host>

Setup Assistant and Migration Assistant do not restore MS Windows, it only does the OS X partition. All of your Windows stuff must be backed up and restore using a MS Windows application. If no one on this forum is able to answer your question then I'd repost it on a Parallels forum to see how other Windows users approach this.

"Unable to Connect" using Firefox and Windows 7. Have tried all the suggestions on this website to no avail. I need firefox for my work! Please help!

"Unable to Connect" using Firefox and Windows 7. Have tried all the suggestions on this website to no avail. I need firefox for my work! Please help!
== This happened ==
Every time Firefox opened
== Since I downloaded Firefox

same here my AV is ESET, i already unblock it but no use can't connect to the internet..

Activating Windows 7 by using KMS Without the Active Directory Domain environment

Dear,
Can we able to activate the Windows 7 O/S Machines by using KMS without the Active Directory Domain environment,As our some of the Computers will not connect with AD domain, we need to setup the speprate KMS
server for this.
Thanks
Balaji K

You can point the KMS clients to the KMS host machine by opening an Elevated CMD prompt:
and running slmgr /skms to point directly to the KMS host.
You do not need a Domain controller.
Volume Licensing: Key Management Service (KMS) Client Options:
/skms <Name[:Port] | : port> [Activation ID] [Activation ID]
Set the name and/or the port for the KMS computer this machine will use. IPv6 address must be specified in
the format [hostname]:port /ckms [Activation ID]
Arnav Sharma | http://arnavsharma.net/ Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading
the thread.

OS X authenticates as Guest to Samba, but uses Kerberos to Windows

My network: Windows 2003 file server, Windows 2003 Domain Controller, multiple WinXP clients, Ubuntu 7.1 server with Samba 3.0.28a joined to the domain, iMac w/ OS X 10.5.2 joined to the Windows Domain, user accounts are domain accounts.
My problem: My Mac happily logs on to the Windows domain and will also happily access shares on the 2 Windows servers using Kerberos authentication as the logged in user on the Mac. However, accessing the Samba server shares results in OS X authenticating as Guest and the need to use "connect as..." to re-enter the domain username/password to access the share.
My question: There are lots of posts regarding OS X always using Guest to authenticate to XP and Samba machines however none of these seem to be using a Windows domain. Can anyone explain why my Mac is quite capable of using Kerberos authentication as the logged in AD account when connecting to a Windows share but steadfastly refuses to use the same AD account to access the Samba share and instead always uses Guest? I'd be tempted to think that this was a Samba issue bar the fact that Windows clients will happily connect to the Samba share using an AD account; this seems to indicate that the issue is with Leopard.

More data: I have now switched the user profiles on AD so that My Documents is mapped to the Linux Samba server; I also switched the users home directories so that they connect to the Linux Samba server. Logging on to OS X correctly maps the home folder and, more importantly, it authenticates using the AD account.
However, in the Finder list of servers there are now two entries, one for the Samba server with a full DNS name (for the mapped home folder) and one for the same machine via Bonjour. The full DNS name entry is correctly authenticated with the AD account, but accessing the same machine via the Bonjour entry results in a connection using the Guest account. Finder correctly uses the AD account for other Bonjour entries where the target machine is running Windows, it only gets it wrong for the Samba server, despite the fact that it has already connected using the AD account for the home folder mapping.
Any insights much appreciated...

SSO using Windows Active Directory but without EP or Java stack

Good morning and thank you in advance for your help.
The question is:
our environment includes windows domain with Active Directory, ECC 6.0 ABAP (DEV, QAS, PROD), BW 7.0 (DEV, QAS, PROD) only ABAP stack.
I would like to know if we can enable SSO using only this configuration without introducing EP or Java stack.
Best regards
Max

