[30899] in Kerberos
RE: JBoss Negotiate
daemon@ATHENA.MIT.EDU (Thomas Maslen)
Fri Mar 20 11:46:04 2009
From: Thomas Maslen <Thomas.Maslen@quest.com>
To: "Krishnawat, Nagendra" <Nagendra.Krishnawat@westernasset.com>,
"kerberos@mit.edu" <kerberos@mit.edu>
Date: Fri, 20 Mar 2009 08:45:03 -0700
Message-ID: <723530449330F342A68634ADF3CE8DE2033D50DAAB@alvxmbw02.prod.quest.corp>
In-Reply-To: <CD466582FA6D3D4E8896E91AE7483C5D63BBA17538@PASEXCCMS1.wam.westernasset.local>
Content-Language: en-US
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
> [...] I am using SPNEGO for silent authentication. Referring https://www.jboss.org/community/docs/DOC-10680 [...] Am I doing anything fundamentally wrong
With the caveat that I have only had a cursory look [we have our own product that supports SPNEGO and other GSSAPI / Kerberos goodness on various Java app servers (including JBoss) so we don't use the JBoss Negotiate code, nor its setup instructions]... I _think_ the problem is that the setup instructions you followed implicitly assume that the machine where you are installing JBoss Negotiate is *not* joined to an Active Directory domain[*], and bad things happen if you try to use those same setup instructions for a machine that is joined to the Active Directory domain -- you end up with two different objects in AD that both want to be the HOST principal, e.g. HOST/PASKTABSVR1.wamtest.wa.local in your example. (And you are going even further than that; the machine that you're using for JBoss Negotiate isn't just any member of the AD domain, it is actually a domain controller).
[*] A plausible guess would be that the instructions were developed for running JBoss Negotiate on a Unix or Linux (e.g. Redhat...) host that is likely _not_ configured to enable MIT Kerberos (or whatever), so the host is not joined to the AD domain.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
