Kerberos Authentication for EP 7.0 Portal

We are implementing Kerberos Authentication on our EP7 Portal. In our landscape we have
2 main domains (US & INTL). In each of the domain we have several domain controllers (more than 10 each). We had the following queries:
1) We have a mix of domain controllers running on win 2000 and win 2003. Will this cause any issue with the SPNego configuration?
2) Since we have more than 10 DCs in each domain do we need to add all the DCs as KDCs in the step 2 of SPNego wizard?
System Details
1) Portal Version à EP7 SP13
2) Operating System à SunOS (sparcv9) 5.9
3) LDAP à MS ADS
4) DB à Oracle 10.2.0.2.0 - 64bit
Thanks.

Hi Lisandro,
For Q1: I don't think there should be a problem with the mixture of DCs types.
For Q2: You only need to configure one DC in the wizard (a W2003 server may be the best choice). This is just the DC that the wizard talks to during configuration.
Hope this helps,
Darren

Similar Messages

Configuring Kerberos authentication for SSRS in native mode - SSRS 2008 R2-2012

Hi,
I've a SSRS native mode installation on a server and a SSAS installation on another server.
In order to configure the Kerberos authentication for SSRS native mode, I need to register one SPN for the report server service, one SPN for SSAS service and to configure SSRS to use the negotiate authentication type, isn't it?
Thanks

Hi pscorca,
If we have applications that only use Kerberos authentication and we are using RSWindowsNegotiate AuthenticationType, we must create a Service Principal Name (SPN) for the Report Server service if we configure it to run as a domain user account.
Before setting up constrained delegation, we must register a
Service Principle Name (SPN) for the Analysis Services instance. We will need the Analysis Services SPN when configuring Kerberos constrained delegation for middle tier services.
There is a document about Enabling Kerberos Authentication for Reporting Services, you can refer to it.
http://blogs.technet.com/b/rob/archive/2011/11/23/enabling-kerberos-authentication-for-reporting-services.aspx
Hoe this helps.
Regards,
Alisa Tang
Alisa Tang
TechNet Community Support

Regarding Kerberos authentication for webservices.

Hi,
I need to use kerberos authentication for my receiver webservice. I am working in PI7.1 . Which adapter I can use for this ( WS-RM adapter or SOAP adapter) and How to configure it for kerberos. I mean, which value of authentication parameter refers to kerberos authentication.
Regards,
Reyaz hussain

Hi Reyaz,
To tell you frankly i never come across this kerberos protocol but since you would like to use there is certainly a chance after the launch of PI 7.1. The launch has Opened the Door to the World of Web Services Reliable Messaging. "The Integration Directory enables you to easily configure scenarios where the Integration Server acts as a message hub between WS-RM-enabled applications and any other application or technical system. Thus, you can configure scenarios where either a Web Service client calls the Integration Server and the message is then routed to any other application, or the other way around where any application calls a Web Service provider via the Integration Server. In the Integration Directory you can do the complete configuration of the Integration Server inbound or outbound processing."
https://www.sdn.sap.com/irj/scn/wiki?path=/display/profile/2007/07/25/new+news&focusedcommentid=44360
Regards
joel

Enable Kerberos Authentication for OWA only

Hi guys,
Having a customer that asked me if we can enable Kerberos Authentication for OWA only?
When reading various blogposts (official and unofficial sources) it seems that this is done for the whole CASArray which means every vdir right? Is this so and shall we instead aim for using kerberos for both MAPI/Outlook Anywhere and OWA?
Found this for MAPI clients: http://blogs.technet.com/b/exchange/archive/2011/04/15/recommendation-enabling-kerberos-authentication-for-mapi-clients.aspx
This seems to be more complicated?

