Package: netsight.windowsauthplugin
Introduction============netsight.windowsauthplugin is a Plone authentication plugin to doSingle Sign On (SSO) in a Microsoft Windows Active Directoryenvironment or other environment that used Kerberos (e.g. Apple MacOS,or Linux).It uses the same underlying authentication mechanisms as Windows usesinternally, known as Integrated Windows Authentication. This usesKerberos underneath to do the actual authentication.Current web browsers able to use this plugin to do SSO are MicrosoftInternet Explorer 6+, Mozilla Firefox, Apple Safari, and Google Chrome.netsight.windowsauthplugin is pure python and can run on Plone oneither a Unix or Windows server. It relies on the MITKerberos libraries (on Unix, Linux, OSX) or the native Windows SSPIlibraries in Windows to so the Kerberos authentication.Infrastructure Setup====================In order for netsight.windowsauthplugin to work you need to have anActive Directory server (or Kerberos KDC) setup. For thisdocumentation we will assume:- You already have a working AD setup and user accounts.- You currently log into a Windows desktop with an AD username/password.- You have an admin account or access to a user with an admin accounton AD and able to create accounts- You are using Microsoft Internet Explorer- You are running the Plone server on Unix/Linux/OSXDNS & Time----------Kerberos is very particular about DNS and time. Ensure that yourservers and clients are all synced with a network time source. The wayInternet Explorer constructs Kerberos SPNs depends on the host havinga DNS A record. When you try to access a site with IE and are usingIntegrated Windows Authentication, IE will attempt to construct a SPNbased upon resolving the hostname to an A record. Hence to avoidproblems, do not use CNAMEs for your DNS records.Service Principal Names (SPNs) and Keytabs------------------------------------------You will need to create a user to associate the SPN with. This can bea standard user account set to never expire. Ensure that 'Use DES' isunselected in the properties for the user.Create the SPNs using the *ktpass* tool as shown below depending onthe version of Windows Server you are using for your DomainController.The ktpass command below does two things:1. Creates the SPN for the service2. Exports the keytab to the specified fileIn the example below:- intranet.example.com is the hostname used in the URL to your site- EXAMPLE.COM is your active directory domain- plonesvc is the user account created to associate this SPN with- c:\\temp\\intranet.keytab is the location of the exported keytab+----------------+---------------------------------------------------------------------------------------------------+------------------------------------------------+|                | Windows 2008 SP2 DC                                                                               | Windows 2003 SP3 DC                            |+----------------+--------------------------------------------------+------------------------------------------------+------------------------------------------------+| Crypto type    |  RC4                                             | AES256 (not supported by WinXP)                | RC4                                            |+----------------+--------------------------------------------------+------------------------------------------------+------------------------------------------------+| ktpass command | | C:\\>ktpass                                    | | C:\\>ktpass                                  | | C:\\>ktpass                                  ||                | | -princ HTTP/intranet.example.com@EXAMPLE.COM   | | -princ HTTP/intranet.example.com@EXAMPLE.COM | | -princ HTTP/intranet.example.com@EXAMPLE.COM ||                | | -mapuser plonesvc@EXAMPLE.COM                  | | -mapuser plonesvc@EXAMPLE.COM                | | -mapuser plonesvc@EXAMPLE.COM                ||                | | -crypto RC4-HMAC-NT                            | | -crypto AES256-SHA1                          | | -crypto rc4-hmac-nt                          ||                | | -ptype KRB5_NT_PRINCIPAL                       | | -ptype KRB5_NT_PRINCIPAL                     | | -ptype KRB5_NT_SRV_HST                       ||                | | -pass long!$longp2ass3word                     | | -pass long!$longp2ass3word                   | | -pass longlongpassword                       ||                | | -out c:\\temp\\intranet.keytab                 | | -out c:\\temp\\intranet.keytab               | | -out c:\\temp\\intranet.keytab               |+----------------+--------------------------------------------------+------------------------------------------------+------------------------------------------------+The keytab exported to *c:\\temp\\intranet.keytab* needs to be copiedsecurely to the server running Plone.The default path for the keytab file in unix environments is``/etc/krb5.keytab``, but it can be customized by defining ``KRB5_KTNAME``environment variable. The keytab must be readable by the user running the Ploneprocess.Troubleshooting===============- ERROR SPNEGO plugin 127.0.0.1: GSSError (('Unspecified GSS failure. Minor code may provide more information', 851968), ('', 100005))**Solution**: This was seen with crypto type AES256 on RHEL6 server.This was solved by changing crypto type to RC4.Glossary========`Integrated Windows Authentication (IWA) <http://en.wikipedia.org/wiki/Integrated_Windows_Authentication>`_This is Microsoft's is a term associated with Microsoft productsthat refers to the SPNEGO, Kerberos, and NTLMSSP authenticationprotocols with respect to SSPI functionality introduced withMicrosoft Windows 2000 and included with later Windows NT-basedoperating systems. The term is used more commonly for theautomatically authenticated connections between Microsoft InternetInformation Services, Internet Explorer, and other Active Directoryaware applications.