Hi Willi,
It won't be that easy to understand each other... as my english is not that good either
Most of the points introduced in the SAP help link are automatically performed by sapinst.
Almost all my customers running on MS are not using an AV, and neither get into troubles...
but no user ever connect on the SAP server, only admin, for maintenance purpose or SAP admin when needed...
Internet explorer should not be used on a sever, MS itself says it should be uninstalled...
Best regards
SAP on SQL General Update for Customers & Partners April 2014
10. Do Not Install SAPGUI on SAP Servers
Windows Servers have the ability to run many desktop PC applications such as SAPGUI and Internet Explorer however it is strongly recommended not to install this software on SAP servers, particularly production servers.
To improve reliability of an operating system it is recommended to install as few software packages as possible. This will not only improve reliability and performance, but will also make debugging any issues considerably simpler
“A server is a server, a PC is a PC”. Customers are encouraged to restrict access to production servers by implementing Server Hardening Procedure.
SAP Servers should not be used as administration consoles and there should be no need to directly connect to a server. Almost all administration can be done remotely
SAP on SQL General Update for Customers & Partners September 2013
Internet Explorer (and any other non-essential software) should always be removed from every SAP DB or Application server.
The following command line removes IE from Windows 2008 R2, Windows 2012 and Windows 2012 R2:
Open command prompt as an Administrator -> dism /online /Disable-Feature /FeatureName:Internet-Explorer-Optional-amd64

Single sign-on using Kerberos and Ldap

I am currently setting up single sign-on using Kerberos for authentication and Ldap for authorization and information store.
The setup includes several Solaris 8 & 9 workstations, a couple of SGI's, as well as a M$ terminal server farm, several WinXP desktops and their associated Active Directory.
I am required to authenticate etc against the AD. (which has M$ SFU3.5 installed)
I have the Kerberos authentication and part of the Ldap service working via pam & nss.
ie. I can logon to the solaris worksatations using the AD username and password, mount the home directory from a M$ NFS server.
BUT...
id gives:- userID, groupID (primary group only)
groups :- primary group only. (no secondary groups are listed)
Question: what additional configuration information do I need in the pam, nss &/or ldap config files, so that I can list the secondary groups.
Thanks in advance for any help.

After evaluating (giving up on, and finally throwing out) the Sun Directory server it looks like we are going to endup with a similar solution..
Sadly enough, the MS AD seems much more stable and easier to handle than Suns DS, kerberos and associated services.
Anyway, currently we are evaluating a product called vintela ( www.vintela.com ), and it seems very promising; its easy, robust, stable and does what we require it to do, as well as more :) It comes with an additional nss module called 'vas', so you easily can retrieve data like hosts/groups from your AD.
//M.

Oracle Discoverer 10G and mapping Active Directory to use SSO/OID

Could anybody point me please to the right direction?
1. I've setup Oracle 10gIAS but turned off SSO and my users running discoverer /portals with no SSO.
2. My goal is to turn on SSO and synchronize it with Active directory on the windows box.
Thanks you in advance

Hi Randy;
As you mention all notes refer to SSO&OID for Active Directory integration.AFAIK there is no way to do it, please log a Sr and confirm this wiht oracle support
Regard
Helios

SSO All SAP solution with windows Active directory

Dear Experts,
We have multiple sap solution like
SAP ERP EHP7
SAP BW
SAPBO
SAP EES/MMS
SAP Solution Manager
And all solutions based on Operating system AIX and database is DB2
We want to configure SSO ( using windows 2012 active directory users ) with all above systems and it's clients.
Kindly guide me how to achieve SSO using Windows 2013 active directory users.
DO we need LDAP between Active directory and all servers ?
we need additional SAP license
please guide me
Regards

Hello
You can use SAP Single Sign-on 2.0 solution by SAP to integrate all your systems with SSO. The solution contains all what is required for configuring SSO in SAP ABAP and Java Systems. To know more, you may refer:
1. SAP NetWeaver Single Sign-On 2.0 – SAP Help Portal Page
2. Implementing SAP NetWeaver Single Sign-On 2.0 Based on Kerberos Tokens 1/4 - YouTube
3.Implementing SAP NetWeaver Single Sign-On 2.0 Based on Kerberos Tokens 2/4 - YouTube
4. Implementing SAP NetWeaver Single Sign-On 2.0 Based on Kerberos Tokens 3/4 - YouTube
5. Implementing SAP NetWeaver Single Sign-On 2.0 Based on Kerberos Tokens 4/4 - YouTube
You will have to buy license for SAP Single Sign-on 2.0.
Regards,
Tapan