Hi Fredrik,
Base on my search , I found an article which may give you some hints:
OWA publishing using Kerberos Constrained Delegation method for authentication delegation
This article is to show case how you would configure kerberos constrained delegation method for authentication delegation .We would use the OWA publishing post as reference.
Best regards,
Niko Cheng
TechNet Community Support

Kerberos Authentication for Oracle 9i ODBC

Hi,
I want to connect to Oracle 9i database through ODBC with Kerberos Authentication. Can any one able to provide some document/Sample Code/Web Resource ???
Thanks,
Zahir

Hi,
I want to connect to Oracle 9i database through ODBC with Kerberos Authentication. Can any one able to provide some document/Sample Code/Web Resource ???
Thanks,
Zahir

Kerberos authentication for Excel Services

Hi,
I am configuring Keberos for Excel Service Application and facing some issue. Things i have done so far:
Configured web application to use Kerberos: Verified it from server authentication logs, klist and net mon that web application is using kerberos.
Excel service Account: domain\ExcelSVA
SQL server service account: domain\SQLSERV
C2WTS account : domain\C2wts
set spn on in using setspn - s sp/excelservices domain\ExcelSVA and delegated constarined authentication to domain\SQLSERV
then setspn - s sp/c2wts domain\C2wts and delegated constrained authentication to domain\SQLSERV.
C2WS account has impersonate identity ,logon as service and act as part of OS rights in app servers where excel and c2wt are running
Now when i try to refresh data i get error :The data connection uses Windows Authentication and user credentials could not be delegated.
The following connections failed to refresh: SQLServername port, databasename
http://technet.microsoft.com/en-us/library/ff487975.aspx
First 3 errors don't apply to me since i cant see these errors in SP log files and my sharepoint and database servers are in same domain.
For UPN, there is a email id assoisated with account that i am using and i have been using that email id to logon to other services in my company so UPN should be done too.
The Excel Services service account must have Active Directory permissions to query the object. Now this got me confusing. Where do i actually
give this? In sql server or AD? Which object does it need to query? The excel database in sql server. If it is so, then the permission needs to be granted on sql .
Also this link http://social.msdn.microsoft.com/Forums/en-US/99a3cf4f-dabc-4ac9-9ea8-afa677199ffa/kerberos-and-excel-services?forum=sharepointgeneralprevious
Microsoft solution described here is weired. I don't think sql server has c2wts or excel service application started on it. And from drop down list that is i don't know what is the solution talking of.
Does any one have any idea if i am missing any delegation or any step?
sachin

Any idea??
sachin

Kerberos Authentication Failure for POP3 After Upgrading to 10.6.5

So I just upgraded from 10.6.4 to 10.6.5 and now Kerberos authentication for POP3 from Mail fails. Kerberos authentication for SMTP outgoing mail is just fine, it's only POP3 incoming mail that fails to authenticate. POP3 Kerberos authentication still works fine for the same account from another machine running 10.5.8. The mailaccess.log file contains the following:
Nov 23 15:36:59 server master[423]: about to exec /usr/bin/cyrus/bin/pop3d
Nov 23 15:36:59 server pop3[423]: executed
Nov 23 15:37:00 server pop3[423]: accepted connection
Nov 23 15:37:00 server pop3[423]: Major Error (1): A token was invalid (gssaccept_seccontext)
Nov 23 15:37:01 server pop3[423]: Minor Error (1): Token header is malformed or corrupt (gssaccept_seccontext)
Nov 23 15:37:01 server pop3[423]: Major Error (1): A token was invalid (gssaccept_seccontext)
Nov 23 15:37:01 server pop3[423]: Minor Error (1): Token header is malformed or corrupt (gssaccept_seccontext)
Nov 23 15:37:04 server pop3[423]: badlogin: FQDN [192.168.0.4] GSSAPI
Nov 23 15:37:04 server master[52]: process 423 exited, status 0
The server is running Mac OS X Server 10.4.11 and cannot be upgraded any further than as it is ancient hardware.
Any thoughts?
Cheers,
Derek

Makes perfect sense to me that ending one session by logging out enables him to begin a new session by logging back in. I give the young man credit for figuring out how to get around this deficiency in Parental Controls, as, deep down, I'm sure you do, too.
If you can't trust him to stick to his agreed upon half an hour a day, you can always (threaten to) lock him out of the computer for 23.5 hrs/day using the Bedtime settings. ; )

