{"id":2165,"date":"2014-09-14T08:22:00","date_gmt":"2014-09-14T06:22:00","guid":{"rendered":"https:\/\/www.dbi-services.com\/blog\/kerberos-sso-with-liferay-61\/"},"modified":"2014-09-14T08:22:00","modified_gmt":"2014-09-14T06:22:00","slug":"kerberos-sso-with-liferay-61","status":"publish","type":"post","link":"https:\/\/www.dbi-services.com\/blog\/kerberos-sso-with-liferay-61\/","title":{"rendered":"Kerberos SSO with Liferay 6.1"},"content":{"rendered":"<p><img decoding=\"async\" class=\"blog-image aligncenter\" src=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_MIT-Kerberos.jpg\" alt=\"\" \/><\/p>\n<p>In my previous blog, I described the process to <a href=\"\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\">install a Kerberos Client and how to Kerberized Alfresco<\/a>. In this blog, I will continue in the same way and present another application that could be configured to use the Kerberos MIT KDC: Liferay. Liferay is a very popular and a leader in Open Source solution for enterprise web platform (Intranet\/Extranet\/Internet web sites). Liferay could be bundled with several application servers like Tomcat, JBoss, Glassfish, but it could also be installed from scratch (deployment of a war file) with a lot of existing application servers.<\/p>\n<p>For this blog, I will need the following properties\/variables:<\/p>\n<ul>\n<li>example.com = the DNS Domain<\/li>\n<li>EXAMPLE.COM = the KDC REALM<\/li>\n<li>kdc01oel.example.com = the FQDN of the KDC<\/li>\n<li>mpatou@EXAMPLE.COM = the principal of a test user<\/li>\n<li>lif01.example.com = the FQDN of the Liferay host server<\/li>\n<li>otrs01.example.com = the FQDN of the OTRS host server<\/li>\n<\/ul>\n<p>Please be aware that some configurations below may not be appropriate for production environment. For example, I don&#8217;t configure Apache to run as a different user like &#8220;www&#8221; or &#8220;apache&#8221;, I don&#8217;t specify the installation directory for Apache or Kerberos, aso&#8230;<\/p>\n<p>Actual test configuration:<\/p>\n<ul>\n<li>OS: Oracle Enterprise Linux 6<\/li>\n<li>Liferay: Liferay Community Edition 6.1.1 GA2 &#8211; installed on \/opt\/liferay-6.1.1<\/li>\n<li>Application Server: Tomcat 7.0.27 &#8211; listening on port 8080<\/li>\n<\/ul>\n<p>This version of Liferay doesn&#8217;t have a default connection to a Linux KDC so everything should be done from scratch. The first thing to do is to add an Apache httpd in front of Liferay, if there is not already one, to process Kerberos requests. This part is described very quickly without extensive explanations because we don&#8217;t need all the functionalities of Apache. Of course you can, if you want, add some other configurations to the Apache httpd to manage for example an SSL certificate, the security of your application or other very important features of Apache&#8230; So first let&#8217;s check that the Tomcat used by Liferay is well configured for Kerberos with an Apache front-end:<\/p>\n<ul>\n<li>The HTTP port should be 8080 for this configuration<\/li>\n<li>The maxHttpHeaderSize must be increased to avoid authentication errors because an http header with a Kerberos ticket is much more bigger than a standard http header<\/li>\n<li>The AJP port should be 8009 for this configuration<\/li>\n<li>The tomcatAuthentication must be disabled to delegate the authentication to Apache<\/li>\n<\/ul>\n<p>To verify that, just take a look at the file server.xml:<\/p>\n<pre>[root ~]# vi \/opt\/liferay-6.1.1\/tomcat-7.0.27\/conf\/server.xml\n<a class=\"easyblog-thumb-preview\" title=\"1.png\" href=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/1.png\"><img loading=\"lazy\" decoding=\"async\" title=\"1.png\" src=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/1.png\" alt=\"1.png\" width=\"535\" height=\"121\" \/><\/a><\/pre>\n<p>Then download Apache httpd from the Apache web site (or use yum\/apt-get), extract the downloaded file and go inside of the extracted folder to install this Apache httpd with some default parameters:<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\">[root ~]# cd \/opt\n[root opt]# wget http:\/\/mirror.switch.ch\/mirror\/apache\/dist\/\/httpd\/httpd-2.4.10.tar.gz\n[root opt]# tar -xvf httpd-2.4.10.tar.gz\n[root opt]# cd httpd-2.4.10\n[root httpd-2.4.10]# .