search

igniterealtime / pade

Pàdé (Yoruba word for Meet) is a browser extension (Chrome/Edge) based unified communications desktop client for Openfire.
https://igniterealtime.github.io/pade/
Apache License 2.0
106 stars 47 forks source link

SSO Kerberos v5 #132

Open AGNaumov opened 5 years ago

AGNaumov commented 5 years ago

У меня сервер OpenFire на CentOS 7. Сервер введен в Microsoft Active Directory. На сервере для локальной сети (пользователей домена) реализована SSO авторизация клиентов по xmpp.keytab Kerberos v5, протестировано на клиентах Spark и Miranda. Нужно реализовать SSO авторизацию через xmpp.keytab Kerberos v5

Google translation by translator:

I have an OpenFire server on CentOS 7. The server is entered into Microsoft Active Directory. The server for the local network (domain users) has SSO authentication of clients using xmpp.keytab Kerberos v5, tested on Spark and Miranda clients. Need to implement SSO authentication through xmpp.keytab Kerberos v5

AGNaumov commented 5 years ago

Исправил изначальное сообщение, в первоначальном сообщении нашёл мою ошибку.

Google translation by translator:

Corrected the original message, found my error in the original message

deleolajide commented 5 years ago

Pàdé supports Windows SSO through NTLM using Waffle. See https://github.com/igniterealtime/Pade/issues/66

I have no plans to support SSO via Kerberos as it is complicated to setup for a web browser.

AGNaumov commented 5 years ago

Pàdé supports Windows SSO through NTLM using Waffle. See #66

I have no plans to support SSO via Kerberos as it is complicated to setup for a web browser.

Да действительно есть сложности с настройкой веб браузера. Но они решаемы. Для Waffle нужно сервер openfire устанавливать на операционную систему Windows а у меня openfire установлен на операционной системе CentOS 7. SSO авторизация через xmpp.keytab Kerberos v5 - это универсальный способ подходящий для любого варианта установки сервера openfire. А с помощью GPO эти настройки можно сделать на всех компьютерах домена. Может попробуем реализовать? С меня тестирование. И инструкция по настройке, если в ней будет необходимость.

Google translation by translator:

Yes indeed there are difficulties with setting up a web browser. But they are solvable. For Waffle, you need to install the openfire server on the Windows operating system and I have openfire installed on the CentOS 7 operating system. SSO authentication via xmpp.keytab Kerberos v5 is a universal way suitable for any installation option of the openfire server. And with the help of GPO, these settings can be made on all computers in the domain. Can we try to implement? With me testing. And instructions for setting up if it is necessary.

deleolajide commented 5 years ago

I will investigate

deleolajide commented 5 years ago

I did some investigation and this is what I found.

  1. There are NO changes needed to Pade in order to use Kerberos v5 SSO authentication. It will use the same method for Waffle NTM. It will request an access token for the user from the same secured web page used by Waffle in the Chat API plugin for Openfire. You may need to configure Chrome for Kerberos v5 SSO.

  2. Changes are required in the Chat API Plugin for Openfire in order to support Kerberos v5 SSO authentication between Chrome browser and Jetty web server embedded in Openfire. I have made the required changes, but cannot confirm it works as I don't have a windows domain server to test with. Make sure you download and install openfire-chat-api plugin version 0.9.5 Release 1

In order to test this, you would need to:

  1. Configure Pade for Windows SSO. See https://github.com/igniterealtime/Pade/issues/66.
  2. Configure Openfire-Chat API for Kerberos. See screenshot below

image

Make sure you can access the secure web page at https://your-server:7443/sso/password from Openfire with NO prompt before you test Pade.

I used the following web pages for reference.

  1. https://stackoverflow.com/questions/27427654/how-to-use-embedded-jetty-server-9-with-kerberos-authentication
  2. https://discourse.igniterealtime.org/t/sso-configuration/49064

Best of luck

AGNaumov commented 5 years ago

Спасибо, буду пробовать. Пока занят чуть позже отпишусь.

Google translation by translator:

Thanks, I will try. While busy a little later accomplish your goal.

