{"id":4793,"date":"2015-05-18T15:09:31","date_gmt":"2015-05-18T13:09:31","guid":{"rendered":"https:\/\/www.dbi-services.com\/blog\/kerberos-configuration-for-dfs-6-7-sp1\/"},"modified":"2015-05-18T15:09:31","modified_gmt":"2015-05-18T13:09:31","slug":"kerberos-configuration-for-dfs-6-7-sp1","status":"publish","type":"post","link":"https:\/\/www.dbi-services.com\/blog\/kerberos-configuration-for-dfs-6-7-sp1\/","title":{"rendered":"Kerberos configuration for DFS 6.7 SP1"},"content":{"rendered":"<p>In my last post, I explained how to configure <a title=\"Kerberos configuration\" href=\"http:\/\/dbi-services.com\/blog\/kerberos-configuration-for-a-cs-6-7-sp1\/\">Kerberos for a CS 6.7 SP1<\/a>. Unfortunately if you only configure the Content Server, it will almost be useless&#8230; If you want this configuration to be useful, then you will also have to configure the Kerberos SSO for the Documentum Foundation Services (DFS). That&#8217;s why in this blog post I will describe step by step what need to be done for that purpose.<br \/>\nSo what are the pre-requisites to setup the Kerberos SSO for the Documentum Foundation Services? Well of course you will need an application server for your DFS, a Content Server that is already installed and an Active Directory to generate the keytab(s). Just to let you know, I used (for the DFS) a Tomcat application server that is on the Content Server&#8217;s machine and an Active Directory on a Windows Server 2008 R2. Let&#8217;s define the following properties:<\/p>\n<ul>\n<li>Active Directory &#8211; user = dfskrb<\/li>\n<li>Active Directory &#8211; password = ##dfskrb_pwd##<\/li>\n<li>Active Directory &#8211; domain = DOMAIN.COM<\/li>\n<li>Active Directory &#8211; hostname1 = adsrv1.domain.com<\/li>\n<li>Active Directory &#8211; hostname2 = adsrv2.domain.com<\/li>\n<li>Alias of the DFS&#8217; host = csdfs.domain.com (can be a Load Balancer alias)<\/li>\n<li>$CATALINA_HOME = \/opt\/tomcat<\/li>\n<\/ul>\n<h3>I. Active Directory prerequisites<\/h3>\n<p>As always when working with Kerberos on an Active Directory, the first thing to do is to create a user. So let&#8217;s create this user with the following properties:<\/p>\n<ul>\n<li>User name: dfskrb<\/li>\n<li>Support AES 128 bits encryption<\/li>\n<li>This account MUST NOT support AES 256 bits encryption. I set it that way because the Content Server doesn&#8217;t support AES 256 bits encryption so I disabled it for the DFS part too.<\/li>\n<li>Trust for Delegation to any service (Kerberos Only)<\/li>\n<li>Password never expires<\/li>\n<li>Account never expires<\/li>\n<li>Account not locked<\/li>\n<\/ul>\n<p>Once the user has been created, you can proceed with the keytab creation using the comment prompt on the Active Directory host:<\/p>\n<p><a class=\"easyblog-thumb-preview\" title=\"dfs_keytab.png\" href=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/2022\/04\/dfs_keytab.png\"><img decoding=\"async\" title=\"dfs_keytab.png\" src=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/2022\/04\/dfs_keytab.png\" alt=\"dfs_keytab.png\" \/><\/a><br \/>\nFor the Content Server part, the name of the &#8220;princ&#8221; (SPN) has to be &#8220;CS\/##repository_name##&#8221;. For the DFS part, the EMC documentation ask you to generate a keytab with a SPN that is &#8220;DFS\/##dfs_url##:##dfs_port##&#8221;. In fact, if you are going to use only one DFS url\/port, then you don&#8217;t need to add the port in the SPN of the DFS.<br \/>\nRegarding the name of the keytab, for the Content Server part, it has to be &#8220;##repository_name##.keytab&#8221; for the Content Server to be able to automatically recognize it during the server re-initialization. For the DFS part, the name of the keytab isn&#8217;t important because you will have to configure it manually.<\/p>\n<h3>II. Configuration of the Documentum Foundation Services side<\/h3>\n<p>So let&#8217;s start the configuration of the Kerberos SSO for the DFS. The first thing to do is of course to transfer the keytab created previously (dfs.keytab) from the Active Directory to the host of the DFS (a Linux in my case). There are no specific locations for this keytab so you just have to put it somewhere and remember this location. For this example, I will create a folder that will contain all elements that are required. Please make sure that the keytab belongs to the Documentum installation owner (user and group) on the file system with the appropriate permissions (640).