\/configure\n[root httpd-2.4.10]# make\n[root httpd-2.4.10]# make install<\/pre>\n<p>&nbsp;<\/p>\n<p>This will install Apache httpd 2.4.10 under \/usr\/local\/apache2. There could be some errors during the execution of &#8220;.\/configure&#8221; or &#8220;make&#8221; or &#8220;make install&#8221; but these kind of issues are generally well known and so the solutions to these issues could be found everywhere on Internet. An installation with the command apt-get will put the configuration file (named apache2.conf not httpd.conf) under \/etc\/apache2\/ so please adapt the description below to your environment.<\/p>\n<p>Once Apache httpd is installed, it must be configured to understand and use Kerberos for all incoming requests:<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\">[root httpd-2.4.10]# vi \/usr\/local\/apache2\/conf\/httpd.conf\n    # Add at the end of the file\n    Include \/opt\/liferay-6.1.1\/tomcat-7.0.27\/conf\/mod_jk.conf\n\u00a0\u00a0\u00a0 Include \/usr\/local\/apache2\/conf\/mod_kerb.conf\n\n[root httpd-2.4.10]# vi \/usr\/local\/apache2\/conf\/mod_kerb.conf\n    # New file for the configuration of the module \"mod_auth_kerb\" and Kerberos\n\u00a0\u00a0\u00a0 ServerAdmin root@localhost\n\u00a0\u00a0\u00a0 # The FQDN of the host server\n\u00a0\u00a0\u00a0 ServerName lif01.example.com:80\n\n    # Of course, find the location of the mod_auth_kerb and replace it there if\n    # it's not the same\n\u00a0\u00a0\u00a0 LoadModule auth_kerb_module \/usr\/local\/apache2\/modules\/mod_auth_kerb.so\n\n    \u2039Location \/\u203a\n\u00a0\u00a0\u00a0     AuthName \"EXAMPLE.COM\"\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 AuthType Kerberos\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 Krb5Keytab \/etc\/krb5lif.keytab\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 KrbAuthRealms EXAMPLE.COM\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 KrbMethodNegotiate On\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 KrbMethodK5Passwd On\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 require valid-user\n\u00a0\u00a0\u00a0 \u2039\/Location\u203a<\/pre>\n<p>&nbsp;<\/p>\n<p>The next step is to build the mod_auth_kerb and mod_jk. The build of mod_auth_kerb requires an already installed Kerberos client in this Liferay server. As seen below, my Kerberos client on this server is under \/usr\/local. Moreover, the buid of mod_jk may requires to specify the apxs binary used by Apache, that&#8217;s why there is the &#8220;&#8211;with-apxs&#8221; parameter:<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\">[root httpd-2.4.10]# cd ..\n[root opt]# wget http:\/\/sourceforge.net\/projects\/modauthkerb\/files\/mod_auth_kerb\/mod_auth_kerb-5.4\/mod_auth_kerb-5.4.tar.gz\/download\n[root opt]# tar -xvf mod_auth_kerb-5.4.tar.gz\n[root opt]# cd mod_auth_kerb-5.4\n[root mod_auth_kerb-5.4]# .\/configure --with-krb4=no --with-krb5=\/usr\/local --with-apache=\/usr\/local\/apache2\n[root mod_auth_kerb-5.4]# make\n[root mod_auth_kerb-5.4]# make install\n\n[root mod_auth_kerb-5.4]# cd ..\n[root opt]# wget http:\/\/mirror.switch.ch\/mirror\/apache\/dist\/tomcat\/tomcat-connectors\/jk\/tomcat-connectors-1.2.40-src.tar.gz\n[root opt]# tar -xvf tomcat-connectors-1.2.40-src.tar.gz\n[root opt]# cd tomcat-connectors-1.2.40-src\/native\n[root native]# .\/configure --with-apxs=\/usr\/local\/apache2\/bin\/apxs --enable-api-compatibility\n[root native]# make\n[root native]# make install<\/pre>\n<p>&nbsp;<\/p>\n<p>The module auth_mod_kerb doesn&#8217;t need extra configuration but it&#8217;s not the case of the mod_jk for which we will need to define several elements like log file and level, JkMount parameters which defines http requests that should be sent to the AJP connector, aso:<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\">[root native]# cd ..