Page Comparison

Integrated Windows Authentication (IWA) is a popular authentication mechanism that is used to authenticate users in Microsoft Windows servers. It uses Negotiate/Kerberos or NTLM to authenticate users based on an encrypted ticket/message passed between a browser and a server. Follow the instructions in the sections below to configure IWA for local or federated authentication in WSO2 Identity Server (IS). 

...

1. Add a DNS host entry in the Active Directory (AD) to map the IP address of the WSO2 Identity Server to a hostname. If there are multiple kerberos domains, WSO2 IS should have a virtual host name for each kerberos domain.

   Info
   When adding the DNS entry, generally the first part of the hostname is given. The AD will append the rest with it's AD domain. For example, if the AD domain is wso2.com, after you add a DNS host entry, the final result will be similiar to the following: Code Block title Example idp.wso2.com NOTE: Kerberos does not work with IP addresses, it relies on domain names and correct DNS entries only.

2. Open the carbon.xml file found in the <IS_HOME>/repository/conf folder and set the hostname (idp.wso2.com) in the <HostName> tag. 

   Code Block
   language xml
   <HostName>idp.wso2.com</HostName> <MgtHostName>idp.wso2.com</MgtHostName>\

3. Open the jaas.conf file found in the <IS_HOME>/repository/conf/identity folder and check if the configuration is as follows. (Refer this for more information on JAAS)

   Code Block
   Server { com.sun.security.auth.module.Krb5LoginModule required useKeyTab=false storeKey=true useTicketCache=false isInitiator=false; }; Client { com.sun.security.auth.module.Krb5LoginModule required useTicketCache=false; };

4. Register WSO2 IS using the same hostname (idp.wso2.com) in Active Directory. To do this, use the DNS tool on the machine that is running WSO2 IS to add an entry for the hostname (idp.is.local), and map it to the local ip address.

5. Create a service account in the Active Directory for WSO2 IS or use an existing account. (For this tutorial, the sample username of the service account is is_linux).

   Note
   Note: The account used for WSO2 IS needs to be different from the one used by the user to login to the application.

6. Run the following commands to register WSO2 IS as a service principal in Active Directory. 

   Note
   Note: Replace is_linux with the username of your service account in the command below. The format of the command is as follows: [setspn -A HTTP/<url of Identity Server> <service_account>]

   Code Block
   setspn -A HTTP/idp.wso2.com is_linux setspn -A HTTP/idp is_linux

...

Configuring WSO2 IS with IWA as a local or federated authenticator

Follow the steps above to set up IWA. 

1. Start the WSO2 IS server and login to andloginto the management console.
2. Navigate to Main>Identity Providers and click Add. Enter a name for the identity provider. 
3. Expand the Federated Authenticators section and then expand IWA Federated Configuration. 

4. Fill in the fields as follows:

   Field	Description	Sample Value
   Enable	Enable this Enablethis to enable a custom authenticator for the identity provider.	Selected
   Server Principal Name	The SPNName should be the SPN you registered in step 6 of Setting up IWA, with the Active Directory domain. The SPNName follows this format: Code Block language bash <service class>/<host>@<AD domain> For example, If the SPN is HTTP/idp.wso2.com, where HTTP is a service class (in this case, HTTP is not the standard protocol; it is the service class) and IS.wso2.com is the Active Directory domain, the SPNName will be HTTP/idp.wso2.com@wso2.com	HTTP/idp.wso2.com@wso2.com
   Server Principal Password	The SPNPassword should be the password of the service account associated with the SPN (the service account created in step 6 of Setting up IWA).	-
   User store domains	[Mandatory only if you want to use IWA as a local authenticator] The mounted user stores in which you want the user’s existence to be checked in. To configure IWA as a local authenticator, mount the user store domain names of the relevant user stores that you expect the user to be in. To configure IWA as a federated authenticator, leave this field blank.	PRIMARY

   Panel
   Localtabgroup Localtab active true title IWA as a Local Authenticator Localtab title IWA as a Federated Authenticator

5. Configure your browser to support Kerberos and NTLM. For more information on how to do this, see the following article.  The tabs below explain how to configure each browser.

   Panel

   Localtabgroup Localtab active true title for Firefox 1. Type about:config in the address bar, ignore the warning and continue, this will display the advanced settings of Firefox. 2. In the search bar, search for the key "network.negotiate-auth.trusted-uris. Image Added 3. Add the WSO2 Identity Server URL and click OK. Image Added Localtab title for Internet Explorer/Chrome 1. Go to Tools ->Internet Options. 2. In the “security” tab select local intranet. Image Added 3. Click the Sites button. Then add the URL of WSO2 Identity Server there. Image Added Chrome simply inherits the settings from Internet Explorer. So you don’t have to configure anything additionally.

Testing the IWA authenticator

1. Set up IWA as a local authenticator or as a federated authenticator by following the steps above. 

2. Download and set up the travelocity Travelocity sample application. To do this, follow the instructions on the Configuring Single Sign-On page. 

3. Edit the service provider you created for the travelocity Travelocity sample, and expand the Local and Outbound Authentication section. 

4. Select Federated Authentication as the Authentication Type and select the identity provider you created above.
   
5. Restart the Apache Tomcat server and run the travelocity Travelocity sample application from a Windows machine.