8.9. Active Directory Authentication Using Kerberos (GSSAPI)

Procedure 8.6. Configure Kerberos Authentication for Active Directory (Library Mode)

1. Configure JBoss EAP server to authenticate itself to Kerberos. This can be done by configuring a dedicated security domain, for example:

   <security-domain name="ldap-service" cache-type="default">
       <authentication>
           <login-module code="Kerberos" flag="required">
               <module-option name="storeKey" value="true"/>
               <module-option name="useKeyTab" value="true"/>
               <module-option name="refreshKrb5Config" value="true"/>
               <module-option name="principal" value="ldap/localhost@INFINISPAN.ORG"/>
               <module-option name="keyTab" value="${basedir}/keytab/ldap.keytab"/>
               <module-option name="doNotPrompt" value="true"/>
           </login-module>
       </authentication>
   </security-domain>

2. The security domain for authentication must be configured correctly for JBoss EAP, an application must have a valid Kerberos ticket. To initiate the Kerberos ticket, you must reference another security domain using

   <module-option name="usernamePasswordDomain" value="krb-admin"/>

   . This points to the standard Kerberos login module described in Step 3.

   <security-domain name="ispn-admin" cache-type="default">
       <authentication>
           <login-module code="SPNEGO" flag="requisite">
               <module-option name="password-stacking" value="useFirstPass"/>
               <module-option name="serverSecurityDomain" value="ldap-service"/>
               <module-option name="usernamePasswordDomain" value="krb-admin"/>
           </login-module>
           <login-module code="AdvancedAdLdap" flag="required">
               <module-option name="password-stacking" value="useFirstPass"/>
               <module-option name="bindAuthentication" value="GSSAPI"/>
               <module-option name="jaasSecurityDomain" value="ldap-service"/>
               <module-option name="java.naming.provider.url" value="ldap://localhost:389"/>
               <module-option name="baseCtxDN" value="ou=People,dc=infinispan,dc=org"/>
               <module-option name="baseFilter" value="(krb5PrincipalName={0})"/>
               <module-option name="rolesCtxDN" value="ou=Roles,dc=infinispan,dc=org"/>
               <module-option name="roleFilter" value="(member={1})"/>
               <module-option name="roleAttributeID" value="cn"/>
           </login-module>
       </authentication>
   </security-domain>

3. The security domain authentication configuration described in the previous step points to the following standard Kerberos login module:

   <security-domain name="krb-admin" cache-type="default">
       <authentication>
           <login-module code="Kerberos" flag="required">
               <module-option name="useKeyTab" value="true"/>
               <module-option name="principal" value="admin@INFINISPAN.ORG"/>
               <module-option name="keyTab" value="${basedir}/keytab/admin.keytab"/>
           </login-module>
       </authentication>
   </security-domain>