...

Kerberos is a network authentication protocol designed by the Massachusetts Institute of Technology (MIT) for SSO in client-server environments, while SPNEGO (Simple and Protected GSS-API Negotiation Mechanism) extends Kerberos SSO to web applications. 

This plugin source code is available in a new open source repository at https://github.com/jogetoss/. JogetOSS is a community-led team for open source software related to the Joget no-code/low-code application platform. Projects under JogetOSS are community-driven and community-supported, and you are welcome to contribute to the projects.

Test EnvironmentTest Environment:

• Joget Server: Joget Workflow v5 Enterprise on Apache Tomcat 8 and Java 8

• Windows Server: Windows Server 2012 R2 Datacenter (running on VirtualBox within a NAT Network, downloaded from https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2012-r2)

• Windows Client PC: IE11 on Windows 10 (running on VirtualBox within a NAT Network, downloaded from https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/) 

Test Settings:

• Windows Server COMPUTER NAME is WIN-TKDH9LCHUUO 

• WINDOWS DOMAIN is windows.local

• DOMAIN USER is joget

• JOGET DOMAIN is joget.windows.local 

  
  

...

1. In PowerShell, execute: setspn -s HTTP/{JOGET DOMAIN} {DOMAIN USER} e.g. 

   Code Block
   setspn -s HTTP/JOGET.WINDOWS.LOCAL joget

In PowerShell, check that the SPN has been registered 

setspn -L joget

...

Registered ServicePrincipalNames for CN=Joget,CN=Users,DC=windows,DC=local:
         HTTP/JOGET.WINDOWS.LOCAL

2. Setup Joget Server for Kerberos

2.1 Add Windows Domain to Hosts File

1. Edit /etc/hosts (Linux or macOS) or C:\Windows\System32\drivers\etc\hosts (Windows) and add the server IP e.g. 

   Code Block
   192.168.56.102        windows.local win-tkdh9lchuuo win-tkdh9lchuuo.windows.local

   Info
   NOTE: This step is not required if the Joget Server is using the Windows Server as the DNS server.

...

2.2 Create Kerberos Identification (Keytab) File

Using Windows

1. In PowerShell on the Windows Server, generate a keytab file using the Ktpass tool: 

   Code Block
   ktpass -out joget.keytab -mapuser joget@WINDOWS.LOCAL  -pass Pass@word1  -crypto all -ptype KRB5_NT_PRINCIPAL  -princ HTTP/joget.windows.local@WINDOWS.LOCAL

   
   

2. Copy the generated joget.keytab file into the Joget server e.g. at C:\Joget-v5-Enterprise\wflow\joget.keytab

3. Java 8 may be required for the Kerberos authentication to work with the ktpass generated keytab. Download and install JDK 8, and edit the tomcat-run.bat startup script to update the JAVA_HOME path accordingly.

...

3.1 Upload Kerberos Directory Manager Plugin

1. Download the Kerberos the Kerberos Directory Manager plugin from the Joget Marketplace and upload it in Settings > Manage Plugins. 

   

...

1. In Settings > General Settings, set the API Domain Whitelist to * to allow SSO requests to the Kerberos Directory Manager. 

   

4. Setup Client PC for SSO

...

1. In IE, click on Internet Options > Security > Local intranet site > Advanced and add the Joget domain e.g. http://joget.windows.local  

4.3 Test the SSO

1. If using Using the Kerberos Directory Manager plugin approach, access http://joget.windows.local/jw/web/json/plugin/org.joget.plugin.kerberos.KerberosDirectoryManager/service to SSO.

2. If using the Spring Security Kerberos Extension approach, access http://joget.windows.local/jw/web/sso to SSO.

    

3. Info

...

1. Please note that for the SSO to work properly: the client PC and Joget server must reside on different machines

...

1. the Windows server and client PC must reside on the same Windows domain

...

...

Resources

Introduction to Kerberos and SPNEGO

• http://thekspace.com/home/component/content/article/54-kerberos-and-spnego.html

• https://developer.ibm.com/answers/questions/246107/what-is-the-difference-between-kerberos-and-spnego.html?lnk=hm

• http://web.mit.edu/kerberos/www/index.html

...

Configuring Kerberos on Windows Server

• https://technet.microsoft.com/en-us/library/hh831553(v=ws.11).aspx

• https://msftplayground.com/2009/08/configure-kerberos-authentication/

• https://technet.microsoft.com/en-us/library/cc731241(v=ws.11).aspx

• https://technet.microsoft.com/en-us/library/hh831553(v=ws.11).aspx

• https://msftplayground.com/2009/08/configure-kerberos-authentication/

...

Kerberos with Java and Spring

• https://venkatsadasivam.com/2009/08/29/single-sign-on-in-java-platform/

• http://docs.spring.io/spring-security-kerberos/docs/1.0.1.RELEASE/reference/htmlsingle/

• http://projects.spring.io/spring-security-kerberos/

• https://tomcat.apache.org/tomcat-8.0-doc/windows-auth-howto.html

• http://docs.oracle.com/javase/jndi/tutorial/ldap/security/gssapi.html

• http://docs.oracle.com/javase/8/docs/technotes/guides/security/jgss/lab/part1.html#PART1

• https://docs.oracle.com/cd/E23943_01/web.1111/e13707/sso.htm#SECMG481

• https://stackoverflow.com/questions/25289231/using-gssmanager-to-validate-a-kerberos-ticket