Real time collaboration issue after Kerberos authentication setup

Hi,
We are using SPNego (kerberos) authentication for our portal (EP 7.0 SP10). When user clicks on log off link, he comes back to the portal home page again so there is no way for the user to log off from the portal. I don't see this as a problem for the users who are not having access to collaboration. But for the users having access to collaboration, when they login to the portal second time (before expiry of the first login session which they couldn't close as log off is not working), they get warning stating
"You are logged to the same portal already. Real-time collaboration capabilities will not be available in the current portal session until you terminate the other session and then restart this one by refreshing the browser or logging on again."
How to resolve this?
Helpful answers will be rewarded
Regards,
Chandra

Most people set the logoff link to a URL which contains soem javascript which closes the browser.
Paul

Kerberos Authentication: "Integrity check on decrypted field failed"

Hi,
I have configured a portal (NW 7.0 SP13) for Kerberos Authentication. I have another portal with exactly the same configuration (same MS-ADS etc, just a different user) which is working fine. But this one is giving me the error "Integrity check on decrypted field failed" (and Kerberos Auth fails).
Any ideas?? I get the same error whether I use the keytab from the SPNEGO wizard, or the keytab from "ktpass -princ host/%HOST%@%DOMAIN% -pass %PASSWORD% -out keytab -mapUser %USER% +DesOnly /crypto DES-CBC-MD5 /ptype KRB5_NT_PRINCIPAL"
The only difference I can see between the ldifde outputs of the two users (the one that works and the one that doesn't) is the one that doesn't has an extra SPN "HTTP/" - would that cause this error??
Has anyone else had this error & what causes it?
Many thanks in advance.
Regards
Jane
Full error text:
JGSS_DBG_CTX Creating context, initiator = no, input cred = not null
JGSS_DBG_CRED getCred: only one cred, returning it
JGSS_DBG_CRED getName found name: host/[email protected], mech=1.2.840.113554.1.2.2
JGSS_DBG_CRED Krb5 name type = 0
JGSS_DBG_CTX Creating context, cred usage = 2
GSS Context created
JGSS_DBG_UNMARSH Real token len 1641
JGSS_DBG_UNMARSH Token oid 1.2.840.113554.1.2.2
JGSS_DBG_UNMARSH inner token len 1630
JGSS_DBG_PROV getFactory: index = 0 found factory
JGSS_DBG_PROV getMechs: Mechanism(s) supported by provider IBMJGSSProvider
JGSS_DBG_PROV 1.2.840.113554.1.2.2
JGSS_DBG_PROV getMechs: 1 unique mechanism(s) found
JGSS_DBG_PROV [0]: 1.2.840.113554.1.2.2
JGSS_DBG_CTX Default list of negotiable mechs:
1.2.840.113554.1.2.2
JGSS_DBG_CTX ticket enc type = des-cbc-md5
com.ibm.security.krb5.internal.KrbException, status code: 31
message: Integrity check on decrypted field failed
at com.ibm.security.krb5.internal.crypto.n.decrypt(n.java:31)
at com.ibm.security.krb5.internal.crypto.n.decrypt(n.java:15)
at com.ibm.security.krb5.internal.crypto.n.decrypt(n.java:32)
at com.ibm.security.krb5.EncryptedData.decrypt(EncryptedData.java:106)
at com.ibm.security.jgss.mech.krb5.k.a(k.java:248)
at com.ibm.security.jgss.mech.krb5.k.b(k.java:188)
at com.ibm.security.jgss.mech.krb5.k.acceptSecContext(k.java:533)
at com.ibm.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:155)
at com.ibm.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:153)
at com.sap.security.core.server.jaas.SPNegoLoginModule.doHandshake(SPNegoLoginModule.java:738)
at com.sap.security.core.server.jaas.SPNegoLoginModule.login(SPNegoLoginModule.java:362)
at com.sap.engine.services.security.login.LoginModuleLoggingWrapperImpl.login(LoginModuleLoggingWrapperImpl.java:185)
at com.sap.engine.services.security.login.ModulesProcessAction.run(ModulesProcessAction.java:70)
at java.security.AccessController.doPrivileged(AccessController.java:242)
at com.sap.engine.services.security.login.FastLoginContext.login(FastLoginContext.java:181)
at com.sap.engine.system.SystemLoginModule.login(SystemLoginModule.java:90)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:85)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:58)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:60)
at java.lang.reflect.Method.invoke(Method.java:391)
at javax.security.auth.login.LoginContext.invoke(LoginContext.java:699)
at javax.security.auth.login.LoginContext.access$000(LoginContext.java:151)
at javax.security.auth.login.LoginContext$4.run(LoginContext.java:634)
at java.security.AccessController.doPrivileged(AccessController.java:242)
at javax.security.auth.login.LoginContext.invokeModule(LoginContext.java:631)
at javax.security.auth.login.LoginContext.login(LoginContext.java:557)
at com.sap.security.core.logon.imp.SAPJ2EEAuthenticator.getLoggedInUser(SAPJ2EEAuthenticator.java:146)
at com.sapportals.portal.prt.service.authenticationservice.AuthenticationService.getLoggedInUser(AuthenticationService.java:303)
at com.sapportals.portal.prt.connection.UMHandler.handleUM(UMHandler.java:96)
at com.sapportals.portal.prt.connection.ServletConnection.handleRequest(ServletConnection.java:186)
at com.sapportals.portal.prt.dispatcher.Dispatcher$doService.run(Dispatcher.java:524)
at java.security.AccessController.doPrivileged(AccessController.java:242)
at com.sapportals.portal.prt.dispatcher.Dispatcher.service(Dispatcher.java:407)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
at com.sap.engine.services.servlets_jsp.server.servlet.InvokerServlet.service(InvokerServlet.java:156)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)
at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)
at com.sap.portal.navigation.Gateway.service(Gateway.java:126)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:401)
at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)
at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:387)
at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:365)
at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:944)
at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:266)
at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)
at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)
at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
at java.security.AccessController.doPrivileged(AccessController.java:215)
at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:100)
com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:170)
JGSS_DBG_CTX Error authenticating request. Reporting to client
Major code = 11, Minor code = 31
org.ietf.jgss.GSSException, major code: 11, minor code: 31
major string: General failure, unspecified at GSSAPI level
minor string: Kerberos error while decoding and verifying token: com.ibm.security.krb5.internal.KrbException, status code: 31
message: Integrity check on decrypted field failed

