Gitiles
Code Review Sign In
source.supwisdom.com / portal_platform / tomcat-cms / 07b3087b89f4c23810bb2a7902fe5a06f392b984 / . / webapps / docs / windows-auth-howto.html
blob: e45c5cc12d1a49e96d1d3d615da60528475c3cd2 [file] [log] [blame]
Cheng Tang07b30872014-04-27 16:37:18 +0800[diff] [blame^]1<html><head><META http-equiv="Content-Type" content="text/html; charset=iso-8859-1"><title>Apache Tomcat 7 (7.0.42) - Windows Authentication How-To</title><style type="text/css" media="print">
2 .noPrint {display: none;}
3 td#mainBody {width: 100%;}
4 </style><style type="text/css">
5 code {background-color:rgb(224,255,255);padding:0 0.1em;}
6 code.attributeName, code.propertyName {background-color:transparent;}
7 </style><style type="text/css">
8 .wrapped-source code { display: block; background-color: transparent; }
9 .wrapped-source div { margin: 0 0 0 1.25em; }
10 .wrapped-source p { margin: 0 0 0 1.25em; text-indent: -1.25em; }
11 </style><style type="text/css">
12 p.notice {
13 border: 1px solid rgb(255, 0, 0);
14 background-color: rgb(238, 238, 238);
15 color: rgb(0, 51, 102);
16 padding: 0.5em;
17 margin: 1em 2em 1em 1em;
18 }
19 </style></head><body bgcolor="#ffffff" text="#000000" link="#525D76" alink="#525D76" vlink="#525D76"><table border="0" width="100%" cellspacing="0"><!--PAGE HEADER--><tr><td><!--PROJECT LOGO--><a href="http://tomcat.apache.org/"><img src="./images/tomcat.gif" align="right" alt="
20 The Apache Tomcat Servlet/JSP Container
21 " border="0"></a></td><td><h1><font face="arial,helvetica,sanserif">Apache Tomcat 7</font></h1><font face="arial,helvetica,sanserif">Version 7.0.42, Jul 2 2013</font></td><td><!--APACHE LOGO--><a href="http://www.apache.org/"><img src="./images/asf-logo.gif" align="right" alt="Apache Logo" border="0"></a></td></tr></table><table border="0" width="100%" cellspacing="4"><!--HEADER SEPARATOR--><tr><td colspan="2"><hr noshade size="1"></td></tr><tr><!--LEFT SIDE NAVIGATION--><td width="20%" valign="top" nowrap class="noPrint"><p><strong>Links</strong></p><ul><li><a href="index.html">Docs Home</a></li><li><a href="http://wiki.apache.org/tomcat/FAQ">FAQ</a></li><li><a href="#comments_section">User Comments</a></li></ul><p><strong>User Guide</strong></p><ul><li><a href="introduction.html">1) Introduction</a></li><li><a href="setup.html">2) Setup</a></li><li><a href="appdev/index.html">3) First webapp</a></li><li><a href="deployer-howto.html">4) Deployer</a></li><li><a href="manager-howto.html">5) Manager</a></li><li><a href="realm-howto.html">6) Realms and AAA</a></li><li><a href="security-manager-howto.html">7) Security Manager</a></li><li><a href="jndi-resources-howto.html">8) JNDI Resources</a></li><li><a href="jndi-datasource-examples-howto.html">9) JDBC DataSources</a></li><li><a href="class-loader-howto.html">10) Classloading</a></li><li><a href="jasper-howto.html">11) JSPs</a></li><li><a href="ssl-howto.html">12) SSL</a></li><li><a href="ssi-howto.html">13) SSI</a></li><li><a href="cgi-howto.html">14) CGI</a></li><li><a href="proxy-howto.html">15) Proxy Support</a></li><li><a href="mbeans-descriptor-howto.html">16) MBean Descriptor</a></li><li><a href="default-servlet.html">17) Default Servlet</a></li><li><a href="cluster-howto.html">18) Clustering</a></li><li><a href="balancer-howto.html">19) Load Balancer</a></li><li><a href="connectors.html">20) Connectors</a></li><li><a href="monitoring.html">21) Monitoring and Management</a></li><li><a href="logging.html">22) Logging</a></li><li><a href="apr.html">23) APR/Native</a></li><li><a href="virtual-hosting-howto.html">24) Virtual Hosting</a></li><li><a href="aio.html">25) Advanced IO</a></li><li><a href="extras.html">26) Additional Components</a></li><li><a href="maven-jars.html">27) Mavenized</a></li><li><a href="security-howto.html">28) Security Considerations</a></li><li><a href="windows-service-howto.html">29) Windows Service</a></li><li><a href="windows-auth-howto.html">30) Windows Authentication</a></li><li><a href="jdbc-pool.html">31) Tomcat's JDBC Pool</a></li><li><a href="web-socket-howto.html">32) WebSocket</a></li></ul><p><strong>Reference</strong></p><ul><li><a href="RELEASE-NOTES.txt">Release Notes</a></li><li><a href="config/index.html">Configuration</a></li><li><a href="api/index.html">Tomcat Javadocs</a></li><li><a href="servletapi/index.html">Servlet Javadocs</a></li><li><a href="jspapi/index.html">JSP 2.2 Javadocs</a></li><li><a href="elapi/index.html">EL 2.2 Javadocs</a></li><li><a href="http://tomcat.apache.org/connectors-doc/">JK 1.2 Documentation</a></li></ul><p><strong>Apache Tomcat Development</strong></p><ul><li><a href="building.html">Building</a></li><li><a href="changelog.html">Changelog</a></li><li><a href="http://wiki.apache.org/tomcat/TomcatVersions">Status</a></li><li><a href="developers.html">Developers</a></li><li><a href="architecture/index.html">Architecture</a></li><li><a href="funcspecs/index.html">Functional Specs.