I tried the past 2 days to get SSO to work. I have OpenFire 3.6.2 installed on Windows 2003 Standard (domain member server), we have a Windows2003 Active Directory (one Forest/Domain). On Windows XP we use as IM client Spark 2.5.8 .
I have check discussions and documents here but still SSO doesn’t work and I don’t know what else to do.
I tried the documentations:
Here is what I did:
created user xmpp-openfire and checked “Unable to change password”, “Password never expires” and “Does not require Kerberos Preauthentication”
on domain controller:
setspn -A xmpp/slsv-test2.domain.com@DOMAIN.COM xmpp-openfire
ktpass -princ xmpp/slsv-test2.domain.com@DOMAIN.COM -mapuser email@example.com -pass * -ptype KRB5_NT_PRINCIPAL
on openfire server: ktab -k xmpp.keytab -a xmpp/slsv-test2.domain.com@DOMAIN.COM
created gss.conf in Openfire\conf folder:
- created krb5.ini in C:\Windows on openfire server and spark client:
default_realm = DOMAIN.COM
noaddresses = true
- added in openfire.xml after :
- added in registry on Windows XP SP2 client:
Value Name: AllowTGTSessionKey
Value Type: REG_DWORD
domain.com is replaced by the domain what we have.
At the beginning I had on the server in the debug window the message Checksum failed and Authentication failed, I recreated the keytab file and tried the java/openfire one and the one created on the domain controller.
Then I redid the whole configuration and wiped every SSO setting on the server and every file.
Now it doesn’t even load/open the gss.conf.
The strange thing is that after starting the openfire server most sasl settings in the openfire.xml disappeared:
I have now only in there:DOMAIN.COM
and in the openfire System Properties I have:
sasl.gssapi.config C:/Program Files/Openfire/conf/gss.conf
I don’t know if that is normal. So I removed all sasl entries in the openfire.xml and added entry sasl.realm DOMAIN.COM in the openfire System Properties.
I don’t know what I should check or what I can do to get it to work. I can connect with Spark by typing in the password but SSO just doesn’t work.
Any help would be appreciated.