Difference between revisions of "Windows Authentication"
old>Admin |
m (30 revisions imported) |
||
| (5 intermediate revisions by one other user not shown) | |||
| Line 2: | Line 2: | ||
== Understanding AD integration == | == Understanding AD integration == | ||
SSO happens between three entities in the same network domain: | SSO happens between three entities in the same network domain: | ||
* Tomcat server with | * Tomcat server with TempusServa | ||
* Domain controller (Active Directory) | * Domain controller (Active Directory) | ||
* Client machine with a user | * Client machine with a user | ||
| Line 8: | Line 8: | ||
**accessing the TempusServa installation | **accessing the TempusServa installation | ||
Other integrations methods include | After the initial contact with the user TempusServa validates the original AD authentication, and logs in the user if a matching username can be found. Optionally TempusServa can synchronize group memberships using regular LDAP querying. | ||
The recommended approach for Tomcat is using a SPNEGO servlet filter mapped to the TempusServa login page. Other integrations methods include | |||
* Waffle (support for other servers) | * Waffle (support for other servers) | ||
* Tomcat 7 native SPNEGO | * Tomcat 7 native SPNEGO | ||
== | == Installing the SPNEGO servlet filter == | ||
Note the following guide is for Tomcat 6 or higher. | Note the following guide is for Tomcat 6 or higher. | ||
Latest revision as of 11:56, 10 December 2021
Understanding AD integration
SSO happens between three entities in the same network domain:
- Tomcat server with TempusServa
- Domain controller (Active Directory)
- Client machine with a user
- authenticated against the domain controller
- accessing the TempusServa installation
After the initial contact with the user TempusServa validates the original AD authentication, and logs in the user if a matching username can be found. Optionally TempusServa can synchronize group memberships using regular LDAP querying.
The recommended approach for Tomcat is using a SPNEGO servlet filter mapped to the TempusServa login page. Other integrations methods include
- Waffle (support for other servers)
- Tomcat 7 native SPNEGO
Installing the SPNEGO servlet filter
Note the following guide is for Tomcat 6 or higher.
Installation part 1
The first part of the installation ensures the basic SSO communication is in place.
Troubleshooting
- Check Tomcat is running in the same context as the domain user
- Ensure only one SPN exists (with fully qualified name)
After a succesfull test you should remove the jsp test file.
Installation part 2
The second part of the installation ensures TempusServa logs in the user based on the Windows authenticated username.
Install the SPNEGO filter on the TempusServa application
- Copy filter setting from the guide to <Tomcat>\webapps\<Application>\WEB-INF\web.xml
- Change the filter mapping from *.jsp to the login page
<filter-mapping>
<filter-name>SpnegoHttpFilter</filter-name>
<url-pattern>/login</url-pattern>
</filter-mapping>
Configure TempusServa to accept SSO by changing system configuration
ssoSpnegoAuthenticate = true
Finally restart Tomcat
Testing the setup
Find a suitable user
- Must exist as a Domain User in the AD server (ex. "TESTDOMAIN\DrStrangelove" )
- Must exist as a user in Tempus Serva (ex. "DrStrangelove")
Login to a machine connected to the Domain controller
Navigate to the TempusServa login page and check if you are logged in and redirected to the main page.
Other results
- Login displayed with "Login failed" message: The SPNEGO is working but it was not possible to match the Windows authenticated user to a (valid) user in the Tempus Serva database
- Login displayed without any messages: The SPNEGO is NOT working or is deactivated