Quantcast
Channel: Software Communities : Popular Discussions - All Things Unix
Viewing all 1046 articles
Browse latest View live

Not seeing correct AD group membership using vastool

$
0
0

We have an AD group 'foo'.  User Abe is added to it using AD tools.

 

I cannot see this user in the group using vastool on Solaris.  And of course the user cannot login.

 

$ vastool list groups | grep foo

foo:VAS:2010:john.doe@na.company.com,harry.who@na.company.com

$

 

I've executed vastool flush to no affect.

 

What am I doing wrong?


Stuck with kerberos authentication to Sharepoint

$
0
0
I have to connect to MS IIS server using SPNEGO token with Kerberos ticket inside, exactly as Internet Explorer does it.

If I use java GSSManager.initiateContext() it does request tickets with incorrect KDCOptions, dates and some other params I cannot control.

I tried com.dstc.security lib, and was able to get tickets axactly as Internet Explorer with couple of lines:

prepare required KDCOptions;
Credential tgt = kerberos.requestTicketGrantingTicket(new KerberosPassword(password.getBytes()), kdo, new Date(), d, new InetAddress[] {InetAddress.getByName("somename")}, null);
Credential srvt = kerberos.requestServiceTicket(TGT, new PrincipalName(2, "HTTP/server.domain.net"), REALM, kdo);

But how can I use these credentials or tickets inside to create SPNEGO token same as I can get with GSSManager.initiateContext()?

mod_auth_vas Solaris 9 with sunfreeware build Apache 2.2.12 mod load issue

$
0
0
Trying on Solaris 9 hosts with Apache 2.2.12
Modified httpd.conf  with below lines.
LoadModule auth_vas_module  modules/mod_auth_vas.so
 copied the mod_auth_vas.so  to /usr/local/apache2/modules dir.

The setup script complains that the LoadMod is not working.

Below is the debug run
root@njwashud7 #> /usr/local/apache2/bin/httpd -f "/usr/local/apache2/conf/httpd.conf" ->
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module authn_file_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module authn_dbm_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module authn_anon_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module authn_dbd_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module authn_default_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module authz_host_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module authz_groupfile_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module authz_user_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module authz_dbm_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module authz_owner_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module authnz_ldap_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module authz_default_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module auth_basic_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module auth_digest_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module dbd_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module dumpio_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module ext_filter_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module include_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module filter_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module substitute_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module deflate_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module ldap_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module log_config_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module log_forensic_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module logio_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module env_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module mime_magic_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module cern_meta_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module expires_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module headers_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module ident_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module usertrack_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module unique_id_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module setenvif_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module version_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module ssl_module
[Mon Oct 05 18:35:04 2009] [debug] mod_so.c(246): loaded module mime_module
[Mon Oct 05 18:35:05 2009] [debug] mod_so.c(246): loaded module dav_module
[Mon Oct 05 18:35:05 2009] [debug] mod_so.c(246): loaded module status_module
[Mon Oct 05 18:35:05 2009] [debug] mod_so.c(246): loaded module autoindex_module
[Mon Oct 05 18:35:05 2009] [debug] mod_so.c(246): loaded module asis_module
[Mon Oct 05 18:35:05 2009] [debug] mod_so.c(246): loaded module info_module
[Mon Oct 05 18:35:05 2009] [debug] mod_so.c(246): loaded module cgi_module
[Mon Oct 05 18:35:05 2009] [debug] mod_so.c(246): loaded module dav_fs_module
[Mon Oct 05 18:35:05 2009] [debug] mod_so.c(246): loaded module vhost_alias_module
[Mon Oct 05 18:35:05 2009] [debug] mod_so.c(246): loaded module negotiation_module
[Mon Oct 05 18:35:05 2009] [debug] mod_so.c(246): loaded module dir_module
[Mon Oct 05 18:35:05 2009] [debug] mod_so.c(246): loaded module imagemap_module
[Mon Oct 05 18:35:05 2009] [debug] mod_so.c(246): loaded module actions_module
[Mon Oct 05 18:35:05 2009] [debug] mod_so.c(246): loaded module speling_module
[Mon Oct 05 18:35:05 2009] [debug] mod_so.c(246): loaded module userdir_module
[Mon Oct 05 18:35:05 2009] [debug] mod_so.c(246): loaded module alias_module
[Mon Oct 05 18:35:05 2009] [debug] mod_so.c(246): loaded module rewrite_module
httpd: Syntax error on line 113 of /usr/local/apache2/conf/httpd.conf: Cannot load /usr/local/apache2/modules/mod_auth_vas.so into server: ld.so.1: httpd: fatal: relocation error: file /usr/local/apache2/modules/mod_auth_vas.so: symbol ap_dummy_mutex: referenced symbol not found