Hi Désirée,
Yes the service user has "Use DES encryption" set.
In the end, it was resolved by changing the password and running the SPNEGO wizard again to generate a new keytab with the new password.
Regards
Jane

Kerberos Authentication between Sharepoint 2013 Foundation - SSRS 2012 - Oracle 11g failing with ORA-12638: Credential retrieval failed

I have set up SharePoint 2013 Foundation, SharePoint Reporting Services and SQL Server 2012 in a single server. I then created a Data Connection to Oracle 11g. Upon testing the connection, it throws the error “ORA-12638: Credential retrieval failed”.
Given below are the steps of installation and configuration.
Installation till basic authentication:
The installation has been done in a
single server.
Installed SQL Server 2012 (Developer version).
Selected only the following features:
Database Engine Services
Analysis Services
Reporting Services – SharePoint
Reporting Services Add-in for SharePoint Products
Management Tools – Basic
- Management Tools - Complete
2. Installed SQL Server 2012 SP1.
3. Installed SQL Server 2012 SP2.
  4. Installed SharePoint Foundation 2013.
5. Created web application (without Kerberos; we did not even create the SPNs).
      The application pool has been configured to use Reporting Services account since it is a single server installation. This account has been registered as a managed
account.
6. Created Site Collection.
7. Verified that Reporting Services is not installed.
8. Installed SharePoint Reporting Services from SharePoint 2013 Management Shell.
9. Verified that Reporting Services is installed.
10. Created a new SQL Server Reporting Services Service Application and associated the Web Application to the new SQL server Reporting Services Service Application.
11. Verified that SQL Server Reporting Services Service Application and its proxy have started. Reset IIS.
12. Created a Site.
  13. Created a Data Connection library with “Report Data Source” content type.
14. Created a Report Model library with “Report Builder Model” content type.
15. Created a Report library with “Report Builder Report” content type.
16. Uploaded an SMDL to the Report Model library.
  17. Added the top level site to Local Intranet instead of as a Trusted Site in the browser settings.
  18. Able to create and save a report using Report Builder.
Hence, basic authentication is working and SSRS is able to connect to Oracle database.
Next we have to configure Kerberos settings between SharePoint and SQL Server.
Implementation of Kerberos authentication
In the Report Server machine, opened the file C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\WebServices\Reporting\rsreportserver.config and added the Authentication Types of RSWindowsNegotiate
and RSWindowsKerberos.
2. Set up the following SPNs.
               a) SQL Server Database Engine service (sqlDbSrv2):
                setspn -S MSSQLSvc/CER1110:1433 CERDEMO\sqlDbSrv2
                setspn -S MSSQLSvc/CER1110.cer.demo.com:1433 CERDEMO\sqlDbSrv2
             In the Delegation tab of the account, selected "Trust this user for delegation to any service (Kerberos only)".
b) Account: SharePoint Setup Admin account (spAdmin2)
     setspn -S HTTP/CER1110:9999 CERDEMO\spAdmin2
                setspn -S HTTP/CER1110.cer.demo.com:9999 CERDEMO\spAdmin2
                In the Delegation tab of the account, selected "Trust this user for delegation to any  service
(Kerberos only)".
c) Account: SQL Server Reporting Service account (sqlRepSrv2)
                   setspn -S HTTP/CER1110 CERDEMO\sqlRepSrv2
                   setspn -S HTTP/CER1110.cer.demo.com CERDEMO\sqlRepSrv2
                   In the Delegation tab of the account, selected "Trust this user for delegation to any service
