Windows authentication with Kerberos

Hi All,
We have configured Kerberos for Windows Authentication for EP 7.0.
The authentication works fine when we use the server name alone, but it fails when we use the FQDN.
Any clues would be really helpful.
Regards,
Noufal

Hi Noufal,
When you register the Service Principal Name on the LDAP, Please make sure that you register it with your FQDN.
Please refer the Excellent Blog series by Holger Sir here..
http://www.sdn.sap.com/irj/scn/weblogs?blog=/pub/wlg/8235. [original link is broken]
These blog series cover almost all the errors caused during SPNEGO configuration.
Regards
Hussain.

Similar Messages

Windows AD with Kerberos authentication not supported for NW AS JAVA 7.1

The Admin guide for BO 3.1 states that Windows AD with Kerberos authentication is not supported on NetWeaver AS.
Can anybody suggest & confirm on this???

I know we haven't been receiving cases for it, but I think in theory it should work fine. BO doesn't really care what web/app kerberos comes from as the manual authentication uses the java SDK (i.e tomcat 5.5 would use Sun JDK 1.5), and SSO kerberos (vintela) uses 3rd party libraries. It's possible our 3rd party libraries may not support netweaver yet. If I hear anything else I'll post.
Regards,
Tim

Windows authentication with oracle9i

Hi,i am working on windows authentication with oracle9i.my client server is connecting and client can access the database.now can you please guide me the steps for windows authentication in brief.i will appreciate that.

can u plz help me how to ser OS_roles value to true.

SQL Windows Authentication with Login of AD Group 'Domain Admins'

Having a bit of a difficulty with Microsoft SQL Server 2012 windows authentication integration...
The server is setup to have Windows authentication used as its means of login authentication. No issues with this other than a strange error that occurs on multiple SQL servers in our domain:
When a login is created for domain group "[domain]\Domain Admins", users within this AD group cannot connect to the SQL server through the Management Studio. The error that SQL server gives is Error 18456, Sate 11, i.e. "Valid login but server
access failure"
However when a different AD group is added as a login (like [domain]\[group]), users from this group can successfully log into SQL server. It seems that adding any other group, even groups from a different domain, grants successful authentication as I would
expect EXCEPT the AD group 'Domain Admins".
Is there some restriction/security feature at play here on this AD group that makes using the 'Domain Admins' group as a login not possible?
Andrew

Yes, this group was removed and readded just yesterday to try to fix the issue.
Here is the output of the command:
class
class_desc
major_id
minor_id
grantee_principal_id
grantor_principal_id
type
permission_name
state
state_desc
105
ENDPOINT
2
0
2
1
CO
CONNECT
G
GRANT
105
ENDPOINT
3
0
2
1
CO
CONNECT
G
GRANT
105
ENDPOINT
4
0
2
1
CO
CONNECT
G
GRANT
105
ENDPOINT
5
0
2
1
CO
CONNECT
G
GRANT

Integrated Windows Authentication with a WebSphere Cliente

Hi all,
I need to write a web service client that connects to a .NET Web Service that is configured to use Integrated Windows Authentication (NTLM).
I'm using the IBM WebSphere Runtime environment for the client and using the web service client wizard in the RSD 6.0.1.
When I try to call a method in the .NET web service, I get the error shown below. If I configure the .NET web service to permit Anonymous Access, my client works fine.
Does anybody know if the WebSphere web services engine supports Integrated Windows Authentication? If so, how can I configure my cliente to pass my credentials? Do people use this type of authentication if the web service will be called by non Windows clientes or is it better to use Basic Authentication with HTTPS or digital certificates?
I've read that Apache Axis can be configured to use integrated windows authentication (http://people.etango.com/~markm/archives/2005/11/21/using_apache_axis_with_integrated_windows_security.html) by using a different HTTP transport class (CommonsHTTPSender).
Thanks in advance!
Craig
[14/06/06 10:06:56:805 GMT-03:00] 00000031 enterprise I WSWS3243I: Info: Mapping Exception to WebServicesFault.
[14/06/06 10:06:56:821 GMT-03:00] 00000031 enterprise I TRAS0014I: The following exception was logged WebServicesFault
faultCode: {http://schemas.xmlsoap.org/soap/envelope/}Server.generalException
faultString: java.lang.StringIndexOutOfBoundsException
faultActor: null
faultDetail:
java.lang.StringIndexOutOfBoundsException
     at com.ibm.ws.webservices.engine.WebServicesFault.makeFault(WebServicesFault.java:179)
     at com.ibm.ws.webservices.engine.transport.http.HTTPSender.invoke(HTTPSender.java:490)
     at com.ibm.ws.webservices.engine.PivotHandlerWrapper.invoke(PivotHandlerWrapper.java:218)
     at com.ibm.ws.webservices.engine.PivotHandlerWrapper.invoke(PivotHandlerWrapper.java:218)
     at com.ibm.ws.webservices.engine.WebServicesEngine.invoke(WebServicesEngine.java:274)
     at com.ibm.ws.webservices.engine.client.Connection.invokeEngine

