Using Kerberos 5 keytab to authenticate LDAP resolver with 3.2.1

[Simon Lundström]

Hi David!

I can't remember that I changed anything when porting our LDAPS + GSSAPI
config from 2.x to 3.x. See our config below yours:

On Wed, 2016-02-03 at 12:49:24 +0000, King, David wrote:
> […]
> My current 3.2.1 test configuration is has the following in attribute-resolver:
> 
>     <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
>         ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
>         baseDN="%{idp.attribute.resolver.LDAP.baseDN}"
>         authenticationType="GSSAPI" >
>         <dc:FilterTemplate>
>             <![CDATA[
>                 %{idp.attribute.resolver.LDAP.searchFilter}
>             ]]>
>         </dc:FilterTemplate>
>         <dc:StartTLSTrustCredential id="LDAPtoIdPCredential" xsi:type="sec:X509ResourceBacked">
>             <sec:Certificate>%{idp.attribute.resolver.LDAP.trustCertificates}</sec:Certificate>
>         </dc:StartTLSTrustCredential>
>     </resolver:DataConnector>

  <resolver:DataConnector id="suLDAP" xsi:type="LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc"
                          ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
                          baseDN=""
                          principal="uid=%{su.idp.principal},dc=it,dc=su,dc=se"
                          principalCredential="bar"
                          authenticationType="GSSAPI"
                          >
[…]

    <StartTLSTrustCredential id="IdPtoLDAPCredential" xsi:type="sec:X509ResourceBacked">
      <sec:Certificate>%{idp.attribute.resolver.LDAP.trustCertificates}</sec:Certificate>
    </StartTLSTrustCredential>

  </resolver:DataConnector>

> And I have modified the Jetty start.ini to include:
> 
> -Djava.security.auth.login.config=/usr/local/shibboleth-idp/conf/login.config

We use Tomcat but AFAIK that doesn't matter:
  JAVA_OPTS+=" -Djavax.security.auth.useSubjectCredsOnly=false "
  JAVA_OPTS+=" -Djava.security.auth.login.config=$BASEDIR/idp/conf/jaas.config "

>From <http://docs.oracle.com/javase/7/docs/technotes/guides/security/jgss/tutorials/Troubleshooting.html>
it looks like useSubjectCredsOnly is what you need. I'll provide
everything else for completeness.

> That login.config contains:
> 
> com.sun.security.jgss.initiate {
>    com.sun.security.auth.module.Krb5LoginModule required
>       useTicketCache="true"
>       ticketCache="/tmp/krb5cc_idp_ldap"
>       renewTGT="true"
>       useKeyTab="true"
>       keyTab="/opt/shibboleth-idp/credentials/shib-user-instance.keytab "
>       principal="shib-user/instance at bu.edu"
>       foobar="true"
>       doNotPrompt="true";
> };
> 
> ldaptive {
>    com.sun.security.auth.module.Krb5LoginModule required
>       useTicketCache="true"
>       ticketCache="/tmp/krb5cc_idp_ldap"
>       renewTGT="true"
>       useKeyTab="true"
>       keyTab="/opt/shibboleth-idp/credentials/shib-user-instance.keytab"
>       principal="shib-user/instance at bu.edu"
>       foobar="true"
>       doNotPrompt="true";
> };

com.sun.security.jgss.initiate {
  com.sun.security.auth.module.Krb5LoginModule required
    doNotPrompt=true
    keyTab="/etc/krb5.keytab-su-shib-test"
    principal="su-shib-test at SU.SE"
    storeKey=true
    useKeyTab=true
    ;
};

BR,
- Simon

____________________________________

Simon Lundström
Section for Infrastructure

IT Services
Stockholm University
SE-106 91 Stockholm, Sweden

www.su.se/english/staff-info/it