Howto SSO from remote ejb client via kerberos authentication (EAP 6.4)

[henrikdeluxe]

Hi,

i've read EAP 6.4 supports kerberos authentication form remote ejb clients. (lookup via remote jndi)

Actually i have a working application containing an remote ejb client, lookup ejb via remote jndi, acess secured ejb, authenticate via custom LDAP Login.

Now i want to realize a SSO for the remote ejb client, using kerberos.

I've tried a lot, but i have no idea how to configure my system to get it work.

The only thing i got working was the client to retrieve the ticket from ticketCache and localy authorize against the kdc.

When trying to get authorized acces to secured ejb i only get a message like this: "...all mechanisms has failed ..." while on the server side no loginmodule has ever worked.

Is there any how to or quickstart example for this new feature?

thanks for helping me

[lylewang]

>> Actually i have a working application containing an remote ejb client, lookup ejb via remote jndi, acess secured ejb, authenticate via custom LDAP Login.

Looks like you have a working ejb client accessing secured ejb (custom login module) on hand already ?

Now you just need to change that to use kerberos ?

I've never tried these and I'm not a security person at all, but this doc looks promising:

https://access.redhat.com/beta/documentation/en/red-hat-jboss-enterprise-application-platform-64-how-to-setup-sso-with-kerberos#how_to_setup_sso_for_jboss_enterprise_application_platform_6_with_kerberos

It talks about how to setup kerberos based security domain / login module and use it to secure a web app.

Now the only difference is you're going to use same login module to secure your EJB, not web app...  if I'm reading correctly...?

[henrikdeluxe]

i tried this a long time but at the end i dont get it working

does anyone have a working example project what could be shared her?

thank you in advance