Using Kerberos Authentication for Single Sign-On 

Use

The SAP Web AS Java enables you to use the Simple and Protected GSS API Negotiation Mechanism (SPNego) to negotiate Kerberos authentication with Web clients, such as Web browsers. SPNego is a standard mechanism to determine shared authentication mechanisms, select one and establish a security context for communication.

The SPNego functions on the J2EE Engine are available with the JAAS login module SPNegoLoginModule. With this login module, you can use Kerberos authentication without an intermediary Web server. In addition, the use of Kerberos authentication is not tied to the specific operating system of the J2EE Engine host.

Integration

When you use Kerberos, authentication is performed by several systems in your landscape, which negotiate the outcome of the authentication process transparently for the user. At a minimum, Kerberos authentication involves the following systems:

●      Web client – the Web client requests a service or a resource from the J2EE Engine and authenticates against the Kerberos Key Distribution Center. For example, users use a Web browser for a Web client to access Web applications running on the J2EE Engine.

●      Kerberos Key Distribution Center (KDC) – the KDC authenticates the Web client and grants a Kerberos Client/Server Session Ticket that is used for the communication between the J2EE Engine and the Web client. To authenticate the Web client, the KDC uses a Kerberos user data store, which can also be the UME data store of the J2EE Engine.

●      SAP Web AS Java – the J2EE Engine uses the User Management Engine (UME) to retrieve the identity management information for the authenticated with Kerberos J2EE Engine user. Subsequently, the J2EE Engine provides access to the services or resources requested by the Web client.

For more information about the Kerberos systems landscape and infrastructure, see Kerberos V5 Administrator’s Guide, available from web.mit.edu

Prerequisites

The SPNegoLoginModule enables the use of the Kerberos authentication functions that are an integral part of the Microsoft Windows 2000 and higher operating systems. The Kerberos functions can be used for Windows Integrated Authentication in a Windows Domain, which makes use of a Microsoft Windows Domain Controller (DC) that acts as a KDC. For information about the integration of non-Windows server components in the Microsoft Kerberos Infrastructure, see the documents available from the Microsoft Developer Network (MSDN) at msdn.microsoft.com.

Kerberos authentication with the J2EE Engine has been tested with the following platforms:

●      SAPNetWeaver Web Application Server Java Release:

○       J2EE Engine 7.0 SP 6 or higher

●      Java Development Kits (JDKs):

○       Sun JDK 1.4 on Windows

○       Sun JDK 1.4 on SuSE Linux Enterprise Server SLES9

○       Sun JDK 1.4 on Sun Solaris

○       IBM JDK 1.4 on AIX

○       Sun JDK 1.4 on HP UX

●      Windows Kerberos Environment:

○       Microsoft Windows Server 2000 Active Directory

○       Microsoft Windows Server 2003 Active Directory

Activities

The systems involved in the SPNego authentication process share user information. Therefore, to enable the J2EE Engine to use SPNego authentication you have to configure several systems including the KDC, the J2EE Engine and its UME, as well as the Web client. In addition, the J2EE Engine uses GSS-API functions available from your Java Development Kit (JDK) and the actual J2EE Engine configuration depends on the underlying JDK you use.

For information about configuring Kerberos authentication with the J2EE Engine, see the following topics:

●      Key Distribution Center Configuration

Information about required configuration settings on the KDC.

●      Wizard-based Configuration for Kerberos Authentication

Information about the step-by-step wizard which is used to configure the J2EE Engine for SPNego authentication.

●      Accessing J2EE Engine Resources with Kerberos Authentication

Information about Web client configuration for using Kerberos authentication.

In addition, SPNego does not provide transport layer security. Therefore, we recommend that you use transport layer security mechanisms, such as SSL,  for increased security for the SPNego communication with the J2EE Engine. More information: Network and Transport Layer Security.

Example

For an example of the Kerberos authentication process, see the figure below:

Example of Kerberos authentication with the J2EE Engine

...

       1.      The Web client accesses a J2EE Engine resource with a GET request.

       2.      The J2EE Engine sends back a 401 response code (unauthorized) with a request to initiate SPNego authentication by setting the HTTP header “WWW-Authenticate” to “Negotiate”.

       3.      The Web client recognizes that the J2EE Engine host is a member of the Kerberos Realm and procures a Kerberos Client/Server Session Ticket for the J2EE Engine from the KDC.

       4.      The Web client then sends the Kerberos Client/Server Session Ticket to the J2EE Engine wrapped as a SPNego token in the HTTP authorization header.

       5.      The SPNegoLoginModule reads the token from the HTTP request and feeds the Kerberos implementation of the JDK with it.

       6.      The result is either successful client authentication or failure when the client request is rejected or another roundtrip to the KDC is necessary. In the case of failure, the Kerberos JDK implementation of the J2EE Engine generates and sends back to the Web client an output token. The output token is wrapped as a SPNego token and sent in the HTTP authorization header.

 

More Information:

SAP Notes:

●      968191 – SPNego Central Note

●      994791 – Wizard-based SPNego configuration