root@njwashud7 #> ldd -d /usr/local/apache2/modules/mod_auth_vas.so
        libvas.so.4 =>   /opt/quest/lib/libvas.so.4
        libc.so.1 =>     /usr/lib/libc.so.1
        libgcc_s.so.1 =>         (file not found)
        libresolv.so.2 =>        /usr/lib/libresolv.so.2
        libnsl.so.1 =>   /usr/lib/libnsl.so.1
        libsocket.so.1 =>        /usr/lib/libsocket.so.1
        libdl.so.1 =>    /usr/lib/libdl.so.1
        libmp.so.2 =>    /usr/lib/libmp.so.2
        symbol not found: ap_set_flag_slot              (/usr/local/apache2/modules/mod_auth_vas.so)
        symbol not found: ap_set_flag_slot              (/usr/local/apache2/modules/mod_auth_vas.so)
        symbol not found: ap_set_flag_slot              (/usr/local/apache2/modules/mod_auth_vas.so)
        symbol not found: ap_set_flag_slot              (/usr/local/apache2/modules/mod_auth_vas.so)
        symbol not found: ap_set_flag_slot              (/usr/local/apache2/modules/mod_auth_vas.so)
        symbol not found: ap_set_flag_slot              (/usr/local/apache2/modules/mod_auth_vas.so)
        symbol not found: ap_set_string_slot            (/usr/local/apache2/modules/mod_auth_vas.so)
        symbol not found: ap_dummy_mutex                (/usr/local/apache2/modules/mod_auth_vas.so)
        /usr/platform/SUNW,Ultra-60/lib/libc_psr.so.1




Can you tell me Am I missing some libraries?

Thanks
kannan

I am getting page moved 302 error from Ajax call

$
0
0

By enabling logging, I see that authentication info is not found in the cache, when AJAX call is made, so vsj java filter is redirecting for authentication token. User is already authenticated and established a user session.

Any help is appreciated.

 

Thanks

-Apparao

wyse T50 problem with key "." layout pt-BR keyboard ABNT2

$
0
0

I'm using Wyse T50 with brazilian ABNT2 keyboard(pt-BR) and the key "."(point) in numeric keyboard does work inside rdpclient. It works fine with console and other apps outside rdpclient but not inside. Using rdpclient with parameter --lx-debug helped to get the keycode 0x79 but I do not how to fix it. I installed Remmina/Rdesktop and all the keys works fine, so I guess the problem is with Wyse-rdpclient/RDP.

 

Any idea?

 

Thanks in advance

Alternate way to supply vsj properties

$
0
0

 

We are trying to use the vsj servlet filter in one of the vendor supplied web application, where we can not include vsj-federation.properties file as part of the deployments.
Is there alternate way of providing "fsProxy", "applicationUrl" and "fsCertificate" properties to the filter?

 


Using VAS Apache Module on Multiple Apache instances

$
0
0

Hi all,

 

- I have  a Web Server configured with 2 Apache Instances, each instance running as different user and port.

- I configured the VAS module for Active Directory Authentication on both instances

 

- So, now, the problem, is that in one instance the VAS authentication is working really good, and in the otherone,

we're having problems. It's always requesting Credentials when you try to access any websites hosted on this second instances.

 

The strange thing is that in the first instance, every website is working correctly and it's taking credentials automatically from browser.

 

Have anyone seen this kind of behavior?

