Kerberos Authentication

The Fabasoft Folio Web Management supports authentication based on Kerberos.

Configuration of Mozilla Firefox

The following chapters describe the configuration of Mozilla Firefox.

No Proxy Server

No proxy server may be used. On the “Edit” menu, click “Properties”. On the “General” tab, click “Connection Settings” and select the Direct connection to the Internet box.

Security Settings

Enable the negotiate authentication for the Linux server running the Fabasoft Folio Management Service. Type the “about:config” command in the address bar of the web browser. Modify the parameters network.negotiate-auth.delegation-uris and network.negotiate-auth.trusted-uris and add the Linux server.

URL

It is mandatory that a fully qualified domain name is provided to connect to the service. By default, the Linux Fabasoft Folio Management Service listens on port 17088.

Example:

http://fsclnx.sub.comp.com:17088

Kerberos Tickets

The user, who should administer the Fabasoft Folio Domain via the Fabasoft Folio Web Management, must have a valid Kerberos ticket.

If the Fabasoft Folio Web Management runs on a Microsoft Windows system, log in as a Microsoft Windows domain user, who has administrative rights on the Fabasoft Folio Domain. The Kerberos ticket is provided automatically.

If the Fabasoft Folio Web Management runs on a Linux system, the Kerberos ticket is also provided automatically if a LDAP and KDC environment is available. To get a ticket for a specific user (e.g. Microsoft Windows domain user) manually execute the kinit <user> command. To verify the ticket use the klist command.

To authorize a given user, a local user must be created and added to the group fsc:

useradd <user> -g fsc