| Rev | Author | # | Line |
|---|---|---|---|
| 2 | GuyThornley | 1 | Getting WinXP to authenticate to a MIT [Kerberos5] KDC and use [AFS], all with single-sign-on, is not too difficult. However it does not appear to be completely (or correctly) documented anywhere. |
| 1 | GuyThornley | 2 | |
| 5 | PerryLorier | 3 | You will need a correctly configured Kerberos5 domain and AFS server, which is probably its own set of headaches. I haven't done that; it was already setup correctly. I simply connected a WinXP client. The OpenAFS network here is using Kerberos5 natively. There is no krb524 type things going on. |
| 1 | GuyThornley | 4 | |
| 5 | Software I used: | ||
| 6 | * WindowsXP Pro, service pack 2 | ||
| 2 | GuyThornley | 7 | * MIT Kerberos for Windows (KfW) 3.0 from [http://web.mit.edu/Kerberos/dist/index.html] |
| 8 | * OpenAFS Windows client 1.4.2rc1 from [http://openafs.org/release/latest.html] | ||
| 9 | * OpenAFS plugin for NetIDMgr from [https://www.secure-endpoints.com/] | ||
| 10 | |||
| 11 | As of Sep 5 2006, new versions of KfW and the OpenAFS NetIDMgr plugin are available. You must always get the OpenAFS NetIDMgr plugin built for the version of KfW you are installing. | ||
| 12 | |||
| 13 | The approach documented here is a very basic configuration with some caveats: | ||
| 6 | PerryLorier | 14 | * This does not use Active Directory (ldap), the client still needs a local user account |
| 2 | GuyThornley | 15 | * This cannot use NT roaming profiles |
| 1 | GuyThornley | 16 | |
| 17 | The overall process: | ||
| 18 | # Get WinXP to authenticate to MIT Kerberos5 domain | ||
| 19 | # Installing and configuring MIT Kerberos; obtaining regular Krb5 tickets from the WinXP ones | ||
| 20 | # Installing and configuring OpenAFS | ||
| 2 | GuyThornley | 21 | # Tieing it all together |
| 1 | GuyThornley | 22 | |
| 2 | GuyThornley | 23 | !!!Authenticating using Kerberos5 |
| 1 | GuyThornley | 24 | Some useful background reading, if you care: |
| 25 | * [http://www.microsoft.com/technet/prodtechnol/windows2000serv/maintain/featusability/kerbinop.mspx] | ||
| 26 | * [http://www.microsoft.com/technet/prodtechnol/windows2000serv/deploy/confeat/kerberos.mspx] | ||
| 27 | * [http://www.microsoft.com/technet/prodtechnol/windows2000serv/howto/kerbstep.mspx] | ||
| 28 | |||
| 29 | To authenticate your WinXP client against an external MIT Kerberos5 server, you need: | ||
| 30 | * A user principal in the Kerberos domain (duh :)) | ||
| 31 | * A host principal account in the Kerberos domain for the WinXP client | ||
| 32 | * A local account on the WinXP client for the user | ||
| 33 | |||
| 34 | The host principal (called a "machine account" by Microsoft) is needed by WinXP. If this is absent or incorrect, you cannot login. I'm not sure what WinXP uses the host prinicipal for; perhaps it is some form of mutual authentication, where WinXP uses the machine account to protect against a fake domain controller. | ||
| 35 | |||
| 36 | The host principle ''must'' be encrypted with the __des-cbc-crc__ method; nothing else seems to work. Yeah, I know, its a ''really'' weak encryption method. If you want to use a random password (which is probably reccomended), make sure you write it down; you need to type this into the WinXP client too. This restriction on encryption methods applies ''only'' to the host principal; my own user principal is encypted with with __des3-cbc-sha1__ method, and that works just fine. | ||
| 37 | |||
| 38 | The local account on the WinXP client is part of the odd "trust" relationship that ends up in place between the Kerberos5 domain and the WinXP client. The client maps the Kerberos principal to a local account for the purposes of file permissions, group membership, and so on. (The stuff typically kept in ldap). I added myself the "Administrators" built-in group, and did not worry about it; AFS enforces its own permissions. | ||
| 39 | |||
| 40 | The host prinicipal is added using the <tt>kadmin</tt> tool like any regular Kerberos5 principal: | ||
| 41 | <pre> | ||
| 42 | kadmin q "addprinc -edes-cbc-crc:normal pw ''{passwd}'' host/''{fqdn}''" | ||