(Kerberos only)".
3. Configure the Web Application to use “Negotiate (Kerberos)”.
4. Logged in as SharePoint Administrator to the SharePoint server and opened the top level site in the IE browser.
     The Event Viewer logged the login process for the SharePoint Administration account as
Negotiate and not Kerberos.
5. Implemented Kerberos for Oracle database and client.
     Able to connect to the Oracle database via Kerberos authentication using SQL Plus.
6. Turn on Windows Firewall.
7. While testing the site's data connection using Kerberos settings, got the error
“Can not convert claims identity to windows token. This may be due to user not logging in using windows credentials.”
      Note: The Data Connection for basic authentication still worked.
8. Created a Claims to Windows Token Service account (spC2WTS2).
9. Started the Claims to Windows Token Service.
10. Registered the Claims to Windows Token Service account as a Managed Account.
11. Changed the Claims To Windows Token Service to use the above managed account.
12. Verified that the Claims to Windows Token Service account (spC2WTS2) is automatically added to the WSS_WPG local group on the SharePoint box.
      Note: The Reporting Services service account is also a part of the WSS_WPG local group.
13. Added the Claims to Windows Token Service account (spC2WTS2) to the Local Admin Group on the machine having the SharePoint App Server.
14. In the SharePoint box, added the Claims to Windows Token Service account (spC2WTS2) in the Act as part of the operating system policy right.
15. The Claims to Windows Token Service account (spC2WTS2) has the WSS_WPG group configured.
      When the C2WTS service was configured to use the managed account Claims to Windows Token Service account (spC2WTS2) earlier, the spC2WTS2 account was automatically
added to the WSS_WPG local group on the SharePoint box. The WSS_WPG group in turn is configured in c2wtshost.exe.config file.
16. Verified that the Reporting Services account is a managed account and part of the WSS_WPG group.
17. Earlier Service Application Pool - SQL Server Reporting Services App Pool service was associated with the SharePoint Admin account.
      Changed this to associate the Reporting Service account with the Service Application Pool - SQL Server Reporting Services App Pool service.
18. Changed the delegation of the Reporting Service account to constrained delegation with Protocol Transitioning. This is because we are transitioning from one authentication scheme (Claims) to another (Windows Token).
      For this, the delegation has been changed to "Trust this user for delegation to specified services only". Also, selected the sub radio button "Use
any authentication protocol". Selected the Oracle Kerberos service as the service to which this account can present delegated credentials.
      Note: The Reporting Service account already had an HTTP SPN.
19. Next, the goal was to make the Claims To Windows Token Service account match the Reporting Service account.
       For this, we created a fake SPN for the Claims To Windows Token Service account since the delegation tab was missing.
       The delegation has been changed to "Trust this user for delegation to specified services only". Also, selected the sub radio button "Use any
authentication protocol". Selected the Oracle Kerberos service as the service to which this account can present delegated credentials.
20. Restarted the SharePoint server.
21. Tested the data connection with the Kerberos settings again.
       Got the error
“ORA-12638: Credential retrieval failed”.
Can anyone tell me what is wrong with this setup?