 

 

Thanks in advance,

Obed N Munoz

Using Cached Kerberos Ticket to Authenticate SMB Share

$
0
0

I am using Quest Authentication Services to integrate my Linux systems with our lab domain. I want to use the cached kerberos tickets to authenticate without providing a password when mounting an exported SMB share using the command 'mount -t cifs <device> <dir> -o sec=krb5'. My understanding is that when request-key is called by the kernel cifs.upcall is used to locate the cached kerberos ticket. The problem I am having is that when I directly call cifs.upcall with the uid of the user it does not return anything and it has an exit code of 1. If I look at /var/log/messages I see the following log message related to the call.

 

Jun 19 09:55:03 merlin cifs.upcall: keyctl_describe_alloc failed: Required key not available

 

Per the cifs.upcall man page I added the following two lines to request-key.conf

 

create cifs.spnego * * /usr/local/sbin/cifs.upcall %k

create dns_resolver * * /usr/local/sbin/cifs.upcall %k

 

BK


SmartCard, OS X and QAS

$
0
0

Hi all.

 

I'm currently looking at adding Macs to our Active Directory using QAS. Our users all use SmartCards to authenticate, and getting that working in OS X is the primary reason that I'm looking at QAS.

 

After some work I've arrived at a working configuration, but I have a few questions.

 

* Logging on using cached credentials doesn't seem to work. If the computer isn't attached to the internal network I only get the "password box shake" when I enter the SmartCard PIN. No other error.

 

* Local authentication doesn't seem to work. The user is a local admin, but whenever I press a padlock I get a username/password dialog, not a SmartCard PIN dialog. The same thing happens when the screensaver starts.

 

* SUDO asks for a password, not a PIN.

 

What am I missing?

 

Thanks,

Fredrik

Auth Services and Domain Trusts

$
0
0

Hi,

 

Looking for some help and advice.

 

I have a Active Directory that I administer and can install Auth Services into. Within this AD I have some admin users that need access to Redhat machines, all no problem with Auth Services. However, my question is this.

 

If the AD at the other end of the Trust has users that I need to "Unix Enable", so they can also access the RedHat machines using their AD accounts, is that possible?

 

Note - the other AD is managed by another company and I have no possibility of getting anything installed or changed other than a trust established.

 

Can anyone help/suggest if this is possible?

 

Thanks,

Steve

Create pre-auth computer object with vastool

$
0
0
Hi,

I need to be able to create computer objects with vastool instead of being forced to log in to a windows server, run a vbs, and then drag'n'drop the object to the correct OU (OU varies alot).

It seems like vastool create should be able to help me out, but I can't get it to produce objects that can be joined to without password.

I've created a AD user (unixbuild) that has permissions to create computer objects, and to create the object I run this command:

#> vastool -u unixbuild create -o -c "OU=JavaServerPlatform,OU=SolarisServer,OU=Production,DC=deploylab,DC=bj" computer testzone
Password for unixbuild@DEPLOYLAB.BJ:
Computer testzone created
#>

If I check in AD I can see the new object in the correct OU, but when I then try to join it using:

root@testzone:~# vastool -u host/ -w testzone join -f -n testzone.deploylab.bj deploylab.bj

I get:

Checking whether computer is already joined to a domain ... no
ERROR: Could not authenticate as host/. Invalid username or password.
VAS_ERR_KRB5: Failed to obtain credentials. Client: TESTZONE$@DEPLOYLAB.BJ, Service: krbtgt/DEPLOYLAB.BJ@DEPLOYLAB.BJ, Server: bj-labdc-01.deploylab.bj
   Caused by:
   KRB5KDC_ERR_PREAUTH_FAILED (-1765328360): Preauthentication failed
ERROR: Could not join to the domain

So this seems like the "default" computer object password has not been set correctly, is there an option to the vastool create command I need to use, or do I need to specify my own "default" password (also needed to be put in the join script)?

Please help me in my quest for not needing to "use" a windows server when deploying and using my Solaris servers!

BR // Andreas Bjorshammar


Message was edited by: anbj_562

QAS and FileVault on OS X

$
0
0
Is there a way to use FileVault on OS X Mountain Lion with QAS? I mean so that the AD user can be selected during boot for the FileVault authentication.

Thanks,

Nils

Support for apache httpd 2.4?

$
0
0
Do you know if mod_auth_vas will work with Apache httpd 2.4? Or if there is any intention to support this, and if so what time frame this version is likely to be supported in?

