From aaf3c18a1b9bac627c1e980328d28bc6fe7d41d6 Mon Sep 17 00:00:00 2001 From: mposolda Date: Thu, 26 Feb 2015 20:34:51 +0100 Subject: [PATCH] Kerberos documentation --- docbook/reference/en/en-US/master.xml | 2 + .../reference/en/en-US/modules/kerberos.xml | 231 ++++++++++++++++++ .../en/en-US/modules/user-federation.xml | 8 + testsuite/integration/README.md | 50 +++- .../ldap/KerberosEmbeddedServer.java | 2 +- 5 files changed, 282 insertions(+), 11 deletions(-) create mode 100644 docbook/reference/en/en-US/modules/kerberos.xml diff --git a/docbook/reference/en/en-US/master.xml b/docbook/reference/en/en-US/master.xml index a2fbacb571..6bbd3010c9 100755 --- a/docbook/reference/en/en-US/master.xml +++ b/docbook/reference/en/en-US/master.xml @@ -32,6 +32,7 @@ + @@ -119,6 +120,7 @@ This one is short &AdminApi; &Events; &UserFederation; + &Kerberos; &ExportImport; &ServerCache; &SAML; diff --git a/docbook/reference/en/en-US/modules/kerberos.xml b/docbook/reference/en/en-US/modules/kerberos.xml new file mode 100644 index 0000000000..24b5d9baee --- /dev/null +++ b/docbook/reference/en/en-US/modules/kerberos.xml @@ -0,0 +1,231 @@ + + Kerberos brokering + + Keycloak supports login with Kerberos ticket through SPNEGO. SPNEGO (Simple and Protected GSSAPI Negotiation Mechanism) is used + to authenticate transparently through the web browser after the user has been authenticated when logging-in his session. + For non-web cases or when ticket is not available during login, Keycloak also supports login with Kerberos username/password. + + + A typical use case for web authentication is the following: + + + + User logs into his desktop (Such as a Windows machine in Active Directory domain or Linux machine with Kerberos integration enabled). + + + + + User then uses his browser (IE/Firefox/Chrome) to access a web application secured by Keycloak. + + + + + Application redirects to Keycloak login. + + + + + Keycloak sends HTML login screen together with status 401 and HTTP header WWW-Authenticate: Negotiate + + + + + In case that browser has Kerberos ticket from desktop login, it transfers the desktop sign on information to the + Keycloak in header Authorization: Negotiate 'spnego-token' . Otherwise it just displays login screen. + + + + + Keycloak validates token from browser and authenticate user. It provisions user data from LDAP (in case of + LDAPFederationProvider with Kerberos authentication support) or let user to update his profile and prefill data + (in case of KerberosFederationProvider). + + + + + Keycloak returns back to the application. Communication between Keycloak and application happens through OpenID + Connect or SAML messages. The fact that Keycloak was authenticated through Kerberos is hidden from the application. + So Keycloak acts as broker to Kerberos/SPNEGO login. + + + + + + For setup there are 3 main parts: + + + + Setup and configuration of Kerberos server (KDC) + + + + + Setup and configuration of Keycloak server + + + + + Setup and configuration of client machines + + + + +
+ Setup of Kerberos server + + This is platform dependent. Exact steps depend on your OS and the Kerberos vendor you're going to use. + Consult Windows Active Directory, MIT Kerberos and your OS documentation for how exactly to setup and configure Kerberos server. + + + At least you will need to: + + + + Add some user principals to your Kerberos database. You can also integrate your Kerberos with LDAP, + which means that user accounts will be provisioned from LDAP server. + + + + + Add service principal for "HTTP" service. For example if your Keycloak server will be running on + www.mydomain.org you may need to add principal HTTP/www.mydomain.org@MYDOMAIN.ORG + assuming that MYDOMAIN.ORG will be your Kerberos realm. + + + For example on MIT Kerberos you can run "kadmin" session. If you are on same machine where is MIT Kerberos, you can simply use command: + + Then add HTTP principal and export his key to keytab file with the commands like: + + Keytab file /tmp/http.keytab will need to be accessible on the host where keycloak server will be running. + + + + +
+