\/..\n[root opt]# vi \/opt\/liferay-6.1.1\/tomcat\/conf\/mod_jk.conf\n    LoadModule jk_module \/usr\/local\/apache2\/modules\/mod_jk.so\n\u00a0\u00a0\u00a0 JkWorkersFile \/opt\/liferay-6.1.1\/tomcat-7.0.27\/conf\/workers.properties\n\u00a0\u00a0\u00a0 JkLogFile \/usr\/local\/apache2\/logs\/mod_jk.log\n\u00a0\u00a0\u00a0 JkLogLevel debug\n\u00a0\u00a0\u00a0 JkLogStampFormat \"[%a %b %d %H:%M:%S %Y]\"\n\u00a0\u00a0\u00a0 # JkOptions indicate to send SSL KEY SIZE,\n\u00a0\u00a0\u00a0 JkOptions +ForwardKeySize +ForwardURICompat -ForwardDirectories\n\u00a0\u00a0\u00a0 # JkRequestLogFormat set the request format\n\u00a0\u00a0\u00a0 JkRequestLogFormat \"%w %V %T\"\n\u00a0\u00a0\u00a0 JkMount \/ ajp13\n\u00a0\u00a0\u00a0 JkMount \/* ajp13\n\n[root opt]# vi \/opt\/liferay-6.1.1\/tomcat\/conf\/workers.properties\n\u00a0\u00a0\u00a0 # Define 1 real worker named ajp13\n\u00a0\u00a0\u00a0 worker.list=ajp13\n\u00a0\u00a0\u00a0 worker.ajp13.type=ajp13\n\u00a0\u00a0\u00a0 worker.ajp13.host=localhost\n\u00a0\u00a0\u00a0 worker.ajp13.port=8009\n\u00a0\u00a0\u00a0 worker.ajp13.lbfactor=50\n\u00a0\u00a0\u00a0 worker.ajp13.cachesize=10\n\u00a0\u00a0\u00a0 worker.ajp13.cache_timeout=600\n\u00a0\u00a0\u00a0 worker.ajp13.socket_keepalive=1\n\u00a0\u00a0\u00a0 worker.ajp13.socket_timeout=300<\/pre>\n<p>Finally, the last configuration for Apache httpd is to configure a krb5.conf file for the Kerberos client to know where the KDC is located:<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\">[root opt]# vi \/etc\/krb5.conf\n\u00a0\u00a0\u00a0 [libdefaults]\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 default_realm = EXAMPLE.COM\n\n\u00a0\u00a0\u00a0 [realms]\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 EXAMPLE.COM = {\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 kdc = kdc01oel.example.com:88\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 admin_server = kdc01oel.example.com:749\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 default_domain = example.com\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 }\n\n\u00a0\u00a0\u00a0 [domain_realm]\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 .example.com = EXAMPLE.COM\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 example.com = EXAMPLE.COM<\/pre>\n<p>Once this is done, there is one step to execute on the KDC side for the configuration of Kerberos. Indeed, there is a configuration above in the file mod_kerb.conf that shows a keytab file named krb5lif.keytab. By default, this file doesn&#8217;t exist so we must create it! From the KDC host server, execute the following commands to create a new service account for Liferay and then create the keytab for this service account:<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\">[root opt]# kadmin\n    Authenticating as principal root\/admin@EXAMPLE.COM with password.\n    Password for root\/admin@EXAMPLE.COM:\u00a0 ##Enter here the root admin password##\n\nkadmin:\u00a0 addprinc HTTP\/lif01.example.com@EXAMPLE.COM\n    WARNING: no policy specified for HTTP\/lif01.example.com@EXAMPLE.COM; defaulting to no policy\n    Enter password for principal \"HTTP\/lif01.example.com@EXAMPLE.COM\":\u00a0 ##Enter a new password for this service account##\n    Re-enter password for principal \"HTTP\/lif01.example.com@EXAMPLE.COM\":\u00a0 ##Enter a new password for this service account##\n    Principal \"HTTP\/lif01.example.com@EXAMPLE.COM\" created.\n\nkadmin:\u00a0 ktadd -k \/etc\/krb5lif.keytab HTTP\/lif01.example.com@EXAMPLE.COM\n    Entry for principal HTTP\/lif01.example.com@EXAMPLE.COM with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab WRFILE:\/etc\/krb5lif.keytab.\n    Entry for principal HTTP\/lif01.example.com@EXAMPLE.COM with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab WRFILE:\/etc\/krb5lif.keytab.\n    Entry for principal HTTP\/lif01.example.com@EXAMPLE.COM with kvno 2, encryption type des3-cbc-sha1 added to keytab WRFILE:\/etc\/krb5lif.keytab.