Changes for page Einmalanmeldung

From version 1.1 >
edited by gru
on 15.03.2019, 16:31
To version < 3.1 >
edited by gru
on 25.03.2019, 12:03
>
Change comment: Copied from xwiki:Main.SystemSettings.UserInterface.SingleSignOn.WebHome

Summary

Details

Page properties
Title
... ... @@ -1,1 +1,1 @@
1 -$services.localization.render("PT.Main.NTLMMenue")
1 +Single sign-on
Content
... ... @@ -1,3 +1,5 @@
1 +Da Kerberos und NTLM jetzt im Einmalanmeldemenü zusammen sind, muss diese Seite in deutsch und englisch neu erstellt werden. Der Inhalt der beiden alten Seiten befindet sich erstmal noch hier:
2 +
1 1  {{content/}}
2 2  
3 3  {{figure image="FCSnapshot27.png"}}
... ... @@ -107,3 +107,197 @@
107 107  {{code}}
108 108  Example: ou="users", dc="example", dc="de"
109 109  {{/code}}
112 +
113 +
114 +
115 +== Settings for Kerberos authentication ==
116 +
117 +{{figure image="kerberos"}}
118 +User interface for editing the settings for Kerberos authentication. Available only when the license includes this option.
119 +{{/figure}}
120 +
121 +Kerberos can be used to authenticate form users. This is often used for internal forms meant only for the employees of a company. The data of the current user can be retrieved from an active directory as well.
122 +
123 +Kerberos authentication is available only when the license includes this option.
124 +
125 +=== Use Kerberos ===
126 +
127 +Activate this switch to enable Kerberos authentication.
128 +
129 +=== Synchronize with frontend server ===
130 +
131 +When activated, all changes to the configuration will be sent to all available {{fserver number="plural"/}}.
132 +
133 +=== Username ===
134 +
135 +The Window Domain account required for accessing the Key Distribution Center (KDC) and beginning the authentication process.
136 +
137 +Normally this is the user account of the active directory that is setup as a service account.
138 +
139 +{{info}}
140 +When no //default_realm// has been specified in the section //[libdefaults]// of the file //krb5.conf//, you will need to enter the username with a domain (FQDN).
141 +Example: user@EXCAMPLE.COM
142 +{{/info}}
143 +
144 +=== Password ===
145 +
146 +Password of the service account.
147 +
148 +=== File krb5.conf ===
149 +
150 +Enter the content of the file //krb5.conf//, ie. the configuration file for Kerberos.
151 +
152 +Among other settings, the available encryption methods, the current real and its mapping to a KDC should be set.
153 +
154 +==== File structure ====
155 +
156 +The file format is similar to Windows INI files. It contains of individual sections, introduced by their names in brackets. Each section may or may not contain several key-value pairs:
157 +
158 +{{code language="javascript" title=""}}
159 +foo = bar
160 +{{/code}}
161 +
162 +or
163 +
164 +{{code language="javascript" title=""}}
165 +foobar = {
166 + foo = bar
167 + some = input
168 +}
169 +{{/code}}
170 +
171 +==== Section names ====
172 +
173 +* {{litem title="[libdefaults]"}} Contains settings used by the Kerberos library v5.{{/litem}}
174 +* {{litem title="[realms]~}~} Realm-specific settings and contact information.{{/litem~}~}
175 +* {{litem title="}}A list of supported session key encryption methods that should be requested by the client when performing an AS (authentication server) request. The priority of each method is given by the order in which they have been specified, the first one being the method with the highest priority. Several methods can be separated with commas or spaces.{{/litem}}
176 +* ~{~{litem title="default_tgs_enctypes}}A list of supported session key encryption methods that should be requested by the client when performing a TGS (ticket granting server) request. The priority of each method is given by the order in which they have been specified, the first one being the method with the highest priority. Several methods can be separated with commas or spaces.~{~{/litem}}
177 +* {{litem title="permitted_enctypes"}}: A list of all allowed session key encryption methods.{{/litem}}
178 +
179 +A simple configuration for the //[libdefaults]// section might look as follows:
180 +
181 +{{code language="javascript" title=""}}
182 +[libdefaults]
183 + default_realm = EXAMPLE.COM
184 + default_tkt_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 des3-cbc-sha1 arcfour-hmac-md5 camellia256-cts-cmac camellia128-cts-cmac des-cbc-crc des-cbc-md5 des-cbc-md4
185 + default_tgs_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 des3-cbc-sha1 arcfour-hmac-md5 camellia256-cts-cmac camellia128-cts-cmac des-cbc-crc des-cbc-md5 des-cbc-md4
186 + permitted_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 des3-cbc-sha1 arcfour-hmac-md5 camellia256-cts-cmac camellia128-cts-cmac des-cbc-crc des-cbc-md5 des-cbc-md4
187 +{{/code}}
188 +
189 +===== [realms] =====
190 +