<\/p>\n<p><code>[dmadmin ~]$ echo $CATALINA_HOME<br \/>\n\/opt\/tomcat<br \/>\n[dmadmin ~]$ mkdir \/opt\/kerberos<br \/>\n[dmadmin ~]$ mv ~\/dfs.keytab \/opt\/kerberos<br \/>\n[dmadmin ~]$ chmod 640 \/opt\/kerberos\/dfs.keytab<\/code><\/p>\n<p>Create the file &#8220;\/opt\/kerberos\/jaasDfs.conf&#8221; with the following content:<\/p>\n<p><code>[dmadmin ~]$ cat \/opt\/kerberos\/jaasDfs.conf<br \/>\nDFS-csdfs-domain-com {<br \/>\ncom.sun.security.auth.module.Krb5LoginModule required<br \/>\ndebug=true<br \/>\nprincipal=\"DFS\/csdfs.domain.com@DOMAIN.COM\"<br \/>\nrealm=\"DOMAIN.COM\"<br \/>\nrefreshKrb5Config=true<br \/>\nnoTGT=true<br \/>\nuseKeyTab=true<br \/>\nstoreKey=true<br \/>\ndoNotPrompt=true<br \/>\nuseTicketCache=false<br \/>\nisInitiator=false<br \/>\nkeyTab=\"\/opt\/kerberos\/dfs.keytab\";<br \/>\n};<\/code><\/p>\n<p>The first line of this file jaasDfs.conf is the name of the &#8220;module&#8221;. This name is derived from the SPN (or principal) of the DFS: take the SPN, keep the uppercase\/lowercase characters, remove the REALM (everything that is after the at-sign (included)) and replaced all special characters (slash, back-slash, point, colon, aso&#8230;) with a simple dash &#8220;-&#8220;.<br \/>\nThe next thing to do is to modify the DFS war file. So let&#8217;s create a backup of this file and prepare its modification:<\/p>\n<p><code>[dmadmin ~]$ cd $CATALINA_HOME\/webapps\/<br \/>\n[dmadmin ~]$ cp emc-dfs.war emc-dfs.war.bck_$(date +%Y%m%d)<br \/>\n[dmadmin ~]$ cp emc-dfs.war \/tmp\/<br \/>\n[dmadmin ~]$ cd \/tmp<br \/>\n[dmadmin ~]$ unzip emc-dfs.war -d \/tmp\/emc-dfs<br \/>\n<\/code><\/p>\n<p>The setup of the Kerberos SSO requires some jar files that aren&#8217;t necessarily present on a default installation. For that purpose, you can copy these jar files from the Content Server to the new dfs:<\/p>\n<fieldset>\n<pre>[dmadmin ~]$ cp $DOCUMENTUM\/product\/dfc6.7\/dfc\/jcifs-krb5-1.3.1.jar \/tmp\/emc-dfs\/WEB-INF\/lib\/\n[dmadmin ~]$ cp $DOCUMENTUM\/product\/dfc6.7\/dfc\/krbutil.jar \/tmp\/emc-dfs\/WEB-INF\/lib\/\n[dmadmin ~]$ cp $DOCUMENTUM\/product\/dfc6.7\/dfc\/vsj-license.jar \/tmp\/emc-dfs\/WEB-INF\/lib\/\n[dmadmin ~]$ cp $DOCUMENTUM\/product\/dfc6.7\/dfc\/vsj-standard-3.3.jar \/tmp\/emc-dfs\/WEB-INF\/lib\/\n[dmadmin ~]$ cp $DOCUMENTUM\/product\/dfc6.7\/dfc\/questFixForJDK7.jar \/tmp\/emc-dfs\/WEB-INF\/lib\/<\/pre>\n<\/fieldset>\n<p>Once done, a Kerberos handler must be added to the DFS. For that purpose, open the file authorized-service-handler-chain.xml, locate the XML comment that start with &#8220;Any handler using ContextFactory&#8221; and add the following lines just before this comment:<\/p>\n<p><a class=\"easyblog-thumb-preview\" title=\"authorization_chain.png\" href=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/2022\/04\/authorization_chain.png\"><img decoding=\"async\" title=\"authorization_chain.png\" src=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/2022\/04\/authorization_chain.png\" alt=\"authorization_chain.png\" \/><\/a><br \/>\nThen, some Kerberos specific configurations must be added to the web.xml file. For that purpose, open this file and add the following lines at the end, just before the web-app end tag (before the last line):<\/p>\n<p><a class=\"easyblog-thumb-preview\" title=\"web_xml.png\" href=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/2022\/04\/web_xml.png\"><img decoding=\"async\" title=\"web_xml.png\" src=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/2022\/04\/web_xml.png\" alt=\"web_xml.png\" \/><\/a><br \/>\nIn the above configuration, only the &#8220;env-entry-value&#8221; for each &#8220;env-entry&#8221; section should be changed to match your environment. As you can see, the krb5.conf file referenced here is in \/opt\/kerberos. You can use the same krb5.conf file as the one used for the Content Server or you can specify a separate file. As this file can be the same for the Content Server and the DFS I will not set it here but just check my last post to get more information about that.<br \/>\nSo the configuration is now over and you can just repackage and re-deploy the new DFS:<\/p>\n<p><code>[dmadmin ~]$ cd \/tmp\/emc-dfs\/<br \/>\n[dmadmin ~]$ jar -cvf emc-dfs.war *<br \/>\n[dmadmin ~]$ $CATALINA_HOME\/bin\/shutdown.sh<br \/>\n[dmadmin ~]$ mv emc-dfs.war $CATALINA_HOME\/webapps\/<br \/>\n[dmadmin ~]$ cd $CATALINA_HOME<br \/>\n[dmadmin ~]$ rm -Rf emc-dfs\/<br \/>\n[dmadmin ~]$ $CATALINA_HOME\/bin\/startup.sh<\/code><\/p>\n<p>Once done, the Tomcat application server should have been started and the new version of the DFS WAR file should have been deployed. If the Content Server and the DFS are properly setup to use the Kerberos SSO, then you should be able to execute a .NET or Java code to get a Kerberos Ticket for the DFS and work with the DFS features.