\n    Entry for principal HTTP\/lif01.example.com@EXAMPLE.COM with kvno 2, encryption type arcfour-hmac added to keytab WRFILE:\/etc\/krb5lif.keytab.\n\nkadmin:\u00a0 exit\n\n[root opt]# scp \/etc\/krb5lif.keytab root@lif01.example.com:\/etc\/\n    root@lif01.example.com's password:\n    krb5lif.keytab    [====================================\u203a]    100%    406    0.4KB\/s    00:00\n[root opt]# exit<\/pre>\n<p>From now on, all configurations required by Apache &amp; Tomcat to handle Kerberos tickets are done. The only remaining step and certainly the most complicated is to configure Liferay to understand and use this kind of authentication. For that purpose, a Liferay Hook must be created (in eclipse using the Liferay Plugin for example). Let&#8217;s name this Liferay Project created with the liferay-plugins-sdk-6.1.1: &#8220;custom-hook&#8221;. For the configuration below, I will suppose that this project is at the following location: &#8220;C:\/liferay-plugins-sdk-6.1.1\/hooks\/custom-hook\/&#8221; and this location is abbreviated to %CUSTOM_HOOK%. You will find at the bottom of this blog a link to download the files that should be in this custom-hook. Feel free to use it!<\/p>\n<p>To create a new authentication method, the first step is to create and edit the file %CUSTOM_HOOK%\/docroot\/WEB-INF\/liferay-hook.xml as follow:<\/p>\n<pre><a class=\"easyblog-thumb-preview\" title=\"liferay-hook.png\" href=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/liferay-hook.png\"><img loading=\"lazy\" decoding=\"async\" title=\"liferay-hook.png\" src=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/liferay-hook.png\" alt=\"liferay-hook.png\" width=\"558\" height=\"201\" \/><\/a><\/pre>\n<p>Then, create and insert in the file %CUSTOM_HOOK%\/docroot\/WEB-INF\/src\/portal.properties the following lines:<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\">    # This line defines the new auto login authentication used by Liferay\n\u00a0\u00a0\u00a0 auto.login.hooks=com.liferay.portal.security.auth.KerberosAutoLogin<\/pre>\n<p>And finally, the last step is to create the Java Class %CUSTOM_HOOK%\/docroot\/WEB-INF\/src\/com\/liferay\/portal\/security\/auth\/KerberosAutoLogin with the following content. This class is used to retrieve the Kerberos principal from the Kerberos Ticket received by Apache and then transforms this principal to log the user in Liferay. Please be aware that this code can probably not be used as such because it&#8217;s specific to our company: the screenName used in Liferay is equal to the principal used in the KDC. That&#8217;s why there is some logger.info in the code: to help you to find the good relation between the Liferay screenName and the KDC principal.<\/p>\n<p><a class=\"easyblog-thumb-preview\" title=\"AutoLogin.png\" href=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/AutoLogin.png\"><img loading=\"lazy\" decoding=\"async\" title=\"AutoLogin.png\" src=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/AutoLogin.png\" alt=\"AutoLogin.png\" width=\"793\" height=\"713\" \/><\/a><\/p>\n<p>After that, just build your hook and deploy it using the liferay deploy folder (\/opt\/liferay-6.1.1\/deploy\/). If necessary, restart Apache and Liferay using the services or the control scripts:<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\">[root opt]# \/opt\/liferay-6.1.1\/tomcat-7.0.27\/bin\/shutdown.sh\n[root opt]# \/opt\/liferay-6.1.1\/tomcat-7.0.27\/bin\/startup.sh\n[root opt]# \/usr\/local\/apache2\/bin\/apachectl -k stop\n[root opt]# \/usr\/local\/apache2\/bin\/apachectl -f \/usr\/local\/apache2\/conf\/httpd.conf<\/pre>\n<p>Wait for Liferay to start and that&#8217;s it, you should be able to obtain a Kerberos Ticket from the KDC, access to Liferay (through Apache on port 80) and you should be logged in automatically. That&#8217;s MAGIC!<\/p>\n<p>Thanks for reading and I hope you will be able to work with Kerberos for a long long time =).