Real World Guide to Setting up Kerberos
I was recently involved with the configuration of Kerberos with a customer and as I was reading about it in the documentation, I realized that there were a number of areas that lacked the clarity I needed to understand what information SAP BusinessObjects needed to know about my environment.
The Service Account
Permissions are one of the first areas that might trip you up. In my case I used the same user for the service account that you use for configuring the SIA and that has read access to Active Directory. It will simplify things for you. You should also make the service account a local admin on the Business Objects Enterprise Servers. The service should be a non-dialog user.
Step 1 – Create the SPN
As a Domain Admin, Create the SPN for all of your CMS Servers. You will need to create an SPN for the fully qualified domain name, as well as the short name. In my case I have two machines which are running a CMS on each. I will refer to these machines as cms1 and cms2.
Example:
SETSPN.exe -A BOBJCentralMS/cms1 serviceaccountname
SETSPN.exe -A BOBJCentralMS/cms1.mydomain.local serviceaccountname
SETSPN.exe -A BOBJCentralMS/cms2 serviceaccountname
SETSPN.exe -A BOBJCentralMS/cms2.mydomain.local serviceaccountname
(In the above example: host – cms1 and cms2, domain – mydomain.local, username - serviceaccountname)
Step 2 – Confirm the SPN
In the Windows Server Support tools you will find lfifde.exe. You can use this to application to confirm that the SPN has been correctly associated with the username.
Example:
ldifde -d "dc=mydomain,dc=local" -r "servicePrincipalName=BOBJCentralMS*" -p subtree -l "dn,servicePrincipalName" –f C:\ldifdeoutput.txt
When you run the command, you should see something like:
Connecting to "adc1.mydomain.local" Logging in as current user using SSPI Exporting directory to file C:\ldifdeoutput.txt Searching for entries... Writing out entries.. 1 entries exported
When you open C:\ldifdeoutput.txt, you should see something like:
dn: CN=mydomain\, serviceaccountname,OU=Service Accounts,OU=Accounts, DC=mydomain,DC=local changetype: add servicePrincipalName: BOBJCentralMS/cms1.mydomain.local servicePrincipalName: BOBJCentralMS/cms1 servicePrincipalName: BOBJCentralMS/cms2.mydomain.local servicePrincipalName: BOBJCentralMS/cms2
Important Note: Keep track of the way that serviceaccountname is spelled within the first line of C:\ldifdeoutput.txt. You will need to use it later and it IS case sensitive.
Step 3 – Create Files for Kerberos
On your CMS Servers (cms1 & cms2 in this example) create two files for Kerberos. The documentation indicates that you should be able to control the locations of the files using your java options. I was unable to get Kerberos to work unless they were in the default location of C:\WINNT, therefore I made a C:\WINNT directory for the files.
File 1: krb5.ini
[libdefaults]
default_realm = MYDOMAIN.LOCAL
dns_lookup_kdc = true
dns_lookup_realm = true
[realms]
MYDOMAIN.LOCAL = {
default_domain = MYDOMAIN.LOCAL
kdc = MYDOMAIN.LOCAL
}
NOTE: If you want to query a particular domain controller you should be able to specify it on the line kdc=, however if AD is set up correctly then your domain name should resolve to the nearest domain controller. You may want to check the configuration by typing “nslookup mydomain.local” at a command prompt.
File 2: bscLogin.conf
com.businessobjects.security.jgss.initiate {
com.sun.security.auth.module.Krb5LoginModule required debug=true;
};
Step 4 –Rights to the Service Account
Next we need to grant the Service Account rights to act as part of the operating system. These 7 steps walk you through the process.
- Click Start > Control Panel > Administrative Tools > Local Security Policy.
- Expand Local Policies, then click User Rights Assignment.
- Double-click Act as part of the operating system.
- Click Add.
- Enter the name of the service account you created, then click OK.
- Ensure that the Local Policy Setting check box is selected, and click OK.
- Repeat the above steps on each machine running a BusinessObjects Enterprise.
Step 5 – Testing Kerberos
We can now test Kerberos with the kinit.exe utility. An example of this command for a service account called servact would be:
C:\Program Files\Business Objects\javasdk\bin\kinit.exe servact@TESTM03.COM Password
Syntax Example:
<InstallDirectory>\Business Objects\javasdk\bin\kinit.exe serviceaccountname@MYDOMAIN.LOCAL password
IMPORTANT NOTE: If you still have a problem, ensure that the case you entered for your domain and service principal name match exactly with what is set in Active Directory. The easiest way to find the proper casing for the account is to look at the C:\ldifdeoutput.txt file we created in Step 2 – Confirm the SPN.
Step 6 – Configuring Active Directory
We can configure the Active Directory Plug-in within SAP BusinessObjects.
- Launch the CMC (http://yourserver:8080/CmcApp) and go to the Authentication section of the CMC (Central Management Console).
- Double-click on Windows AD
- Select “Enable” Windows AD
- Click the AD Administration Name.
- For the user enter the NTLM name…for example: MYDOMAIN\serviceaccountname
- For the password enter the password
- For the Default AD Domain Enter the full domain name in all caps: MYDOMAIN.LOCAL
- Click update.
- Add a Mapped AD Member Group by typing the group name in the box and clicking add…for example: MYDOMAIN\BOEUsers
- Under Authentication Options:
- Click Use Kerberos authentication and make sure the Cache Security Context is checked.
- For the Service Principal name enter the service account name with the casing exactly as it appears in the C:\ldifdeoutput.txt created in step 2 followed by an @ sign followed by the domain in all caps. EXAMPLE: serviceaccountname@MYDOMAIN.LOCAL
- Check the box that says Enable Single Sign on for selected authentication mode.
- Under AD Alias Options, configure the options here however are appropriate for your environment.
- Under Attribute Binding Options, we need to check both boxes
- Under AD Group Graph, configure as desired
- Under On-demand AD Update, configure as desired
- Click Update
Step 7 – Configuring Tomcat
Configure tomcat to use WinAD as the default Authentication mechanism for infoview:
- Open <Install Directory>\Tomcat55\webapps\InfoViewApp\WEB-INF\web.xml in your favorite text editor.
- Search for authentication.default and change the value to: secWinAD
- Use Central Configuration Manager (CCM) to restart Tomcat.
Conclusion
Please let me know if this guide was useful. Setting up Kerberos with SAP BusinessObjects can be tricky and it’s only when I hear from you that I know whether or not these posts are hitting the mark.
«Good BI»
Although I usually like to focus on tips and tricks for BusinessObjects software, I occassionally run across something that I which I had known a long time ago. As a BusinessObjects administrator how often have you mistyped the URL that takes you to InfoView? Wouldn’t it be nice if you just typed in the server name and it would take you to the InfoView login page? Well, the change is quite easy.
and attempting to calculate a ratio between two numbers and coming up with some strange results. I wanted to share this with you so you didn’t waste as much time as I did trying to solve the problem.
