Using Kerberos Authentication for Single
Sign-On
Use
SAP NetWeaver Application Server (AS) Java enables you to use the Simple and Protected GSS API Negotiation Mechanism (SPNego) to negotiate Kerberos authentication with Web clients, such as Web browsers. SPNego is a standard mechanism to determine shared authentication mechanisms, select one and establish a security context for communication.
SPNego functions on the AS Java are available with the JAAS login module SPNegoLoginModule. With this login module, you can use Kerberos authentication without an intermediary Web server. In addition, the use of Kerberos authentication is not tied to the specific operating system of the AS Java host.
This guide describes the steps to configure and use the original version of SPNego distributed with SAP NetWeaver Application Server Java. With the latest service packs (SPs), however, some of the features of SPNego have changed. The current documentation describes SPNego distributed with the following releases:
■ SAP NetWeaver Application Server 6.40 SP26 and lower
■ SAP NetWeaver Application Server 7.00 SP 22 and lower
■ SAP NetWeaver Application Server 7.01 SP 07 and lower
■ SAP NetWeaver Application Server 7.02 SP5 and lower
If you are using a higher SP than the mentioned above or if you want to migrate the old SPNEGO to the new version, refer to SAP Note 1488409 and the configuration guide attached to it.
Integration
When you use Kerberos, authentication is performed by several systems in your landscape, which negotiate the outcome of the authentication process transparently for the user. At a minimum, Kerberos authentication involves the following systems:
● Web client
The Web client requests a service or a resource from the AS Java and authenticates against the Kerberos Key Distribution Center. For example, a user uses a Web browser to access Web applications running on the AS Java.
● Kerberos Key Distribution Center (KDC)
The KDC authenticates the Web client and grants a Kerberos Client/Server Session Ticket that is used for the communication between the AS Java and the Web client. To authenticate the Web client, the KDC uses a Kerberos user data store, which can also be the UME data store of the AS Java.
● AS Java
The AS Java uses the user management engine (UME) to retrieve the identity management information for the authenticated with Kerberos AS Java user. Subsequently, the AS Java provides access to the services or resources requested by the Web client.
For more information about the Kerberos systems landscape and infrastructure, see Kerberos V5 Administrator’s Guide, available from web.mit.edu
Prerequisites
The SPNegoLoginModule enables the use of the Kerberos authentication functions that are an integral part of the Microsoft Windows 2000 and higher operating systems. The Kerberos functions can be used for Windows Integrated Authentication in a Windows domain, which makes use of a Microsoft Windows Domain Controller (DC) that acts as a KDC.
For more information about the integration of non-Windows server components in the Microsoft Kerberos infrastructure, see the documents available from the Microsoft Developer Network (MSDN) at msdn.microsoft.com.
Kerberos authentication with the AS Java has been tested with the following platforms:
● SAP NetWeaver 7.0 SP 6 or higher
● Java Development Kits (JDKs):
○ Sun JDK 1.4 on Windows
○ Sun JDK 1.4 on SuSE Linux Enterprise Server SLES9
○ Sun JDK 1.4 on Sun Solaris
○ IBM JDK 1.4 on AIX
○ Sun JDK 1.4 on HP UX
● Windows Kerberos Environment:
○ Microsoft Windows Server 2000 Active Directory
○ Microsoft Windows Server 2003 Active Directory
Activities
The systems involved in the SPNego authentication process share user information. Therefore, to enable the AS Java to use SPNego authentication you have to configure several systems including the KDC, the AS Java and its UME, as well as the Web client. In addition, the AS Java uses GSS-API functions available from your Java Development Kit (JDK) and the actual AS Java configuration depends on the underlying JDK you use.
For information about configuring Kerberos authentication with the AS Java, see the following topics:
● Key Distribution Center Configuration
Information about required configuration settings on the KDC.
● Wizard-based Configuration for Kerberos Authentication
Information about the step-by-step wizard, which is used to configure the AS Java for SPNego authentication.
● Accessing AS Java Resources with Kerberos Authentication
Information about Web client configuration for using Kerberos authentication.
In addition, SPNego does not provide transport layer security. Therefore, we recommend that you use transport layer security mechanisms, such as SSL, for increased security for the SPNego communication with the AS Java.
For
more information, see
Network and Transport
Layer Security.
Example
For an example of the Kerberos authentication process, see the figure below:
Example of Kerberos authentication with the AS Java
...
1. The Web client accesses an AS Java resource with a GET request.
2. The AS Java sends back a 401 response code (unauthorized) with a request to initiate SPNego authentication by setting the HTTP header WWW-Authenticate to Negotiate.
3. The Web client recognizes that the AS Java host is a member of the Kerberos Realm and procures a Kerberos Client/Server Session Ticket for the AS Java from the KDC.
4. The Web client then sends the Kerberos Client/Server Session Ticket to the AS Java wrapped as an SPNego token in the HTTP authorization header.
5. The SPNegoLoginModule reads the token from the HTTP request and feeds the Kerberos implementation of the JDK with it.
6. The result is either successful client authentication or failure when the client request is rejected or another roundtrip to the KDC is necessary. In the case of failure, the Kerberos JDK implementation of the AS Java generates and sends back to the Web client an output token. The output token is wrapped in an SPNego token and sent in the HTTP authorization header.
SAP Notes:
● 696294 – Logoff from Portal does not invalidate 3rd-party SSO session
● 968191 – SPNego Central Note
● 994791 – Wizard-based SPNego configuration