Kerberos Adapter for webmethods

Transcription

1 Kerberos Adapter for webmethods Many webmethods programmers are familiar with the problem of authenticating from.net clients to a webmethods server. Sometimes this is solved by transferring authentication information from client to server as text values, which is not a good practice. KogunKerberos is a webmethods package which provides Kerberos authentication support from.net clients to webmethods services. The package contains a custom JAAS login module as well as providing public flow services. The login module provides a Kerberos authentication for clients who wants to authenticate with Kerberos. The flow services makes it possible to request a new service ticket, from either user/pass, keytab/principal or current user subject if it contains a valid TGT. The ticket can then be included in the transport headers when consuming external services that supports Kerberos authentication. For further information please contact Mr. Gisli Ragnarsson gisli.ragnarsson@advania.is Technical Overview Figure 1: Overview of communication between client and server when authenticating with Kerberos Application wants to call a webmethods web service with a Authorization Challenge 1. Application sends an anonymous HTTP request to webmethods web service

2 2. webmethods responds with 401 Unauthorized request from the KogunKerberos Login Module with WWW-Authenticate header set to both Negotiate and Basic (listing the authentication protocols supported) 3. The Application is configured to use Kerberos authentication, hence recognizes the Negotiate header and request the Domain Controller for a service ticket for the webmethods IS 4. If everything was valid the Domain Controller responds with the generated service ticket 5. The Application now includes the service ticket received in the HTTP Authorization header when it sends a new request to the webmethods web service 6. KogunKerberos Login Module recognizes the Negotiate type in the Authorization header and tries to validate the ticket using a keytab file 7. If KogunKerberos Login Module successfully validated the user from the ticket then webmethods responds with the response from the web service. Otherwise it responds with Unauthorized response. Install Guide The same guide is also available at KogunKerberos_InstallGuide.pdf and at the package home page on the Integration Server. After installing the KogunKerberos package onto Integration Server please follow these steps to complete the installation of the Kerberos login module. Requirements Existing service user for the Integration Server in the Active Directory, service principal name (SPN) for that user and the associated keytab file generated from the SPN. Configure the Kerberos module Open the KogunKerberos package home page:

3 Figure 2: Configuration interface for the Kerberos Module 1. Set the SPN as the service principal name that was used to generate the keytab file. 2. Set the Keytab as the path of the keytab file. Note: If full path is not specified the IS starts from the IntegrationServer folder. We recommend to store the keytab in the resource folder of the package. 3. Set Debug either true or false as needed. Note: The log can be found under IntegrationServer/logs. 4. Press Save to store the changes. Configure IS use the Kerberos Module Open the is_jaas.cnf file which is located under IntegrationServer/config. Add is.kogun.security.auth.kerberos.kerberosloginmodule sufficient; to the IS_Transport context as the last entry above the DefaultLoginModule and change the flags for other entries from requisite to sufficient and save the changes.

4 Figure 3: Example of how IS_Transport context of is_jaas.cnf should be Restart the server Restart the Integration Server to activate the changes. After restart make sure the KerbersLoginModule_1_0.jar is loaded in the server classpath under the About page in the Administration View.

5 Package Service Description The package provides two flow services KogunKerberos.pub.ticket:requestServiceTicket This service requests a new Kerberos service ticket for specified service principal name. The service reads the domain configurations from the krb5.conf file. The default file location is in the package resource folder. By passing the fully qualified file name into the input variable krb5config the file can be located in another directory. Note: If the krb5.conf has not been updated with the right domain configurations the service will fail to request the ticket. The service checks first if username / password is provided and uses that, however if that is not provided it checks if keytab / keytabprincipal is provided and uses that. If neither username / password nor keytab / keytabprincipal is provided the service checks if there is a subject in Service.getSession().getJaasSubject() and tries to use that. Input serviceprincipalname Yes The service principal name of the service that the caller is requesting a ticket for. krb5config No Fully qualified file name of the krb5.conf configuration file. If not provided the service tries to locate the file in the resource folder of the package. delegation No If the service ticket should be forwardable. Default value is false. username No The username used to acquire the TGT to request a new service ticket. If username is provided the password needs to be provided as well. password No The password for the username. keytab No Path to the keytab file to use to require the TGT to request a new service ticket. If keytab is provided the keytabprincipal needs to be provided as well. keytabprincipal No The user/service principal the keytab was generated for. Output ticket No The service ticket as a Base64 encoded string if it was successfully generated. Otherwise it is null. statuscode Yes Code representing the success status of the service. 0 is success / 1 is error statusmessage Yes Message explaining in more details the success status of the service.

6 KogunKerberos.pub.transport:getAuthHeader This service requests a new Kerberos service ticket for specified service principal name and wraps it in a transport header to be passed as an input to consumer WSD Connectors. The service calls KogunKerberos.pub.ticket:requestServiceTicket to request a new service ticket. See KogunKerberos.pub.ticket:requestServiceTicket for further documentation. Input serviceprincipalname Yes The service principal name of the service that the caller is requesting a ticket for. krb5config No Fully qualified file name of the krb5.cnf configuration file. If not provided the service tries to locate the file in the resource folder of the package. delegation No If the service ticket should be forwardable. Default value is false. username No The username used to acquire the TGT to request a new service ticket. If username is provided the password needs to be provided as well. password No The password for the username. keytab No Path to the keytab file to use to require the TGT to request a new service ticket. If keytab is provided the keytabprincipal needs to be provided as well. keytabprincipal No The user/service principal the keytab was generated for. Output transportheader No Document containing string called Authorization. The string contains the value Negotiate <encoded ticket>, like the Authorization header should be when using Kerberos authentication. If the service failed to request ticket the transportheader will be null. statuscode Yes Code representing the success status of the service. 0 is success / 1 is error statusmessage Yes Message explaining in more details the success status of the service.