JAAS, JGSS Kerberos and windows 2000 newbie question

Hi
I have setup a Kerberos server on windows 2000, now i want to write code in java to authenticate and authorize user using Kerberos , I know I have to use JAAS, JGSS,
is there a how to document to setup a client machine, like setup krb4.ini file and other security files so i can use java to authorize and authenticate, i am using j2sdk1.4.2
I have following code
GSSManager manager = GSSManager.getInstance();
               Oid krb5Mechanism = new Oid("1.2.840.113554.1.2.2");
               Oid krb5PrincipalNameType = new Oid("1.2.840.113554.1.2.2.1");
               // Identify who the client wishes to be
               GSSName userName = manager.createName("test02EIM", GSSName.NT_USER_NAME);
               // Identify the name of the server. This uses a Kerberos specific
               // name format.
               GSSName serverName = manager.createName("krbsvr400/[email protected]",
                                                                 krb5PrincipalNameType);
          System.out.println("server name " +serverName.getStringNameType());
               // Acquire credentials for the user
               GSSCredential userCreds = manager.createCredential(userName,
                                                                 GSSCredential.DEFAULT_LIFETIME,
                                                                 krb5Mechanism,
                                                                 GSSCredential.INITIATE_ONLY);
               // Instantiate and initialize a security context that will be
               // established with the server
               GSSContext context = manager.createContext(serverName,
                                                                      krb5Mechanism,
                                                                      userCreds,
                                                                      GSSContext.DEFAULT_LIFETIME);
and krb5.ini file looks like below
[libdefaults]
default_realm = GL1AMR.PFIZER1.TEST
default_tgs_enctypes = des-cbc-crc
default_tkt_enctypes = des-cbc-crc
forwardable = true
proxiable = true
[realms]
GL1AMR.PFIZER1.TEST= {
kdc = gl1mopsamrdc01.gl1amr.pfizer1.test:88
admin_server = gl1mopsamrdc03.gl1amr.pfizer1.test
default_domain = gl1amr.pfizer1.test
[domain_realm]
.gl1amr.pfizer1.test = GL1AMR.PFIZER1.TEST
gl1amr.pfizer1.testm = GL1AMR.PFIZER1.TEST
[login]
krb4_convert = true
krb4_get_tickets = true
i get following error
SSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos Ticket)
     at sun.security.jgss.krb5.Krb5InitCredential.getInstance(Krb5InitCredential.java:143)
     at sun.security.jgss.krb5.Krb5MechFactory.getCredentialElement(Krb5MechFactory.java:70)
     at sun.security.jgss.GSSManagerImpl.getCredentialElement(GSSManagerImpl.java:149)
     at sun.security.jgss.GSSCredentialImpl.add(GSSCredentialImpl.java:334)
     at sun.security.jgss.GSSCredentialImpl.<init>(GSSCredentialImpl.java:44)
     at sun.security.jgss.GSSManagerImpl.createCredential(GSSManagerImpl.java:102)
     at com.pfizer.maps.sso.TestGSS.useGSS(TestGSS.java:41)
     at com.pfizer.maps.sso.TestGSS.main(TestGSS.java:59)
what am i missing