`Kerberos <http://en.wikipedia.org/wiki/Kerberos_(protocol)>`_Kerberos is a network authentication protocol. It is designed toprovide strong authentication for client/server applications byusing secret-key cryptography. It is a standardised protocol andused by Unix, Linux, Microsoft Windows and Apple Mac OSX forauthentication services.`Service Principal Name (SPN) <http://msdn.microsoft.com/en-gb/library/windows/desktop/ms677949(v=vs.85).aspx>`_A service principal name (SPN) is the name by which a clientuniquely identifies an instance of a service. When a client wants toconnect to a service, it locates an instance of the service,composes an SPN for that instance, connects to the service, andpresents the SPN for the service to authenticate. These often startwith the service/protocol being used and are then followed by thehostname e.g. HTTP/intranet.example.com`SPNEGO <http://en.wikipedia.org/wiki/SPNEGO>`_SPNEGO (Simple and Protected GSSAPI Negotiation Mechanism) is aGSSAPI "pseudo mechanism" that is used by Microsoft InternetExplorer 5.01 and above to negotiate an authenticationmechanism. The negotiable sub-mechanisms included NTLM and Kerberos,both used in Active Directory`GSSAPI <http://en.wikipedia.org/wiki/Generic_Security_Services_Application_Program_Interface>`_GSSAPI (Generic Security Services Application Program Interface) isan IETF standard API for accessing a number of authenticatationmechanisms. The GSSAPI, by itself, does not provide anysecurity. Instead, security service vendors provide GSSAPIimplementations usually in the form of libraries installed withtheir security software.`SSPI <http://en.wikipedia.org/wiki/Security_Support_Provider_Interface>`_SSPI (Security Support Provider Interface) is an API used byMicrosoft Windows systems to perform a variety of security-relatedoperations such as authentication. SSPI is a proprietary variant ofGSSAPI with extensions and very Windows-specific data types. ForWindows 2000, an implementation of Kerberos 5 was added, using tokenformats conforming to the official protocol standard RFC 1964 (TheKerberos 5 GSSAPI mechanism) and providing wire-levelinteroperability with Kerberos 5 implementations from other vendors.`PAS <http://plone.org/documentation/manual/developer-manual/users-and-security/pluggable-authentication-service/>`_PAS (Pluggable Authentication Service) is a modular suthanticationsystem used by Zope and Plone for the management of users. PAS isbuilt around the concepts of interfaces and plugins: all possibletasks related to user and group management and authentication aredescribed in separate interfaces. These interfaces are implementedby plugins, which can be selectively enabled per interface.`Active Directory <http://en.wikipedia.org/wiki/Active_Directory>`_Active Directory (AD) is a directory service created by Microsoftfor Windows domain networks. It is included in most Windows Serveroperating systems.Active Directory provides a central location for networkadministration and security. Server computers that run ActiveDirectory are called domain controllers. An AD domain controllerauthenticates and authorizes all users and computers in a Windowsdomain type network—assigning and enforcing security policies forall computers and installing or updating software. For example, whena user logs into a computer that is part of a Windows domain, ActiveDirectory checks the submitted password and determines whether theuser is a system administrator or normal user.Active Directory makes use of Lightweight Directory Access Protocol(LDAP) versions 2 and 3, Kerberos and DNS.Change history**************2.3.1 (2014-07-04)------------------- Fixed issue with 'came_from' redirects not working correctly2.3 (2014-03-17)----------------- Mixed-auth helper now redirects to 'logged_in' to continue standard plone login process [mattss]2.2 (2014-03-5)----------------- Added missing __init__.py for mixed-auth profile [giacomos]2.1 2014-02-10--------------- Add default configuration profile for mixed authentication environments[datakurre]2.0 2013-03-27--------------- This is a major change- All LDAP code has been removed. If you want to use LDAP to look upuser details then use a separate LDAP PAS plugin- The kerberos python library is now only installed if you add [unix]option with the egg- We now decode the username to Unicode before returning it1.3 (2013-03-18)----------------- Fixed missing README.txt in last release1.2 (2013-03-18)----------------- Works with subrequests now (p.a.theming)1.1 2013-03-18--------------- Fixed it so we work within a subrequest (so p.a.themeing works)0.9 Initial release-------------------- Initial releaseContributors************Matt Hamilton, matth@netsight.co.uk, AuthorDownload********