Hi, community.
The guide below shows how to configure SSO Kerberos with Ubuntu Server 16.04 and 18.04.
Java version no higher than Java 8 update 221 and Java 11.0.4. in latest java versions my SSO doesn’t work
srvdca3.domain.local-------|AD DC + DNS|
srv-chat.domain.local-------|Openfire server 4.5.2|
- Create a domain user openfire *
1.1.Set it: User cannot change password Password never expires ** Do not require Kerberos preauthentication *
1.2 On any DC, open CMD under the admin and run this command.
setspn -A xmpp/srv-chat.domain.local@DOMAIN.LOCAL **openfire**
Where: srv-chat.domain.local - full name your server Ubuntu with Openfire, @DOMAIN.LOCAL - your domain, openfire - your domain user(step 1,with which authorization through Kerberos (SSO) will work)
1.3 in CMD run this command and save file openfire.keytab in drive C.
ktpass /princ xmpp/srv-chat.domain.local@DOMAIN.LOCAL /mapuser openfire@domain.local /pass * /ptype KRB5_NT_PRINCIPAL /crypto RC4-HMAC-NT /out c:\openfire.keytab
Openfire user attributes will change
servicePrincipalName – xmpp/srv-chat.domain.local
userPrincipalName – xmpp/srv-chat.domain.local@DOMAIN.LOCAL
2.Preparing an Openfire Server
2.1 install Openfire server
2.2 Copy openfire.keytab(step 1.3) to /usr/share/openfire/resources/
2.3 Create the file /etc/openfire/gss.conf
com.sun.security.jgss.accept {
com.sun.security.auth.module.Krb5LoginModule
required
storeKey=true
keyTab="/usr/share/openfire/resources/openfire.keytab"
doNotPrompt=true
useKeyTab=true
realm="DOMAIN.LOCAL"
principal="xmpp/srv-chat.domain.local@DOMAIN.LOCAL"
debug=false;
};
2.4 Create a Kerberos configuration file and save it as krb5.ini to /etc/krb5.conf
[libdefaults]
default_realm = DOMAIN.LOCAL
default_keytab_name = /usr/share/openfire/resources/openfire.keytab
default_tkt_enctypes = rc4-hmac des3-cbc-sha1 des-cbc-crc des-cbc-md5
default_tgs_enctypes = rc4-hmac des3-cbc-sha1 des-cbc-crc des-cbc-md5
permitted_enctypes = rc4-hmac des3-cbc-sha1 des-cbc-crc des-cbc-md5
[realms]
DOMAIN.LOCAL = {
kdc = srvdc3.domain.local
kdc = srvdca1.domain.local
admin_server = srvdc3.domain.local
default_domain = domain.local
}
[domain_realms]
domain.com = DOMAIN.LOCAL
.domain.com = DOMAIN.LOCAL
To check the ticket, you can use the following commands:
kinit -V -k -t /usr/share/openfire/resources/openfire.keytab xmpp/srv-chat.domain.local@DOMAIN.LOCAL
klist -ek /usr/share/openfire/resources/openfire.keytab
3.Openfire Preparation
3.1 go to http://srv-chat.domain.local:9090
3.2. We write our domain controller and any domain user (without administrative rights, I have this user “testuser”)
Server
–Server Settings
—Profile Settings
----LDAP Settings
Host:srvdca3.domain.local Port:389
Administrator DN: domain\testuser
3.3 Go to
-Server
–System Properties
and change this parametrs and save:
|Property Name|Property Value|
|---|---|
|authorization.classList|org.jivesoftware.openfire.auth.DefaultAuthorizationPolicy|
|sasl.gssapi.config|/etc/openfire/gss.conf|
|sasl.gssapi.debug|true|
|sasl.gssapi.useSubjectCredsOnly|False|
|sasl.mechs.00002|PLAIN|
|sasl.mechs.00008|GSSAPI|
|sasl.realm|DOMAIN.LOCAL|
|xmpp.fqdn|srv-chat.domain.local|
3.4 Reboot your Openfire service and reboot Ubuntu server.
4.Client Windows preparation(Spark 2.8.3)
4.1 HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters
Value Name: AllowTGTSessionKey
Value Type: REG_DWORD
Value: 1
4.2 install Spark 2.8.3
4.3 Open Spark -> Advanced button -> SSO tab -> enable Use Single Sign-On (SSO) via GSSAPI
4.4 And write your server Openfire and click on “Logon”