Here's a project ( [http://spnego.sourceforge.net/protected_soap_service.html|http://spnego.sourceforge.net/protected_soap_service.html] ) that shows how to write a soap client that can connect to a soap web service with integrated windows authentication turned on.

Windows Authentication with jCIFS

Hello,
I am new to jCIFS and willing to know as to how I can use windows authentication using jCIFS or any other tool/framework.
I ran through the link - [http://jcifs.samba.org/src/docs/ntlmhttpauth.html] and developed a small web application (deployed on tomcat 5.x) which would fetch user details for me from my organization's active directory. It works fine on my machine; however when I try running the application from any other machine, it prompts me for the credentials. I want this application to authenticate the user (without user having to key in the credentials) that is logged on to the machine and fetch his/her user details. Can anyone please advise?
Thanking you in anticipation.
Here's my web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app id="WebApp_ID" version="2.4"
xmlns="http://java.sun.com/xml/ns/j2ee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
<display-name>AD Authentication</display-name>
<filter>
<filter-name>NtlmHttpFilter</filter-name>
<filter-class>jcifs.http.NtlmHttpFilter</filter-class>
<init-param>
   <param-name>jcifs.http.domainController</param-name>
   <param-value>xx.xx.xx.xx</param-value>
   </init-param>
<init-param>
   <param-name>jcifs.smb.client.domain</param-name>
   <param-value>MYDOMAIN</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>NtlmHttpFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<welcome-file-list>
<welcome-file>index.jsp</welcome-file>
</welcome-file-list>
</web-app>
{code}

Here's a useful link - [http://roneiv.wordpress.com/2007/12/11/hello-world/]. This worked for me.
Can any one let me know as to how can I retrieve user's e-mail (associated with his account) once he's authenticated? For example, if user xyz has logged in to domain mydomain then I need to fetch [[email protected]|mailto:[email protected]]
Thanks!

Can I use Windows authentication with Firefox?

My company has a website that I need to login to on a daily basis. With IE I can set up Windows Authentication to have a "single sign-on" for this website and it automatically logs me in when I open the site. I do not see any options for authentication under the Tools menu. Using Firefox's password memory does not give the same functionality.

You can do it by adding the server host name to a list of trusted host names. Obviously you need to be very careful about not adding untrustworthy servers to the list. See this article for how: [http://support.mozilla.com/en-US/kb/Firefox%20asks%20for%20user%20name%20and%20password%20on%20internal%20sites Firefox asks for user name and password on internal sites | Troubleshooting | Firefox Help].

Windows authentication with WCF-NetTcp adapter

I have a WCF-NetTcp receive location and I like to set it up with Windows Authentication. (transport security)
IIS or WAS is not used so the receive port is self-hosted.
I would like to configure a certain user or group that has permission to send messages to this receive location. All other users/groups must be denied acces. How do I achieve this? I know how to configure windows authentication in the binding but I cannot
find a way to configure a specific user or group.
I am using BizTalk Server 2010.

Hi,
You should implement a custom behavior extension to achieve this.
See
here for an example.
Regards,
René
Thanks, I was already looking in this direction but was hoping this could have been done easier.

