System Requirements for SSO with Microsoft Clients Single Sign-On with Microsoft Clients: Main Steps

6-2 Securing Oracle WebLogic Server

6.2 System Requirements for SSO with Microsoft Clients

To use SSO with Microsoft clients you need: A host computer with: ■ Windows 2000 or later installed ■ Fully-configured Active Directory authentication service. Specific Active Directory requirements include: – User accounts for mapping Kerberos services – Service Principal Names SPNs for those accounts – Key tab files created and copied to the start-up directory in the WebLogic domain ■ WebLogic Server installed and configured properly to authenticate through Kerberos, as described in this chapter Client systems with: ■ Windows 2000 Professional SP2 or later installed ■ One of the following types of clients: – A properly configured Internet Explorer browser. Internet Explorer 6.01 or later is supported. – .NET Framework 1.1 and a properly configured Web service client. Clients must be logged on to a Windows 2000 domain and have Kerberos credentials acquired from the Active Directory server in the domain. Local logins will not work.

6.3 Single Sign-On with Microsoft Clients: Main Steps

Configuring SSO with Microsoft clients requires set-up procedures in the Microsoft Active Directory, the client, and the WebLogic domain. These procedures are detailed in the sections that follow. ■ Define a principal in Active Directory to represent the WebLogic Server. The Kerberos protocol uses the Active Directory server in the Microsoft domain to store the necessary security information. ■ Any Microsoft client you want to access in the Microsoft domain must be set up to use Windows Integrated authentication, sending a Kerberos ticket when available. ■ In the security realm of the WebLogic domain, configure a Negotiate Identity Assertion provider. The Web application or Web service used in SSO needs to have authentication set in a specific manner. A JAAS login file that defines the location of the Kerberos identification for WebLogic Server must be created. To configure SSO with Microsoft clients: 1. Configure your network domain to use Kerberos. See Section 6.4, Configuring Your Network Domain to Use Kerberos. 2. Create a Kerberos identification for WebLogic Server. a. Create a user account in the Active Directory for the host on which WebLogic Server is running. b. Create a Service Principal Name for this account. Configuring Single Sign-On with Microsoft Clients 6-3 c. Create a user mapping and keytab file for this account. See Section 6.5, Creating a Kerberos Identification for WebLogic Server. 3. Choose a Microsoft client either a Web service or a browser and configure it to use Windows Integrated authentication. See Section 6.6, Configuring Microsoft Clients to Use Windows Integrated Authentication. 4. Set up the WebLogic domain to use Kerberos authentication. a. Create a JAAS login file that points to the Active Directory server in the Microsoft domain and the keytab file created in Step 1. See Section 6.7, Creating a JAAS Login File. b. Configure a Negotiate Identity Assertion provider in the WebLogic Server security realm. See Section 5.9.3, Configuring a Negotiate Identity Assertion Provider. 5. Start WebLogic Server using specific start-up arguments. See Section 6.9, Using Startup Arguments for Kerberos Authentication with WebLogic Server. The following sections describe these steps in detail.

6.4 Configuring Your Network Domain to Use Kerberos