BOXI 3.1 & Windows 2003 AD

Question

Hello,
I've followed all the steps to configure my Java application with Kerberos.
1.-on active Directory machine (AA11)
  setspn -A BOBJCentralMS/AA22.domain.com  bo_ldap
  select in de checkbox "account is trust for delegation to any service (Kerberos only)
2.- in BOserver ->NTBOF1
   add my_user as a member of administrators group
   assign the right "act as a part of Operating System"
   create krb5.ini
[libdefaults]
default_realm = domain.com
dns_lookup_kdc = true
dns_lookup_realm = true
[realms]
domain.com = {
kdc=AA11.domain.com
default_domain = domain.com
& bscLogin.conf
com.businessobjects.security.jgss.initiate {
com.sun.security.auth.module.krb5LoginModule required debug=true;
Go to  tomcat configuration and
-Djava.security.auth.login.config=C:\WINNT\bscLogin.conf
-Djava.security.krb5.conf=C:\WINNT\krb5.ini
Start BO & Tomcat
launch CMC and go to windows AD and enter my_user as SPN
RESULTS
Client/Server go fine.
Infoview & CMC doesn't run
tests:
1.- setspn -l boldap
setspn -l boldap
Registered ServicePrincipalNames for CN=BOLDAP Usuario para SAP Bussines Obj,OU=
Users,OU=Sistemas,DC=central,DC=xxx,DC=com:
        BOBJCentralMS/NTBOF1.CENTRAL.xxx.COM
2.- kinit boldap
Password for boldap-AT-CENTRAL.xxx.COM:********
Exception: krb_error 0 Cannot get kdc for realm CENTRAL.xxx.COM No error
KrbException: Cannot get kdc for realm CENTRAL.xxx.COM
        at sun.security.krb5.KrbKdcReq.send(KrbKdcReq.java:133)
        at sun.security.krb5.KrbKdcReq.send(KrbKdcReq.java:106)
        at sun.security.krb5.internal.tools.Kinit.sendASRequest(Kinit.java:300)
        at sun.security.krb5.internal.tools.Kinit.<init>(Kinit.java:239)
        at sun.security.krb5.internal.tools.Kinit.main(Kinit.java:106)
3.- There are no advise inside stdout.log
Thanks in advance
j

Answer 1

Cannot get kdc for realm CENTRAL.xxx.COM -
When performing kinit the java SDK will take the value after the @ sign
Perform kinit username enter then add the password to confirm this value if not entering the @REALM.COM. If not entering @REALM.COM then the default domain value should be used (from the krb5.ini)
Then once you confirm your value of the KDC it must match a domain listed in your Realms section of the krb5.ini (all upper case and exact match on case). After it matches your realm it will attempt to connect the  defined KDC(s). In your case it cannot match the realm or connect to it's KDC.
You will probably have a 2nd issue if no error shows up in the std.out. Likely your bsclogin.conf is not loading properly as the debug=true option you show should be logging the java SDK even when it fails.
Finally if those issues are fixed ensure the default domain in the CMC > auth > AD also is an exact match for the default domain in the krb5.ini.
Regards,
Tim