My JAVA FILE having the code as follows , when i run this code iam geeting the Folowing error
Error
D:\Ramesh_Dump\KerbersTools>java GSSAPI
GSSException: No valid credentials provided (Mechanism level: Failed to find any
Kerberos Ticket)
at sun.security.jgss.krb5.Krb5InitCredential.getInstance(Krb5InitCredent
ial.java:133)
at sun.security.jgss.krb5.Krb5MechFactory.getCredentialElement(Krb5MechF
actory.java:72)
at sun.security.jgss.GSSManagerImpl.getCredentialElement(GSSManagerImpl.
java:149)
at sun.security.jgss.GSSCredentialImpl.add(GSSCredentialImpl.java:389)
at sun.security.jgss.GSSCredentialImpl.<init>(GSSCredentialImpl.java:60)
at sun.security.jgss.GSSCredentialImpl.<init>(GSSCredentialImpl.java:37)
at sun.security.jgss.GSSManagerImpl.createCredential(GSSManagerImpl.java
:96)
at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:1
78)
at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:1
58)
at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5
Client.java:155)
at com.sun.jndi.ldap.sasl.LdapSasl.saslBind(LdapSasl.java:105)
at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:214)
at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2637)
at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:283)
at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:175)
at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:193
at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.ja
va:136)
at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.jav
a:66)
at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:6
67)
at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:247
at javax.naming.InitialContext.init(InitialContext.java:223)
at javax.naming.ldap.InitialLdapContext.<init>(InitialLdapContext.java:1
34)
at GSSAPI.main(GSSAPI.java:34)
Problem searching directory: javax.naming.AuthenticationException: GSSAPI [Root
exception is javax.security.sasl.SaslException: GSS initiate failed [Caused by G
SSException: No valid credentials provided]]
JAVA CODE
import java.util.Hashtable;
import javax.naming.ldap.*;
import javax.naming.directory.*;
import javax.naming.*;
import java.util.*;
import java.util.Calendar.*;
import java.text.*;
public class GSSAPI {
     * @param args
     public static void main(String[] args) {
     Hashtable env = new Hashtable();
     String adminName = "[email protected]";//"[email protected]";
     String adminPassword = "Password12";
     String ldapURL = "ldap://172.20.55.97:389/";
     env.put(Context.INITIAL_CONTEXT_FACTORY,"com.sun.jndi.ldap.LdapCtxFactory");
     //set security credentials, note using simple cleartext authentication
     env.put(Context.SECURITY_AUTHENTICATION,"GSSAPI");
     //env.put(Context.SECURITY_PRINCIPAL,adminName);
     //env.put(Context.SECURITY_CREDENTIALS,adminPassword);
     //env.put("javax.security.sasl.server.authentication","true");
     //connect to my domain controller
     env.put(Context.PROVIDER_URL,ldapURL);
     try {
          //Create the initial directory context
          LdapContext ctx = new InitialLdapContext(env,null);
          //lets get the domain lockout duration policy
          Attributes attrs = ctx.getAttributes("dc=globalv,dc=com");
          //System.out.println("test arttr"+attrs.get(""));
          System.out.println("Lockout policy for " + attrs.get("distinguishedName").get());
          System.out.println("Duration: " + attrs.get("lockoutDuration").get());
          System.out.println("Threshold: " + attrs.get("lockoutThreshold").get());
          long lockoutDuration = Long.parseLong(attrs.get("lockoutDuration").get().toString());
          //Create the search controls
          SearchControls searchCtls = new SearchControls();
          //Specify the attributes to return
          String returnedAtts[]={"sn","givenName","mail","lockoutTime"};
          searchCtls.setReturningAttributes(returnedAtts);
          //Specify the search scope
          searchCtls.setSearchScope(SearchControls.SUBTREE_SCOPE);
          //Create the correct LDAP search filter
          //Win32 file time is based from 1/1/1601
          //Java date/time is based from 1/1/1970
          /*GregorianCalendar Win32Epoch = new GregorianCalendar(1601,Calendar.JANUARY,1);
          GregorianCalendar Today = new GregorianCalendar();
          long Win32Date = Win32Epoch.getTimeInMillis();
          long TodaysDate = Today.getTimeInMillis();
          long TimeSinceWin32Epoch = TodaysDate - Win32Date;
          long lockoutDate = (TimeSinceWin32Epoch * 10000) + lockoutDuration;
          System.out.println("Lockout (Long): " + lockoutDate);*/
          //System.out.println("Lockout (Date): " + DisplayWin32Date(lockoutDate));
          //String searchFilter = "(&(objectClass=user)(lockoutTime>=" + lockoutDate + "))";
          String searchFilter = "(objectclass=user)";
          //Specify the Base for the search
          String searchBase = "dc=globalv,dc=com";
          //initialize counter to total the results
          int totalResults = 0;
          //Search for objects using the filter
          NamingEnumeration answer = ctx.search(searchBase, searchFilter, searchCtls);
          //Loop through the search results
          while (answer.hasMoreElements()) {
               SearchResult sr = (SearchResult)answer.next();
               totalResults++;
               System.out.println(">>>" + sr.getName());