AGNaumov commented 5 years ago

Скачал и установил openfire-chat-api plugin version 0.9.5 Release 1. Возникла проблема со страницей https://your-server:7443/sso/password. Я правильно понимаю, что мне необходимо создать эту страницу через Jetty? (создать файл .java, скомпилировать его в .class и запустить на сервере openfire)

Google translation by translator:

Downloaded and installed openfire-chat-api plugin version 0.9.5 Release 1. There was a problem with the page https://your-server:7443/sso/password. Do I understand correctly that I need to create this page through Jetty? (create the file. java, compile it into .class and run on openfire server)

deleolajide commented 5 years ago

Do I understand correctly that I need to create this page through Jetty? (create the file. java, compile it into .class and run on openfire server)

No

Please download and install openfire-chat plugin. See https://github.com/igniterealtime/Openfire-Chat/releases/tag/v0.9.5-release1

Follow the steps here https://github.com/igniterealtime/Pade/issues/132#issuecomment-473236674

AGNaumov commented 5 years ago

Sample setup CentOS 7 OpenFire SSO via xmpp.keytab and http.keytab

A description of server configuration:

What to do on the server OpenFire

com.sun.security.jgss.accept { com.sun.security.auth.module.Krb5LoginModule required storeKey=true keyTab="/opt/openfire/xmpp.keytab" doNotPrompt=true useKeyTab=true realm="MYDOMAIN.LOC" principal="xmpp/jabber.openfire.su@MYDOMAIN.LOC" isInitiator=false debug=false; };

com.sun.security.jgss.accept { com.sun.security.auth.module.Krb5LoginModule required principal="HTTP/jabber.openfire.su@MYDOMAIN.LOC" useKeyTab=true keyTab="/opt/openfire/http.keytab" storeKey=true debug=false isInitiator=false; };

[realms] MYDOMAIN.LOC = { kdc = ADSERVER.mydomain.loc admin_server = ADSERVER.mydomain.loc default_domain = MYDOMAIN.LOC }

[domain_realm] .mydomain.loc = MYDOMAIN.LOC mydomain.loc = MYDOMAIN.LOC

[appdefaults] autologin = true forwardable = true

chown daemon:daemon /opt/openfire/conf/gss.conf chown daemon:daemon /opt/openfire/xmpp.keytab chmod 440 /opt/openfire/xmpp.keytab chown daemon:daemon /opt/openfire/conf/spnego.conf chown daemon:daemon /opt/openfire/conf/spnego.properties chown daemon:daemon /opt/openfire/conf/krb5.ini chown daemon:daemon /opt/openfire/http.keytab chmod 440 /opt/openfire/http.keytab

kinit -V -k -t /opt/openfire/http.keytab HTTP/jabber.openfire.su@MYDOMAIN.LOC answer must be Authenticated to Kerberos v5

sasl.gssapi.config = /opt/openfire/conf/gss.conf sasl.gssapi.debug = false sasl.gssapi.useSubjectCredsOnly = false sasl.mechs = GSSAPI, PLAIN sasl.realm = MYDOMAIN.LOC xmpp.fqdn = jabber.openfire.su Restart openfire systemctl restart openfire.service

image

image

deleolajide commented 5 years ago

Please make sure chat api plugin is enabled and restart openfire

image

First make sure SSO kerberos works between Chrome browser and Openfire Jetty web server by accessing web page https://jabber.openfire.su:7443/sso/password from your Chrome browser. I am assuming jabber.openfire.su is the FQDN of the openfire server and http-bind port is 7443.

If you get a browser username/password window, then it is not working. Recheck parameters or restart Openfire. You should NOT get a prompt and it should display you some data on the screen. If that happens, then you should test with Pade.

AGNaumov commented 5 years ago

Checked that Chat API is enabled. Still, when you try to log in, the login-password window appears.

Is it possible to view logs in jetty? We tested authorization from chrome on IIS, it works. It turns out that the problem is in the openfire settings and we can not yet find where exactly we need to configure.

deleolajide commented 5 years ago

To see Jetty logs, enable debug logging in openfire. For more info about configuring Jetty with Kerberos, start from here - https://stackoverflow.com/questions/27427654/how-to-use-embedded-jetty-server-9-with-kerberos-authentication