20 Configuring Single Sign-On with Microsoft Clients

The host computer that supports SSO for Microsoft clients must meet the following system requirements:

• A version of Microsoft Windows that is supported by WebLogic Server for SSO with Microsoft clients

  For information about these supported versions, see the Oracle Fusion Middleware Supported System Configurations page on the Oracle Technology Network.

• Fully-configured Active Directory authentication service. Specific Active Directory requirements include:

  • User accounts for mapping Kerberos services

  • Service Principal Names (SPNs) for those accounts

  • Keytab files created and copied to the start-up directory in the WebLogic domain

• WebLogic Server installed and configured properly to authenticate through Kerberos, as described in this chapter

Oracle recommends encrypting the user accounts that are mapped to Kerberos services on the WebLogic Server host. However, the ability to encrypt these accounts imposes additional requirements. The specific requirements depend on the encryption algorithm used, as shown in Table 20-1. For each encryption algorithm listed in Table 20-1, see the Oracle Fusion Middleware Supported System Configurations page on the Oracle Technology Network for information about:

• The corresponding version of Microsoft Windows that is supported as the Active Directory platform.

• The specific versions of the Internet Explorer and Mozilla FireFox client types that are supported.

^Footnote 1

User accounts accessed with a Java SE client can also be encrypted with DES, AES-128, AES-256, and RC4 and defined in Active Directory running on a Microsoft Windows platform supported by WebLogic Server for this purpose.

The computer hosting a Microsoft client that uses SSO must meet the following requirements:

• An installation of Microsoft Windows

• Include one of the client types listed in the following table, which also includes links to the instructions for configuring those clients:

  For the following client type . . .	. . . see the following topic
  Internet ExplorerFoot 2	Configuring an Internet Explorer Browser
  Mozilla FireFoxFootref	Configuring a Mozilla Firefox Browser
  .NET Framework with properly configured web service client	Configuring a .NET Web Service
  Standalone Java SE client application	Configuring a Java SE Client Application

  ^Footnote 2

  For information about the specific version supported for accessing user accounts that are defined in Active Directory and encrypted with AES-128, AES-256, or RC4, see the Oracle Fusion Middleware Supported System Configurations page on the Oracle Technology Network.

  Clients must be logged on to a Microsoft Windows domain and have Kerberos credentials acquired from the Active Directory server in the domain. Local logins are not supported.

  Note:

  For information about the versions of Microsoft Windows that are supported for hosting clients using SSO, and the encryption algorithms with which user accounts accessed by those clients can be defined in Active Directory, see the Oracle Fusion Middleware Supported System Configurations page on the Oracle Technology Network.

1. Right-click the name of the user account in the Users tree in the left pane and select Properties.
2. Select the Account tab and check the following:

   • If you plan to use DES encryption, check the box Use DES encryption types for this account.

   • If you plan to use AES encryption, check the boxes This account supports Kerberos AES 128 and This account supports Kerberos AES 256, and make sure that Use Kerberos DES Encryption is unchecked.

   Make sure no other boxes are checked, particularly the box "Do not require Kerberos pre-authentication."

3. Click OK.

As mentioned in Creating a Kerberos Identification for WebLogic Server, an SPN is a unique name that identifies an instance of a service and is associated with the logon account under which the service instance runs. The SPN is used in the process of mutual authentication between the client and the server hosting a particular service. The client finds a computer account based on the SPN of the service to which it is trying to connect. So, in a specific project, you need to link the service that will be invoked by your WebLogic clients to the account you just defined for your WebLogic Server. For example, the service invoked by the WebLogic browser clients is HTTP/myhost.example.com, which needs to be linked to the myhost account.

Windows account names are not multipart as Kerberos principal names. Because of this, it is not possible to directly create an account using the name HTTP/hostname.dns.com. Such a principal instance is created through SPN mappings. In this case, an account is created with a meaningful name hostname, and an SPN mapping is added for HTTP/hostname.dns.com.

The specific steps for defining an SPN and creating a keytab for the service depend on the underlying platform on which WebLogic Server is running. They are provided in the following sections:

You can use the following utilities to verify that your SPN and keytab files are set up correctly.

• Use the setspn -l command to verify that the SPN is mapped successfully.

• Use the klist command to verify the key type. For example:

  -klist -e -k keytab-file-name
  

  For AES 128, this command displays Key type: 17. For AES 256, Key type: 18 is displayed.