</a></li><li><a href="tribes/introduction.html">Tribes</a></li></ul></td><!--RIGHT SIDE MAIN BODY--><td width="80%" valign="top" align="left" id="mainBody"><h1>Windows Authentication How-To</h1><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Table of Contents"><!--()--></a><a name="Table_of_Contents"><strong>Table of Contents</strong></a></font></td></tr><tr><td><blockquote>
22<ul><li><a href="#Overview">Overview</a></li><li><a href="#Built-in_Tomcat_support">Built-in Tomcat support</a><ol><li><a href="#Domain_Controller">Domain Controller</a></li><li><a href="#Tomcat_instance">Tomcat instance</a></li><li><a href="#Web_application">Web application</a></li><li><a href="#Client">Client</a></li><li><a href="#References">References</a></li></ol></li><li><a href="#Third_party_libraries">Third party libraries</a><ol><li><a href="#Waffle">Waffle</a></li><li><a href="#Spring_Security_-_Kerberos_Extension">Spring Security - Kerberos Extension</a></li><li><a href="#SPNEGO_project_at_SourceForge">SPNEGO project at SourceForge</a></li><li><a href="#Jespa">Jespa</a></li></ol></li><li><a href="#Reverse_proxies">Reverse proxies</a><ol><li><a href="#Microsoft_IIS">Microsoft IIS</a></li><li><a href="#Apache_httpd">Apache httpd</a></li></ol></li></ul>
23</blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Overview"><strong>Overview</strong></a></font></td></tr><tr><td><blockquote>
24<p>Integrated Windows authentication is most frequently used within intranet
25environments since it requires that the server performing the authentication and
26the user being authenticated are part of the same domain. For the user to be
27authenticated automatically, the client machine used by the user must also be
28part of the domain.</p>
29<p>There are several options for implementing integrated Windows authentication
30with Apache Tomcat. They are:
31<ul>
32<li>Built-in Tomcat support.</li>
33<li>Use a third party library such as Waffle.</li>
34<li>Use a reverse proxy that supports Windows authentication to perform the
35authentication step such as IIS or httpd.</li>
36</ul>
37The configuration of each of these options is discussed in the following
38sections.</p>
39</blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Built-in Tomcat support"><!--()--></a><a name="Built-in_Tomcat_support"><strong>Built-in Tomcat support</strong></a></font></td></tr><tr><td><blockquote>
40<p><strong>This documentation is a work in progress. There are a number of
41outstanding questions around the edge cases that require further
42testing.</strong> These include:
43</p>
44<ul>
45<li>Does the domain name have to be in upper case?</li>
46<li>Does the SPN have to start with HTTP/...?</li>
47<li>Can a port number be appended to the end of the host in the SPN?</li>
48<li>Can the domain be left off the user in the ktpass command?</li>
49<li>What are the limitations on the account that Tomcat can run as? SPN
50 associated account works, domain admin works, local admin doesn't
51 work</li>
52</ul>
53<p>There are four components to the configuration of the built-in Tomcat
54support for Windows authentication. The domain controller, the server hosting
55Tomcat, the web application wishing to use Windows authentication and the client
56machine. The following sections describe the configuration required for each
57component.</p>
58<p>The names of the three machines used in the configuration examples below are
59win-dc01.dev.local (the domain controller), win-tc01.dev.local (the Tomcat
60instance) and win-pc01.dev.local (client). All are members of the DEV.LOCAL
61domain.</p>
62<p>Note: In order to use the passwords in the steps below, the domain password
63policy had to be relaxed. This is not recommended for production environments.
