Kerberos realm

From scm-return-42919-apmail-geronimo-scm-archive=geronimo.apache.org@geronimo.apache.org Thu Jun 03 05:51:26 2010
Return-Path: 
Delivered-To: apmail-geronimo-scm-archive@www.apache.org
Received: (qmail 98183 invoked from network); 3 Jun 2010 05:51:25 -0000
Received: from unknown (HELO mail.apache.org) (140.211.11.3)
  by 140.211.11.9 with SMTP; 3 Jun 2010 05:51:25 -0000
Received: (qmail 98281 invoked by uid 500); 3 Jun 2010 05:51:25 -0000
Delivered-To: apmail-geronimo-scm-archive@geronimo.apache.org
Received: (qmail 98209 invoked by uid 500); 3 Jun 2010 05:51:25 -0000
Mailing-List: contact scm-help@geronimo.apache.org; run by ezmlm
Precedence: bulk
list-help: 
list-unsubscribe: 
List-Post: 
Reply-To: dev@geronimo.apache.org
List-Id: 
Delivered-To: mailing list scm@geronimo.apache.org
Received: (qmail 98192 invoked by uid 99); 3 Jun 2010 05:51:24 -0000
Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230)
    by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 03 Jun 2010 05:51:24 +0000
X-ASF-Spam-Status: No, hits=-1994.3 required=10.0
	tests=ALL_TRUSTED,HTML_MESSAGE,MIME_HTML_ONLY
X-Spam-Check-By: apache.org
Received: from [140.211.11.22] (HELO thor.apache.org) (140.211.11.22)
    by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 03 Jun 2010 05:51:22 +0000
Received: from thor (localhost [127.0.0.1])
	by thor.apache.org (8.13.8+Sun/8.13.8) with ESMTP id o535p0h0019670
	for ; Thu, 3 Jun 2010 05:51:00 GMT
Date: Thu, 3 Jun 2010 01:51:00 -0400 (EDT)
From: confluence@apache.org
To: scm@geronimo.apache.org
Message-ID: <13316963.2690.1275544260012.JavaMail.confluence@thor>
Subject: [CONF] Apache Geronimo v2.2 > Configuring Kerberos Realm
MIME-Version: 1.0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit
Auto-Submitted: auto-generated
X-Virus-Checked: Checked by ClamAV on apache.org

    Configuring Kerberos Realm
    Page  added by             Runhua Chi

           Administering security realms  

In Geronimo, you can create your own custom realm type when none of the provided ones fit your environment needs. This requires creating your own implementation of a org.apache.geronimo.security.realm.providers class, which implements the javax.security.auth.spi.LoginModule interface to acquire credentials, then use the customized realm by choosing the Other realm from console.

Kerberos realm

Starting from Geronimo 2.2.1, Kerberoes realm is supported by providing a wrapper class named org.apache.geronimo.security.realm.providers.KerberosLoginModule leveraging kerberoes protocol implementation of underlying Java platforms. 

To create a new security realm, click Add new security realm from the Security Realms portlet. On the next page, enter Kerberoes_security_realm in the name of Security Realm: field and select Other from the Realm type: dropdown box. Then click Next and fill in the following parameters:

	The Value of Login Module Class should be org. apache.geronimo.security.realm.providers.KerberosLoginModule
	The value of Configuration options for IBM Java platform should be:

addOnPrincipalName=admin

addOnPrincipalClass=org.apache.geronimo.security.realm.providers.GeronimoGroupPrincipal

krb_debug=true

krb5LoginModuleClass=com.ibm.security.auth.module.Krb5LoginModule

	Leave the other values as default.

If you are using Sun Java platform, the value of Configuration Options for Kerberoes realm should be:

addOnPrincipalName=admin

addOnPrincipalClass=org.apache.geronimo.security.realm.providers.GeronimoGroupPrincipal

krb_debug=true

krb5LoginModuleClass=com.sun.security.auth.module.Krb5LoginModule

            Change Notification Preferences

       View Online
              |
       Add Comment