+ Setup and configuration of Keycloak server + + + + Install kerberos client. This is again platform dependent. If you are on Fedora, Ubuntu or RHEL, you can install package freeipa-client, + which contains Kerberos client and bunch of other stuff. + + + + + Configure kerberos client (on linux it's in file /etc/krb5.conf ). You need to put your Kerberos realm and at least + configure the Http domains your server will be running on. For the example realm MYDOMAIN.ORG you may configure domain_realm section like this: + + + + + + Export keytab file with HTTP principal and make sure the file is accessible to the process under which Keycloak + server is running. For production, it's ideal if it's readable just by this process and not by someone else. + For MIT Kerberos example above, we already exported keytab to /tmp/http.keytab . If your KDC and Keycloak + are running on same host, you have file already available. + + + + + Finally run Keycloak server and configure SPNEGO/Kerberos authentication in Keycloak admin console. Keycloak supports Kerberos authentication + through Federation provider SPI . We have 2 federation providers with Kerberos authentication support: + + + Kerberos + + + This provider is useful if you want to authenticate with Kerberos NOT backed by LDAP server. + In this case, users are usually created to Keycloak database after first successful SPNEGO/Kerberos login + and they may need to update profile after first login, as Kerberos protocol itself doesn't provision + any data like first name, last name or email. + + + You can also choose if users can authenticate with classic username/password. In this case, if user doesn't have SPNEGO ticket available, + Keycloak will display login screen and user can fill his Kerberos username and password on login screen. Username/password works also for non-web flows like + Direct Access grants. + + + + + LDAP + + + This provider is useful if you want to authenticate with Kerberos backed by LDAP server. + In this case, data about users are provisioned from LDAP server after successful Kerberos authentication. + + + + + + + +
+
+ Setup and configuration of client machines + + Clients need to install kerberos client and setup krb5.conf as described above. Additionally they need to enable SPNEGO login support in their browser. + See for example this + for more info about Firefox. URI .mydomain.org must be allowed in network.negotiate-auth.trusted-uris config option. + + + In windows domain, clients usually don't need to configure anything special as IE is already able to participate in SPNEGO authentication for the windows domain. + +
+
+ Example setups + + For easier testing with Kerberos, we provided some example setups to test. + +
+ Keycloak and FreeIPA docker image + + Once you install docker, you can run docker image with FreeIPA + server installed. FreeIPA provides integrated security solution with MIT Kerberos and 389 LDAP server among other things . The image provides + also Keycloak server configured with LDAP Federation provider and enabled SPNEGO/Kerberos authentication against the FreeIPA server. + See details here . + +
+
+ ApacheDS testing Kerberos server + + For quick testing and unit tests, we use very simple ApacheDS Kerberos server. + You need to build Keycloak from sources and then run Kerberos server with maven-exec-plugin from our testsuite. See details + here . + +
+
+
+ Troubleshooting + + If you have issues, we recommend to enable more logging by: + + + + Enable Debug flag in admin console for Kerberos or LDAP federation providers + + + + + Enable TRACE logging for category org.keycloak in logging section of $WILDFLY_HOME/standalone/configuration/standalone.xml + to receive more info $WILDFLY_HOME/standalone/log/server.log + + + + + Add system properties -Dsun.security.krb5.debug=true and -Dsun.security.spnego.debug=true + + + + +
