Windows Authentication
Understanding AD integration
SSO happens between three entities in the same network domain:
- Tomcat server with Tempus Serva installed
- Domain controller (Active Directory)
- Client machine with a user
- authenticated against the domain controller
- accessing the TempusServa installation
Other integrations methods include
- Waffle (support for other servers)
- Tomcat 7 native SPNEGO
Recommended: SPNEGO filter
Note the following guide is for Tomcat 6 or higher.
Installation part 1
The first part of the installation ensures the basic SSO communication is in place.
Troubleshooting
- Check Tomcat is running in the same context as the domain user
- Ensure only one SPN exists (with fully qualified name)
After a succesfull test you should remove the jsp test file.
Installation part 2
The second part of the installation ensures TempusServa logs in the user based on the Windows authenticated username.
Install the SPNEGO filter on the TempusServa application
- Copy filter setting from the guide to <Tomcat>\webapps\<Application>\WEB-INF\web.xml
- Change the filter mapping from *.jsp to the login page
<filter-mapping>
<filter-name>SpnegoHttpFilter</filter-name>
<url-pattern>/login</url-pattern>
</filter-mapping>
Configure TempusServa to accept SSO by changing system configuration
ssoSpnegoAuthenticate = true
Finally restart Tomcat
Testing the setup
Find a suitable user
- Must exist as a Domain User in the AD server (ex. "TESTDOMAIN\DrStrangelove" )
- Must exist as a user in Tempus Serva (ex. "DrStrangelove")
Login to a machine connected to the Domain controller
Navigate to the TempusServa login page and check if you are logged in and redirected to the main page.
Other results
- Login displayed with "Login failed" message: The SPNEGO is working but it was not possible to match the Windows authenticated user to a (valid) user in the Tempus Serva database
- Login displayed without any messages: The SPNEGO is NOT working or is deactivated