64</p>
65
66 <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Domain Controller"><!--()--></a><a name="Domain_Controller"><strong>Domain Controller</strong></a></font></td></tr><tr><td><blockquote>
67 <p>These steps assume that the server has already been configured to act as a
68 domain controller. Configuration of a Windows server as a domain controller is
69 outside the scope of this how-to. The steps to configure the domain controller
70 to enable Tomcat to support Windows authentication are as follows:
71 </p>
72 <ul>
73 <li>Create a domain user that will be mapped to the service name used by the
74 Tomcat server. In this how-to, this user is called <code>tc01</code> and has a
75 password of <code>tc01pass</code>.</li>
76 <li>Map the service principal name (SPN) to the user account. SPNs take the
77 form <code>
78 &lt;service class&gt;/&lt;host&gt;:&lt;port&gt;/&lt;service name&gt;</code>.
79 The SPN used in this how-to is <code>HTTP/win-tc01.dev.local</code>. To
80 map the user to the SPN, run the following:
81 <div align="left"><table cellspacing="4" cellpadding="0" border="0"><tr><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr><tr><td bgcolor="#023264" width="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#ffffff" height="1"><pre>setspn -A HTTP/win-tc01.dev.local tc01</pre></td><td bgcolor="#023264" width="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr><tr><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr></table></div>
82 </li>
83 <li>Generate the keytab file that the Tomcat server will use to authenticate
84 itself to the domain controller. This file contains the Tomcat private key for
85 the service provider account and should be protected accordingly. To generate
86 the file, run the following command (all on a single line):
87 <div align="left"><table cellspacing="4" cellpadding="0" border="0"><tr><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr><tr><td bgcolor="#023264" width="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#ffffff" height="1"><pre>ktpass /out c:\tomcat.keytab /mapuser tc01@DEV.LOCAL
88 /princ HTTP/win-tc01.dev.local@DEV.LOCAL
89 /pass tc01pass /kvno 0</pre></td><td bgcolor="#023264" width="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr><tr><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr></table></div></li>
90 <li>Create a domain user to be used on the client. In this how-to the domain
91 user is <code>test</code> with a password of <code>testpass</code>.</li>
92 </ul>
93 <p>The above steps have been tested on a domain controller running Windows
94 Server 2008 R2 64-bit Standard using the Windows Server 2003 functional level
95 for both the forest and the domain.
