From c61c4a868c7a1c6ce58c49f4ba87fc0f5603b5da Mon Sep 17 00:00:00 2001 From: kkolinko Date: Sun, 3 Apr 2011 22:23:05 +0000 Subject: [PATCH] Correct a typo and some formatting as a followup to r1087524 git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@1088429 13f79535-47bb-0310-9956-ffa450edef68 --- webapps/docs/changelog.xml | 2 +- webapps/docs/windows-auth-howto.xml | 31 ++++++++++++++----------------- 2 files changed, 15 insertions(+), 18 deletions(-) diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml index 280f27bd0..99cc719c8 100644 --- a/webapps/docs/changelog.xml +++ b/webapps/docs/changelog.xml @@ -130,7 +130,7 @@ also referred to as integrated Windows authentication. This includes user authentication, authorisation via the directory using the user's delegated credentials and exposing the user's delegated - credentials via a request attribute so applications can make use of the + credentials via a request attribute so applications can make use of them to impersonate the current user when accessing third-party systems that use a compatible authentication mechanism. Based on a patch provided by Michael Osipov. (markt) diff --git a/webapps/docs/windows-auth-howto.xml b/webapps/docs/windows-auth-howto.xml index eff4771a3..e6fac2687 100644 --- a/webapps/docs/windows-auth-howto.xml +++ b/webapps/docs/windows-auth-howto.xml @@ -53,6 +53,7 @@ sections.

This is a work in progress. There are a number of outstanding questions that require further testing. These include: +

-

There are four components to the configuration of the built-in Tomcat support for Windows authentication. The domain controller, the server hosting Tomcat, the web application wishing to use Windows authentication and the client @@ -81,6 +81,7 @@ policy had to be relaxed. This is not recommended for production environments. domain controller. Configuration of a Windows server as a domain controller is outside the scope of this how-to. The steps to configure the domain controller to enable Tomcat to support Windows authentication are as follows: +

-

The above steps have been tested on a domain controller running Windows Server 2008 R2 64-bit Standard using the Windows Server 2003 functional level for both the forest and the domain. @@ -114,6 +114,8 @@ policy had to be relaxed. This is not recommended for production environments. installed and configured and that Tomcat is running as the tc01@DEV.LOCAL user. The steps to configure the Tomcat instance for Windows authentication are as follows: +

+

The SPNEGO authenticator will work with any Realm but if used with the JNDI Realm, by default the JNDI Realm will use the user's delegated credentials to connect to the Active Directory. @@ -194,7 +196,7 @@ com.sun.security.jgss.krb5.accept {

Correctly configuring Kerberos authentication can be tricky. The following references may prove helpful. Advice is also always available from the Tomcat users - mailing list. + mailing list.

  1. IIS and Kerberos
    2. @@ -208,7 +210,7 @@ com.sun.security.jgss.krb5.accept { Encryption Selection in Kerberos Exchanges
  2. Supported Kerberos Cipher Suites
    3. -

+
@@ -217,37 +219,34 @@ com.sun.security.jgss.krb5.accept {

Full details of this solution can be found through the - Waffle site. The key features are: + Waffle site. The key features are:

-

Full details of this solution can be found through the - Kerberos extension site. The key features are: + Kerberos extension site. The key features are:

-

Full details of this solution can be found through the project site. The key - features are: + features are:

-

@@ -255,7 +254,7 @@ com.sun.security.jgss.krb5.accept {

There are three steps to configuring IIS to provide Windows authentication. - They are: + They are:

  1. Configure IIS as a reverse proxy for Tomcat (see the @@ -265,12 +264,11 @@ com.sun.security.jgss.krb5.accept { setting the tomcatAuthentication attribute on the AJP connector to false.
-

Apache httpd does not support Windows authentication out of the box but - there are a number of third-party modules that can be used. These include: + there are a number of third-party modules that can be used. These include:

  1. mod_auth_sspi for use on Windows platforms.
    2. @@ -279,8 +277,8 @@ com.sun.security.jgss.krb5.accept { 2.0.x on 32-bit platforms. Some users have reported stability issues with both httpd 2.2.x builds and 64-bit Linux builds.
- There are three steps to configuring httpd to provide Windows - authentication. They are: +

There are three steps to configuring httpd to provide Windows + authentication. They are:

  1. Configure httpd as a reverse proxy for Tomcat (see the @@ -290,7 +288,6 @@ com.sun.security.jgss.krb5.accept { setting the tomcatAuthentication attribute on the AJP connector to false.
-

-- 2.11.0