<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Hi Kevin,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I am looking through my notes from the fall of 2016.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I definitely used
<a href="http://www.grolmsnet.de/kerbtut/">http://www.grolmsnet.de/kerbtut/</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">But, I also have references to<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Create a keytab file:
<a href="http://www.itadmintools.com/2011/07/creating-kerberos-keytab-files.html">
http://www.itadmintools.com/2011/07/creating-kerberos-keytab-files.html</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><a href="https://blogs.oracle.com/wangwj/entry/kerberos_programming_on_windows">https://blogs.oracle.com/wangwj/entry/kerberos_programming_on_windows</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">setspn:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">https://social.technet.microsoft.com/Forums/windowsserver/en-US/9341da1a-1491-4d56-b986-39c8b1b000da/domain-admin-unable-to-create-assign-spns?forum=windowsserver2008r2general<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">https://technet.microsoft.com/en-us/library/cc731241(WS.10).aspx#BKMK_Del<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">----- John Volmer, 630.252.5449,
<a href="mailto:volmer@anl.gov"><span style="color:#0563C1">volmer@anl.gov</span></a> -----<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users <users-bounces@shibboleth.net>
<b>On Behalf Of </b>Kevin B<br>
<b>Sent:</b> Wednesday, September 5, 2018 12:44 PM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> Re: Shibboleth in Active Directory<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Thank you for the replies. Can you tell me was it necessary to alter the auth that the workstations used to authenticate to the DC to get true SSO with the IdP?<o:p></o:p></p>
<div>
<p class="MsoNormal">The two articles for tutorials are quite different so I wasn't sure which were needed if not both:<o:p></o:p></p>
</div>
<div>
<p style="mso-margin-top-alt:7.5pt;margin-right:0in;margin-bottom:0in;margin-left:0in;margin-bottom:.0001pt">
<span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#172B4D">To use the authn/SPNEGO login flow, it is necessary to have the Kerberos environment configured and working properly.<o:p></o:p></span></p>
<p style="mso-margin-top-alt:7.5pt;margin-right:0in;margin-bottom:0in;margin-left:0in;margin-bottom:.0001pt">
<span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#172B4D">Some interesting tutorials that may help are:<o:p></o:p></span></p>
<p style="mso-margin-top-alt:7.5pt;margin-right:0in;margin-bottom:0in;margin-left:0in;margin-bottom:.0001pt">
<span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#172B4D"><a href="http://www.grolmsnet.de/kerbtut/"><span style="color:#3260BA">http://www.grolmsnet.de/kerbtut/</span></a><o:p></o:p></span></p>
<p style="mso-margin-top-alt:7.5pt;margin-right:0in;margin-bottom:0in;margin-left:0in;margin-bottom:.0001pt">
<span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif;color:#172B4D"><a href="http://msdn.microsoft.com/en-us/library/ms995329#http-sso-1_topic3"><span style="color:#3260BA">HTTP-Based Cross-Platform Authentication by Using the Negotiate Protocol</span></a>.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Wed, Sep 5, 2018 at 1:30 PM Volmer, John A. <<a href="mailto:volmer@anl.gov">volmer@anl.gov</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal">We have used Rod's approach below at ANL.<br>
<br>
----- John Volmer, 630.252.5449, <a href="mailto:volmer@anl.gov" target="_blank">
volmer@anl.gov</a> -----<br>
<br>
-----Original Message-----<br>
From: users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>> On Behalf Of Rod Widdowson<br>
Sent: Wednesday, September 5, 2018 8:23 AM<br>
To: 'Shib Users' <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
Subject: RE: Shibboleth in Active Directory<br>
<br>
Does <br>
<a href="https://wiki.shibboleth.net/confluence/display/IDP30/SPNEGOAuthnConfiguration" target="_blank">https://wiki.shibboleth.net/confluence/display/IDP30/SPNEGOAuthnConfiguration</a><br>
help?<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" target="_blank">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" target="_blank">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><o:p></o:p></p>
</blockquote>
</div>
</div>
</body>
</html>