Start of Content Area

Function documentation Using Kerberos Authentication  Locate the document in its SAP Library structure

Use

The AS Java enables you to use the Simple and Protected GSS API Negotiation Mechanism (SPNego) to negotiate Kerberos authentication with Web clients, such as Web browsers. SPNego is a standard mechanism to determine shared authentication mechanisms, select one and establish a security context for communication.

The SPNego functions on the AS Java are available with the JAAS login module SPNegoLoginModule. With this login module, you can use SPNego authentication without an intermediary Web server. In addition, the use of SPNego authentication is not tied to the specific operating system of the AS Java host.

Integration

When you use SPNego, authentication is performed by several systems in your landscape, which negotiate the outcome of the authentication process transparently for the user. At a minimum, SPNego authentication involves the following systems:

      Web client – the Web client requests a service or a resource from the AS Java and authenticates against the Kerberos Key Distribution Center. For example, users use a Web browser for a Web client to access Web applications running on the AS Java.

      Kerberos Key Distribution Center (KDC) – the KDC authenticates the user and grants a Kerberos Client/Server Session Ticket that is used for the communication between the AS Java and the user’s Web client.

      AS Java – the AS Java uses Generic Security Service Application Program Interface (GSS-API), provided by the Java Virtual Machine (JVM) and the User Management Engine (UME). The GSS-API is used to acquire the negotiated security context with the Kerberos ticket issuer, and the UME is used to retrieve the identity management information for the authenticated with Kerberos user. Subsequently, the AS Java provides access to the services or resources requested by the Web client.

For more information about the Kerberos systems landscape and infrastructure, see Kerberos V5 Administrator’s Guide, available from web.mit.edu

Prerequisites

The SPNegoLoginModule enables the use of the Single Sign-On (SSO) authentication mechanism which is an integral part of the Microsoft Windows 2000 and higher operating systems. SPNego authentication can be used for Windows Integrated Authentication in a Windows Domain which makes use of a Microsoft Windows Domain Controller (DC) that acts as a KDC.

For information about the integration of non-Windows server components in the Microsoft Kerberos Infrastructure, see the documents available from the Microsoft Developer Network (MSDN) at msdn.microsoft.com.

Kerberos authentication with the AS Java has been tested with the following platforms:

      SAPNetWeaver Web Application Server Java Release:

¡        AS Java 640 SP 15 or higher

      Java Development Kits (JDKs):

¡        Sun JDK 1.4 on Windows

¡        Sun JDK 1.4 on SuSE Linux Enterprise Server SLES9

¡        Sun JDK 1.4 on Sun Solaris

¡        IBM JDK 1.4 on AIX

¡        Sun JDK 1.4 on HP UX

      Windows Kerberos Environment:

¡        Microsoft Windows Server 2000 Active Directory

¡        Microsoft Windows Server 2003 Active Directory

Activities

The systems involved in the SPNego authentication process share user information. Therefore, to enable the AS Java to use SPNego authentication you have to configure several systems including the KDC, the AS Java and its UME, as well as the Web client. In addition, the AS Java uses GSS-API functions available from your Java Development Kit (JDK) and the actual AS Java configuration depends on the underlying JDK you use.

For information about configuring Kerberos authentication with the AS Java, see the following topics:

·        Key Distribution Center Configuration

Information about required configuration settings on the KDC.

      Wizard-based Configuration for Kerberos Authentication

Information about the step-by-step wizard which is used to configure the AS Java for SPNego authentication.

·        Accessing AS Java Resources with Kerberos Authentication

Information about Web client configuration for using Kerberos authentication.

In addition, SPNego does not provide transport layer security. Therefore, we recommend that you use transport layer security mechanisms, such as SSL to increased security for the SPNego communication with the AS Java. For more information, see Network and Transport Layer Security.

Example

For an example of the SPNego authentication process, see the figure below:

This graphic is explained in the accompanying text

Example of Kerberos authentication with the AS Java

...

       1.      The Web client accesses an AS Java resource with a GET request.

       2.      The AS Java sends back a 401 response code (unauthorized) with a request to initiate SPNego authentication by setting the HTTP  header “WWW-Authenticate” to “Negotiate”.

       3.      The Web client recognizes that the AS Java host is a member of the Kerberos Realm and procures a Kerberos Client/Server Session Ticket for the AS Java from the KDC.

       4.      The Web client then sends the Kerberos Client/Server Session Ticket to the AS Java wrapped as a SPNego token in the HTTP authorization header.

       5.      The SPNegoLoginModule reads the token from the HTTP request and feeds the Kerberos implementation of the JDK with it.

       6.      The result is either successful client authentication or failure when the client request is rejected or another roundtrip to the KDC is necessary. In the case of failure, the Kerberos JDK implementation of the AS Java generates and sends back to the Web client an output token. The output token is wrapped as a SPNego token and sent in the HTTP authorization header.

 

See also:

SAP Notes:

      696294 – Logoff from Portal does not invalidate 3rd-party SSO session

      968191 – SPNego Central Note

      994791 – Wizard-based SPNego configuration

 

 

 

End of Content Area