[30901] in Kerberos
Re: JBoss Negotiate
daemon@ATHENA.MIT.EDU (n.s.krishnawat@gmail.com)
Fri Mar 20 13:49:00 2009
From: n.s.krishnawat@gmail.com
Date: Fri, 20 Mar 2009 10:29:30 -0700 (PDT)
Message-ID: <e6686c41-0549-463b-9957-d6fff2ef4d5d@d7g2000prl.googlegroups.com>
Mime-Version: 1.0
X-Complaints-To: groups-abuse@google.com
Complaints-To: groups-abuse@google.com
To: kerberos@mit.edu
Content-Type: text/plain; charset="iso-8859-1"
Errors-To: kerberos-bounces@mit.edu
Content-Transfer-Encoding: 8bit
On Mar 20, 8:45 am, Thomas Maslen <Thomas.Mas...@quest.com> wrote:
> > [...] I am using SPNEGO for silent authentication. Referringhttps://www.jboss.org/community/docs/DOC-10680 [...] Am I doing anything fundamentally wrong
>
> With the caveat that I have only had a cursory look [we have our own product that supports SPNEGO and other GSSAPI / Kerberos goodness on various Java app servers (including JBoss) so we don't use the JBoss Negotiate code, nor its setup instructions]... I _think_ the problem is that the setup instructions you followed implicitly assume that the machine where you are installing JBoss Negotiate is *not* joined to an Active Directory domain[*], and bad things happen if you try to use those same setup instructions for a machine that is joined to the Active Directory domain -- you end up with two different objects in AD that both want to be the HOST principal, e.g. HOST/PASKTABSVR1.wamtest.wa.local in your example. (And you are going even further than that; the machine that you're using for JBoss Negotiate isn't just any member of the AD domain, it is actually a domain controller).
>
> [*] A plausible guess would be that the instructions were developed for running JBoss Negotiate on a Unix or Linux (e.g. Redhat...) host that is likely _not_ configured to enable MIT Kerberos (or whatever), so the host is not joined to the AD domain.
I really didn't get what you meant by " ....the machine where you are
installing JBoss Negotiate is *not* joined to an Active Directory
domain[*],..... ", As far as I know any machine or user in a
particular domain will be the part of active directory. Ya I can
separate JBOSS machine from the AD (KDC), ie I will create new machine
in same domain and install JBOSS and test, hope this helps !
I actually didnt got what you meant by word "joined". I am
misunderstanding something..
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