Thanks,
Paul

Single Sign-On for Java 7 Not working

$
0
0

Hi,

 

We have been using winSSPI.dll on client side from 3.2 package. This dll is not working anymore in JDK 7.

 

The exception trace as follows :

 

[DEBUG] Mon Aug 26 14:30:10 CEST 2013 jcsi.kerberos: [init]: OS name = 'Windows 7', version = '6.1'

[DEBUG] Mon Aug 26 14:30:10 CEST 2013 jcsi.kerberos: [init]: isKerberosOS = true, isSessionKeySupported = true

[DEBUG] Mon Aug 26 14:30:10 CEST 2013 jcsi.kerberos: initialize: calling native method ...

[winSSPI.dll] initialize

[winSSPI.dll] initialize: done

[INFO] Mon Aug 26 14:30:10 CEST 2013 jcsi.kerberos: initialize: Successfully initialized Windows SSPI

[DEBUG] Mon Aug 26 14:30:10 CEST 2013 jcsi.kerberos: acquireCredentialsHandle: calling native method ...

[winSSPI.dll] acquireCredentialsHandle

[DEBUG] Mon Aug 26 14:30:10 CEST 2013 jcsi.kerberos: loadCredential: result = 0

Attempting initContext with principal: HTTP/appsec001.gaia.net.intra

initContext failed with principal: HTTP/appsec001.gaia.net.intra error: GSSException: com.dstc.security.kerberos.winSSPI.WinSSPIMechanismFactoryU2S configured by WinSSPIGSS for GSS-API Mechanism Factory cannot be created

Attempting initContext with principal: HOST/appsec001.gaia.net.intra

initContext failed with principal: HOST/appsec001.gaia.net.intra error: GSSException: com.dstc.security.kerberos.winSSPI.WinSSPIMechanismFactoryU2S configured by WinSSPIGSS for GSS-API Mechanism Factory cannot be created

initContext failed with all attempted principals

java.security.PrivilegedActionException: javax.security.auth.login.LoginException: LoginException: java.security.PrivilegedActionException: GSSException: com.dstc.security.kerberos.winSSPI.WinSSPIMechanismFactoryU2S configured by WinSSPIGSS for GSS-API Mechanism Factory cannot be created

          at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:373)

          at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:146)

          at weblogic.security.Security.runAs(Security.java:61)

          at security.role.TestKerberosEJBCall.main(TestKerberosEJBCall.java:32)

Caused by: javax.security.auth.login.LoginException: LoginException: java.security.PrivilegedActionException: GSSException: com.dstc.security.kerberos.winSSPI.WinSSPIMechanismFactoryU2S configured by WinSSPIGSS for GSS-API Mechanism Factory cannot be created

          at com.quest.vsj.weblogic.login.EjbClientKerberosLoginModule.login(EjbClientKerberosLoginModule.java:107)

          at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

          at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)

          at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

          at java.lang.reflect.Method.invoke(Method.java:606)

          at javax.security.auth.login.LoginContext.invoke(LoginContext.java:784)

          at javax.security.auth.login.LoginContext.access$000(LoginContext.java:203)

          at javax.security.auth.login.LoginContext$4.run(LoginContext.java:698)

          at javax.security.auth.login.LoginContext$4.run(LoginContext.java:696)

          at java.security.AccessController.doPrivileged(Native Method)

          at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:695)

          at javax.security.auth.login.LoginContext.login(LoginContext.java:594)

          at security.role.TestKerberosEJBCall$1.run(TestKerberosEJBCall.java:35)

          at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:363)

          ... 3 more

 

Any ideas if any newer version or patch is supporting both JDK 7 64 & 32 bit ?

 

Thanks in advance.

why?

$
0
0
HTTP Status 500 - com.wedgetail.idm.sso.ntlm.NtlmException: No servers available in AD domain example.com for NTLM authentication

VAS error "Unknown error 851968"

$
0
0
Hi.

I configured Oracle iAS apache to use mod_auth_vas
I have added to httpd.conf:
LoadModule auth_vas_module      libexec/mod_auth_vas.so
AuthVasServerPrincipal  ServiceHTPausgotst70@AMER.DELL.COM
AuthVasKeytabFile       /etc/opt/quest/vas/HTTP.keytab

I created file .htaccess in
htdocs/vas/ directory. Content is:
AuthType VAS
AuthVasAuthz On
Require valid-user

When I trying to load page in IE, I saw error:
"
Authorization RequiredAuthorization Required
This server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn't understand how to supply the credentials required.