96 </p>
97 </blockquote></td></tr></table>
98
99 <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Tomcat instance"><!--()--></a><a name="Tomcat_instance"><strong>Tomcat instance</strong></a></font></td></tr><tr><td><blockquote>
100 <p>These steps assume that Tomcat and a Java 6 JDK/JRE have already been
101 installed and configured and that Tomcat is running as the tc01@DEV.LOCAL
102 user. The steps to configure the Tomcat instance for Windows authentication
103 are as follows:
104 </p>
105 <ul>
106 <li>Copy the <code>tomcat.keytab</code> file created on the domain controller
107 to <code>$CATALINA_BASE/conf/tomcat.keytab</code>.</li>
108 <li>Create the kerberos configuration file
109 <code>$CATALINA_BASE/conf/krb5.ini</code>. The file used in this how-to
110 contained:<div align="left"><table cellspacing="4" cellpadding="0" border="0"><tr><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr><tr><td bgcolor="#023264" width="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#ffffff" height="1"><pre>[libdefaults]
111default_realm = DEV.LOCAL
112default_keytab_name = FILE:c:\apache-tomcat-7.0.x\conf\tomcat.keytab
113default_tkt_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96
114default_tgs_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96
115forwardable=true
116
117[realms]
118DEV.LOCAL = {
119 kdc = win-dc01.dev.local:88
120}
121
122[domain_realm]
123dev.local= DEV.LOCAL
124.dev.local= DEV.LOCAL</pre></td><td bgcolor="#023264" width="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr><tr><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr></table></div>
125 The location of this file can be changed by setting the
126 <code>java.security.krb5.conf</code> systm property.</li>
127 <li>Create the JAAS login configuration file
128 <code>$CATALINA_BASE/conf/jaas.conf</code>. The file used in this how-to
129 contained:<div align="left"><table cellspacing="4" cellpadding="0" border="0"><tr><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr><tr><td bgcolor="#023264" width="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#ffffff" height="1"><pre>com.sun.security.jgss.krb5.initiate {
130 com.sun.security.auth.module.Krb5LoginModule required
131 doNotPrompt=true
132 principal="HTTP/win-tc01.dev.local@DEV.LOCAL"
133 useKeyTab=true
134 keyTab="c:/apache-tomcat-7.0.x/conf/tomcat.keytab"
135 storeKey=true;
136};
137
138com.sun.security.jgss.krb5.accept {
139 com.sun.security.auth.module.Krb5LoginModule required
140 doNotPrompt=true
141 principal="HTTP/win-tc01.dev.local@DEV.LOCAL"
142 useKeyTab=true
143 keyTab="c:/apache-tomcat-7.0.x/conf/tomcat.keytab"
144 storeKey=true;
145};</pre></td><td bgcolor="#023264" width="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr><tr><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr></table></div>
146 The location of this file can be changed by setting the
147 <code>java.security.auth.login.config</code> system property. The LoginModule
148 used is a JVM specific one so ensure that the LoginModule specified matches
149 the JVM being used. The name of the login configuration must match the
150 value used by the <a href="config/valve.html#SPNEGO_Valve">authentication
151 valve</a>.</li>
152 <li>The system property <code>javax.security.auth.useSubjectCredsOnly</code>
153 is automatically set to the required value of false if a web application is
154 configured to use the SPNEGO authentication method.</li>
155 </ul>
156 <p>The SPNEGO authenticator will work with any <a href="config/realm.html">
157 Realm</a> but if used with the JNDI Realm, by default the JNDI Realm will use
158 the user's delegated credentials to connect to the Active Directory.
159 </p>
160 <p>The above steps have been tested on a Tomcat server running Windows Server
161 2008 R2 64-bit Standard with an Oracle 1.6.0_24 64-bit JDK.</p>
162 </blockquote></td></tr></table>
163
164 <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Web application"><!--()--></a><a name="Web_application"><strong>Web application</strong></a></font></td></tr><tr><td><blockquote>
165 <p>The web application needs to be configured to the use Tomcat specific
166 authentication method of <code>SPNEGO</code> (rather than BASIC etc.) in
167 web.xml. As with the other authenticators, behaviour can be customised by
168 explicitly configuring the <a href="config/valve.html#SPNEGO_Valve">
169 authentication valve</a> and setting attributes on the Valve.</p>
170 </blockquote></td></tr></table>
171
172 <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Client"><strong>Client</strong></a></font></td></tr><tr><td><blockquote>
