Install the Federation Agent for Windows Authentication on the same Windows or UNIX system where is installed. The following restrictions apply:
The CA SiteMinder® Federation Windows Agent has three modes of operation, depending on the choice of authentication protocol
You select the mode of operation when you run the Agent configuration wizard.
The setup process for Federation Windows Agent includes the following steps:
Before you install the Federation Windows Agent on a Windows system using NTLM, complete the installation prerequisites.
Windows 2003 SP 1 Active Directory is the primary domain controller for the Windows Domain. This host provides storage for the user, service accounts, credentials, and Windows Domain services.
The Federation Agent generates an NTLM response message to the NTML challenge message sent by the relying party. The server at the relying party passes the challenge and the response to the domain controller. The response is an encrypted version of the challenge using the hash of the user password. The domain controller encrypts the challenge using the same hash of the password and compares it with the response generated at the asserting party. If they match, the authentication is complete. The domain controller informs the server at the relying party.
Follow these steps:
The domain controller is deployed for NTLM.
Configure Internet Explorer for single sign-on. The procedures apply whether you are using NTLM or Kerberos as the authentication protocol.
Complete the installation prerequisites for the Federation Agent on a Windows system using Kerberos mode. The KDC is on a Windows system. Set up the domain controller for Kerberos on Windows.
When using Kerberos, the domain controller is the key distribution center (KDC) for the Kerberos realm. In a pure Windows 2003 environment, a Kerberos realm is equivalent to a Windows domain. The domain controller host provides storage for the user, service accounts, credentials, the Kerberos ticketing services, and Windows domain services.
A keytab file is required for Kerberos authentication, which lets users logged on to the federation system authenticate with the KDC without being prompted for a password. The keytab file is created with the ktpass utility. The ktpass command tool utility is a Windows support tool. The default encryption type is RC4-HMAC-NT, which can be confirmed by running ktpass /? at the command prompt. Also, confirm the Kerberos version number.
Follow these steps:
ktpass -out output_keytab_location -princ SPN_name -ptype KRB5_NT_PRINCIPAL ‑mapuser username -pass password
Use the password entered in step 4.
The keytab file is created.
For example:
ktpass -out c:\workstation.keytab -princ HTTP/ IWAConnectorHostName.idp.com@IDP.COM -ptype KRB5_NT_PRINCIPAL -mapuser testkrb -pass password Targeting domain controller: winkdc.idp.com Using legacy password setting method Successfully mapped HTTP/ IWAConnectorHostName.idp.com to testkrb. Key created. Output keytab to c:\workstation.keytab: Keytab version: 0x502 keysize 67 HTTP/ IWAConnectorHostName.idp.com@IDP.COM ptype 1 (KRB5_NT_PRINCIPAL) vno 2 etype 0x17 (RC4-HMAC) keylength 16 (0xfd77a26f1f5d61d1fafd67a2d88784c7)
Important! The keytab name with its full path must be specified in the Keytab Location field during the Federation Agent configuration.
The domain controller is deployed for Kerberos on systems running Windows.
The following actions are required on the federation system when using Kerberos on Windows:
[libdefaults]
default_realm = IDP.COM
default_keytab_name = C:\WINDOWS\krb5.keytab
default_tkt_enctypes = des-cbc-md5 rc4-hmac
default_tgs_enctypes = des-cbc-md5 rc4-hmac
[realms]
IDP.COM = {
kdc = winkdc.idp.com:88
default_domain = IDP.COM
}
[domain_realm]
.idp.com = IDP.COM
Configure Internet Explorer for single sign-on. The procedures apply whether you are using NTLM or Kerberos as the authentication protocol.
Complete the installation prerequisites for the Federation Agent on a system running Windows in Kerberos mode. The KDC is on a UNIX system.
The UNIX server that hosts the Kerberos key distribution center (KDC) must be configured to support the federation system. Part of this process is to create a keytab file. A keytab file is required for Kerberos authentication.
Follow these steps:
usr/sbin/kadmin.local
addprinc -pw <password> HTTP/AgentHost Name.domainname.com@DOMAINNAME.COM
ktadd -k output_keytab_location SPN name
The keytab file is created.
The configuration of federation on the UNIX KDC server is complete.
To configure Kerberos, the following commands are required on a federation system on a UNIX system:
The UNIX system is configured for Kerberos authentication.
