Configure SPNEGO TAI in WAS
Performing this task helps you, as Web administrator, to ensure that WAS is properly configured to enable the operation of the Simple and Protected GSS-API Negotiation (SPNEGO) trust association interceptor (TAI). We need to know how to use the WAS administrative console to manage the security configuration and have the proper authority to modify the security configuration of the appserver.
It is recommended that you use wsadmin to manage the SPNEGO TAI properties.
Overview
Complete the following steps to enable the operation of the SPNEGO TAI.
Procedure
- Log on to the console.
- Click Security > Secure administration, applications, and infrastructure.
- Expand Web security and click Trust association.
- Under the General Properties heading, select the Enable trust association check box, then click Interceptors.
- Select the SPNEGO TAI in the list of interceptors, then click Custom properties.
- Click New and then fill in the Name and Value fields. Click OK. Repeat this step for each custom property to apply to the SPNEGO TAI.
- After you finish defining your custom properties, click Save to store the updated SPNEGO TAI configuration.
Results
Your SPNEGO TAI configuration is now configured for WebSphere Application Server. You must ensure that:
- A user account is created in the Microsoft Active Directory and mapped to a Kerberos principal name.
- A Kerberos keytab file (krb5.keytab) is created and made available to the WAS. The Kerberos keytab file contains keys WAS uses to authenticate the user in the Microsoft Active Directory and the Kerberos account.
SPNEGO TAI custom configuration attributes
Adding SPNEGO TAI properties using the wsadmin utility
Modifying SPNEGO TAI properties using the wsadmin utility
Deleting SPNEGO TAI properties using the wsadmin utility
Displaying SPNEGO TAI properties using the wsadmin utility
Related concepts
Single sign-on for HTTP requests using SPNEGO
Related tasks
Configure the Web browser to use SPNEGO
Configure JVM properties and enabling SPNEGO TAI in WebSphere Application Server
Configure WAS environment to use SPNEGO