http://www.freeoraclehelp.com/2011/10/kerberos-authentication-for-oracle.html
Problem4: ORA-12638: Credential retrieval failed
Solution: Make sure that SQLNET.KERBEROS5_CC_NAME is set in sqlnet.ora and okinit has been run before attempting to connect to the database.
Do check
http://webcache.googleusercontent.com/search?q=cache:5a2Pf3FH7vkJ:externaltable.blogspot.com/2012/06/kerberos-authentication-and-proxy-users.html+&cd=5&hl=en&ct=clnk&gl=in
If this helped you resolve your issue, please mark it Answered. You can reach me through http://itfreesupport.com/

Issue in confuguration of Kerberos authentication

Hi all
We are trying to configure Kerberos authentication for single sign-on on a SAP WAS 6.40 Java System. We configured the Kerberos using SPNEGO wizard. After configuring when we tried to login to UME, but it prompted for Username and Password which confirms that single sign on is not working.
In default trace file we got the following info
i. Key for the principal [email protected] not available in default key     tab
ii. [Krb5LoginModule] authentication failed
     Unable to obtain password from user
iii. Login module com.sun.security.auth.module.Krb5LoginModule from authentication stack com.sun.security.jgss.accept does not authenticate the caller.
iv. LOGIN.FAILED
    Unable to obtain password from user
1. Why password cannot be obtained from user?
2. Is there a default keytab other than the one created by the spnego wizard?
3. If there is one, then can we add the key for [email protected] in         that file and how?
4. How can this be resolved?
Regards
Deepu

Your log files are recording an authentication error, so that usually means your login information is incorrect, or just corrupted. Try reseting your Kerberos password, and if that doesn't work, double-check your Kerberos connectivity and configuration settings.

Using Kerberos authentication on Forms and Reports version 11.1.2

Hi
I have configured Kerberos authentication for Forms on the server and it works fine, but I cannot get it to work for Reports.
When I access the database for Forms I use a connect string that looks like this: /@tns_name The Forms server is running using a domain user and the database user is externally identified. It just works.
I have tried the same for Reports but it is not accepted. In the URL I have written userid=/@tns_name and the Reports server then asks for user id and password with a pre filled tns_name. I have tried to put the userid parameter in cgicmd.dat but the result is the same. Even enabled SSO in rwservlet.properties using singlesignon>yes</singlesignon> but it just do not work.
I have bounced the server every time I have made a change to be absolutely that the changes had taken effect.
The question is: How do I tell the Reports server that I do not want to apply user id and password but just the tns_name, like /@tns_name
I know Kerberos authentication is not an area that is well known and I have spent hours over the years to find out how to make the configuration work.

Questions regarding version compabilities come up quite often, yet the answer is still the same: have a look at the certification matrix http://www.oracle.com/technetwork/developer-tools/forms/oracle-forms-11gr2certmatrix-519680.xls
for installation instructions on your chosen platform have a look at the installation manual: http://docs.oracle.com/cd/E24269_01/doc.11120/e23960/toc.htm
What do you plan to do with SOA suite? This isn't needed for forms&reports.
cheers

