Procedure 25.7. Configure Kerberos Authentication for Active Directory (Library Mode)

1. Configure JBoss EAP server to authenticate itself to Kerberos. This can be done by configuring a dedicated security domain, for example:

   <security-domain name="ldap-service" cache-type="default">
       <authentication>
           <login-module code="Kerberos" flag="required">
               <module-option name="storeKey" value="true"/>
               <module-option name="useKeyTab" value="true"/>
               <module-option name="refreshKrb5Config" value="true"/>
               <module-option name="principal" value="ldap/localhost@INFINISPAN.ORG"/>
               <module-option name="keyTab" value="${basedir}/keytab/ldap.keytab"/>
               <module-option name="doNotPrompt" value="true"/>
           </login-module>
       </authentication>
   </security-domain>

2. The security domain for authentication must be configured correctly for JBoss EAP, an application must have a valid Kerberos ticket. To initiate the Kerberos ticket, you must reference another security domain using

   <module-option name="usernamePasswordDomain" value="krb-admin"/>

   . This points to the standard Kerberos login module described in Step 3.

   <security-domain name="ispn-admin" cache-type="default">
       <authentication>
           <login-module code="SPNEGO" flag="requisite">
               <module-option name="password-stacking" value="useFirstPass"/>
               <module-option name="serverSecurityDomain" value="ldap-service"/>
               <module-option name="usernamePasswordDomain" value="krb-admin"/>
           </login-module>
           <login-module code="AdvancedAdLdap" flag="required">
               <module-option name="password-stacking" value="useFirstPass"/>
               <module-option name="bindAuthentication" value="GSSAPI"/>
               <module-option name="jaasSecurityDomain" value="ldap-service"/>
               <module-option name="java.naming.provider.url" value="ldap://localhost:389"/>
               <module-option name="baseCtxDN" value="ou=People,dc=infinispan,dc=org"/>
               <module-option name="baseFilter" value="(krb5PrincipalName={0})"/>
               <module-option name="rolesCtxDN" value="ou=Roles,dc=infinispan,dc=org"/>
               <module-option name="roleFilter" value="(member={1})"/>
               <module-option name="roleAttributeID" value="cn"/>
           </login-module>
       </authentication>
   </security-domain>

3. The security domain authentication configuration described in the previous step points to the following standard Kerberos login module:

   <security-domain name="krb-admin" cache-type="default">
       <authentication>
           <login-module code="Kerberos" flag="required">
               <module-option name="useKeyTab" value="true"/>
               <module-option name="principal" value="admin@INFINISPAN.ORG"/>
               <module-option name="keyTab" value="${basedir}/keytab/admin.keytab"/>
           </login-module>
       </authentication>
   </security-domain>