Oracle-Application-Server-10g/10.1.3.4.0 Oracle-HTTP-Server Server at ausgotst70.us.dell.com Port 7790
"

Server logs listed below:
$ cat access_log.1245888000
10.24.164.152 - - [25/Jun/2009:10:40:52 +0100] "GET /vas/README.html HTTP/1.1" 401 536 0
10.24.164.152 - - [25/Jun/2009:10:40:52 +0100] "GET /vas/README.html HTTP/1.1" 401 536 0

$ cat ssl_request_log.1245888000
[25/Jun/2009:10:40:52 +0100] 10.24.164.152 TLSv1 SSL_RSA_WITH_RC4_128_MD5 "GET /vas/README.html HTTP/1.1" 536
[25/Jun/2009:10:40:52 +0100] 10.24.164.152 TLSv1 SSL_RSA_WITH_RC4_128_MD5 "GET /vas/README.html HTTP/1.1" 536

$ cat error_log.1245888000
[Thu Jun 25 10:40:52 2009] [error] [client 10.24.164.152] [ecid: 1245922852:10.30.101.222:3917:0:5,0] do_gss_spnego_accept: VAS_ERR_INTERNAL: First call to gss_accept_sec_context() failed, minor_status = -1765328240, result = 851968, display_status = " Miscellaneous failure (see text)", Mechanism Specific error text: "Unknown error 851968"
[Thu Jun 25 10:40:52 2009] [error] [client 10.24.164.152] [ecid: 1245922852:10.30.101.222:3917:0:5,0] do_gss_spnego_accept: VAS_ERR_INTERNAL: First call to gss_accept_sec_context() failed, minor_status = -1765328240, result = 851968, display_status = " Miscellaneous failure (see text)", Mechanism Specific error text: "Unknown error 851968"

Using secondary groups for sudo roles in AIX

$
0
0
Hi,
    We are using AIX 5.3 and using QAS 3.5. We have not tested "Quest SUDO" and so we are NOT using that as of now.

   We are finding that we cannot use sudo rules for secondary unix groups. It works only for Primary Unix group. Are we missing something here. Both Primary and secondary groups are Unix enabled and can been seen when we do a lsuser.

Thanks
Manohar

Stuck with kerberos authentication to Sharepoint

$
0
0
I have to connect to MS IIS server using SPNEGO token with Kerberos ticket inside, exactly as Internet Explorer does it.

If I use java GSSManager.initiateContext() it does request tickets with incorrect KDCOptions, dates and some other params I cannot control.

I tried com.dstc.security lib, and was able to get tickets axactly as Internet Explorer with couple of lines:

prepare required KDCOptions;
Credential tgt = kerberos.requestTicketGrantingTicket(new KerberosPassword(password.getBytes()), kdo, new Date(), d, new InetAddress[] {InetAddress.getByName("somename")}, null);
Credential srvt = kerberos.requestServiceTicket(TGT, new PrincipalName(2, "HTTP/server.domain.net"), REALM, kdo);

But how can I use these credentials or tickets inside to create SPNEGO token same as I can get with GSSManager.initiateContext()?

Using vendor SSH tools with QAS 4.0.3

$
0
0
Hi,

Since Jul. 17 2012, Quest-OpenSSH is no longer being maintained by Quest Software. I have followed the instructions on how to configure AD SSO on Linux but SSO does not work, I keep getting prompted to enter the user credentials.

Has anybody configured SSO with OpenSSH (bundled package) on RHEL5/6 and QAS 4.0.3?

Thanks!

quest-openssh-4.7p1_q1.217-1.rhel5.x86_64.rpm

$
0
0
there appears not to be a quest-openssh-4.7p1_q1.217-1.rhel5.x86_64.rpm although ther appears to be a quest-openssh-4.7p1_q1.217-1.rhel5.i386.rpm.  was unable to crete rpm's from source. 
Viewing all 1046 articles
Browse latest View live