Hallo Gerrit,
nachdem es kurz funktioniert hat, ist nun alles wieder kaputt.
Aus dem fs-server.log:
DEBUG 24.07.2012 15:53:53.862 (de.espirit.firstspirit.server.authentication.AuthenticationManagerImpl): [1635487875] login context 'websso' created.
DEBUG 24.07.2012 15:53:53.865 (de.espirit.firstspirit.server.authentication.AuthenticationManagerImpl): [1635487875] initialize...
DEBUG 24.07.2012 15:53:53.867 (de.espirit.firstspirit.server.authentication.AuthenticationManagerImpl): [1635487875] login: [FSTicketLoginModule/Anmeldemodul-Steuerflag: sufficient]
DEBUG 24.07.2012 15:53:53.867 (de.espirit.firstspirit.server.authentication.AuthenticationManagerImpl): request for callbacks handled without c/s roundtrip.
DEBUG 24.07.2012 15:53:53.867 (de.espirit.firstspirit.server.authentication.FSTicketLoginModule): ticket not found!
DEBUG 24.07.2012 15:53:53.874 (de.espirit.firstspirit.server.authentication.AuthenticationManagerImpl): [1635487875] initialize...
DEBUG 24.07.2012 15:53:53.876 (de.espirit.firstspirit.server.authentication.AuthenticationManagerImpl): [1635487875] login: [FSUserLoginModule/Anmeldemodul-Steuerflag: optional]
DEBUG 24.07.2012 15:53:53.876 (de.espirit.firstspirit.server.authentication.FSUserLoginModule): try to login...
DEBUG 24.07.2012 15:53:53.876 (de.espirit.firstspirit.server.authentication.AuthenticationManagerImpl): request for callbacks handled without c/s roundtrip.
DEBUG 24.07.2012 15:53:53.876 (de.espirit.firstspirit.server.authentication.FSUserLoginModule): name/password missing!
DEBUG 24.07.2012 15:53:53.878 (de.espirit.firstspirit.server.authentication.AuthenticationManagerImpl): [1635487875] abort: [FSTicketLoginModule/Anmeldemodul-Steuerflag: sufficient]
DEBUG 24.07.2012 15:53:53.880 (de.espirit.firstspirit.server.authentication.AuthenticationManagerImpl): [1635487875] abort: [FSUserLoginModule/Anmeldemodul-Steuerflag: optional]
DEBUG 24.07.2012 15:53:53.880 (de.espirit.firstspirit.server.authentication.FSUserLoginModule): aborting...
Aus dem Tomcat Log:
Debug is true storeKey true useTicketCache false useKeyTab true doNotPrompt true ticketCache is null isInitiator false KeyTab is /opt/firstspirit4/conf/wcms-t.keytab refreshKrb5Config is false principal is HTTP/wcms-t.dmag.messe.de@MESSE.ADS tryFirstPass is false useFirstPass is false storePass is false clearPass is false
principal's key obtained from the keytab
principal is HTTP/wcms-t.dmag.messe.de@MESSE.ADS
EncryptionKey: keyType=23 keyBytes (hex dump)=0000: D6 67 5C 4F CC 63 0E C4 D6 51 20 36 C4 AB 92 F6 .g\O.c...Q 6....
Added server's keyKerberos Principal HTTP/wcms-t.dmag.messe.de@MESSE.ADSKey Version 3key EncryptionKey: keyType=23 keyBytes (hex dump)=
0000: D6 67 5C 4F CC 63 0E C4 D6 51 20 36 C4 AB 92 F6 .g\O.c...Q 6....
[Krb5LoginModule] added Krb5Principal HTTP/wcms-t.dmag.messe.de@MESSE.ADS to Subject
Commit Succeeded
Und die Konfiguration:
/*
* JAAS Login Configurations.
* (for app-to-config mappings see fs-server.conf, JAAS.*)
*/
/* access api authentication (e.g., for remote projects) */
system {
de.espirit.firstspirit.server.authentication.FSUserLoginModule sufficient hash="true";
de.espirit.firstspirit.server.authentication.FSTicketLoginModule sufficient;
};
/* java-/admin-client authentication without sso */
plain {
de.espirit.firstspirit.server.authentication.KerberosLoginModule optional useFullPrincipal="false" userAgents=".*";
de.espirit.firstspirit.server.authentication.FSUserLoginModule optional;
};
/* java-/admin-client authentication sso */
sso {
de.espirit.firstspirit.server.authentication.FSTicketLoginModule sufficient;
de.espirit.firstspirit.server.authentication.KerberosLoginModule optional useFullPrincipal="false" userAgents=".*";
de.espirit.firstspirit.server.authentication.FSUserLoginModule optional;
};
/* web authentication (for preview, webedit, webmonitor) without sso */
webplain {
de.espirit.firstspirit.server.authentication.KerberosLoginModule optional useFullPrincipal="false" userAgents=".*";
de.espirit.firstspirit.server.authentication.FSUserLoginModule optional;
};
/* web authentication (for preview, webedit, webmonitor) with sso */
websso {
de.espirit.firstspirit.server.authentication.FSTicketLoginModule sufficient;
de.espirit.firstspirit.server.authentication.KerberosLoginModule optional useFullPrincipal="false" userAgents=".*";
de.espirit.firstspirit.server.authentication.FSUserLoginModule optional;
};
/* required additional configuration for KerberosLoginModule: */
com.sun.security.jgss.accept {
com.sun.security.auth.module.Krb5LoginModule required
principal="HTTP/wcms-t.dmag.messe.de@MESSE.ADS"
keyTab="/opt/firstspirit4/conf/wcms-t.keytab"
useKeyTab="true"
storeKey="true"
isInitiator="false"
doNotPrompt="true"
debug="true";
};
