21 Configuring Windows Native Authentication

Overview of WNA

WNA allows desktop clients using Microsoft Internet Explorer (or any browser that supports Microsoft's SPNEGO protocol) to automatically authenticate with Web applications using their Windows desktop credentials. OC4J Web applications can be configured to use WNA instead of challenging users for login credentials.

WNA uses a Kerberos session ticket that is generated when logging into the Windows desktop. The ticket is not visible to the user and contains, among other things, login credentials. The ticket is passed through the browser to the web application. The SPNEGO protocol is used to retrieve the Kerberos credentials from the browser. Web applications validate the credentials by checking them against the Key Distribution Center (KDC) server on the Windows domain server. If authentication succeeds, access is automatically granted to the Web applications.

Figure 21-1 below provides a conceptual view of the key components involved when using WNA. The authentication flow is described following the diagram.

Figure 21-1 Conceptual View and Flow of WNA

The authentication flow is as follows:

• (1) The user signs into their domain at the Windows desktop (Windows sign-on), which is configured for Kerberos authentication.

• (2, 3, 4) The user then uses a browser to accesses the Web application, which is configured as a Java Single Sign-On (JSSO) partner application. If the user is not authenticated, they are redirected to JSSO. The JSSO application is configured with WNA authentication and uses the Generic Security Services Java API (GSS-API) token exchange protocol to request the user's Kerberos ticket. OC4J validates the ticket and extracts the user's Security Account Manager (SAM) account information.

• (5, 6, 7) OC4J maps the SAM account name to the user in Active Directory by querying Active Directory to locate the user. Active Directory is then used to compute the user's enterprise groups. The user's identity and their enterprise groups are set as the authenticated subject to complete the authentication step. A cookie is then set for the user and the request is redirected back to the Web application.

Prerequisites for Configuring WNA

The following tasks must be completed before configuring WNA:

• Install OC4J server.

• Verify that the Active Directory server that is being used is accessible and that the server's KDC is operational.

• Create the necessary users and groups in Active Directory. For example oc4jadmin and the management groups such as oc4j-adminstrators and oc4j-app-adminstrators. Refer to "Creating Required Accounts in the LDAP Server" for a list of all required accounts.

Step 1: Configure the Linux Host System as a Kerberos Client

The Linux host system where JSSO is deployed must be configured as a kerberos client.

To configure the Linux host system as a kerberos client:

1. On the Linux host server, open the /etc/krb5.conf file.

2. In the [libdefaults] section, edit the value of default_realm to a default kerberos realm name for your environment. The name can be a domain name and must be entered in upper case. For example:

   [libdefaults]
    default_realm = MYDOMAIN.COM
   

3. In the [realms] section, replace the realm name with the name defined in step 2 and set its value to the fully qualified domain name of the Active Directory server including the kerberos port number. For example:

   [realms]
    MYDOMAIN.COM = {
     kdc = name.mydomain.com:8787
    }
   

4. In the [domain_realm] section, set the DNS domain name for your JSSO server equal to the default realm. For example:

   [domain_realm].mydomain.com = MYDOMAIN.COM
   

5. Save and close the krb5.conf file.

6. Verify that the clocks on both your JSSO server and the Active Directory server are synchronized. This includes the time, date, and time zone settings.

Step 2: Create a User Account in Active Directory

A Web application host user account must be created on the Active Directory server with the same host name where JSSO is deployed.

To create a Web application service host user account:

1. Log in to the Active Directory server as the Administrator.

2. Click Start -> Programs -> Administrative Tools -> Active Directory Users and Computer.

3. Select the Users folder.

4. Click Create User.

5. Enter the following information:

   • First name: Enter a nickname that can be any readable name for this account.User logon name: Enter the JSSO host's complete DNS name. For example, mydomain.com.

6. Click Next.

7. Enter a password for this user. Do not select any password expiration settings.

8. Click Next. The new user appears in the list of users.

Step 3: Generate and Test the Keytab File for the Linux Host

A keytab file is used by the Web application to map an account name to a service principal name. The keytab file is required and must be generated using the ktpass command.