| 43 | </pre> | ||
| 44 | |||
| 45 | On the WinXP client, execute the following in a command prompt window: | ||
| 46 | <pre> | ||
| 47 | ksetup /setdomain ''{REALM}'' | ||
| 48 | ksetup /setmachpassword ''{passwd}'' | ||
| 49 | ksetup /mapuser * * | ||
| 50 | ksetup /addkdc ''{REALM}'' ''{kdc}'' | ||
| 51 | </pre> | ||
| 52 | |||
| 53 | passwd: | ||
| 54 | The host prinicipal password for the machine account | ||
| 55 | fqdn: | ||
| 56 | The fully-qualified domain name for the WinXP client. I've only tested a situation where the DNS domain is the same as the Kerberos domain, where the mapping is trivial. | ||
| 57 | REALM: | ||
| 58 | The Kerberos realm. These are typically all uppercase version of the the domain name. | ||
| 59 | kdc: | ||
| 2 | GuyThornley | 60 | The DNS name of a KDC for ''{REALM}''. Using SRV records does not work correctly. |
| 61 | |||
| 62 | The <tt>ksetup</tt> program has lots of options; you can see them all by using <tt>ksetup /h</tt>. | ||
| 1 | GuyThornley | 63 | |
| 64 | Finally you must reboot your WinXP client. When it starts up again, you should hopefully have the option to login to your Kerberos realm. Even better, if you did everything right, it should work! Woohoo! | ||
| 65 | |||
| 2 | GuyThornley | 66 | !!!Installing KfW |
| 67 | Next, you need to install KfW. The OpenAFS client for Windows cannot use the WinXP credentials directly; KfW will import the WinXP credentials into a traditional Kerberos5 ticket for regular Kerberos software, such as OpenAFS. | ||
| 68 | |||
| 69 | The latest version (3.0) of KfW comes with a new pluggable framework called the "Network Identity Manager". The idea is that different packages or authentication schemes can install their own plugins into the NetIDMgr; then the user can manage all of their credentials from a single place. Personally I find it very quirky. However, once configured, it will grab your WinXP credentials and convert them into regular Kerberos5 ones. | ||
| 70 | |||
| 71 | Unfortunately, I find that is the only useful thing it does, and isnt particularly good at that, either; but you need it, so you live with it. | ||
| 72 | |||
| 73 | Once you have installed KfW, start the Network Identity Manager. Use the <tt>View -> Layout -> By Location</tt> menu sequence; you should see some credentials under the <tt>MSLSA:</tt> location. It may have already imported them, too; I cant remember the default configuration. If you select the <tt>MSLSA:</tt> credential, and use the <tt>Credential -> Import Credentials</tt> menu option you'll get Kerberos API credentials, which are called <tt>API:</tt> credentials in the list. | ||
| 74 | |||
| 75 | Open up the NetIDMgr configuration dialogue using the <tt>Options -> General</tt> menu option. Under the "Kerberos 5" tree item, there is an "Import Tickets" option. Set it to "always". | ||
| 76 | |||
| 6 | PerryLorier | 77 | We aren't quite finished with this yet, we'll be coming back to it later. |
| 2 | GuyThornley | 78 | |
| 79 | !!!Installing OpenAFS client for WinXP | ||
| 80 | Installing the OpenAFS client asks you a few questions: | ||
| 81 | # You are given the option of installing AFS' own MS Loopback interface. I must have done this when I first installed OpenAFS; now I have a strange "AFS" network adapter with the IP address 10.254.254.253 with netmask 255.255.255.252. If this bugs you, try unchecking it. The strange thing is that 127.0.0.1 still seems to work, dispite not being bound to any network adapter (!). | ||
| 82 | # When asked about the CellServDB configuration, if you are given the "Use existing" option, then use it. Otherwise, select the "Use packaged" option. | ||
| 83 | # It will then prompt for the cell name. Enter your AFS cell name here. The settings for the other options are: | ||
| 84 | * Crypt security - no | ||
| 85 | * Freelance client - yes | ||
| 86 | * Use DNS - yes | ||
| 87 | * Integrated logon - no | ||
| 88 | # Then you are presented a "AFS Credentials Configuration" dialogue: | ||
| 89 | * Start at login - yes | ||