<\/p>\n<p>Custom hook download link: <a title=\"title\" href=\"http:\/\/dbi-services.com\/blog\/images\/easyblog_images\/132\/SSO Liferay\/custom-hook.zip\" target=\"_self\">custom-hook.zip<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>In my previous blog, I described the process to install a Kerberos Client and how to Kerberized Alfresco. In this blog, I will continue in the same way and present another application that could be configured to use the Kerberos MIT KDC: Liferay. Liferay is a very popular and a leader in Open Source solution [&hellip;]<\/p>\n","protected":false},"author":20,"featured_media":2166,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[197],"tags":[],"type_dbi":[],"class_list":["post-2165","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-application-integration-middleware"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.2 (Yoast SEO v27.5) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Kerberos SSO with Liferay 6.1 - dbi Blog<\/title>\n<meta name=\"description\" content=\"How to setup SSO using Kerberos in Liferay 6.1.1 CE.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.dbi-services.com\/blog\/kerberos-sso-with-liferay-61\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Kerberos SSO with Liferay 6.1\" \/>\n<meta property=\"og:description\" content=\"How to setup SSO using Kerberos in Liferay 6.1.1 CE.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.dbi-services.com\/blog\/kerberos-sso-with-liferay-61\/\" \/>\n<meta property=\"og:site_name\" content=\"dbi Blog\" \/>\n<meta property=\"article:published_time\" content=\"2014-09-14T06:22:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_MIT-Kerberos.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"170\" \/>\n\t<meta property=\"og:image:height\" content=\"178\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Morgan Patou\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@MorganPatou\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Morgan Patou\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"9 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kerberos-sso-with-liferay-61\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kerberos-sso-with-liferay-61\\\/\"},\"author\":{\"name\":\"Morgan Patou\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/c4d05b25843a9bc2ab20415dae6bd2d8\"},\"headline\":\"Kerberos SSO with Liferay 6.1\",\"datePublished\":\"2014-09-14T06:22:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kerberos-sso-with-liferay-61\\\/\"},\"wordCount\":1122,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kerberos-sso-with-liferay-61\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2022\\\/04\\\/2e1ax_default_entry_MIT-Kerberos.jpg\",\"articleSection\":[\"Application integration &amp; Middleware\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kerberos-sso-with-liferay-61\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kerberos-sso-with-liferay-61\\\/\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kerberos-sso-with-liferay-61\\\/\",\"name\":\"Kerberos SSO with Liferay 6.1 - dbi Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kerberos-sso-with-liferay-61\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kerberos-sso-with-liferay-61\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2022\\\/04\\\/2e1ax_default_entry_MIT-Kerberos.jpg\",\"datePublished\":\"2014-09-14T06:22:00+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/c4d05b25843a9bc2ab20415dae6bd2d8\"},\"description\":\"How to setup SSO using Kerberos in Liferay 6.1.1 CE.