Integrated windows authentication with Oracle access manager 10g

Hi SSo guys,
Our project requirement is as follows:
We have two applications Ebiz 11.5.10.2 and OBIEE10g and we are supposed to integrate IWA for both the applications
so as per the below note OAM integration with IWA only works for the applications using IIS.
So can we protect both the applications in OAM 10g and point those applications to two html pages say http://IIS hostname/ebiz and http://IIS hostname/OBIEE and protect those two resorces in OAM suing IIS webserver?
As per the note :
Doc ID 1072204.1 specify
Excerpt from this doc:
#-begin-
OAM accomplishes IWA by using an OAM Webgate on the IIS Web Server that uses a hidden feature of external authentication to get the REMOTE_USER header variable value and map it to a DN for the ObSSOCookie generation and authorization. Behind the scenes, the IIS WebGate utilizes the UseIISBuiltinAuthentication parameter, by default, this value is false. IWA can only be achieved when this attribute is set to true on an IIS WebGate. This is not a valid parameter for any other OAM WebGate.
#-end-

It should be this way:
Ebiz:
1. Integrate OAM with OASSO
2. Register OASSO and OID with Ebiz11.5.10.2
3. Protect the resource in OAM
4. Verify if authentication is successful for this resource.
Obiee:
1. Integrate OBIEE with OAM
2. Verify if authentication is successful for this resource.
IWA:
1. Install IIS webser and webgate
2. Create authentication scheme which protects / of IIS web server.
Create a Form Authentication Scheme(this scheme should protect OBIEE and EBiz resource) which will have challenge redirect to IIS web server where IWA is configured and / is protected.
Login Flow:
1. User tries to access ebiz or obiee resource.
2. Form Authentication Scheme will challenge redirect to IIS web server where IWA is configured.
3. As IWA is configured. User will be automatically get ObSSOCookie.
4. User gets redirected back to the requested resource.
There is a My oracle support doc which talks in details about this setup.

Integrating windows authentication with Sun ACCESS MANAGER

Hi,
I have implemented sun access manager and successfully protected an application (ABC). At present iam using the SDS as the authentication and authorization directory. I login in to the machine using the network username and password which is on AD.
I want to integrate my authentication/authorization mechanism from SDS to AD. so that when i login into the machine and open application ABC it should not ask me for the credentials; instead allow me to the homepage directly.
How to do this.
Thanks in advance
Maruthi

Hi!
Maybe this helps you, it describes how to setup AM and policy agent to handle basic authentication protected sites. While the article is about sharepoint it should work for any application.
http://developers.sun.com/identity/reference/techart/sharepoint.html
Christoph

Windows authentication via kerberos on LDAP

question - where can I generate ktpass -princ host/ etc. it isn't at j2ee engine machine ( is it at SAP Web Dispatcher)??

Hi Damian
You need to run the command on the Domain Controller
Theo

NTLM is not working with EP 6 SP 9 on Windows 2003 with IIS 6.