To generate the keytab file for the Linux host:

1. Open a command prompt on the Active Directory server.

2. Issue the following command:

   C:\> ktpass -princ HTTP/domain@DEFAULT_REALM -pass password 
   -mapuser host_user_account -out file_name.keytab
   

   Where:

   • The -princ (principal) value is HTTP/ followed by the fully qualified domain name of the Web application service host, followed by the default realm name. This is case sensitive. The Active Directory default realm must be in upper case and the fully qualified domain name of the Web application should be in lower case. For example:

     -princ HTTP/name.mydomain.com@MYDOMAIN.COM
     

   • The -pass value must be set to the same password assigned to the Web application host user account created on the Active Directory server.

   • The -mapuser value is the JSSO fully qualified domain name (hostname) user created on the Active Directory server.

   • The -out value is the name for the output file. For example:

     MyFile.keytab
     

3. Copy the generated keytab file to the OC4J instance where JSSO is deployed and configured on the Linux Host. For example:

   ORACLE_HOME/j2ee/home/config
   

4. Issue the following kinit command to test the Kerberos connection between the Linux server and the Active Directory server to ensure that they have both been properly configured. The kinit executable for Red Hat Linux is located in the /usr/kerberos/bin directory.

   # /usr/kerberos/bin/kinit -k -t ORACLE_HOME/j2ee/home/config/keytab_file HTTP/domain_name
   

   The command must include the full path to the keytab file generated in step two and the fully qualified domain name of the of the Web application service host. For example:

   # /usr/kerberos/bin/kinit -k -t oracle/j2ee/home/config/MyFile.keytab HTTP/name.mydomain.com
   

   If the command is successful, there should be no output from the command and another command prompt returns. Any errors that are reported in the output must be resolved.

Step 4: Configure the OC4J Instance

The tasks in this section configure an OC4J instance and its deployed Web applications to use WNA. Stop the OC4J instance before completing the tasks in this section. Make sure OC4J is started after completing the tasks in this section.

The following tasks are required to configure an OC4J instance to use WNA:

• Set Security System Properties for OC4J

• Edit the System JAZN Configuration File

• Edit the JAZN Configuration File

• Edit Application Deployment Descriptors

-Djavax.security.auth.useSubjectCredsOnly=false
-Doracle.security.jazn.config =ORACLE_HOME/j2ee/home/config/jazn.xml

-Djava.security.krb5.realm=kerberos-realm-name
-Djava.security.krb5.kdc=kdc_host_name
-Dsun.security.krb5.debug=true

Step 5: Configuring a Browser and Testing WNA

The host name where the JSSO application is deployed must be added as a trusted host within a client's Internet Explorer browser before attempting to access a Web application that has been configured to use WNA. If Internet Explorer is running on a computer that is in the JSSO domain, a Kerberos negotiation takes place. If Internet Explorer is running on a computer that is not part of the JSSO domain, then the fallback logic is to use basic authentication and the browser will prompt for a username and password. The username and password is authenticated against the Active Directory configured in the system-jazn-data.xml file.

To configure your browser settings and test the WNA feature, perform the following steps:

1. Log in to the Windows domain.

2. Open the Internet Explorer browser.

3. From the browser's Tools menu, select Internet Options. The Internet Options dialog box displays.

4. From the Internet Options dialog box, select the Security tab.

5. Click to highlight the Local intranet icon and click Sites. The Local intranet dialog box displays.

6. From the Local intranet dialog box, click Advanced.

7. In the text field, enter the URL for the computer that is hosting the JSSO server. For example, http://dude.mydomain.com. Do not include the JSSO login page or port number.

8. Click Add to add the URL to the list of Web sites for the Local intranet zone.

9. Click OK and then click OK again to close the Local intranet dialog box.

10. From the Security tab on the Internet Options dialog box, click Custom Level. The Security Settings dialog box displays. Make sure the Automatic logon only in Intranet zone option is selected.

11. Click OK to close the Security Settings dialog box.

12. Click OK to close the Internet Options dialog box.

13. In the browser address field, enter the following URL to navigate to the JSSO server login page: http://host:port/jsso/SSOLogin. Replace host:port with the host and port used to access the JSSO application.

    The Kerberos credentials are transparently passed through the browser to the JSSO server and you are automatically logged into the JSSO server. If you are redirected to the top-level page, then the test is successful.