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In my last post, I explained how to configure Kerberos for a CS 6.7 SP1. Unfortunately if you only configure the Content Server, it will almost be useless&#8230; If you want this configuration to be useful, then you will also have to configure the Kerberos SSO for the Documentum Foundation Services (DFS). That&#8217;s why in&hellip;&nbsp;<\/p>\n","protected":false},"author":20,"featured_media":4794,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","neve_meta_reading_time":"","_themeisle_gutenberg_block_has_review":false,"footnotes":""},"categories":[4134,4179],"tags":[444,445],"class_list":["post-4793","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-application-server","category-documentum","tag-kerberos","tag-sso"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.4 (Yoast SEO v28.7) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Kerberos configuration for DFS 6.7 SP1 - dbi services | Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.dbi-services.com\/blog\/kerberos-configuration-for-dfs-6-7-sp1\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Kerberos configuration for DFS 6.7 SP1\" \/>\n<meta property=\"og:description\" content=\"In my last post, I explained how to configure Kerberos for a CS 6.7 SP1. Unfortunately if you only configure the Content Server, it will almost be useless&#8230; If you want this configuration to be useful, then you will also have to configure the Kerberos SSO for the Documentum Foundation Services (DFS). That&#8217;s why in&hellip;&nbsp;\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.dbi-services.com\/blog\/kerberos-configuration-for-dfs-6-7-sp1\/\" \/>\n<meta property=\"og:site_name\" content=\"dbi services | Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/dbiservices\/\" \/>\n<meta property=\"article:published_time\" content=\"2015-05-18T13:09:31+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/2022\/04\/dfs_keytab.png\" \/>\n\t<meta property=\"og:image:width\" content=\"674\" \/>\n\t<meta property=\"og:image:height\" content=\"44\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Morgan Patou\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@MorganPatou\" \/>\n<meta name=\"twitter:site\" content=\"@dbiservices\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Morgan Patou\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kerberos-configuration-for-dfs-6-7-sp1\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kerberos-configuration-for-dfs-6-7-sp1\\\/\"},\"author\":{\"name\":\"Morgan Patou\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/80b23b8d61648c45dd30be73b6b6979d\"},\"headline\":\"Kerberos configuration for DFS 6.7 SP1\",\"datePublished\":\"2015-05-18T13:09:31+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kerberos-configuration-for-dfs-6-7-sp1\\\/\"},\"wordCount\":924,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kerberos-configuration-for-dfs-6-7-sp1\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/04\\\/dfs_keytab.png\",\"keywords\":[\"Kerberos\",\"SSO\"],\"articleSection\":[\"Application Server\",\"Documentum\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kerberos-configuration-for-dfs-6-7-sp1\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kerberos-configuration-for-dfs-6-7-sp1\\\/\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kerberos-configuration-for-dfs-6-7-sp1\\\/\",\"name\":\"Kerberos configuration for DFS 6.7 SP1 - dbi services | Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kerberos-configuration-for-dfs-6-7-sp1\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kerberos-configuration-for-dfs-6-7-sp1\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/04\\\/dfs_keytab.png\",\"datePublished\":\"2015-05-18T13:09:31+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kerberos-configuration-for-dfs-6-7-sp1\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kerberos-configuration-for-dfs-6-7-sp1\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kerberos-configuration-for-dfs-6-7-sp1\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/04\\\/dfs_keytab.png\",\"contentUrl\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/04\\\/dfs_keytab.png\",\"width\":674,\"height\":44},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/kerberos-configuration-for-dfs-6-7-sp1\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Kerberos configuration for DFS 6.7 SP1\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/\",\"name\":\"dbi services Blog\",\"description\":\"#BeSharing\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#organization\"},\"alternateName\":\"dbi Blog\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#organization\",\"name\":\"dbi