I installed EP 6 SP 9 on windiows 2003 server with IIS version 6.
Configures IisProxy.xml for redirection for filter irj. When I make a call to default website, it in turn calls server with irj filter.
Portal page comes up and requesting me to enter user id password.
I made the changes mentioned by some of the web logs in this site.
I configured HeaderVariableLoginModule an and added as explined by Gregory Wolf on the following topic.
Integrated Windows Authentication with SAP EP 6.0 SP 3 and higher.
I see following log from Ep 6 SP 9 log file security.log from directory E:\usr\sap\DEV\JC00\j2ee\cluster\server0\log\system.
security#Plain###No user name provided.#
#1.5#000C2953326B00430000000100000A780003F358EF2132DE#1111988099323#/System/Security#sap.com/irj#com.sap.engine.services.security#Guest#18####200d0cb09f4b11d9926a000c2953326b#SAPEngine_Application_Thread[impl:3]_37##0#0#Info#1#com.sap.engine.services.security#Plain###Cannot log info about the logon attempt because the user name is null.#
#1.5#000C2953326B00440000000000000A780003F3591D22E168#1111988846027#/System/Security#sap.com/irj#com.sap.engine.services.security#Guest#18####dd1f09b19f4c11d98e98000c2953326b#SAPEngine_Application_Thread[impl:3]_7##0#0#Info#1#com.sap.engine.services.security#Plain###No user name provided.#
#1.5#000C2953326B00440000000100000A780003F3591D22E215#1111988846027#/System/Security#sap.com/irj#com.sap.engine.services.security#Guest#18####dd1f09b19f4c11d98e98000c2953326b#SAPEngine_Application_Thread[impl:3]_7##0#0#Info#1#com.sap.engine.services.security#Plain###Cannot log info about the logon attempt because the user name is null.#
#1.5#000C2953326B00450000000000000A780003F359227DE92E#1111988935662#/System/Security#sap.com/irj#com.sap.engine.services.security#Guest#18####128c40e09f4d11d9acb7000c2953326b#SAPEngine_Application_Thread[impl:3]_28##0#0#Info#1#com.sap.engine.services.security#Plain###No user name provided.#
#1.5#000C2953326B00450000000100000A780003F359227DEDC7#1111988935662#/System/Security#sap.com/irj#com.sap.engine.services.security#Guest#18####128c40e09f4d11d9acb7000c2953326b#SAPEngine_Application_Thread[impl:3]_28##0#0#Info#1#com.sap.engine.services.security#Plain###Cannot log info about the logon attempt because the user name is null.#
Lots of weblogs are pointing to remote_user value in IisProxy.log file. I am not able to see that.
I also tried switching IIS 6 to run as IIS 5 and did not help much at all.
Please help me on the issue.
I did not change authschemes.xml file.
My IisProxy.xml file looks as follows:
<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE ISAPI-config[
     <!ELEMENT ISAPI-config ( filter, extension, ( mapping | config )* )>
     <!ATTLIST ISAPI-config
          version CDATA #REQUIRED
     >
     <!ELEMENT filter (log-path?)>
     <!ATTLIST filter
          name CDATA #IMPLIED
          log-level CDATA "3"
          log-flags CDATA "0x00000001"
          debug-flags CDATA "0x00008000"
          priority ( high | medium | low ) "high"
          extension-url CDATA "/scripts/IisProxy.dll"
          authentication ( skip | normal | forward ) "normal"
          remote-address ( skip | forward ) "skip"
     >
     <!ELEMENT extension (
          keystore-dir?,
          log-path?,
          data-path?,
          trace-path? )>
     <!ATTLIST extension
          name CDATA #IMPLIED
          log-level CDATA "1"
          log-flags CDATA "0"
          debug-flags CDATA "0"
          access ( filter | direct | both ) "filter"
     >
     <!ELEMENT keystore-dir (#PCDATA)>
     <!ELEMENT log-path (#PCDATA)>
     <!ELEMENT data-path (#PCDATA)>
     <!ELEMENT trace-path (#PCDATA)>
     <!ELEMENT mapping (
          source+,
          target,
          compress-types*,
          protocol-header?,
          certificate-header?,
          cert-chain-header?,
          cipher-header?,
          keysize-header?,
          keystore-path?,
          log-path?,
          data-path? )>
     <!ATTLIST mapping
          name CDATA #IMPLIED
          log-level CDATA "1"
          log-flags CDATA "0"
          debug-flags CDATA "0"
          keep-alive ( true | false ) "true"
          use-continue ( true | false ) "true"
          close-socket ( true | false ) "true"
          close-socket-delay CDATA "1000"
          thread-count CDATA "100"
          max-socket-age CDATA "37"
     >
     <!ELEMENT source (protocol, host?, port?, prefix, new-prefix?)>
     <!ATTLIST source
          access ( filter | direct | both ) "filter"
     >
     <!ELEMENT protocol (#PCDATA)>
     <!ELEMENT host (#PCDATA)>
     <!ELEMENT port (#PCDATA)>
     <!ELEMENT prefix (#PCDATA)>
     <!ELEMENT new-prefix (#PCDATA)>
     <!ELEMENT target (protocol, host, port)>
     <!ELEMENT compress-types (#PCDATA)>
     <!ATTLIST compress-types
          min-size CDATA "1024"
     >
     <!ELEMENT protocol-header (#PCDATA)>
     <!ELEMENT certificate-header (#PCDATA)>
     <!ELEMENT cert-chain-header (#PCDATA)>
     <!ELEMENT cipher-header (#PCDATA)>
     <!ELEMENT keysize-header (#PCDATA)>
     <!ELEMENT keystore-path (#PCDATA)>
     <!ELEMENT config ( source+ )>
]>
<ISAPI-config version="1.6">
     <filter name="IisProxy filter"/>
     <extension name="IisProxy extension" />
     <mapping name="IisProxy samples">
          <source>
               <protocol>http</protocol>
               <prefix>/irj</prefix>
          </source>
          <source>
               <protocol>http</protocol>
               <prefix>/Hello/</prefix>
          </source>
          <source>
               <protocol>http</protocol>
               <prefix>/Hello2/</prefix>
               <new-prefix>/Hello/</new-prefix>
          </source>
          <target>
               <protocol>http</protocol>
               <host>slcsepw04vd.pacificorp.us</host>
               <port>50000</port>
          </target>
          <compress-types>text/html, text/plain</compress-types>
     </mapping>
     <mapping name="Secure IisProxy samples">
          <source>
               <protocol>https</protocol>
               <prefix>/Hello/</prefix>
          </source>
          <target>
               <protocol>https</protocol>
               <host>localhost.your.corp</host>
               <port>8443</port>
          </target>
          <keystore-path>c:\sec\SAPSSLC.pse</keystore-path>
     </mapping>
     <config>
          <source>
               <protocol>http</protocol>
               <host>localhost</host>
               <prefix>/IisProxy</prefix>
          </source>
          <source>
               <protocol>https</protocol>
               <host>localhost</host>
               <prefix>/IisProxy</prefix>
          </source>
     </config>
</ISAPI-config>
Please help me. I am not sure what is missing. Please make a note that Portal version is EP 6 SP9 & Server is Windows 2003 with IIS 6.

