Configuring IWA on Linux

Integrated Windows Authentication (IWA) is a popular authentication mechanism that is used to authenticate users in Microsoft Windows servers. It uses Negotiate/Kerberos or NTLM to authenticate users based on an encrypted ticket/message passed between a browser and a server. Follow the instructions in the sections below to configure IWA for local or federated authentication in WSO2 Identity Server (IS). 

How IWA with Kerberos works

Open

Open

Setting up IWA

1. Add a DNS host entry in the Active Directory (AD) to map the IP address of the WSO2 Identity Server to a hostname. If there are multiple Kerberos domains, WSO2 IS should have a virtual host name for each Kerberos domain.

2. Open the carbon.xml file found in the <IS_HOME>/repository/conf folder and set the hostname (idp.wso2.com) in the <HostName> tag. 

   <HostName>idp.wso2.com</HostName> <MgtHostName>idp.wso2.com</MgtHostName>\

3. Open the jaas.conf file found in the <IS_HOME>/repository/conf/identity folder and check if the configuration is as follows. (Refer this for more information on JAAS)

   Server { com.sun.security.auth.module.Krb5LoginModule required useKeyTab=false storeKey=true useTicketCache=false isInitiator=false; }; Client { com.sun.security.auth.module.Krb5LoginModule required useTicketCache=false; };

4. Register WSO2 IS using the same hostname (idp.wso2.com) in Active Directory. To do this, use the DNS tool on the machine that is running WSO2 IS to add an entry for the hostname (idp.is.local), and map it to the local IP address.

5. Create a service account in the Active Directory for WSO2 IS or use an existing account. (For this tutorial, the sample username of the service account is is_linux).

6. Run the following commands to register WSO2 IS as a service principal in Active Directory. 

   setspn -A HTTP/idp.wso2.com is_linux setspn -A HTTP/idp is_linux

You can now set up IWA either as a local authenticator or as a federated authenticator. 

Configuring WSO2 IS with IWA as a local or federated authenticator

1. Follow the steps above to set up IWA. 

2. Start the WSO2 IS server and log in to the management console.

3. Navigate to Main>Identity Providers and click Add. Enter a name for the identity provider. 

4. Expand the Federated Authenticators section and then expand IWA Federated Configuration. 

5. Fill in the fields as follows:

6. Configure your browser to support Kerberos and NTLM. The tabs below explain how to configure each browser. 

Testing the IWA authenticator

1. Set up IWA as a local authenticator or as a federated authenticator by following the steps above. 

2. Download and set up the Travelocity sample application. To do this, follow the instructions on the Configuring Single Sign-On page. 

3. Edit the service provider you created for the Travelocity sample, and expand the Local and Outbound Authentication section. 

4. Select Federated Authentication as the Authentication Type and select the identity provider you created above.

   Open

   

5. Restart the Apache Tomcat server and run the Travelocity sample application from a Windows machine.