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kerberos-sso-with-liferay-61\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kerberos-sso-with-liferay-61\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kerberos-sso-with-liferay-61\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2022\\\/04\\\/2e1ax_default_entry_MIT-Kerberos.jpg\",\"contentUrl\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2022\\\/04\\\/2e1ax_default_entry_MIT-Kerberos.jpg\",\"width\":170,\"height\":178},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kerberos-sso-with-liferay-61\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Kerberos SSO with Liferay 6.1\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/\",\"name\":\"dbi Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/c4d05b25843a9bc2ab20415dae6bd2d8\",\"name\":\"Morgan Patou\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/5d7f5bec8b597db68a09107a6f5309e3870d6296ef94fb10ead4b09454ca67e5?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/5d7f5bec8b597db68a09107a6f5309e3870d6296ef94fb10ead4b09454ca67e5?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/5d7f5bec8b597db68a09107a6f5309e3870d6296ef94fb10ead4b09454ca67e5?s=96&d=mm&r=g\",\"caption\":\"Morgan Patou\"},\"description\":\"Morgan Patou has over 12 years of experience in Enterprise Content Management (ECM) systems, with a strong focus in recent years on platforms such as Alfresco, Documentum, and M-Files. He specializes in the architecture, setup, customization, and maintenance of ECM infrastructures in complex &amp; critical environments. Morgan is well-versed in both engineering and operations aspects, including high availability design, system integration, and lifecycle management. He also has a solid foundation in open-source and proprietary technologies - ranging from Apache, OpenLDAP or Kerberos to enterprise-grade systems like WebLogic. Morgan Patou holds an Engineering Degree in Computer Science from ENSISA (\u00c9cole Nationale Sup\u00e9rieure d'Ing\u00e9nieurs Sud Alsace) in Mulhouse, France. He is Alfresco Content Services Certified Administrator (ACSCA), Alfresco Content Services Certified Engineer (ACSCE) as well as OpenText Documentum Certified Administrator. His industry experience spans the Public Sector, IT Services, Financial Services\\\/Banking, and the Pharmaceutical industry.\",\"sameAs\":[\"https:\\\/\\\/blog.dbi-services.com\\\/author\\\/morgan-patou\\\/\",\"https:\\\/\\\/x.com\\\/MorganPatou\"],\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/author\\\/morgan-patou\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Kerberos SSO with Liferay 6.1 - dbi Blog","description":"How to setup SSO using Kerberos in Liferay 6.1.1 CE.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.dbi-services.com\/blog\/kerberos-sso-with-liferay-61\/","og_locale":"en_US","og_type":"article","og_title":"Kerberos SSO with Liferay 6.1","og_description":"How to setup SSO using Kerberos in Liferay 6.1.1 CE.","og_url":"https:\/\/www.dbi-services.com\/blog\/kerberos-sso-with-liferay-61\/","og_site_name":"dbi Blog","article_published_time":"2014-09-14T06:22:00+00:00","og_image":[{"width":170,"height":178,"url":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_MIT-Kerberos.jpg","type":"image\/jpeg"}],"author":"Morgan Patou","twitter_card":"summary_large_image","twitter_creator":"@MorganPatou","twitter_misc":{"Written by":"Morgan Patou","Est. reading time":"9 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.dbi-services.com\/blog\/kerberos-sso-with-liferay-61\/#article","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/kerberos-sso-with-liferay-61\/"},"author":{"name":"Morgan Patou","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/c4d05b25843a9bc2ab20415dae6bd2d8"},"headline":"Kerberos SSO with Liferay 6.1","datePublished":"2014-09-14T06:22:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/kerberos-sso-with-liferay-61\/"},"wordCount":1122,"commentCount":0,"image":{"@id":"https:\/\/www.dbi-services.com\/blog\/kerberos-sso-with-liferay-61\/#primaryimage"},"thumbnailUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_MIT-Kerberos.jpg","articleSection":["Application integration &amp; Middleware"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.dbi-services.com\/blog\/kerberos-sso-with-liferay-61\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.dbi-services.com\/blog\/kerberos-sso-with-liferay-61\/","url":"https:\/\/www.dbi-services.com\/blog\/kerberos-sso-with-liferay-61\/","name":"Kerberos