How to Setup Single Sign-On (SSO) for HTTP requests using SPNEGO authentication in WebSphere Application Server

Install the WebSphere Application Server Default Application (snoop)

1.       Open the administrative console.

Type http://localhost:port_number/ibm/console to access the administrative console in a web browser.

Port 9060 is the default port number for accessing the administrative console.

2.Click Applications > New Application > New Enterprise Application

3. Click the Browse button under Remote file system > click your Nodename > click Appserver > click installableApps

4. Click Next. On the "Preparing for the application installation" page, ensure that Fast Path (default) is chosen for "How do you want to install the application?"

5. Click Map modules to servers page, select the Default Web Application, and then select your application server click Apply and Next.

6. Click the Summary link and Click Finish to save the changes to the master configuration

7. Once it is deployed, check Click Applications > Application Types > WebSphere enterprise applications. The new application, DefaultApplication, is stopped. To start the application, select DefaultApplication.ear, and then click start.

8. Make sure you sync all nodes with dmgr. Click System Administration Nodes > Select the Node for the server, and then click Synchronize.

Make sure to test the Snoop application without spnego SSO configuration. Snoop servlet requests a basic auth prompt for login where you can manually enter your LDAP username and password.

4. Set up Kerberos configuration file on WebSphere Application Server.

Enter the command wsadmin to start the wsadmin tool. If prompted, enter the username and password for your WebSphere Application Server Administrator username.

Enter the following wsadmin command to create the Kerberos configuration file

$AdminTask createKrbConfigFile {-krbPath <path to config file with filename> -realm <KERBEROS REALM> -kdcHost <Active Directory hostname> -dns <DNS domain> -keytabPath <keytab filename>}

encryption: This parameter identifies the list of supported encryption types, separated by a pipe character. The default value is des-cbc-md5 and rc4-hmac. If you want to use AES256 or AES128, then you pass the argument encryption type in the wsadmin command. More details are given in the following example

DNS: A list of default domain name services DNS, separated by a pipe character that is used to produce a fully qualified hostname. The first one in the list is the default domain name service. More details are given in the following example

For example, if you are using web application URL https://ramlinux1.fyre.ibm.com/myapp, then your DNS name <DNS domain> is fyre.ibm.com, and your KDC Realm name (KERBEROS REALM)  is WASSEC-L2.LOCAL (Microsoft AD Domain Name). In this case, you are mapping the DNS for the URL with the KDC realm name (Microsoft AD Domain Name)

realm: realm name is all UPPERCASE (WASSEC-L2.LOCAL) of the Microsoft AD Domain Name

Ensure that the keytab file location matches with the location defined in the krb5.ini or .conf file and that the KDC server (MSAD) hostname entry resolves successfully

WASSEC-L2.LOCAL

For more information, see:

Creating a Kerberos configuration file

https://www.ibm.com/docs/en/was-nd/9.0.5?topic=server-creating-kerberos-configuration-file

Sample of Kerberos Configuration file Krb5.ini & Krb5.conf

From a command line, navigate to the bin directory for the Deployment Manager, cd to /opt/IBM/WebSphere/AppServer/profiles/Dmgr01/bin

Use the wsadmin command utility to create a krb5.ini/krb5.conf file

Note:  Copy keytab from KDC server to the WebSphere Application Server system to the same directory path where the krb5 file exists. If you have multiple nodes within the cell, then you can copy the krb5.ini or Krb5.conf under the same directory path (example path: /spnego) so that all node servers to the same location where they can access this file.

$AdminTask createKrbConfigFile {-krbPath /spnego/krb5.conf -realm WASSEC-L2.LOCAL -kdcHost waskdc1.fyre.ibm.com -dns fyre.ibm.com -encryption aes256-cts-hmac-sha1-96 -keytabPath /spnego/WASServer.keytab}

Use Java klist –k command to view the keytab file content

On the WebSphere Application Server instance, you can verify that the Kerberos keytab file is valid with the correct encryption by using the following command, and it returns your spn's list and encryption types on your keytab.

<WAS_JAVA_HOME>/jre/bin/java com.ibm.security.krb5.internal.tools.Klist -e –k <keytab file>

Example shows an example of the correct output and Sample Klist output

cd /opt/IBM/WebSphere/AppServer/java/8.0/jre/bin and run the following command.

./java com.ibm.security.krb5.internal.tools.Klist -e –k -K /spnego/WASServer.keytab

5. Enable SPNEGO authentication on WebSphere Application Server.

1. Open the administrative console.

Type http://localhost:port_number/ibm/console to access the administrative console in a web browser.