I made the change as you requested and it did not help.
I do not see any remote_user entry in IisProxy.log file.
Please let me know the procedure to get REMOTE_USER into the IisProxy.log file.
<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE ISAPI-config[
     <!ELEMENT ISAPI-config ( filter, extension, ( mapping | config )* )>
     <!ATTLIST ISAPI-config
          version CDATA #REQUIRED
     >
     <!ELEMENT filter (log-path?)>
     <!ATTLIST filter
          name CDATA #IMPLIED
          log-level CDATA "3"
          log-flags CDATA "0x00000001"
          debug-flags CDATA "0x00008000"
          priority ( high | medium | low ) "high"
          extension-url CDATA "/scripts/IisProxy.dll"
          authentication ( skip | normal | forward ) "normal"
          remote-address ( skip | forward ) "skip"
     >
     <!ELEMENT extension (
          keystore-dir?,
          log-path?,
          data-path?,
          trace-path? )>
     <!ATTLIST extension
          name CDATA #IMPLIED
          log-level CDATA "1"
          log-flags CDATA "0"
          debug-flags CDATA "0"
          access ( filter | direct | both ) "filter"
     >
     <!ELEMENT keystore-dir (#PCDATA)>
     <!ELEMENT log-path (#PCDATA)>
     <!ELEMENT data-path (#PCDATA)>
     <!ELEMENT trace-path (#PCDATA)>
     <!ELEMENT mapping (
          source+,
          target,
          compress-types*,
          protocol-header?,
          certificate-header?,
          cert-chain-header?,
          cipher-header?,
          keysize-header?,
          keystore-path?,
          log-path?,
          data-path? )>
     <!ATTLIST mapping
          name CDATA #IMPLIED
          log-level CDATA "1"
          log-flags CDATA "0"
          debug-flags CDATA "0"
          keep-alive ( true | false ) "true"
          use-continue ( true | false ) "true"
          close-socket ( true | false ) "true"
          close-socket-delay CDATA "1000"
          thread-count CDATA "100"
          max-socket-age CDATA "37"
     >
     <!ELEMENT source (protocol, host?, port?, prefix, new-prefix?)>
     <!ATTLIST source
          access ( filter | direct | both ) "filter"
     >
     <!ELEMENT protocol (#PCDATA)>
     <!ELEMENT host (#PCDATA)>
     <!ELEMENT port (#PCDATA)>
     <!ELEMENT prefix (#PCDATA)>
     <!ELEMENT new-prefix (#PCDATA)>
     <!ELEMENT target (protocol, host, port)>
     <!ELEMENT compress-types (#PCDATA)>
     <!ATTLIST compress-types
          min-size CDATA "1024"
     >
     <!ELEMENT protocol-header (#PCDATA)>
     <!ELEMENT certificate-header (#PCDATA)>
     <!ELEMENT cert-chain-header (#PCDATA)>
     <!ELEMENT cipher-header (#PCDATA)>
     <!ELEMENT keysize-header (#PCDATA)>
     <!ELEMENT keystore-path (#PCDATA)>
     <!ELEMENT config ( source+ )>
]>
<ISAPI-config version="1.6">
     <filter name="IisProxy filter" authentication="forward"/>
     <extension name="IisProxy extension" />
     <mapping name="IisProxy samples">
          <source>
               <protocol>http</protocol>
               <prefix>/irj</prefix>
          </source>
          <source>
               <protocol>http</protocol>
               <prefix>/Hello/</prefix>
          </source>
          <source>
               <protocol>http</protocol>
               <prefix>/Hello2/</prefix>
               <new-prefix>/Hello/</new-prefix>
          </source>
          <target>
               <protocol>http</protocol>
               <host>slcsepw04vd.pacificorp.us</host>
               <port>50000</port>
          </target>
          <compress-types>text/html, text/plain</compress-types>
     </mapping>
     <mapping name="Secure IisProxy samples">
          <source>
               <protocol>https</protocol>
               <prefix>/Hello/</prefix>
          </source>
          <target>
               <protocol>https</protocol>
               <host>localhost.your.corp</host>
               <port>8443</port>
          </target>
          <keystore-path>c:secSAPSSLC.pse</keystore-path>
     </mapping>
     <config>
          <source>
               <protocol>http</protocol>
               <host>localhost</host>
               <prefix>/IisProxy</prefix>
          </source>
          <source>
               <protocol>https</protocol>
               <host>localhost</host>
               <prefix>/IisProxy</prefix>
          </source>
     </config>
</ISAPI-config>
Please let me know what is missing.
Thanks.

