Let me start off by saying I have a running Openfire 3.7.0server working with NTLM and the spark client 2.5.8 but mostly 2.6.0. Myissue becomes when I try to get the sso w/ GSSAPI to work.
On the domain controller (Win 2003 STD):
Created an account in AD called xmpp-openfire put it domainusers group /Cannot change password/password never expires/ Do not requireKerberos preauthentication
setspn -A xmpp/jabber.gsprecision.com@GSPRECISION.COMxmpp-openfire
ktpass -princ xmpp/jabber.gsprecision.com@GSPRECISION.COM -mapuser xmpp-openfire@gsprecision.com -pass * -ptype KRB5_NT_PRINCIPAL
On Jabber (openfire 3.7.0 server):
From the c:\Program Files\Java\jre6\bin
ktab -k xmpp.keytab -a xmpp/jabber.gsprecision.com@GSPRECISION.COM NOTE: I have also tried creating the keytab file from the DC itself
Moved the xmpp.keytab into c:\Program Files (x86)\Openfire\resources
Created a gss.conf file:
com.sun.security.jgss.accept {
com.sun.security.auth.module.Krb5LoginModule
required
storeKey=true
keyTab="C:/Program Files (x86)/Openfire/resources/xmpp.keytab"
doNotPrompt=true
useKeyTab=true
realm="gsprecision.com"
principal="xmpp/Jabber.gsprecision.com@gsprecision.com"
debug=true;
};
Edited the openfire.mxl and addes the sasl section
<?xml version="1.0" encoding="UTF-8"?>
-<!–
This file stores bootstrap properties needed by Openfire.
Property names must be in the format: "prop.name.is.blah=value"
That will be stored as:
<prop>
<name>
<is>
<blah>value</blah>
</is>
</name>
</prop>
Most properties are stored in the Openfire database. A
property viewer and editor is included in the admin console.
–>
-
-
-
-
9090
9091
en
-<!-- Networksettings. By default, Openfire will bind to all network interfaces.
Alternatively, you can specify a specific network interfaces that the server
will listen on. For example, 127.0.0.1. This setting is generally only useful
on multi-homed servers. -->
-<!–
<network>
<interface></interface>
</network>
-->
-
org.jivesoftware.database.EmbeddedConnectionProvider
true
-
- <
-<!-- Include acomma-separated list of the authentication mechanisms
to advertise support for to clients. Make sure GSSAPI is listed,
and best if it's listed first. The order of mechanisms is important;
clients should try to use the first mechanism they support
(although not all will). Some clients will try to use the most
secure first.
You can add other mechanisms in order to support non-GSSAPI clients,
or clients who cannot authenticate to the realm (like Windows 9X,
off-site, and so on). Keep in mind that by allowing other mechanisms
you are compromising the security of your realm. Be sure to talk
to the Security Officer/Directory/Manager/Administrator about any
policies your organization might have before enabling less secure
mechanisms. By removing PLAIN and ANONYMOUS from the list, you will
also disable non-SASL authentications.
Keep in mind that a mechanism listed here might not actually be
advertised, such as when the authProvider can't support the mechanism.
PLAIN and ANONYMOUS mechanisms also enable non-SASL authentication
(the old style XMPP auth), so removing them from this list will
disallow non-SASL authentication. -->
-
-
<GSPRECISION.COM
-
-<!-- Use true toturn on debugging information. This adds a lot
of noise to your log files, but it can help you spot problems
sooner in the initial setup. -->
-
“c:/Program Files(x86)/openfire/conf/gss.conf” NOTE: I have also tried the slashes both ways and just /Program Files(x86)/openfire/conf/gss.conf
-<!-- Sets thesystem property with the same name. You’ll probably want
"false" here (the default). For more details, see
[[http://java.sun.com/j2se/1.4.2/docs/api/org/ietf/jgss/package-summary.html](http://java.sun.com/j2se/1.4.2/docs/api/org/ietf/jgss/package-summary.html)] -->
On the client:
Windows 7 / XP SP3 running Spark 2.6.0
Checked the reg and the key was already there.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters
Value Name: AllowTGTSessionKey
Value Type: REG_DWORD
Value: 1
When we start debugging I do not see any errors but get the message on the client Unable to connect using Single Sign-On. Please check the principal and server settings. Some other users are getting Unable to determine whe SSO is checked. When I turn debugging on in the client I do not see any error but I do not get anything in the All Packets section. and I do not see any errors that stand out any other place.