Hello everyone,
I'm trying to setup Windows AD SSO for BusinessObjects 4.1 SP7, followed Josh's blog which helped me all along. I'm stuck at the keytab file creation (step 11 in that blog). The SSO works fine, its just that the service account's password is currently hard coded in Tomcat Configuration -> Java -> Java Options. Obviously, when the keytab is created, I'll remove that hard coded value from Java options and a create a pointer to the keytab in the global.properties file.
Env details:
- Windows Server 2012 R2
- BO 4.1 SP7
- Service account properties include 'Password never expires' and, Delegation rules as 'Trust this user for delegation to any service (Kerberos only)'
- Service account is in Local Admins groups on BO server.
- Service account has the rights 'Act a part of operating system', 'Logon as a batch job', and 'Logon as a service.'
- Tomcat & SIA running under Service account
Snapshot of Josh's ktpass command results:
My ktpass command results:
C:\>ktpass -out serviceaccount.keytab -princ serviceaccount@DOMAINNAME -pass <Password> -kvno 255 -ptype KRB5_NT_PRINCIPAL -crypto RC4-HMAC-NT
NOTE: creating a keytab but not mapping principal to any user.
For the account to work within a Windows domain, the
principal must be mapped to an account, either at the
domain level (with /mapuser) or locally (using ksetup)
If you intend to map serviceaccount@DOMAINNAME to an account through other m
eans
or don't need to map the user, this message can safely be ignored.
WARNING: pType and account type do not match. This might cause problems.
Key created.
Output keytab to serviceaccount.keytab:
Keytab version: 0x502
keysize 63serviceaccount@DOMAINNAME ptype 1 (KRB5_NT_PRINCIPAL) vno 255 etype 0x17 (RC4-HMAC) keylength 16 (0x51170bf7e07e9d02bcbff669f9725f6e)
** 0x1 Failed to create file!
Failed to write keytab file mbdbouat.keytab.
Good news: I see the Key created line in my results.
Bad news (& the difference): I see keysize 63 when compared to Josh's keysize 59. Is that an issue? Or I'm looking at the wrong place?
And obviously, the last 2 lines in my result where it says, Failed to create file and the next line (in red)
Any help is appreciated.
Thanks,
Mahboob Mohammed