First you have to download the WSO2-ESB 4.5.0 and WSO2-IS 4.0.0
In this example IS(Identity Server) act as KDC(key distribution center) so first of all we have to configure the IS
Open the bellow mentioned files and do the required changes
1. $IS_HOME/repository/conf/embedded-ldap.xml
Download Sample embedded-ldap.xml here
under <KDCServer> and make the property "enable" = true as follows
<Property name="enabled">true</Property>
add this property under <KDCServer>
<Property name="preAuthenticationTimeStampEnabled">false</Property>
2. $IS_HOME/repository/conf/user-mgt.xml
Download Sample user-mgt.xml here
under <ApacheDSUserStoreManager>
<Property name="kdcEnabled">true</Property>
3. $IS_HOME/repository/conf/security/krb5.conf
Download Sample krb5.conf here
[libdefaults]
default_realm = WSO2.ORG
default_tkt_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1
default_tgs_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1
permitted_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1
allow_weak_crypto = true
[realms]
WSO2.ORG = {
kdc = 127.0.0.1:8000
}
[domain_realm]
.wso2.org = WSO2.ORG
wso2.org = WSO2.ORG
[login]
krb4_convert = true
krb4_get_tickets = false
4. $IS_HOME/repository/conf/security/jaas.conf
Download Sample jaas.conf here
Server {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=false
storeKey=true
useTicketCache=false
isInitiator=false
principal="esb/localhost@WSO2.ORG";
};
Client {
com.sun.security.auth.module.Krb5LoginModule required
useTicketCache=false;
};
Now IS is configured successfully
Go to $IS_HOME/bin and run the wso2serever.sh
If IS configured properly, when your stating the IS you can see this log in command line
"[2012-12-13 14:40:32,426] INFO {org.apache.directory.server.kerberos.kdc.KdcServer} - Kerberos service started."
Now you have to create the Server principle that we mention in "jass.conf"
Login to IS buy using username - "admin" password -"admin" and go to configure->Service Principle and create It
Register the Server Principle
Service Name : esb/localhost
Description : Test
Password : dinuka
Re Password : dinuka
Next we have to create Client Principle that means "User"
Username : dinuka
Password : dinuka
User Role : admin
Lets move to configure the ESB
First go to $ESB_HOME/repository/conf/security/
and place the same krb5.conf and jaas.conf files in $IS_HOME/repository/conf/security/
Open $IS_HOME/repository/conf/carbon.xml and change the offset 0 to 1 and start the ESB
Download sample carbon.xml here
Go to ESB and secure the "echo" service with kerboros
Service Principle Name : esb/localhost
Service Principle Password : dinuka
We are done with the configuration now we have to invoke the echo service so you can download the Java Client from here
You have to set the project dependencies for above client so point the all jars in $ESB_HOME/repository/components/plugins
If you change username and password at the configuration time you have to make those changes on the above client also Go to policy.xml in the above client and change the following details according to your setting
<rampart:property name="client.principal.name">dinuka</rampart:property>
<!-- Authenticating user password -->
<rampart:property name="client.principal.password">dinuka</rampart:property>
<!-- To which service client needs to talk to -->
<rampart:property name="service.principal.name">esb/localhost@WSO2.ORG</rampart:property>
Finally change the ECHO_SERVICE_EPR relevant to the your ESB and run the KerberosClient.java
Results should be
Calling Echo service with parameter - Hello World
Response : <ns:echoStringResponse xmlns:ns="http://echo.services.core.carbon.wso2.org"><return>Hello World</return></ns:echoStringResponse>
No comments:
Post a Comment