tomcat-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Mead, Jen L" <>
Subject RE: looking for help with getting tomcat 7 to authenticate aginst windows domain controller from aix 6.1 and 5.3
Date Mon, 04 Jun 2012 21:08:04 GMT
Now that I am looking further into this, I am almost convinced that I don't need Kerberos on
the AIX webserver but only in the client (PC that is accessing the pages that are going to
authenticate).  I don't get the feeling that many people are doing this (just using a keytab
file with an AD account and tweaking the conf files on the UNIX box where tomcat is installed).
 This is the only response so far. 

-----Original Message-----
From: Martin Gainty [] 
Sent: Monday, June 04, 2012 12:45 PM
To: Tomcat Users List
Subject: RE: looking for help with getting tomcat 7 to authenticate aginst windows domain
controller from aix 6.1 and 5.3

assuming you're auth'ing against ADS then your Servlet will have to load a ADS Authentication
library and then extract auth creds to validate against ADS..
By the way ADS is native windows code so the only option to make ADS run on AIX is thru a
Windows Emulator such as WINE And yes if your ADS library forces
Kerberos Authentication thru TC NegotiateAuthenticator valve (such as waffle).. then the answer
is yes you will need to accomodate Kerberos Authentication Tokens
in mind that the majority of ADS Libraries are written for native windows so turn your radar
on for1)32bit vs 64bit ADS Deployments
2)Specific .NET Framework implementations (v1 or v2 or v3) for ADS3)Threaded vs non-threaded
singleton library dependencies for ADS (keep the other library off the path) //somewhere in
your code you have a concrete class  .. then get the SSLSession
with your ssl_session=SSLSessionContext.getSession(JSessionID.getBytes());
//extract PeerPrincipal from your principal =(
ssl_session.getPeerPrincipal();//test Principal for Kerberos    if (principal instanceof KerberosPrincipal)
                 serverName =;
i would not deploy on AIX and deploy on a windows box..far easier to load ADS Server and ADS
client code windows code to test on guys..any suggestions?
Do not alter or disrupt this message..Thank You

Date: Mon, 4 Jun 2012 11:42:38 -0700
Subject: looking for help with getting tomcat 7 to authenticate aginst windows domain controller
from aix 6.1 and 5.3

Hi,   I am brand new to tomcat 7 and am hoping to get realms set-up for users to use my CGI
scripts using their windows password.  So far I have put a request into the windows group
to create a user for this verification.  I followed the example in the tomcat manual as follows:Create
a domain user that will be mapped to the service name used by the Tomcat server. In this how-to,
this user is called tc01 and has a password of tc01pass.Map the service principal name (SPN)
to the user account. SPNs take the form <service class>/<host>:<port>/<service
name>. The SPN used in this how-to is HTTP/ To map the user to the SPN,
run the following: setspn -A HTTP/ tc01Generate the keytab file that the
Tomcat server will use to authenticate itself to the domain controller. This file contains
the Tomcat private key for the service provider account and should be protected accordingly.
To generate the file, run the following command (all on a single line): ktpass /out c:\tomcat.keytab
/mapuser tc01@DEV.LOCAL          /princ HTTP/          /pass tc01pass
/kvno 0Create a domain user to be used on the client. In this how-to the domain user is test
with a password of testpass.I then went into the next section and started to do some configuration
on the tomcat server, which right now is a prototype and is an AIX box running 5300-12-04-1119.
My question is: does the box need to be configured for Kerberos?  If so how does the Kerberos
authentication work with tomcat?  The above code sent to the windows group creates a tomcat
user, should there also be a Kerberos user?  How would they work together?  Or do they need
to?  Should they be the same user?  The documentation does not address this situation in any
way at all except to specify that Kerberos is required on the unix box, it doesn't address
AIX specifically ever.   I work at a place where the admin team is half way around the world.
 So each and every request and test is painstakingly long and obscure for the most part. 
So any and all information I come armed with is the only way to fly.  Has anyone succeeded
with this on unix or better yet AIX?  Any and all information is greatly appreciated. Regards,Jen
in Oregon   Regards,Jen  		 	   		  

To unsubscribe, e-mail:
For additional commands, e-mail:

View raw message