Kerberos authentication

Hi,
I have set up kerberos authentication for my application, but I allways get 401 - Unauthorized.
I've done all steps from http://e-docs.bea.com/wls/docs92/secmanage/sso.html - Single Sign-On with Microsoft Clients: Main Steps.
C:\jaas.conf:
com.sun.security.jgss.initiate {
com.sun.security.auth.module.Krb5LoginModule required
principal="host/[email protected]" useKeyTab=true refreshKrb5Config=true
keyTab="c:\\pc179.keytab" storeKey=true debug=true;
com.sun.security.jgss.accept {
com.sun.security.auth.module.Krb5LoginModule required
principal="host/[email protected]" useKeyTab=true refreshKrb5Config=true
keyTab="c:\\pc179.keytab" storeKey=true debug=true;
C:\krb5.conf:
\[libdefaults\]
default_realm = CCA.CZ
dns_lookup_kdc = true
default_tkt_enctypes = des-cbc-crc
default_tgs_enctypes = des-cbc-crc
\[realms\]
CCA.CZ = {
kdc = BOBES.CCA.CZ
\[domain_realm\]
.cca.cz = CCA.CZ
\[appdefaults\]
autologin = true
forward = true
forwardable = true
encrypt = true
I also have created security realm CCA.CZ as a copy of myrealm with WebLogic Negotiate Identity Assertion provider added.
Server is starting with parameters -Djava.security.krb5.conf=c:/krb5.conf -Djava.security.auth.login.config=c:/jaas.conf -Djavax.security.auth.useSubjectCredsOnly=false -Dweblogic.security.enableNegotiate=true -Dsun.security.krb5.debug=true -Djava.security.krb5.realm=CCA.CZ -Djava.security.krb5.kdc=BOBES.CCA.CZ
When I request any secured page, the server returns 401 with WWW-Authenticate: Negotiate header. So browser sends another request with Authorization: Negotiate and ticket. Server then returns 401 without authentication header (instead of requested page - which I expect).
Can you please tell me what am I doing wrong?
(WebLogic v10.3)
Edited by: user11038158 on 15.4.2009 0:50

Hi:
Did you manage to overcome this problem? I'm having the same problem and any help would be highly appreciated.
Cheers,
Albert

Portal Drive Single Sign On and Kerberos Authentication

Hi,
We are using NW2004s SP10 Portal and we have successfully configured Kerberos authentication with Windows Active Directory 2003. To access the KM Content in windows explorer format, we are using Portal Drive but Portal Drive still asks for authentication i.e. SSO is not working for Portal Drive. I have understood from the forums and sap help site that SSO from portal drive will work only for NTLM authentication and client certificates. Can you please help regarding below questions.
1. Can Kerberos and NTLM authentication be configured together.
2. If yes, what are the steps to configure NTLM authentication for NW2004s SAP Portal and Active Directory 2003.
3. Any other approach to make Portal Drive SSO work.
Helpful answers will be rewarded.
Regards,
Chandra

Hi Gregor,
I did two things:
first i made a change in the portalapp.xml in the PAR file "com.sap.km.cm.par". In the section authentication scheme for "docs" I changed the authentication scheme to "default" to make sure that documents are opened using the default authentication scheme (SPNego) instead of basic authentication
second, I used the SPNego wizard to configure SPNego. So I didn't adjust anything in the Visual Admin or the authentication template apart from adding the Template to the Ticket policy configuration.
Again, this only worked after installing the latest vesion.
Hope this helps
Marcel

Any document explaining Risks involved in assigning "Delegation Permission" to a computer for Kerberos Authentication

Need SSO on CRM 2013. As per documents assigning Delegation Permission in Kerberos Authentication is mandatory to achieve SSO in CRM 2013.
Before doing that need to evaluate risks in doing so. Any help or document for the same is helpful.
Devesh

Hi Devesh,
“The idea of delegation in Kerberos is that if a user makes a request to a final resource, and some
intermediary accounts must process the request, then those intermediary accounts can be trusted to delegate on the user’s behalf. You can configure an account for delegation by using Active Directory Users and Computers as a domain administrator.
Select Trust this user/computer for delegation to any service (Kerberos) under the Delegation tab of the user or computer account.”
Quoted from this article below:
Using Kerberos for SharePoint Authentication
http://technet.microsoft.com/en-us/magazine/ee914605.aspx
From my point of view, as long as the intermediary account can be trusted, then it is safe.
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Kerberos Authentication for EP 7.0 Portal

Similar Messages

Maybe you are looking for