Chapter 6. Configuring FreeIPA

Before you configure FreeIPA to use JBoss Negotiation, make sure you have FreeIPA installed and configured correctly, and the clients are able to obtain Kerberos tickets. Detailed FreeIPA documentation is available on http://www.freeipa.org/.

Warning

Due to the supported encryption types of FreeIPA, the JBoss application server must run on a Java 6 JVM with unlimited cryptography enabled.
To configure FreeIPA to authenticate users through JBoss Negotiation you need to do the following:
  • Create a service principal for the server and add the HTTP service to it. The server user acts as a connection between FreeIPA and the JBoss web server.
  • Generate a keytab file for the server user and export it to the application server. The application server uses the keytab to authenticate to KDC in FreeIPA.

Note

These instructions apply to FreeIPA 1.1.

6.1. Creating Service Principal

You need to create the service principal, which represents the HTTP service of your JBoss Application Server to allow the clients to request the ticket for this service.

Note

Full information on service principal creation is available on http://freeipa.org/page/AdministratorsGuide#Managing_Service_Principals.
  1. The simplest way to create a service principal is through the FreeIPA WebUI: access the tool as an administrator.
  2. Click the Add Service Principal link.
    Adding Service Principal

    Figure 6.1. Adding Service Principal

  3. Set the hostname to the host name of your server (test_server.jboss.org) and the service type to HTTP, and click Add Principal.
    View Service Principal

    Figure 6.2. View Service Principal

    Note

    Creating the service principal requires the host name to be mapped with DNS. If this procedure fails, on the command line, issue the following command to create the principal: ipa-addservice HTTP/test_server.jboss.org@JBOSS.ORG --force