Java Kerberos System User Guide
1
Java Kerberos version 1.1
Installing, Configuring and Running Java Kerberos System
Bojan Pajkovski
Autumn 2005
Contents
1 Introduction 2
2 Java Kerberos System 2
3 Getting Started 3
4 Configuring the KDC 3
4.1 KDC Configuration File (kdc.conf)
3
4.2 Java Security Policy File (.java.policy)
4
5 Configuring the Kerberos Clients and Application Servers 4
6 Configuring the Kerberos Database 5
6.1 Configuring and Running the Admin Server
6
7 Running the Java Kerberos System 8
7.1 Run KDC Services
8
7.2 Run Demo Application Servers
8
7.3 Run Kerberos Clients
9
7.3.1 Communicating with the KDC
10
7.3.2 Communicating with the Application Servers
13
8 Developer’s Guide 15
Java Kerberos System User Guide
2
1. Introduction
This document describes a step-by-step guide to software installation of the Java
Kerberos System in both Linux and Windows environments. It is assumed that the reader
has basic knowledge of Kerberos, including what it is and what is its purpose.
2. Java Kerberos System
The Java Kerberos System consists of three different components: a Key Distribution
Center (KDC), Kerberos Client(s) and Application Server(s). The KDC represents the
heart of the Kerberos system. It maintains a database of Kerberos Clients and Application
Servers within its realm, as well as it issues Kerberos Ticket Granting Tickets (TGT) to
its clients. It consists of an Authentication Server (AS) and a Ticket Granting Server
(TGS), which are both running on the same machine, whereas the Kerberos Client(s) and
the Application Server(s) could be distributed across the network. The architecture of the
Java Kerberos System is presented on Figure 1.
Java Kerberos System User Guide
3
3. Getting Started
Download the Kerberos ZIP-file from:
http://www.imm.dtu.dk/~cdj/JavaKerberos/krb5-1.1.zip
Unzip the files into the destination directory, normally your home directory.
Example (UNIX):
cd $HOME
wget http://www.imm.dtu.dk/~cdj/krb5-1.1.zip
unzip krb5-1.1.zip
Example (Windows 2000/XP):
cd C:\Documents and Settings\user name
start http://www.imm.dtu.dk/~cdj/krb5-1.1.zip
unzip krb5-1.1.zip
The released kerberos package contains the following files:
4. Configuring the KDC
Before starting the KDC, you need edit the
kdc.conf. This configuration file is only
used by the machine where the KDC is to be started.
4.1. KDC Configuration File (kdc.conf)
The
kdc.conf file contains two stanzas. The first stanza, called kdcdefaults, contains
information about the default realm the KDC controls as well as the port numbers on
which the Authentication Server (AS) and the Ticket Granting Server (TGS) are listening
for requests. An example for such a stanza is the following:
[kdcdefaults]
default_realm = DTU.DK
as_port = 8081
tgs_port = 8081
krb5-1.1.jar
−
Kerberos core libraries
krb5db.xml
−
Kerberos database file
krb5db.dtd
−
Kerberos database file
admin.pwd
−
Kerberos database administrator password
kdc.conf
−
Kerberos Distribution Center configuration file
krb5.conf
−
Kerberos Client configuration file
server.keytab
−
Kerberos Application Server file
.java.policy
−
Java security policy
policy.socket
−
Java security policy
LICENSE
−
Software license
Java Kerberos System User Guide
4
The default_realm field is required so that the KDC works properly, whereas the as
port and tgs port are optional. In case the
as_port or tgs_port fields are omitted, port
number 88 will be used as default.
The second stanza is known as realms, and it contains information about the realms
administered by the KDC. This includes information about the attributes of the tickets
issued to kerberos clients as well as the possible encryption types. Most of the
information has reasonable defaults. However, in case you want to modify the maximum
lifetime and/or renew the lifetime of a ticket, you could write the stanza as follows:
[realms]
DTU.DK = {
max_life = 28800
max_rlife = 86400
}
The values of max_life and max_rlife are presented in seconds. Thus, in this
example, the realm’s maximum life of a ticket is set to 8 hours.
In this implementation of the KDC, only the
DES_CBC-MD5 encryption algorithm is
supported, since it is the only symmetric password-based encryption supported by the
JDK 1.5. Thus, any modification to the encryption type in this stanza will be omitted.
4.2. Java Security Policy File (.java.policy)
The user who runs the KDC on his/hers machine must add the
.java.policy file to
his/hers home directory. In addition, the typical contents in this file should include the
following lines:
grant {
permission java.security.AllPermission;
permission java.net.SocketPermission "*:1024-65535",
"accept, connect, listen, resolve";
};
5. Configuring the Kerberos Clients and Application Servers
The krb5.conf configuration file applies to all programs that use Kerberos, both clients
and application servers, and thus, it should be accessible from any host/machine where
Kerberos users might reside. This file contains information about the default realm as
well as the location of the KDC service.
The former stanza is knows as
libdefaults, and it contains general Kerberos defaults.
In this implementation version of Kerberos, all recommended values are set by default
except for the default realm. Therefore, you need specify the
default_realm value in a
similar way as it is shown in the following example:
[libdefaults]
default_realm = DTU.DK
Java Kerberos System User Guide
5
This stanza sets the default realm to DTU.DK. One should be aware that the realm name is
case-sensitive. Hence,
DTU.DK is different from dtu.dk.
The later stanza in the
krb5.conf file is realms, which gives information about how
to connect to the AS and TGS respectively for each realm. An example of a configuration
file containing the realms stanza is the following:
[realms]
DTU.DK = {
kdc = ebar032.ebar.dtu.dk
as_port = 8081
tgs_port = 8081
}
MYREALM.COM = {
kdc = 192.38.79.229
as_port = 8022
tgs_port = 8022
}
EXAMPLE.COM = {
kdc = kerberos.example.com
}
The
kdc field is very important for a Kerberos client and/or an application server, who
wants to communicate with the host/machine on which the KDC is running. As it is
shown in the above example, the value of the kdc filed could be either a host name (if the
KDC is running in the local area network), or an IP address (if the KDC is running in a
wide area network). Thus, it is essential for you to make sure that the value in the kdc
field is correct, before you start any KDC services.
NOTE: Strictly speaking, the
kdc name is not a formal Kerberos KDC name. Normally,
it should be of the form:
kdc = ebar032.dtu.dk
provided that there exist a host ebar032.dtu.dk, on which the KDC is running. However,
for the sake of simplicity, and due to limited experiment conditions for this project, it is
assumed that the all specified hosts on the realm
DTU.DK do exist.
6. Configuring the Kerberos Database
Before you configure the Kerberos database, you need to make sure that the two database
files,
krb5db.xml and krb5db.dtd (included in the kerberos software package), are
located in the
user_home\krb5 directory. After doing this, you should use the Kerberos
administration server in order to manage your Kerberos database.
- 1
- 2
- 3
前往页