services\",\"alternateName\":\"dbi\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/dbi-services-logo.png\",\"contentUrl\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/dbi-services-logo.png\",\"width\":512,\"height\":512,\"caption\":\"dbi services\"},\"image\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/dbiservices\\\/\",\"https:\\\/\\\/x.com\\\/dbiservices\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/dbi-services\\\/\",\"https:\\\/\\\/www.youtube.com\\\/user\\\/dbiservices\"],\"description\":\"Swiss IT consulting and services company specialised in efficient data infrastructures and platforms: databases, application servers, cloud, DevOps, digitalization, analytics, data quality and monitoring. Headquartered in Del\u00e9mont with offices in Nyon, Basel, Bern and Zurich.\",\"email\":\"info@dbi-services.com\",\"telephone\":\"+41 32 422 96 00\",\"legalName\":\"dbi services SA\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/80b23b8d61648c45dd30be73b6b6979d\",\"name\":\"Morgan Patou\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/08\\\/MOP_web-min-scaled.jpg\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/08\\\/MOP_web-min-scaled.jpg\",\"contentUrl\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/08\\\/MOP_web-min-scaled.jpg\",\"caption\":\"Morgan Patou\"},\"description\":\"Morgan Patou has over 15 years of experience building and deploying Java\\\/J2EE applications. He specializes in Enterprise Content Management (ECM) solutions such as Alfresco and Documentum, covering open-source (Apache, OpenLDAP, Kerberos) and proprietary (WebLogic) technologies, with deep expertise in business requirement analysis, ECM architecture, and high-availability infrastructure for mission-critical environments. He oversees knowledge management and technology direction for the ECM practice. He holds Alfresco Content Services Certified Administrator (ACSCA) and Certified Engineer (ACSCE) credentials, plus an Engineering degree in Computer Science from ENSISA Mulhouse. His industry experience covers the public sector, IT, financial services\\\/banking, and pharmaceutical industries.\",\"sameAs\":[\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/author\\\/morgan-patou\\\/\",\"https:\\\/\\\/x.com\\\/MorganPatou\"],\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/author\\\/morgan-patou\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Kerberos configuration for DFS 6.7 SP1 - dbi services | Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.dbi-services.com\/blog\/kerberos-configuration-for-dfs-6-7-sp1\/","og_locale":"en_US","og_type":"article","og_title":"Kerberos configuration for DFS 6.7 SP1","og_description":"In my last post, I explained how to configure Kerberos for a CS 6.7 SP1. Unfortunately if you only configure the Content Server, it will almost be useless&#8230; If you want this configuration to be useful, then you will also have to configure the Kerberos SSO for the Documentum Foundation Services (DFS). That&#8217;s why in&hellip;&nbsp;","og_url":"https:\/\/www.dbi-services.com\/blog\/kerberos-configuration-for-dfs-6-7-sp1\/","og_site_name":"dbi services | Blog","article_publisher":"https:\/\/www.facebook.com\/dbiservices\/","article_published_time":"2015-05-18T13:09:31+00:00","og_image":[{"width":674,"height":44,"url":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/2022\/04\/dfs_keytab.png","type":"image\/png"}],"author":"Morgan Patou","twitter_card":"summary_large_image","twitter_creator":"@MorganPatou","twitter_site":"@dbiservices","twitter_misc":{"Written by":"Morgan Patou","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.dbi-services.com\/blog\/kerberos-configuration-for-dfs-6-7-sp1\/#article","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/kerberos-configuration-for-dfs-6-7-sp1\/"},"author":{"name":"Morgan Patou","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/80b23b8d61648c45dd30be73b6b6979d"},"headline":"Kerberos configuration for DFS 6.7 SP1","datePublished":"2015-05-18T13:09:31+00:00","mainEntityOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/kerberos-configuration-for-dfs-6-7-sp1\/"},"wordCount":924,"commentCount":0,"publisher":{"@id":"https:\/\/www.dbi-services.