Native Windows Authentication in Java?

I'm maintaining a Java web app that runs on a Windows server and needs to use native Windows authentication to do a pass/fail validation of a client's user/pass/domain credentials.
Currently, the app uses JNI to make a simple LogonUserW call, however JNI is causing a variety of headaches. I was wondering if Java can do Windows authentication with JAAS or Java SSO technology. I'm new to Java security APIs so any pointers are greatly appreciated.
Thanks!

I'm maintaining a Java web app that runs on a Windows server and needs to use native Windows authentication to do a pass/fail validation of a client's user/pass/domain credentials.
Currently, the app uses JNI to make a simple LogonUserW call, however JNI is causing a variety of headaches. I was wondering if Java can do Windows authentication with JAAS or Java SSO technology. I'm new to Java security APIs so any pointers are greatly appreciated.
Thanks!

IIS authentication with weblogic

I am trying to use IIS authentication with my ADF application deployed on weblogic. Is there any documentation for this?
I want to use windows authentication with IIS. So users should not get any prompt for username / password to the application after they loggen in their windows machine.
It should be like intranet ADF application.
Thanks

I am trying to use IIS authentication with my ADF application deployed on weblogic. Is there any documentation for this?
I want to use windows authentication with IIS. So users should not get any prompt for username / password to the application after they loggen in their windows machine.
It should be like intranet ADF application.
Thanks

Windows Authentication Kerberos - Logon with different windows user

I've successfully set up Windows Integrated Authentication/SPNego/Kerberos logon on my portal. Now when I launch the portal from a workstation I am logged on automatically with my Windows userid without needed to provided userid and password again - very happy!
When I press logoff the portal returns to the logon screen, sees that I've got a kerberos ticket, and logs me straight back on! Not happy!
As an administrator or as a super user, it is sometimes necessary to log on with an administrative userid or to visit an end user and log on as myself on their workstation. Therefore, I need a mechanism to override the automatic logon and force a basic password prompt screen.
As I understand it I can achieve this by creating a special iView with its own authscheme which does not use SPNego. I could either point the logoff redirect url setting to this iView or I could simply enter the quicklink for the iView in the browser. Will this circumvent the automatic logon and, if so, is there anything special I need to do to achieve this?
I had hoped to use the standard logon screen as the iView. I've got that stored in a par file (along with my corporate icons and a link to local help files). I uploaded the par file through system administration - support - portal runtime - administration console and thought I might be able to see that when I created a portal component iView but it's not visible. Should it be?

When I need to logon as a test user, I find it easier to disable the integrated Windows authentication in the browser. You can do that in the menus, but I change the registry. Create two text files (e.g., DisableKerb.reg and EnableKerb.reg)
Disable.reg:
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"EnableNegotiate"=dword:00000000
Enable.reg:
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"EnableNegotiate"=dword:00000001
Then just double-click to change your authentication mechanism.
Regards,
Sean

Windows authentication with Kerberos

Similar Messages

Maybe you are looking for