Configure Internet Explorer for single sign-on. The procedures apply whether you are using NTLM or Kerberos as the authentication protocol.
Complete the prerequisites for installing the Federation Agent on a UNIX system running in Kerberos mode. The KDC is on a Windows system.
When using Kerberos, the domain controller is the key distribution center (KDC) for the Kerberos realm. In a pure Windows 2003 environment, a Kerberos realm is equivalent to a Windows domain. The domain controller host provides storage for the user, service accounts, credentials, the Kerberos ticketing services, and Windows domain services.
A keytab file is required for Kerberos authentication, which lets users logged on to the federation system authenticate with the KDC without being prompted for a password. The keytab file is created with the ktpass utility. The ktpass command tool utility is a Windows support tool. The default encryption type is RC4-HMAC-NT, which can be confirmed by running ktpass /? at the command prompt. Also, confirm the Kerberos version number.
Follow these steps:
ktpass -out output_keytab_location -princ SPN_name -ptype KRB5_NT_PRINCIPAL ‑mapuser username -pass password
Use the password entered in step 4.
The keytab file is created.
For example:
ktpass -out c:\workstation.keytab -princ HTTP/ IWAConnectorHostName.idp.com@IDP.COM -ptype KRB5_NT_PRINCIPAL -mapuser testkrb -pass password Targeting domain controller: winkdc.idp.com Using legacy password setting method Successfully mapped HTTP/ IWAConnectorHostName.idp.com to testkrb. Key created. Output keytab to c:\workstation.keytab: Keytab version: 0x502 keysize 67 HTTP/ IWAConnectorHostName.idp.com@IDP.COM ptype 1 (KRB5_NT_PRINCIPAL) vno 2 etype 0x17 (RC4-HMAC) keylength 16 (0xfd77a26f1f5d61d1fafd67a2d88784c7)
Important! The keytab name with its full path must be specified in the Keytab Location field during the Federation Agent configuration.
The domain controller is deployed for Kerberos on systems running Windows.
To configure Kerberos, the following commands are required on a federation system on a UNIX system:
The UNIX system is configured for Kerberos authentication.
Configure Internet Explorer for single sign-on. The procedures apply whether you are using NTLM or Kerberos as the authentication protocol.
Complete the installation prerequisites for the Federation Agent on a UNIX system running in Kerberos mode. The KDC is on a UNIX system.
The UNIX server that hosts the Kerberos key distribution center (KDC) must be configured to support the federation system. Part of this process is to create a keytab file. A keytab file is required for Kerberos authentication.
Follow these steps:
usr/sbin/kadmin.local
addprinc -pw <password> HTTP/AgentHost Name.domainname.com@DOMAINNAME.COM
ktadd -k output_keytab_location SPN name
The keytab file is created.
The configuration of federation on the UNIX KDC server is complete.
To configure Kerberos, the following commands are required on a federation system on a UNIX system:
The UNIX system is configured for Kerberos authentication.
Configure Internet Explorer for single sign-on. The procedures apply whether you are using NTLM or Kerberos as the authentication protocol.
To function in a single sign-on deployment, configure some specific Internet Explorer settings.
Internet Explorer requires some specific settings to function in a single sign-on deployment. The setup for the browser requires configuring the local Intranet properties and configuring Intranet authentication. These settings apply whether you are using the Kerberos or the NTLM authentication protocol.
Follow these steps:
The local Intranet properties are configured.
To function in a single-sign on solution requires some specific settings for the Internet Explorer. These client browser settings assume an Intranet environment. The setup for the browser requires configuring the local Intranet properties and configuring Intranet authentication.
Follow these steps:
Users are authenticated on the Intranet zone.
At the asserting party, when a proxy server is inserted between the browser and the federation system with the Agent, authentication no longer works. In this case all URLs with relative domain names must be configured not to go through the proxy server.
Follow these steps:
The browser is configured to bypass the proxy server for the specified domains.
If your configuration has a firewall between the Federation Agent and the domain controller, the following static ports must be opened to allow communication:
In addition, the following Local Security Authority (LSA) ports are dynamic and must be made static by modifying registry entries:
Visit the following site for information about the LSA ports:
http://support.microsoft.com/kb/224196/
|
Copyright © 2014 CA.
All rights reserved.
|
|