Network Deployment (Distributed operating systems), v8.0 > Reference > Commands (wsadmin scripting)

Kerberos authentication commands

Use wsadmin commands to create, modify or delete Kerberos as the authentication mechanism for WAS.

Create Kerberos authentication mechanism

The following items are required before you attempt to use the createKrbAuthMechanism command to create the KRB5 authentication mechanism security object field in the security configuration file:

• If you do not already have a Kerberos configuration file (krb5.ini or krb5.conf), use the createkrbConfigFile command task to create the Kerberos configuration file. Read about creating a Kerberos configuration file for more information.
• We must have a Kerberos keytab file (krb5.keytab) that contains a Kerberos service principal name (SPN), <service name>/ <fully qualified hostname>@KerberosRealm, for each machine that run WebSphere application servers. The service name can be anything; the default value is WAS.

  For example, if we have two application server machines, host1.austin.ibm.com and host2.austin.ibm.com, the Kerberos keytab file must contain the <service name>/host1.austin.ibm.com and service name>/host2.austin.ibm.com SPNs and their Kerberos keys.

Use the createKrbAuthMechanism command to create the KRB5 authentication mechanism security object field in the security configuration file.

At the wsadmin prompt, run:

$AdminTask help createKrbAuthMechanism

Command parameters. You can use the following parameters with the createKrbAuthMechanism command.

Option	Description
<krb5Realm>	This parameter is optional. It indicates the Kerberos realm name. If not specified, the default Kerberos realm in the Kerberos configuration file is used.
<krb5Config>	This parameter is required. It indicates the directory location and file name of the configuration (krb5.ini or krb5.conf) file.
<krb5Keytab>	This parameter is optional. It indicates the directory location and file name of the Kerberos keytab file. If not specified, the default keytab in the Kerberos configuration file is used.
<serviceName>	This parameter is required. It indicates the Kerberos service name. The default Kerberos service name is WAS.
<trimUserName>	This parameter is optional. It removes the suffix of the principal user name, starting from the “@” that precedes the Kerberos realm name. This parameter is optional. The default value is true.
<enabledGssCredDelegate>	This parameter is not required. Use to indicate whether to extract and place the client GSS delegation credential in the subject. The default value is true.
<allowKrbAuthForCsiInbound>	This parameter is optional. It enables Kerberos authentication mechanism for Common Secure Interoperability (CSI) inbound. The default value is true.
<allowKrbAuthForCsiOutbound>	This parameter is required. It enables Kerberos authentication mechanism for CSI outbound. The default value is true.

The Kerberos configuration file name and Kerberos keytab filename path do not have to be absolute paths. We can use WebSphere variables for the paths instead. If we have a mixed platform environment, you can use a variable ${CONF_OR_INI} for the Kerberos configuration file. Security configuration will expand it to “ini” for Windows or “conf” for non-Windows platforms For example:

${WAS_INSTALL_ROOT}\etc\krb5\krb5.${CFG_OR_INI}

The following is an example of the createKrbAuthMechanism command:

wsadmin>$AdminTask createKrbAuthMechanism {
  -krb5Realm  WSSEC.AUSTIN.IBM.COM
  -krb5Config C:\\WINNT\\krb5.ini
  -krb5Keytab C:\\WINNT\\krb5.keytab
  -serviceName WAS }

Modify Kerberos authentication mechanism

Use the modifyKrbAuthMechanism command to make changes to the KRB5 authentication mechanism security object field in the security configuration file.

At the wsadmin prompt, run:

$AdminTask help modifyKrbAuthMechanism

Command parameters. You can use the following parameters with the modifyKrbAuthMechanism command.

Option	Description
<krb5Realm>	This parameter is optional. It indicates the Kerberos realm name. If not specified, the default Kerberos realm in the Kerberos configuration file is used.
<krb5Config>	This parameter is required. It indicates the directory location and file name of the configuration (krb5.ini or krb5.conf) file.
<krb5Keytab>	This parameter is optional. It indicates the directory location and file name of the Kerberos keytab file. If not specified, the default keytab in the Kerberos configuration file is used.
<serviceName>	This parameter is required. It indicates the Kerberos service name. The default Kerberos service name is WAS.
<trimUserName>	This parameter is optional. It removes the suffix of the principal user name, starting from the “@” that precedes the Kerberos realm name. This parameter is optional. The default value is true.
<enabledGssCredDelegate>	This parameter is not required. Use to indicate whether to extract and place the client Kerberos and GSS delegation credential in the Kerberos authentication token (KRBAuthnToken). The default value is true. If this parameter is true, and the runtime cannot extract the Kerberos GSS delegation credential, the runtime logs a warning message.
<allowKrbAuthForCsiInbound>	This parameter is optional. It enables Kerberos authentication mechanism for Common Secure Interoperability (CSI) inbound. The default value is true.
<allowKrbAuthForCsiOutbound>	This parameter is optional. It enables Kerberos authentication mechanism for CSI outbound. The default value is true.

The Kerberos configuration file name and Kerberos keytab filename path do not have to be absolute paths. We can use WebSphere variables for the paths instead. If we have a mixed platform environment, you can use a variable ${CONF_OR_INI} for the Kerberos configuration file. Security configuration will expand it to “ini” for Windows or “conf” for non-Windows platforms For example:

${WAS_INSTALL_ROOT}\etc\krb5\krb5.${CFG_OR_INI}

The following is an example of the modifyKrbAuthMechanism command:

wsadmin>$AdminTask modifyKrbAuthMechanism {
   -krb5Realm  WSSEC.AUSTIN.IBM.COM
   -krb5Config C:\\WINNT\\krb5.ini
   -krb5Keytab C:\\WINNT\\krb5.keytab
   -serviceName WAS }

Delete Kerberos authentication mechanism

Use the deleteKrbAuthMechanism command to remove the KRB5 authentication mechanism security object field in the security configuration file.

At the wsadmin prompt, run:

$AdminTask help deleteKrbAuthMechanism

The following is an example of the deleteKrbAuthMechanism command:

 wsadmin>$AdminTask deleteKrbAuthMechanism

Set active authentication mechanism

Use the setActiveAuthMechanism command to set the active authentication mechanism attribute in the security configuration.

At the wsadmin prompt, run:

$AdminTask help setActiveAuthMechanism

Command parameters. You can use the following parameter with the setActiveAuthMechanism command.

Option	Description
<authMechanismType>	This parameter is not required. It indicates the authentication mechanism type. The default is KRB5.

The following is an example of the setActiveAuthMechanism command:

wsadmin> $AdminTask setActiveAuthMechanism {-authMechanismType KRB5 }

Create a Kerberos configuration file
Create a Kerberos service principal name and keytab file
Configure inbound messages
Configure outbound messages
Configure security with scripting

+

Search Tips   |   Advanced Search