Question

4
Replies
2241
Views
 Arjun Thota (ArjunT21)
TCS

TCS
IN
ArjunT21 Member since 2016 2 posts
TCS
Posted: December 23, 2016
Last activity: January 4, 2017
Posted: 23 Dec 2016 2:22 EST
Last activity: 4 Jan 2017 4:01 EST
Closed

SSO using Kerberos windows authentication in Pega 7.1.9 using SPNEGO

Hi All,

We have already done the configuration changes at Tomcat server like krb5, jass.conf and spnego-r7.jar files in 7.1.9. But we are not receiving the credentials in request header. Every time we are getting login page. Below steps we followed for SSO setup.

Please let me know if any one is done similar configurations or any different approach for SSO using kerberos

STEPS TO CONFIGURE/IMPLEMENT KERBEROS IN ERIMATCH APPLICATION    
    Creation of SPN’s    
    Domain Controller    
    Tomcat instance    
    Spnego Related Changes    
    Pega Side Code changes

Also we have seen recently in Nov 2016 post, saying that kerberos feature is given directly in Auth service in 7.2.2 as per below article. Please let us know any similar article in 7.1.9.

https://pdn.pega.com/using-kerberos-credentials-pega-application-authenticate-and-access-external-systems/using-kerberos

Thanks,

Arjun

***Updated by moderator: Lochan to add Categories; remove personal information***

Data Integration Security System Administration
Moderation Team has archived post, This thread is closed to future replies. Content and links will no longer be updated. If you have the same/similar Question, please write a new Question.
Posted: 4 years ago
Posted: 26 Dec 2016 5:15 EST
Srikanth Challapilla (Srikanth)
PEGA
Senior Manager, Security Engineering
Pegasystems
IN

UserPrincipal was added to the pxRequestor page for access by REST connectors or fetching LDAP credentials in 7.2.2. 


Sample PRCustom scheme was provided for use by customers in 7.2.2. 


in 7.1.9 , you can use kerberos credentials for login to PRPC but cannot cascade them for downstream services. 


 
Posted: 4 years ago
Posted: 27 Dec 2016 1:34 EST
Arjun Thota (ArjunT21)
TCS

TCS
IN

Hi All,


As per the pega 7.1.9 installation guide, while installing we need to enable kerberos at database side. But we didnt enable this as it is a optional. Can we now enable this Kerberos after installation of pega.


Please find the attached relavant screen shots.


Thanks,


Arjun.
Posted: 4 years ago
Posted: 4 Jan 2017 1:37 EST
Srikanth Challapilla (Srikanth)
PEGA
Senior Manager, Security Engineering
Pegasystems
IN

If you setup your datasource(PegaRULES jndi) to use kerberos principal and configure it in prconfig, it should work since jdbc will take care of the connection.


 
Posted: 4 years ago
Posted: 4 Jan 2017 4:01 EST
Faisal Khan (FaisalKhan)
J P Morgan

J P Morgan
IN

"But we are not receiving the credentials in request header"  - This apparently means that kerberos token is not coming to tomcat server itself.


You need to look at your kerberos configuration and troubleshoot accordingly.


I have configured Kerberos with WLS and I assume there won't be a lot of difference with Tomcat configuration.

I have listed the ways to troubleshoot kerberos issues on my website


 


http://weblogic-wonders.com/weblogic/2010/01/07/troubleshooting-kerberos-issues-with-weblogic-server/


 


You need to enable kerberos debug on tomcat and look at the logs. You can paste/upload your logs here if you want me to check.



Regards,

Faisal