• Use the kinit utility to verify that Kerberos is set up properly and that your principal and keytab are valid.

  The kinit utility is provided by the JRE and may be used to obtain and cache Kerberos ticket-granting tickets. You can run the kinit utility by entering the following command:

  kinit -k -t keytab-file account-name
  

  The output should appear similar to the following:

  New ticket is stored in cache file C:\Documents and Settings\Username\krb5cc_myhost
  

1. Download JCE Unlimited Strength Jurisdiction Policy Files from the preceding URL.
2. Uncompress and extract the jurisdiction policy files.
3. Complete the installation procedure described in the included README.txt file.

1. In the web.config file for the Web service, set the authentication mode to Windows for IIS and ASP.NET as follows:

   <authentication mode="Windows" />
   

   This setting is usually the default.

2. Add the statement needed for the Web services client to pass to the proxy Web service object so that the credentials are sent through SOAP.

   For example, if you have a Web service client for a Web service that is represented by the proxy object conv, the syntax is as follows:

   /*
   * Explicitly pass credentials to the Web Service
   */
   conv.Credentials =
   System.Net.CredentialCache.DefaultCredentials;
   

To configure an Internet Explorer browser to use Windows Integrated Authentication, complete the procedures described in the following sections:

1. Start Firefox.
2. In the Location Bar, enter about:config.
3. Enter the filter string network.negotiate.
4. Set the preferences as shown in Table 20-2.

   Table 20-2 Preferences Required in Firefox for Windows Integrated Authentication

   Preference Name	Status	Type	Value
   network.negotiate-auth.allow-proxies	default	boolean	true
   network.negotiate-auth.delegation-uris	user set	string	http://,https://
   network.negotiate-auth.gsslib	default	string	<blank>Foot 3
   network.negotiate-auth.trusted-uris	user set	string	http://,https://
   network.negotiate-auth.using-native-gsslib	default	boolean	true

   ^Footnote 3

   The value for the network.negotiate-auth.gsslib preference should be kept blank.

1. Ensure that your Java SE client is running with a supported JDK. For information, see the Oracle Fusion Middleware Supported System Configurations page on the Oracle Technology Network.
2. Create a JAAS configuration file that identifies the Kerberos login module, com.sun.security.auth.module.Krb5LoginModule. This configuration file defines two login entries:

   • com.sun.security.jgss.krb5.initiate — Invoked for the Java client.

   • com.sun.security.jgss.krb5.accept — Invoked for the WebLogic Server instance that is represented by a Kerberos identity and that hosts the Web application to which the client wants access.

   For each login entry, options are included that:

   • Require that authentication of the principal must succeed (that is, the user of the client application who is defined in the Microsoft domain).

   • Set useKeyTab to true, which causes the principal's key to be obtained from the keytab.

   • Identify the name of the keytab.

   • Set storeKey to true, which causes the principal's key to be stored in the Subject.

   • Optionally, set the debug option to true.

   The following example shows JAAS configuration file for the Kerberos login module used for the principal negotiatetester, who is defined in the Microsoft domain, SECURITYQA.COM, in which the Active Directory server runs:

   com.sun.security.jgss.krb5.initiate {
      com.sun.security.auth.module.Krb5LoginModule 
      required principal="[email protected]" 
      useKeyTab=true 
      keyTab=negotiatetester_keytab storeKey=true debug=true; };
    
   com.sun.security.jgss.krb5.accept {
      com.sun.security.auth.module.Krb5LoginModule 
      required principal="[email protected]" 
      useKeyTab=true keyTab=negotiatetester_keytab storeKey=true debug=true; };
   

3. In the Java command that starts the client application, pass the following values as arguments:

   • The Microsoft domain in which the Active Directory server runs

   • The host name of the computer running the Kerberos Key Distribution Center (KDC) server

   • The JAAS configuration file that identifies the Kerberos login module

   • The javax.security.auth.useSubjectCredsOnly=false property, which specifies that it is permissible to use an authentication mechanism other than Subject credentials

   • The name of the Java SE client class

   • The Web application resource to which access is requested

   For example:

   java -Djava.security.krb5.realm = SECURITYQA.COM\
   -Djava.security.krb5.kdc = rno05089.example.com\
   -Djava.security.auth.login.config = negotiatetester_krb5Login.conf\
   -Djavax.security.auth.useSubjectCredsOnly = false\
   RunHttpSpnego http://myhost.example.com:7001/AuthenticatedServlet.jsp