IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

[spnego]
#
UNIX
ONLY
spnego-krb-service-name
=
HTTP@web1.subnet1.ibm.com
#
UNIX
ONLY
spnego-krb-keytab-file
=
/var/pdweb/keytab-web1/web1_HTTP.keytab
Step
9:
Restart
WebSEAL
UNIX
pdweb
start
Windows
Use
the
Services
Control
Panel.
On
Windows,
WebSEAL
must
be
running
as
a
service
for
SPNEGO
authentication
to
work
properly.
Otherwise,
it
runs
using
the
identity
of
the
logged
in
user.
Step
10:
Configure
the
Internet
Explorer
client
The
Internet
Explorer
client
must
be
configured
to
use
the
SPNEGO
protocol
to
negotiate
authentication
mechanisms.
Consult
the
Microsoft
Internet
Explorer
documentation
for
complete
configuration
instructions.
Notes:
v
The
IE
browser
must
recognize
the
WebSEAL
server
as
an
Intranet
or
Trusted
site.
When
this
is
not
configured,
the
IE
client
does
not
automatically
send
user
name
and
password
to
the
server.
The
IE
client
should
add
the
WebSEAL
server
to
the
Intranet
Sites
list,
or
add
the
WebSEAL
server
to
the
″Do
not
require
a
proxy
for
these
sites″
list.
v
Internet
Explorer
6
must
be
specifically
configured
to
enable
single
sign-on.
Use
the
menu
item
for
Internet
Options...
and
select
the
Advanced
tab.
v
The
Windows
client
must
use
the
correct
DNS
name
to
access
the
WebSEAL
server.
When
an
incorrect
DNS
name
is
used,
IE
may
attempt
to
use
NT
LAN
Manager
(NTLM)
protocol
to
contact
WebSEAL.
WebSEAL
does
not
support
NTLM.
Troubleshooting
tips
Kerberos
configuration
v
Problem:
When
testing
the
keytab
created
for
a
UNIX
server
using
kinit,
you
get
the
error
″Clock
skew
too
great
while
getting
initial
credentials.″
Solution:
You
must
keep
clocks
synchronized
when
using
Kerberos.
For
a
permanent
solution,
deploy
some
kind
of
time
synchronization
service
on
your
machines.
For
a
temporary
solution,
adjust
the
clocks
on
the
machines
so
they
are
within
one
minute
of
each
other.
v
Problem:
When
testing
the
keytab
created
for
a
UNIX
server
using
kinit,
you
get
the
error
″Preauthentication
failed
while
getting
initial
credentials″
or
″Password
incorrect
while
getting
initial
credentials″.
Solution:
The
key
in
the
keytab
file
is
incorrect.
Make
sure
you
generated
the
keytab
file
correctly,
with
the
correct
principal
name,
Active
Directory
user
name,
and
path.
v
Problem:
kinit
crashes
when
running
kinit
-k
-t
Solution:
Some
versions
of
kinit
don’t
deal
properly
with
problems
when
an
entry
is
not
found
in
a
keytab
file.
Double-check
that
the
keytab
file
has
the
exact
same
entry
you
are
passing
to
kinit.
WebSEAL
configuration
Chapter
9.
Client
single
sign-on
solutions
243