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.dbi-services.com\/blog\/kerberos-configuration-for-dfs-6-7-sp1\/#primaryimage"},"thumbnailUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/2022\/04\/dfs_keytab.png","keywords":["Kerberos","SSO"],"articleSection":["Application Server","Documentum"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.dbi-services.com\/blog\/kerberos-configuration-for-dfs-6-7-sp1\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.dbi-services.com\/blog\/kerberos-configuration-for-dfs-6-7-sp1\/","url":"https:\/\/www.dbi-services.com\/blog\/kerberos-configuration-for-dfs-6-7-sp1\/","name":"Kerberos configuration for DFS 6.7 SP1 - dbi services | Blog","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/kerberos-configuration-for-dfs-6-7-sp1\/#primaryimage"},"image":{"@id":"https:\/\/www.dbi-services.com\/blog\/kerberos-configuration-for-dfs-6-7-sp1\/#primaryimage"},"thumbnailUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/2022\/04\/dfs_keytab.png","datePublished":"2015-05-18T13:09:31+00:00","breadcrumb":{"@id":"https:\/\/www.dbi-services.com\/blog\/kerberos-configuration-for-dfs-6-7-sp1\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.dbi-services.com\/blog\/kerberos-configuration-for-dfs-6-7-sp1\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.dbi-services.com\/blog\/kerberos-configuration-for-dfs-6-7-sp1\/#primaryimage","url":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/2022\/04\/dfs_keytab.png","contentUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/2022\/04\/dfs_keytab.png","width":674,"height":44},{"@type":"BreadcrumbList","@id":"https:\/\/www.dbi-services.com\/blog\/kerberos-configuration-for-dfs-6-7-sp1\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.dbi-services.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Kerberos configuration for DFS 6.7 SP1"}]},{"@type":"WebSite","@id":"https:\/\/www.dbi-services.com\/blog\/#website","url":"https:\/\/www.dbi-services.com\/blog\/","name":"dbi services Blog","description":"#BeSharing","publisher":{"@id":"https:\/\/www.dbi-services.com\/blog\/#organization"},"alternateName":"dbi Blog","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.dbi-services.com\/blog\/#organization","name":"dbi services","alternateName":"dbi","url":"https:\/\/www.dbi-services.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/2026\/09\/dbi-services-logo.png","contentUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/2026\/09\/dbi-services-logo.png","width":512,"height":512,"caption":"dbi services"},"image":{"@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/dbiservices\/","https:\/\/x.com\/dbiservices","https:\/\/www.linkedin.com\/company\/dbi-services\/","https:\/\/www.youtube.com\/user\/dbiservices"],"description":"Swiss IT consulting and services company specialised in efficient data infrastructures and platforms: databases, application servers, cloud, DevOps, digitalization, analytics, data quality and monitoring. Headquartered in Del\u00e9mont with offices in Nyon, Basel, Bern and Zurich.","email":"info@dbi-services.com","telephone":"+41 32 422 96 00","legalName":"dbi services SA"},{"@type":"Person","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/80b23b8d61648c45dd30be73b6b6979d","name":"Morgan Patou","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/2022\/08\/MOP_web-min-scaled.jpg","url":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/2022\/08\/MOP_web-min-scaled.jpg","contentUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/2022\/08\/MOP_web-min-scaled.jpg","caption":"Morgan Patou"},"description":"Morgan Patou has over 15 years of experience building and deploying Java\/J2EE applications. He specializes in Enterprise Content Management (ECM) solutions such as Alfresco and Documentum, covering open-source (Apache, OpenLDAP, Kerberos) and proprietary (WebLogic) technologies, with deep expertise in business requirement analysis, ECM architecture, and high-availability infrastructure for mission-critical environments. He oversees knowledge management and technology direction for the ECM practice. He holds Alfresco Content Services Certified Administrator (ACSCA) and Certified Engineer (ACSCE) credentials, plus an Engineering degree in Computer Science from ENSISA Mulhouse. His industry experience covers the public sector, IT, financial services\/banking, and pharmaceutical industries.","sameAs":["https:\/\/www.dbi-services.com\/blog\/author\/morgan-patou\/","https:\/\/x.com\/MorganPatou"],"url":"https:\/\/www.dbi-services.com\/blog\/author\/morgan-patou\/"}]}},"_links":{"self":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/4793","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/users\/20"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/comments?post=4793"}],"version-history":[{"count":0,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/4793\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/media\/4794"}],"wp:attachment":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/media?parent=4793"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/categories?post=4793"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/tags?post=4793"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}