191 +Each key in the //[realms]// section represents the name of a Kerberos realm. The value is a list of mappings, defining the properties of each realm. The following properties can be set:
192 +
193 +* kdc: The name or address of a server running a KDC (key distribution center) for this realm, usually the server with the active directory. When necessary, the port number can be specified by appending it separated by a column.
194 +
195 +A simple configuration for the //[realms]// section might look as follows:
196 +
197 +{{code language="javascript" title=""}}
198 +[realms]
199 + EXAMPLE.COM = {
200 + kdc = domain.example.com
201 + }
202 +{{/code}}
203 +
204 +===== [domain_realm] =====
205 +
206 +The section //[domain_realm]// contains a mapping from domain names or host names to Kerberos realm names. The key can be a host or domain name, but domain names must be prefixed with a period. The value must be the name of a Kerberos realm for this host or domain. Host and domain names should be spelled with lower case letters.
207 +
208 +A simple configuration for the //[domain_realm]// section might look as follows:
209 +
210 +{{code language="javascript" title=""}}
211 +[domain_realm]
212 + .example.com = EXAMPLE.COM
213 +{{/code}}
214 +
215 +=== File login.conf ===
216 +
217 +The content of the file //login.conf//, which contains login-related settings such as the authentication method between clients and servers.
218 +
219 +A sample configuration might look as follows:
220 +
221 +{{code language="java" title=""}}
222 +spnego-client {
223 + com.sun.security.auth.module.Krb5LoginModule required;
224 +};
225 +
226 +spnego-server {
227 + com.sun.security.auth.module.Krb5LoginModule required
228 + refreshKrb5Config=true
229 + storeKey=true
230 + isInitiator=false;
231 +};
232 +{{/code}}
233 +
234 +=== Client module name ===
235 +
236 +The name in the //login.conf// file for the client to be used, eg. {{code}}spnego-client{{/code}}.
237 +
238 +=== Server module name ===
239 +
240 +The name in the //login.conf// file for the server to be used, eg. {{code}}spnego-server{{/code}}.
241 +
242 +{{error}}
243 +When you keep getting a HTTP 400 error with Kerberos activated, the most likely cause is that the HTTP header size of the Kerberos ticket exceeds the default header size limit of the application server, eg. Tomcat of JBoss. See the help pages on [[changing the HTTP header size limit>>doc:Main.Beschraenkung der HTTP-Header-Groesse aendern]].
244 +{{/error}}
245 +
246 +== LDAP user search ==
247 +
248 +The following settings are required to retrieve information about the authenticated user from an LDAP (MS active directory). This data is then available in the form and can be accessed by JavaScript code.
249 +
250 +=== Domain controller host ===
251 +
252 +FQN (fully qualified name) and port of the active directory controller.
253 +
254 +Example: {{code}}domain.example.com Port: 389{{/code}}
255 +
256 +=== SSL connection ===
257 +
258 +When activated, all communications with the LDAP server will be encrypted with SSL.
259 +
260 +=== Referral hops ===
261 +
262 +The maximum number of referral hops that may be performed on the LDAP server. Setting this to {{code}}0{{/code}} deactivates referral hops and no references will be followed.
263 +
264 +=== User account (with domain) ===
265 +
266 +This account must have been granted permission to send search queries to the active directory.
267 +
268 +{{info}}
269 +This needs to be a username suffixed with the domain.
270 +Example: {{code}}user@EXCAMPLE.COM{{/code}}
271 +{{/info}}
272 +
273 +=== User account password ===
274 +
275 +Password for the user account.
276 +
277 +=== Base DN for user lookup ===
278 +
279 +The LDAP baseDN used for looking up the authenticated user.
280 +
281 +Example: {{code}}ou="intern", dc="example", dc="com"{{/code}}
282 +
283 +== Make user data available to forms ==
284 +
285 +The LDAP user data for the currently authenticated user are stored in the JavaScript object {{code}}window.XFC_METADATA.currentUser.ldap{{/code}} and can be accessed via JavaScript.
286 +
287 +{{info}}
288 +The user data that will be retrieved for the current user depends on the (read) permissions of the user account used for the LDAP user lookup.
289 +{{/info}}
290 +
291 +{{panel title="Example"}}
292 +
293 +To access the property //userPrincipalName// of the user from JavaScript, use the following code:
294 +
295 +{{code language="javascript" title=""}}
296 +try {
297 + // Auslesen der Property und Anzeige in einem Label
298 + var elem = $('[name=txt1]');
299 + var ldap = XFC_METADATA.currentUser.ldap;
300 + if(ldap.hasOwnProperty('userPrincipalName')) {
301 + elem.append(ldap.userPrincipalName);
302 + }
303 +} catch (err) {}
304 +{{/code}}
305 +{{/panel}}

Navigation

Copyright 2000-2024