173 <p>The client must be configured to use Kerberos authentication. For Internet
174 Explorer this means making sure that the Tomcat instance is in the "Local
175 intranet" security domain and that it is configured (Tools &gt; Internet
176 Options &gt; Advanced) with integrated Windows authentication enabled. Note that
177 this <strong>will not</strong> work if you use the same machine for the client
178 and the Tomcat instance as Internet Explorer will use the unsupported NTLM
179 protocol.</p>
180 </blockquote></td></tr></table>
181
182 <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="References"><strong>References</strong></a></font></td></tr><tr><td><blockquote>
183 <p>Correctly configuring Kerberos authentication can be tricky. The following
184 references may prove helpful. Advice is also always available from the
185 <a href="http://tomcat.apache.org/lists.html#tomcat-users">Tomcat users
186 mailing list</a>.</p>
187 <ol>
188 <li><a href="http://www.adopenstatic.com/cs/blogs/ken/archive/2006/10/19/512.aspx">
189 IIS and Kerberos</a></li>
190 <li><a href="http://spnego.sourceforge.net/index.html">
191 SPNEGO project at SourceForge</a></li>
192 <li><a href="http://docs.oracle.com/javase/1.5.0/docs/guide/security/jgss/tutorials/index.html">
193 Oracle JGSS tutorial</a></li>
194 <li><a href="https://cwiki.apache.org/GMOxDOC21/using-spengo-in-geronimo.html#UsingSpengoingeronimo-SettinguptheActiveDirectoryDomainController">
195 Geronimo configuration for Windows authentication</a></li>
196 <li><a href="http://blogs.msdn.com/b/openspecification/archive/2010/11/17/encryption-type-selection-in-kerberos-exchanges.aspx">
197 Encryption Selection in Kerberos Exchanges</a></li>
198 <li><a href="http://support.microsoft.com/kb/977321">Supported Kerberos Cipher
199 Suites</a></li>
200 </ol>
201 </blockquote></td></tr></table>
202
203</blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Third party libraries"><!--()--></a><a name="Third_party_libraries"><strong>Third party libraries</strong></a></font></td></tr><tr><td><blockquote>
204
205 <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Waffle"><strong>Waffle</strong></a></font></td></tr><tr><td><blockquote>
206 <p>Full details of this solution can be found through the
207 <a href="http://waffle.codeplex.com/">Waffle web site</a>. The
208 key features are:</p>
209 <ul>
210 <li>Drop-in solution</li>
211 <li>Simple configuration (no JAAS or Kerberos keytab configuration required)
212 </li>
213 <li>Uses a native library</li>
214 </ul>
215 </blockquote></td></tr></table>
216
217 <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Spring Security - Kerberos Extension"><!--()--></a><a name="Spring_Security_-_Kerberos_Extension"><strong>Spring Security - Kerberos Extension</strong></a></font></td></tr><tr><td><blockquote>
218 <p>Full details of this solution can be found through the
219 <a href="http://static.springsource.org/spring-security/site/extensions/krb/index.html"> Kerberos extension web site</a>. The key features are:</p>
220 <ul>
221 <li>Extension to Spring Security</li>
222 <li>Requires a Kerberos keytab file to be generated</li>
223 <li>Pure Java solution</li>
224 </ul>
225 </blockquote></td></tr></table>
226
227 <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="SPNEGO project at SourceForge"><!--()--></a><a name="SPNEGO_project_at_SourceForge"><strong>SPNEGO project at SourceForge</strong></a></font></td></tr><tr><td><blockquote>
228 <p>Full details of this solution can be found through the
229 <a href="http://spnego.sourceforge.net/index.html/">project
230 site</a>. The key features are:</p>
231 <ul>
232 <li>Uses Kerberos</li>
233 <li>Pure Java solution</li>
234 </ul>
235 </blockquote></td></tr></table>
236
237 <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Jespa"><strong>Jespa</strong></a></font></td></tr><tr><td><blockquote>
238 <p>Full details of this solution can be found through the
239 <a href="http://www.ioplex.com/">project web site</a>The key
240 features are:</p>
241 <ul>
242 <li>Pure Java solution</li>
243 <li>Advanced Active Directory integration</li>
244 </ul>
245 </blockquote></td></tr></table>
246</blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Reverse proxies"><!--()--></a><a name="Reverse_proxies"><strong>Reverse proxies</strong></a></font></td></tr><tr><td><blockquote>
247
248 <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Microsoft IIS"><!--()--></a><a name="Microsoft_IIS"><strong>Microsoft IIS</strong></a></font></td></tr><tr><td><blockquote>
249 <p>There are three steps to configuring IIS to provide Windows authentication.
