Integrate CAS with AD in Windows

 

After several days of hard work, I finally passed the cas and ad integration verification last night. Summary of experience, around a lot of circles, this blog will directly provide the configuration process, the final implementation of verification passed.

First, a required domain controller, cas server, client, and application system are created, and all machines are added to the domain for backup. Here it should be noted that I use the domain controller windows2003, cas server version: cas-server-3.4.10-release, cas client Version: cas-client-3.2.1-release.

Then we need to implement cas sso. These two documents can guide the implementation of cas single-point Logon:

Http://www.ibm.com/developerworks/cn/opensource/os-cn-cas/

Http://www.wsria.com/archives/1349

After my verification, the method in the article is feasible. The in-depth configuration mainly involves how to configure the database. If you simply implement integration with the domain, you do not need to configure the database.

After cas sso is implemented, the cas part is ready. You must also prepare a domain environment. Because the domain environment configured this time is ready-made, the configuration scheme is not provided here.

After the domain is ready, the conditions are met, the following configuration can be referred to: http://jcbay.iteye.com/blog/708020

Note that,

 

Reference

C. Exit authenticationManager and add a tag bean in the outer layer: "jcifsConfig ":

<Bean name = "jcifsConfig" class = "org. jasig. cas. support. spnego. authentication. handler. support. JCIFSConfig">

<Property name = "jcifsServicePrincipal" value = "HTTP/your.server.name.here@YOUR.REALM.HERE"/>

<Property name = "jcifsServicePassword" value = "the. service. password. here"/>

<Property name = "kerberosDebug" value = "false"/>

<Property name = "kerberosRealm" value = "YOUR. REALM. HERE"/>

<Property name = "kerberosKdc" value = "THE. KDC. IP. HERE"/>

<Property name = "loginConf" value = "/path/to/WEB-INF/login. conf"/>

</Bean>

 

Here's the jcifsServicePrincipal parameter, value I'm not configured as: HTTP/your.server.name.here@YOUR.REALM.HERE, I changed to: HTTP/RainTime@YOUR.REALM.HERE, the front side of the HTTP/RainTime is:

 

Reference

2: create a user in Windows AD

A. Start domain user management: Start → Administrative Tools → Active ctor users and computers.

B. Create a user: Users → right-click → new → user.

C. Add the user information to be created, for example, "RainTime": "Last Name: RainTime; User Login Name: HTTP/RainTime; User Login Name (earlier than Windows 2000 ): rainTime ".

D. Enter the password and select "the password will never expire", for example, 111111.

E. Click OK to create the user.

"User Login Name" in ".

 

The authentication header cannot be found. Select Tools> Internet Options> advanced in the client IE browser, and enable integrated windows authentication (restart required. Solved this problem.

 

Then the checksum fails. This is an outrageous situation. The attributes of many ad controllers have been modified, finally, the integration is completed by right-clicking the user of the ad controller and selecting "properties"> "Account"> "account options"> "Kerberos pre-Authentication Not required.

 

Then I checked this box and integrated it. Even if all the previous modifications are restored, verification can still be performed to prove that the modification to this location has played a role. Although it is known that the underlying windows layer has done some things, but for the return on hard work for a few days, I sincerely say: True nerves, haha.

 

At last, XiaoYu's integration is on the windows platform. The official documents described above are on the linux platform. there are still differences between the two. In windows, you can obtain the required kerberos authentication information. You do not need to generate a keytab file on the ad controller. Therefore, you can directly configure the cas server. If you refer to the Standard Manual: https://wiki.jasig.org/display/casum/spnego, the keytabfile will be generated to test the part of the SPNs account. You can skip it and click Set up Cas.

 

Author Zhang XiaoYu