Este conteúdo não está disponível no idioma selecionado.

25.11. Active Directory Authentication Using Kerberos (GSSAPI)


When using Red Hat JBoss Data Grid with Microsoft Active Directory, data security can be enabled via Kerberos authentication. To configure Kerberos authentication for Microsoft Active Directory, use the following procedure.

Procedure 25.7. Configure Kerberos Authentication for Active Directory (Library Mode)

  1. Configure JBoss EAP server to authenticate itself to Kerberos. This can be done by configuring a dedicated security domain, for example:
    <security-domain name="ldap-service" cache-type="default">
        <authentication>
            <login-module code="Kerberos" flag="required">
                <module-option name="storeKey" value="true"/>
                <module-option name="useKeyTab" value="true"/>
                <module-option name="refreshKrb5Config" value="true"/>
                <module-option name="principal" value="ldap/localhost@INFINISPAN.ORG"/>
                <module-option name="keyTab" value="${basedir}/keytab/ldap.keytab"/>
                <module-option name="doNotPrompt" value="true"/>
            </login-module>
        </authentication>
    </security-domain>
    Copy to Clipboard Toggle word wrap
  2. The security domain for authentication must be configured correctly for JBoss EAP, an application must have a valid Kerberos ticket. To initiate the Kerberos ticket, you must reference another security domain using
    <module-option name="usernamePasswordDomain" value="krb-admin"/>
    Copy to Clipboard Toggle word wrap
    . This points to the standard Kerberos login module described in Step 3.
    <security-domain name="ispn-admin" cache-type="default">
        <authentication>
            <login-module code="SPNEGO" flag="requisite">
                <module-option name="password-stacking" value="useFirstPass"/>
                <module-option name="serverSecurityDomain" value="ldap-service"/>
                <module-option name="usernamePasswordDomain" value="krb-admin"/>
            </login-module>
            <login-module code="AdvancedAdLdap" flag="required">
                <module-option name="password-stacking" value="useFirstPass"/>
                <module-option name="bindAuthentication" value="GSSAPI"/>
                <module-option name="jaasSecurityDomain" value="ldap-service"/>
                <module-option name="java.naming.provider.url" value="ldap://localhost:389"/>
                <module-option name="baseCtxDN" value="ou=People,dc=infinispan,dc=org"/>
                <module-option name="baseFilter" value="(krb5PrincipalName={0})"/>
                <module-option name="rolesCtxDN" value="ou=Roles,dc=infinispan,dc=org"/>
                <module-option name="roleFilter" value="(member={1})"/>
                <module-option name="roleAttributeID" value="cn"/>
            </login-module>
        </authentication>
    </security-domain>
    Copy to Clipboard Toggle word wrap
  3. The security domain authentication configuration described in the previous step points to the following standard Kerberos login module:
    <security-domain name="krb-admin" cache-type="default">
        <authentication>
            <login-module code="Kerberos" flag="required">
                <module-option name="useKeyTab" value="true"/>
                <module-option name="principal" value="admin@INFINISPAN.ORG"/>
                <module-option name="keyTab" value="${basedir}/keytab/admin.keytab"/>
            </login-module>
        </authentication>
    </security-domain>
    Copy to Clipboard Toggle word wrap
Voltar ao topo
Red Hat logoGithubredditYoutubeTwitter

Aprender

Experimente, compre e venda

Comunidades

Sobre a documentação da Red Hat

Ajudamos os usuários da Red Hat a inovar e atingir seus objetivos com nossos produtos e serviços com conteúdo em que podem confiar. Explore nossas atualizações recentes.

Tornando o open source mais inclusivo

A Red Hat está comprometida em substituir a linguagem problemática em nosso código, documentação e propriedades da web. Para mais detalhes veja o Blog da Red Hat.

Sobre a Red Hat

Fornecemos soluções robustas que facilitam o trabalho das empresas em plataformas e ambientes, desde o data center principal até a borda da rede.

Theme

© 2025 Red Hat