250 They are:</p>
251 <ol>
252 <li>Configure IIS as a reverse proxy for Tomcat (see the
253 <a href="http://tomcat.apache.org/connectors-doc/webserver_howto/iis.html">
254 IIS Web Server How-To)</a>.</li>
255 <li>Configure IIS to use Windows authentication</li>
256 <li>Configure Tomcat to use the authentication user information from IIS by
257 setting the tomcatAuthentication attribute on the <a href="config/ajp.html">
258 AJP connector</a> to <code>false</code>.</li>
259 </ol>
260 </blockquote></td></tr></table>
261
262 <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Apache httpd"><!--()--></a><a name="Apache_httpd"><strong>Apache httpd</strong></a></font></td></tr><tr><td><blockquote>
263 <p>Apache httpd does not support Windows authentication out of the box but
264 there are a number of third-party modules that can be used. These include:</p>
265 <ol>
266 <li><a href="http://sourceforge.net/projects/mod-auth-sspi/">mod_auth_sspi</a> for use on Windows platforms.</li>
267 <li><a href="http://adldap.sourceforge.net/wiki/doku.php?id=mod_auth_ntlm_winbind">mod_auth_ntlm_winbind</a> for non-Windows platforms. Known to
268 work with httpd 2.0.x on 32-bit platforms. Some users have reported stability
269 issues with both httpd 2.2.x builds and 64-bit Linux builds.</li>
270 </ol>
271 <p>There are three steps to configuring httpd to provide Windows
272 authentication. They are:</p>
273 <ol>
274 <li>Configure httpd as a reverse proxy for Tomcat (see the
275 <a href="http://tomcat.apache.org/connectors-doc/webserver_howto/apache.html">
276 Apache httpd Web Server How-To)</a>.</li>
277 <li>Configure httpd to use Windows authentication</li>
278 <li>Configure Tomcat to use the authentication user information from httpd by
279 setting the tomcatAuthentication attribute on the <a href="config/ajp.html">
280 AJP connector</a> to <code>false</code>.</li>
281 </ol>
282 </blockquote></td></tr></table>
283
284</blockquote></td></tr></table></td></tr><tr class="noPrint"><td width="20%" valign="top" nowrap class="noPrint"></td><td width="80%" valign="top" align="left"><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="comments_section" id="comments_section"><strong>Comments</strong></a></font></td></tr><tr><td><blockquote><p class="notice"><strong>Notice: </strong>This comments section collects your suggestions
285 on improving documentation for Apache Tomcat.<br><br>
286 If you have trouble and need help, read
287 <a href="http://tomcat.apache.org/findhelp.html">Find Help</a> page
288 and ask your question on the tomcat-users
289 <a href="http://tomcat.apache.org/lists.html">mailing list</a>.
290 Do not ask such questions here. This is not a Q&amp;A section.<br><br>
291 The Apache Comments System is explained <a href="/tomcat-7.0-doc/comments.html">here</a>.
292 Comments may be removed by our moderators if they are either
293 implemented or considered invalid/off-topic.</p><script type="text/javascript"><!--//--><![CDATA[//><!--
294 var comments_shortname = 'tomcat';
295 var comments_identifier = 'http://tomcat.apache.org/tomcat-7.0-doc/windows-auth-howto.html';
296 (function(w, d) {
297 if (w.location.hostname.toLowerCase() == "tomcat.apache.org") {
298 d.write('<div id="comments_thread"><\/div>');
299 var s = d.createElement('script');
300 s.type = 'text/javascript';
301 s.async = true;
302 s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
303 (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s);
304 }
305 else {
306 d.write('<div id="comments_thread"><strong>Comments are disabled for this page at the moment.<\/strong><\/div>');
307 }
308 })(window, document);
309 //--><!]]></script></blockquote></td></tr></table></td></tr><!--FOOTER SEPARATOR--><tr><td colspan="2"><hr noshade size="1"></td></tr><!--PAGE FOOTER--><tr><td colspan="2"><div align="center"><font color="#525D76" size="-1"><em>
310 Copyright &copy; 1999-2013, Apache Software Foundation
311 </em></font></div></td></tr></table></body></html>