Red Hat Summit Red Hat SummitApoyoConsolaDesarrolladoresIniciar una pruebaContacto

Este contenido no está disponible en el idioma seleccionado.

Chapter 5. Configuring Microsoft Active Directory

Important

The domain details in this chapter differ from the domain details used in the rest of this guide.
To configure Active Directory to authenticate user through JBoss Negotiation you need to do the following:
  • Create a server user account and configure it as a Service Principal Name (SPN) account: the user of the Service Principal Name account (SPN account) acts as a connection between the Kerberos server, the Active Directory and the JBoss web server.
  • Generate a keytab file for the server user and export it to the application server. The application server uses the keytab to authenticate to KDC in AD.

Important

Make sure you are using an Active Directory domain controller. It is not possible to use a Windows machine with accounts managed locally.

Warning

Instructions in this guide apply to Windows 2003 and may differ from the instructions relevant for your Windows operating system.

5.1. User Account for the Application Server
Copiar enlace

To configure an SPN account for the application server on the AD domain controller, you need Setspn and Ktpass. The command line utilities are part of Windows Server 2003 Support Tools and serve for mapping the server user name to the application server and its HTTP service.
The utilities are available on Microsoft web pages.
You need to create a regular user account for the server in the AD domain (make sure it is a user account, not a computer account) and map the account to the service account.

5.1.1. Creating Server User
Copiar enlace

To create a new user for the server, do the following:
  1. Go to Start Administrative Tools Active Directory Users and Computers
  2. In the Active Directory Users and Computers window, go to Action New User
    New User
    View larger image
    New User

    Figure 5.1. New User

  3. In the New User window, enter the user details and click Next. Figure 5.1, “New User” uses the server @vm104.gsslab.rdu.redhat.com and defines a user called testserver.
  4. Enter the password for the user and select the User cannot change password and Password never expires.

    Important

    Make sure you have entered a valid password as changing the password later can invalidate the keytab file and break your JBoss installations.
    New User Password
    View larger image
    New User Password

    Figure 5.2. New User Password

  5. Click Next and Finish.
    New User Finish
    View larger image
    New User Finish

    Figure 5.3. New User Finish

  6. In the Active Directory Users and Computers window, right-click the user and click Properties.
  7. In the user properties window, click the Account tab and make sure the Do not require Kerberos preauthentication and Use DES encryption types for this account are selected under Account Options.
    User Properties
    View larger image
    User Properties

    Figure 5.4. User Properties

Now you need to create and export the keytab file for the created user.
Volver arriba
Red Hat logoGithubredditYoutubeTwitter

Aprender

Pruebe, compre y venda

Comunidades

Acerca de la documentación de Red Hat

Ayudamos a los usuarios de Red Hat a innovar y alcanzar sus objetivos con nuestros productos y servicios con contenido en el que pueden confiar. Explore nuestras recientes actualizaciones.

Hacer que el código abierto sea más inclusivo

Red Hat se compromete a reemplazar el lenguaje problemático en nuestro código, documentación y propiedades web. Para más detalles, consulte el Blog de Red Hat.

Acerca de Red Hat

Ofrecemos soluciones reforzadas que facilitan a las empresas trabajar en plataformas y entornos, desde el centro de datos central hasta el perímetro de la red.

Theme

© 2025 Red Hat