+ \ No newline at end of file diff --git a/docbook/reference/en/en-US/modules/user-federation.xml b/docbook/reference/en/en-US/modules/user-federation.xml index 777f4b71fe..a8e6c17358 100755 --- a/docbook/reference/en/en-US/modules/user-federation.xml +++ b/docbook/reference/en/en-US/modules/user-federation.xml @@ -97,6 +97,14 @@ + + Allow Kerberos authentication + + + Enable Kerberos/SPNEGO authentication in realm with users data provisioned from LDAP. More info in Kerberos section. + + + Other options diff --git a/testsuite/integration/README.md b/testsuite/integration/README.md index a8d06711ce..f76392ed54 100644 --- a/testsuite/integration/README.md +++ b/testsuite/integration/README.md @@ -100,12 +100,12 @@ To start a ApacheDS based LDAP server for testing LDAP sending run: There are additional system properties you can use to configure (See EmbeddedServersFactory class for details). Once done, you can create LDAP Federation provider in Keycloak admin console with the settings like: -Vendor: Other -Connection URL: ldap://localhost:10389 -Base DN: dc=keycloak,dc=org -User DN Suffix: ou=People,dc=keycloak,dc=org -Bind DN: uid=admin,ou=system -Bind credential: secret +* Vendor: Other +* Connection URL: ldap://localhost:10389 +* Base DN: dc=keycloak,dc=org +* User DN Suffix: ou=People,dc=keycloak,dc=org +* Bind DN: uid=admin,ou=system +* Bind credential: secret Kerberos server --------------- @@ -114,10 +114,40 @@ To start a ApacheDS based Kerberos server for testing Kerberos + LDAP sending ru mvn exec:java -Pkerberos -There are additional system properties you can use to configure (See EmbeddedServersFactory class for details). Once done, you can create LDAP Federation provider -in Keycloak admin console with same settings like mentioned in previous LDAP section. And you can enable Kerberos with the settings like: +There are additional system properties you can use to configure (See EmbeddedServersFactory class for details) but for testing purposes default values should be good. +By default ApacheDS LDAP server will be running on localhost:10389 and Kerberos KDC on localhost:6088 . LDAP will import initial data from [src/main/resources/kerberos/users-kerberos.ldif](src/main/resources/kerberos/users-kerberos.ldif) . -Server Principal: HTTP/localhost@KEYCLOAK.ORG -KeyTab: $KEYCLOAK_SOURCES/testsuite/integration/src/main/resources/kerberos/http.keytab +Once kerberos is running, you can create LDAP Federation provider in Keycloak admin console with same settings like mentioned in previous LDAP section. +But additionally you can enable Kerberos authentication in LDAP provider with the settings like: + +* Kerberos realm: KEYCLOAK.ORG +* Server Principal: HTTP/localhost@KEYCLOAK.ORG +* KeyTab: $KEYCLOAK_SOURCES/testsuite/integration/src/main/resources/kerberos/http.keytab (Replace $KEYCLOAK_SOURCES with correct absolute path of your sources) + +Once you do this, you should also ensure that your Kerberos client configuration file is properly configured with KEYCLOAK.ORG domain. +See [src/main/resources/kerberos/test-krb5.conf](src/main/resources/kerberos/test-krb5.conf) for inspiration. The location of Kerberos configuration file +is platform dependent (In linux it's file `/etc/krb5.conf` ) + +Then you need to configure your browser to allow SPNEGO/Kerberos login from `localhost` . + +Exact steps are again browser dependent. For Firefox see for example [http://www.microhowto.info/howto/configure_firefox_to_authenticate_using_spnego_and_kerberos.html](http://www.microhowto.info/howto/configure_firefox_to_authenticate_using_spnego_and_kerberos.html) . +URI `localhost` must be allowed in `network.negotiate-auth.trusted-uris` config option. + +For Chrome, you just need to run the browser with command similar to this (more details in Chrome documentation): + +``` +/usr/bin/google-chrome-stable --auth-server-whitelist="localhost" +``` + + +Finally test the integration by retrieve kerberos ticket. In many OS you can achieve this by running command from CMD like: + +``` +kinit hnelson@KEYCLOAK.ORG +``` + +and provide password `secret` + +Now when you access `http://localhost:8081/auth/realms/master/account` you should be logged in automatically as user `hnelson` . diff --git a/testsuite/integration/src/main/java/org/keycloak/testutils/ldap/KerberosEmbeddedServer.java b/testsuite/integration/src/main/java/org/keycloak/testutils/ldap/KerberosEmbeddedServer.java index ff5b7791e1..527c9b3807 100644 --- a/testsuite/integration/src/main/java/org/keycloak/testutils/ldap/KerberosEmbeddedServer.java +++ b/testsuite/integration/src/main/java/org/keycloak/testutils/ldap/KerberosEmbeddedServer.java @@ -54,7 +54,7 @@ public class KerberosEmbeddedServer extends LDAPEmbeddedServer { public void init() throws Exception { super.init(); - log.info("Creating KDC server"); + log.info("Creating KDC server. kerberosRealm: " + kerberosRealm + ", kdcPort: " + kdcPort); createAndStartKdcServer(); }