SSO with Liferay 6.1 - dbi Blog","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/kerberos-sso-with-liferay-61\/#primaryimage"},"image":{"@id":"https:\/\/www.dbi-services.com\/blog\/kerberos-sso-with-liferay-61\/#primaryimage"},"thumbnailUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_MIT-Kerberos.jpg","datePublished":"2014-09-14T06:22:00+00:00","author":{"@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/c4d05b25843a9bc2ab20415dae6bd2d8"},"description":"How to setup SSO using Kerberos in Liferay 6.1.1 CE.","breadcrumb":{"@id":"https:\/\/www.dbi-services.com\/blog\/kerberos-sso-with-liferay-61\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.dbi-services.com\/blog\/kerberos-sso-with-liferay-61\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.dbi-services.com\/blog\/kerberos-sso-with-liferay-61\/#primaryimage","url":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_MIT-Kerberos.jpg","contentUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_MIT-Kerberos.jpg","width":170,"height":178},{"@type":"BreadcrumbList","@id":"https:\/\/www.dbi-services.com\/blog\/kerberos-sso-with-liferay-61\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.dbi-services.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Kerberos SSO with Liferay 6.1"}]},{"@type":"WebSite","@id":"https:\/\/www.dbi-services.com\/blog\/#website","url":"https:\/\/www.dbi-services.com\/blog\/","name":"dbi Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/c4d05b25843a9bc2ab20415dae6bd2d8","name":"Morgan Patou","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/5d7f5bec8b597db68a09107a6f5309e3870d6296ef94fb10ead4b09454ca67e5?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/5d7f5bec8b597db68a09107a6f5309e3870d6296ef94fb10ead4b09454ca67e5?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/5d7f5bec8b597db68a09107a6f5309e3870d6296ef94fb10ead4b09454ca67e5?s=96&d=mm&r=g","caption":"Morgan Patou"},"description":"Morgan Patou has over 12 years of experience in Enterprise Content Management (ECM) systems, with a strong focus in recent years on platforms such as Alfresco, Documentum, and M-Files. He specializes in the architecture, setup, customization, and maintenance of ECM infrastructures in complex &amp; critical environments. Morgan is well-versed in both engineering and operations aspects, including high availability design, system integration, and lifecycle management. He also has a solid foundation in open-source and proprietary technologies - ranging from Apache, OpenLDAP or Kerberos to enterprise-grade systems like WebLogic. Morgan Patou holds an Engineering Degree in Computer Science from ENSISA (\u00c9cole Nationale Sup\u00e9rieure d'Ing\u00e9nieurs Sud Alsace) in Mulhouse, France. He is Alfresco Content Services Certified Administrator (ACSCA), Alfresco Content Services Certified Engineer (ACSCE) as well as OpenText Documentum Certified Administrator. His industry experience spans the Public Sector, IT Services, Financial Services\/Banking, and the Pharmaceutical industry.","sameAs":["https:\/\/blog.dbi-services.com\/author\/morgan-patou\/","https:\/\/x.com\/MorganPatou"],"url":"https:\/\/www.dbi-services.com\/blog\/author\/morgan-patou\/"}]}},"_links":{"self":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/2165","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/users\/20"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/comments?post=2165"}],"version-history":[{"count":0,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/2165\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/media\/2166"}],"wp:attachment":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/media?parent=2165"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/categories?post=2165"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/tags?post=2165"},{"taxonomy":"type","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/type_dbi?post=2165"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}