We are trying to use the vsj servlet filter in one of the vendor supplied web application, where we can not include vsj-federation.properties file as part of the deployments.
Is there alternate way of providing "fsProxy", "applicationUrl" and "fsCertificate" properties to the filter?
Hi all,
- I have a Web Server configured with 2 Apache Instances, each instance running as different user and port.
- I configured the VAS module for Active Directory Authentication on both instances
- So, now, the problem, is that in one instance the VAS authentication is working really good, and in the otherone,
we're having problems. It's always requesting Credentials when you try to access any websites hosted on this second instances.
The strange thing is that in the first instance, every website is working correctly and it's taking credentials automatically from browser.
Have anyone seen this kind of behavior?
Thanks in advance,
Obed N Munoz
I am using Quest Authentication Services to integrate my Linux systems with our lab domain. I want to use the cached kerberos tickets to authenticate without providing a password when mounting an exported SMB share using the command 'mount -t cifs <device> <dir> -o sec=krb5'. My understanding is that when request-key is called by the kernel cifs.upcall is used to locate the cached kerberos ticket. The problem I am having is that when I directly call cifs.upcall with the uid of the user it does not return anything and it has an exit code of 1. If I look at /var/log/messages I see the following log message related to the call.
Jun 19 09:55:03 merlin cifs.upcall: keyctl_describe_alloc failed: Required key not available
Per the cifs.upcall man page I added the following two lines to request-key.conf
create cifs.spnego * * /usr/local/sbin/cifs.upcall %k
create dns_resolver * * /usr/local/sbin/cifs.upcall %k
BK
AuthType VASRequire group S-1-4-65-1004XXX348-13XXXX898-XXXX001333-XXXX89
I know we can protect the directory & users with VAS. I couldn’t find any document and FAQ to protect particular URI's similar to siteminder.
Hello Quest support,
I've downloaded the latest version (5.2.1.13) of Quest openssh for AIX 5.3, available on:
http://rc.quest.com/topics/openssh/
After installing it on AIX 6.1 I cannot start the ssh daemon. It keeps failing and generating the following message on the AIX error log:
---------------------------------------------------------------------------
LABEL: SRC_SVKO
IDENTIFIER: BC3BE5A3
Date/Time: Tue Feb 1 09:27:41 CUT 2011
Sequence Number: 12988
Machine Id: 00C8CFA44C00
Node Id: ddasy040
Class: S
Type: PERM
WPAR: Global
Resource Name: SRC
Description
SOFTWARE PROGRAM ERROR
Probable Causes
APPLICATION PROGRAM
Failure Causes
SOFTWARE PROGRAM
Recommended Actions
MANUALLY RESTART SUBSYSTEM IF NEEDED
Detail Data
SYMPTOM CODE
65280
SOFTWARE ERROR CODE
-9017
ERROR CODE
0
DETECTING MODULE
'srchevn.c'@line:'376'
FAILING MODULE
sshd-quest
---------------------------------------------------------------------------
The version of the AIX that I'm using is:
$ oslevel -s
6100-05-03-1036
Any advice?
We have an AD group 'foo'. User Abe is added to it using AD tools.
I cannot see this user in the group using vastool on Solaris. And of course the user cannot login.
$ vastool list groups | grep foo
foo:VAS:2010:john.doe@na.company.com,harry.who@na.company.com
$
I've executed vastool flush to no affect.
What am I doing wrong?
I was trying to find info on OpenSSH for AIX 6.1 and 7.1.
Not sure if current version supports/available.
please give info
thx
Dual Authentication working with VAS or else an explanation as to why it is not possible.
Our understanding of dual authentication derives from the remarks on p. 56 of the Vintella Authentication Services 3.3.2 Solutions Guide, in the section Mapped User Mode. These remarks refer to PAM and state
"Though not the default configuration, you can configure a system to allow
mapped local accounts to be able to authenticate with either their old system
account password or the password of the Active Directory account to which they
are mapped. To do this, modify your system's PAM configuration. You will see
the pam_vas3 module configured near the top of the PAM stack. The module
configuration should consist of two lines: auth sufficient pam_vas3.so create_homedir get_nonvas_pass auth requisite pam_vas3.so echo_return
To allow authentication with both passwords, remove the second line." On customer systems (Red Hat Enterprise Linux AS 4) this does not work. PAM logging shows no evidence that the local user password is looked up. We login only via ssh (Quest OpenSSH version 4.7p1_q1.217). At present all logins are from a linux jump host to the desired host. Does this require any special configuration? PAM configs suggest that authentication is passed to system-auth. While dual authentication is not part of our long term solution it has been requested by users as a prerequisite for migration and our failure to get it working is holding us up. Thanks
.. please help