               // Print out some of the attributes, catch the exception if the attributes have no values
               attrs = sr.getAttributes();
               if (attrs != null) {
                    try {
                         System.out.println(" name: " + attrs.get("givenName").get() + " " + attrs.get("sn").get());
                         System.out.println(" mail: " + attrs.get("mail").get());
                         System.out.println(" locked: " + attrs.get("lockoutTime").get().toString());
                         //System.out.println(" locked: " + DisplayWin32Date(attrs.get("lockoutTime").get().toString()));
                    catch (NullPointerException e)     {
                         System.err.println("Problem listing attributes: " + e);
//          System.out.println("Total results: " + totalResults);
          ctx.close();
     catch (NamingException e) {
          System.err.println("Problem searching directory: " + e);
import java.util.Hashtable;
import javax.naming.ldap.*;
import javax.naming.directory.*;
import javax.naming.*;
import java.util.*;
import java.util.Calendar.*;
import java.text.*;
public class GSSAPI {
     * @param args
     public static void main(String[] args) {
     Hashtable env = new Hashtable();
     String adminName = "[email protected]";//"[email protected]";
     String adminPassword = "Password12";
     String ldapURL = "ldap://172.20.55.97:389/";
     env.put(Context.INITIAL_CONTEXT_FACTORY,"com.sun.jndi.ldap.LdapCtxFactory");
     //set security credentials, note using simple cleartext authentication
     env.put(Context.SECURITY_AUTHENTICATION,"GSSAPI");
     //env.put(Context.SECURITY_PRINCIPAL,adminName);
     //env.put(Context.SECURITY_CREDENTIALS,adminPassword);
     //env.put("javax.security.sasl.server.authentication","true");
     //connect to my domain controller
     env.put(Context.PROVIDER_URL,ldapURL);
     try {
          //Create the initial directory context
          LdapContext ctx = new InitialLdapContext(env,null);
          //lets get the domain lockout duration policy
          Attributes attrs = ctx.getAttributes("dc=globalv,dc=com");
          //System.out.println("test arttr"+attrs.get(""));
          System.out.println("Lockout policy for " + attrs.get("distinguishedName").get());
          System.out.println("Duration: " + attrs.get("lockoutDuration").get());
          System.out.println("Threshold: " + attrs.get("lockoutThreshold").get());
          long lockoutDuration = Long.parseLong(attrs.get("lockoutDuration").get().toString());
          //Create the search controls
          SearchControls searchCtls = new SearchControls();
          //Specify the attributes to return
          String returnedAtts[]={"sn","givenName","mail","lockoutTime"};
          searchCtls.setReturningAttributes(returnedAtts);
          //Specify the search scope
          searchCtls.setSearchScope(SearchControls.SUBTREE_SCOPE);
          //Create the correct LDAP search filter
          //Win32 file time is based from 1/1/1601
          //Java date/time is based from 1/1/1970
          /*GregorianCalendar Win32Epoch = new GregorianCalendar(1601,Calendar.JANUARY,1);
          GregorianCalendar Today = new GregorianCalendar();
          long Win32Date = Win32Epoch.getTimeInMillis();
          long TodaysDate = Today.getTimeInMillis();
          long TimeSinceWin32Epoch = TodaysDate - Win32Date;
          long lockoutDate = (TimeSinceWin32Epoch * 10000) + lockoutDuration;
          System.out.println("Lockout (Long): " + lockoutDate);*/
          //System.out.println("Lockout (Date): " + DisplayWin32Date(lockoutDate));
          //String searchFilter = "(&(objectClass=user)(lockoutTime>=" + lockoutDate + "))";
          String searchFilter = "(objectclass=user)";
          //Specify the Base for the search
          String searchBase = "dc=globalv,dc=com";
          //initialize counter to total the results
          int totalResults = 0;
          //Search for objects using the filter
          NamingEnumeration answer = ctx.search(searchBase, searchFilter, searchCtls);
          //Loop through the search results
          while (answer.hasMoreElements()) {
               SearchResult sr = (SearchResult)answer.next();
               totalResults++;
               System.out.println(">>>" + sr.getName());
               // Print out some of the attributes, catch the exception if the attributes have no values
               attrs = sr.getAttributes();
               if (attrs != null) {
                    try {
                         System.out.println(" name: " + attrs.get("givenName").get() + " " + attrs.get("sn").get());
                         System.out.println(" mail: " + attrs.get("mail").get());
                         System.out.println(" locked: " + attrs.get("lockoutTime").get().toString());
                         //System.out.println(" locked: " + DisplayWin32Date(attrs.get("lockoutTime").get().toString()));
                    catch (NullPointerException e)     {
                         System.err.println("Problem listing attributes: " + e);
//          System.out.println("Total results: " + totalResults);
          ctx.close();
     catch (NamingException e) {
          System.err.println("Problem searching directory: " + e);
}

SSO on WAS 6.20 (unix) using kerberos and Windows Active Directory (AD)

Similar Messages

Maybe you are looking for