| 90 | * Auto initialise - yes | ||
| 91 | * Renew mappings - yes | ||
| 92 | * IP address change detection - yes | ||
| 93 | * Quiet - yes | ||
| 94 | * Show credentials on startup - no | ||
| 95 | |||
| 96 | Our AFS SRV records in DNS are working, so configuration is quite simple. Once the obligatory reboot is over, you'll be offered a "Obtain new AFS tokens" dialogue when you login. Just press cancel; AFS native authentication is not being used (its going to come from Kerberos). Don't worry! This dialogue is offered only once, not every time you login. | ||
| 97 | |||
| 98 | If your SRV records are not working, you'll need to manually edit the CellServDB file. If you have a working unix client, the same file should work. Probably you'll need to restart the AFS client after changing/replacing the CellServDB file. | ||
| 99 | |||
| 100 | Once the AFS client has started, you should be able to Run the <tt>\\afs\all</tt> location, and see your cell. | ||
| 101 | |||
| 102 | !!!Tieing it all together | ||
| 103 | By now there should be: | ||
| 104 | # WinXP authenticates using Kerberos | ||
| 105 | # KfW imports the WinXP tickets automatically | ||
| 106 | # OpenAFS client starts, and gives you access to <tt>\\afs\all</tt> | ||
| 107 | |||
| 108 | The last step remains: getting Kerberos5 tickets into OpenAFS. OpenAFS for Windows client comes with the familar <tt>aklog.exe</tt> program that does just that. Find it using the Windows Explorer, and run it. The AFS Client window should change from saying "You do not have tokens" to listing the token imported from Kerberos5. | ||
| 109 | |||
| 110 | If you install the OpenAFS plugin for NetIDMgr, then when you use the NetIDMgr to get new Kerberos5 credentials you can automatically get OpenAFS credentials. However I find this approach has quite a few limitations: | ||
| 111 | * It doesn't work when you import credentials | ||
| 112 | * It doesn't work when you renew credentials | ||
| 3 | GuyThornley | 113 | * it doesn't notice when the <tt>MSLSA:</tt> credential is renewed (eg, password-protected screen saver) |
| 2 | GuyThornley | 114 | * It works *only* when you use NetIDMgr to get *new* credentials |
| 115 | |||
| 116 | However, installing the plugin allows you to see the tokens in the AFS cache, as well as the copy stored by Kerberos. | ||
| 117 | |||
| 118 | To work around those absurd problems, I use the following friendly batch file called <tt>afs.bat</tt> which has a shortcut in the "Startup" folder: | ||
| 119 | <pre> | ||
| 120 | c: | ||
| 121 | cd "\program files\mit\kerberos\bin" | ||
| 122 | ms2mit | ||
| 123 | cd "\program files\openafs\client\program" | ||
| 124 | aklog | ||
| 125 | </pre> | ||
| 126 | The <tt>ms2mit</tt> program forces KfW to import the <tt>MSLSA</tt> credentials. The useful feature is that it does not exit until that is done, so makes a useful synchronisation point. Then <tt>aklog</tt> puts the ticket into OpenAFS. | ||
| 127 | |||
| 128 | !!!Bugs, issues, gotchas, etc | ||
| 129 | * I have experienced AFS cache corruption. The symptom of this were strange failures when accessing commonly accessed AFS directories. Empty listings, strange errors, etc, are all symptoms of this. The solution is to shutdown the AFS client, delete the AFS cache file (which is <tt>%TEMP%\AFSCache</tt> by default). | ||
| 130 | * The limitations of NetIDMgr are really a pain. The <tt>afs.bat</tt> file is going to be your friend. You might like to shortcut it from the desktop or quick start bar. | ||
| 131 | * WinXP decided, fairly arbitarily, it would like to synchronise my AFS home directory and make an offline copy. If your client starts doing the same, open up Windows Explorer, use the <tt>Tools -> Synchronize</tt> menu option, and un-check the AFS paths. | ||
| 132 | * AFS tokens tend to expire. Don't use it for long-running processes like BitTorrent, and so on. | ||
| 4 | GuyThornley | 133 | * *Do not* run the "Network Setup Wizard" ever again, it will trash your configuration and leave you unable to login! |
lib/blame.php:177: Warning: Invalid argument supplied for foreach()