Policy Server Guides › Policy Design Guide › SiteMinder Kerberos Authentication › Kerberos Configuration Examples › Kerberos Configuration at the Policy Server on UNIX Example

Kerberos Configuration at the Policy Server on UNIX Example

The process listed following exemplifies how to configure a Policy Server on a UNIX host to support SiteMinder Kerberos authentication.

1. Create a user, for example, sol8psuser, with the same password used for creating service account for the Policy Server host (sol8ps) in Active Directory.
2. Add the host to test.com domain and login to host with user sol8psuser.
3. Install and configure SiteMinder Policy Server.
4. Install and configure policy store directory services.
5. Add a Host Configuration Object referencing the Solaris Policy Server.
6. Add an Agent Configuration Object and add the following three new parameters:

1. Create a user directory.
2. Create a new user, fr exanple, testkrb, in the user directory.
3. Configure a new Authentication Scheme using the SiteMinder Admin UI:
   1. Create the scheme using the custom template.
   2. Specify the SiteMinder Kerberos Authentication Scheme library.
   3. Select the parameter field and mention the following three values in same order delimited by a semicolon:
      • Server name and target fields.
      • Policy Server's principal name from the Windows 2003 Kerberos realm.
      • Mapping between the user's principal and an LDAP search filter.

      Sample parameter field:

      http://sol8sunone.test.com/siteminderagent/Kerberos/creds.kcc;smps/sol8ps.test.com@TEST.COM;(uid=%{UID})
      

4. Configure a policy domain.
5. Add a realm to protect a resource using the Authentication Scheme.
6. Add Rules and Policies to allow access for the user, testkrb.
7. Configure a Kerberos configuration file (krb5.ini) and place krb5.ini in /etc/krb5 system path
   • Configure the KDC for the Windows 2003 Kerberos realm (domain) to use the Windows 2003 domain controller.
   • Configure krb5.ini to use the Windows 2003 KDC keytab file containing the policy server principal’s credentials.

     See the sample krb5.ini listed following:

     [libdefaults]
      ticket_lifetime = 24000
      default_realm=TEST.COM
      default_tgs_enctypes = des-cbc-md5
      default_tkt_enctypes = des-cbc-md5
      default_keytab_name = FILE:/etc/krb5.keytab
      dns_lookup_realm = false
      dns_lookup_kdc = false
      forwardable = true
      proxiable = true
     [realms]
      TEST.COM = {
       kdc = winkdc.test.com:88
       admin_server = winkdc.test.com:749
       default_domain = test.com
      }
     [domain_realm]
      .test.com=TEST.COM
       test.com=TEST.COM
     

8. Use the ktutil porgram to merge the keytab files (sol8ps_smps.keytab & sol8ps_host.keytab) containing the host principal and service principal names for the policy Server host in /etc/krb5.keytab file:

   ktutil: rkt sol8ps_host.keytab
   ktutil: wkt /etc/krb5.keytab
   ktutil: q
   ktutil: rkt sol8ps_smps.keytab
   ktutil: wkt /etc/krb5.keytab
   ktutil: q
   

9. Verify the created krb5.keytab as follows:

   klist -k
   Keytab name: FILE:/etc/krb5.keytab
   KVNO Principal
   ---- --------------------------------------------------------------------------
      3 host/sol8ps.test.com@TEST.COM
      3 smps/sol8ps.test.com@TEST.COM
   

10. Deploy the Windows 2003 KDC keytab file containing the host and Policy Server principal credentials to a secure location on the Policy Server.
11. Verify that the following environment variable is set before starting the Policy Server:

    KRB5_CONFIG=/etc/krb5/krb5.conf

The Policy Server on a UNIX host is configured for Kerberos authentication.