On Mar 20, 8:45 am, Thomas Maslen <[email protected]> wrote: > > [...] I am using SPNEGO for silent authentication. > > Referringhttps://www.jboss.org/community/docs/DOC-10680 [...] Am I doing > > anything fundamentally wrong > > With the caveat that I have only had a cursory look [we have our own product > that supports SPNEGO and other GSSAPI / Kerberos goodness on various Java app > servers (including JBoss) so we don't use the JBoss Negotiate code, nor its > setup instructions]... I _think_ the problem is that the setup instructions > you followed implicitly assume that the machine where you are installing > JBoss Negotiate is *not* joined to an Active Directory domain[*], and bad > things happen if you try to use those same setup instructions for a machine > that is joined to the Active Directory domain -- you end up with two > different objects in AD that both want to be the HOST principal, e.g. > HOST/PASKTABSVR1.wamtest.wa.local in your example. (And you are going even > further than that; the machine that you're using for JBoss Negotiate isn't > just any member of the AD domain, it is actually a domain controller). > > [*] A plausible guess would be that the instructions were developed for > running JBoss Negotiate on a Unix or Linux (e.g. Redhat...) host that is > likely _not_ configured to enable MIT Kerberos (or whatever), so the host is > not joined to the AD domain.
I really didn't get what you meant by " ....the machine where you are installing JBoss Negotiate is *not* joined to an Active Directory domain[*],..... ", As far as I know any machine or user in a particular domain will be the part of active directory. Ya I can separate JBOSS machine from the AD (KDC), ie I will create new machine in same domain and install JBOSS and test, hope this helps ! I actually didnt got what you meant by word "joined". I am misunderstanding something.. ________________________________________________ Kerberos mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/kerberos