Port 9060 is the default port number for accessing the administrative console.

Note: Don’t click Kerberos configuration. You don’t need Kerberos configuration for spnego authentication configuration. Kerberos authentication is required only when your application making a Kerberos call. In essence, WebSphere communicates directly with the KDC server to get the Kerberos token for your application login.

By convention, a Kerberos service principal name (SPN) is divided into three parts: the primary, the instance, and the Kerberos realm name. The SPNEGO service name must be HTTP, so the Kerberos service principal name for SPNEGO web is HTTP/<fully qualified host name>@KERBEROS_REALM. The SPN is used to validate the incoming SPNEGO token and to establish a security context with a requester.

Enter a fully qualified hostname in the hostname field. The hostname must part of your SPN that exists under your keytab file. In our example spn hostname is ramlinux1.fyre.ibm.com.

Enter Kerberos realm name field, and you must define it in uppercase letters. In our example, Kerberos realm is WASSEC-l2.LOCAL

Select Trim Kerberos realm from principal name option

Important: If there is no alias configured, ensure that the "Use the alias hostname for the application server" option is not selected. The application server performs a DNS lookup as an HTTP request comes in, and if the alias hostname is resolved as a hostname that is already configured for SPNEGO single sign-on (SPN in keytab and Spnego filter), the application server continues to process it.

Enter the Kerberos configuration file name with its full path, or click Browse to locate it. Our example path is /spnego/krb5.conf. The Keytab path is automatically read from this Kerberos configuration file /spnego/krb5.conf

Important:- If you have multiple nodes within the cell then, you need to copy the krb5.conf or WASServer.keytab under the same directory path (In our example path: /spnego) so that all node servers to the same location where it can access this file.

Note: If you don't define krb5 conf location in spnego web authentication configuration, then WebSphere runtime code searches for the Kerberos configuration files in the order as follows

- The file referenced by the system property java.security.krb4.conf

- Windows looks for c:\winnt\krb5.ini

- Unix looks for /etc/krb5.conf

Make sure Full synchronization of the node with dmgr.

For more information, see

Enabling and configuring SPNEGO web authentication using the administrative console

https://www.ibm.com/docs/en/was/9.0.5?topic=csshruswa-enabling-configuring-spnego-web-authentication-using-administrative-console

6. Configure Microsoft Edge and Firefox browser on Client Workstation.

Make sure the client workstation is part of a window domain for which SSO is defined. In the following example, the client workstation mypc1.fyre.ibm.com is a member of the domain controller WASSEC-l2.LOCAL. Log on to the Windows Desktop with a user name from the domain. In the following example domain user is "myuser".

Note: Internet Explorer, Microsoft Edge, and Google Chrome Browser use the same settings as described in the following section:

On the Client Workstation, open the Control Panel.

Click Network and Internet. Click or double-click the Internet Options icon.

Under the internet Internet Properties window, click the Security tab.

Select the Local site's entry and click the Sites button.

Click Advanced and Enter the website in the Add this website to the zone text field. Click the Add button, then click OK to save.

Close the browser and start the browser.

Configure Mozilla or Firefox browser to use SPNEGO authentication

Open the browser.

At the address field, type about: config

In the filter, type network.n

Double-click network.negotiate-auth.trusted-uris. This preference lists the sites that are permitted to engage in SPNEGO Authentication with the browser.

Enter a comma-delimited list of trusted domains or URLs. For example, https://ramlinux1.fyre.ibm.com

Close the browser and start the browser.

7. Test the snoop application to validate the spnego on the Client Workstation.

Make sure you are logged in to the Windows AD domain from your client workstation, start your browser (IE, Chrome, or Firefox), and attempt to access the snoop servlet, by using the fully qualified hostname of the server (Example: https://ramlinux1.fyre.ibm.com:9443/snoop). It automatically logs in to your snoop URL without any authentication challenge.

In the snoop page with your window domain login user, the Authorization Header with spnego token details starts with YII and User principal name.

Useful link as follows

Single sign-on for HTTP requests using SPNEGO web authentication

https://www.ibm.com/docs/en/was/9.0.5?topic=issmwua-single-sign-http-requests-using-spnego-web-authentication

SPNEGO Web authentication filter values

https://www.ibm.com/docs/en/was/9.0.5?topic=console-spnego-web-authentication-filter-values

Configuring the client browser to use SPNEGO

https://www.ibm.com/docs/en/was/9.0.5?topic=authentication-configuring-client-browser-use-spnego