APM Kerberos/SPNEGO to Tomcat (CAS)
We are working on setting up SPNEGO authentication with Apereo CAS (https://apereo.github.io/cas/4.2.x/index.html) running on Linux, and I have a few things I would like clarification on.
We need APM to present a logon page to a user, and then use Kerberos to authenticate them to the CAS server.
It looks like a user account is required for the CAS service, and that ktpass.exe must be used to export the keytab file for that user.
Here are the questions I have:
-
How many Active Directory user accounts are needed for this? I assume we need a delegation account for the F5s, and we also need a service account for CAS. Or do we need to use the same delegation account for the CAS service as well?
-
If two accounts are needed, what do the corresponding SPNs need to be? Here is the hostname information:
castst.company.com - URL of the application that users will be accessing. Points to an F5 VIP.
castst01.company.local - Hostname of CAS server. Refuses any traffic not for castst.company.com, forcing users to go through the F5.
For the delegation account, would I set the SPN to be HTTP/castst.company.com@COMPANY.LOCAL? And then for the service account set it to be HOST/castst01.company.local@COMPANY.LOCAL?
Thanks in advance.
P.S. Specific documentation regarding the CAS configuration can be found here:
https://wiki.jasig.org/display/CASUM/SPNEGO
https://apereo.github.io/cas/4.2.x/installation/SPNEGO-Authentication.html