在 Kerberos 環境中為 IBM Lotus Connections 配置單點登入

w32tm /config /manualpeerlist:acme.yourdomain.com.com,0x8 /syncfromflags:MANUAL
net stop w32time
net start w32time
w32tm /resync

Targeting domain controller: SVTLCSPNEGO.cn.ibm.com
Using legacy password setting method
Successfully mapped HTTP/SVTLCSPNEGO.cn.ibm.com to lcserver01.
WARNING: pType and account type do not match. This might cause  problems.
Key created.
Output keytab to c:\SVTLCSPNEGO.keytab:
Keytab version: 0x502
keysize 68 HTTP/SVTLCSPNEGO.cn.ibm.com@CN.IBM.COM ptype 0 (KRB5_NT_UNKNOWN) vno 4 ety
pe 0x17 (RC4-HMAC) keylength 16 (0x5858d47a41e40b40f294b3100bea611f)

<!--
Notes:
	- This file should be served from an unprotected web site. Alternatively, it can 
	be loaded from the WebSphere Application Server filesystem.
	- Any imbedded graphics/javascript/css MUST BE loaded from an unprotected web site.
	- This file will be loaded once when the WebSphere Application Server is initialized. 
	If changes to this file are necessary, the Application Server should be restarted.
	- This file will be returned whenever the SPNEGO TAI receives an NTLM token for 
	ANY application in the cell. In other words, this file is generic for all applications. 
	However, by using the Javascipt document.location, we can get the original URL, 
	and redirect to that original URL with the "?noSPNEGO" text added - thus forcing 
	the standard application userid/password challenge.
--&gt


	var rigUrl=""+document.location;
   	if (origUrl.indexOf("noSPNEGO")<0) {
		if (origUrl.indexOf('?')>=0) origUrl+="&noSPNEGO";
			else origUrl+="?noSPNEGO";
	}
	function redirTimer() {
		self.setTimeout("self.location.href=origUrl;",0);
	}




	document.write("");	

###################################################
proc saveConfig {} {
	global AdminConfig
	$AdminConfig save
}
proc configTA {} {
	global AdminConfig
	
	set trustAssocConfigId [$AdminConfig list TrustAssociation]
	set trust_attrib {}
	
	set matchFound 0
	set	trust_assocEnabled y
	set	trust_interceptorClassName com.ibm.ws.security.spnego.
	TrustAssociationInterceptorImpl
	
        if {$trust_assocEnabled != {}} {
		if {[regexp $trust_assocEnabled y]} {
			lappend trust_attrib [list enabled "true"]
		} else {
			lappend trust_attrib [list enabled "false"]
		}
		$AdminConfig modify $trustAssocConfigId $trust_attrib 
	}
	if {$trust_interceptorClassName != {}} {
		set listOfTAI [$AdminConfig list TAInterceptor]
		foreach tai $listOfTAI {
			set className [$AdminConfig showAttribute $tai 
			interceptorClassName]
			if {[string compare $className 
			$trust_interceptorClassName] == 0} {
				set matchFound 1
				###
				break
			}
		}
	}
	if {$matchFound == 1} {			
		set interceptorConfigId $tai		
		###################################################
		set trust_propertyName com.ibm.ws.security.spnego.SPN1.hostName
		#replace with your IHS host
		set trust_propertyValue < !! please replace with your IHS host !!>
		set trust_propertyRequired false
		set options_attrib {}		
		lappend options_attrib [list name $trust_propertyName]
		lappend options_attrib [list value $trust_propertyValue]
		lappend options_attrib [list required $trust_propertyRequired]	
			
		$AdminConfig modify $interceptorConfigId [list 
		[list trustProperties [list $options_attrib]]]
		set trustAttrs [$AdminConfig showall $interceptorConfigId]
		puts stdout "trustAttrs=$trustAttrs"
		###################################################
		set trust_propertyName com.ibm.ws.security.spnego.
		SPN1.filterClass		
		set trust_propertyValue com.ibm.ws.security.spnego.
		HTTPHeaderFilter
		set trust_propertyRequired false
		set options_attrib {}
		
		lappend options_attrib [list name $trust_propertyName]
		lappend options_attrib [list value $trust_propertyValue]
		lappend options_attrib [list required $trust_propertyRequired]	
			
		$AdminConfig modify $interceptorConfigId [list [list trustProperties
		[list $options_attrib]]]
		set trustAttrs [$AdminConfig showall $interceptorConfigId]
		puts stdout "trustAttrs=$trustAttrs"
		###################################################
		set trust_propertyName com.ibm.ws.security.spnego.SPN1.filter
		set trust_propertyValue "request-url!=/seedlist/authverify;request-url!=
		/seedlist/server;request-url!=/seedlist/myserver;request-url!=noSPNEGO"
		set trust_propertyRequired false
		set options_attrib {}
		
		lappend options_attrib [list name $trust_propertyName]
		lappend options_attrib [list value $trust_propertyValue]
		lappend options_attrib [list required $trust_propertyRequired]		
			
		$AdminConfig modify $interceptorConfigId [list [list trustProperties 
		[list $options_attrib]]]
		set trustAttrs [$AdminConfig showall $interceptorConfigId]
		puts stdout "trustAttrs=$trustAttrs"
		###################################################
		set trust_propertyName com.ibm.ws.security.spnego.
		SPN1.spnegoNotSupportedPage
		set trust_propertyValue file:///z:/TAIRedirect.html
		set trust_propertyRequired false
		set options_attrib {}
		
		lappend options_attrib [list name $trust_propertyName]
		lappend options_attrib [list value $trust_propertyValue]
		lappend options_attrib [list required $trust_propertyRequired]	
			
		$AdminConfig modify $interceptorConfigId [list [list trustProperties 
		[list $options_attrib]]]
		set trustAttrs [$AdminConfig showall $interceptorConfigId]
		puts stdout "trustAttrs=$trustAttrs"
		###################################################
		set trust_propertyName com.ibm.ws.security.spnego.
		SPN1.NTLMTokenReceivedPage
		set trust_propertyValue file:///z:/TAIRedirect.html
		set trust_propertyRequired false
		set options_attrib {}
	 
		lappend options_attrib [list name $trust_propertyName]
		lappend options_attrib [list value $trust_propertyValue]
		lappend options_attrib [list required $trust_propertyRequired]	
			
		$AdminConfig modify $interceptorConfigId [list [list trustProperties 
		[list $options_attrib]]]
		set trustAttrs [$AdminConfig showall $interceptorConfigId]
		puts stdout "trustAttrs=$trustAttrs"
		###################################################
		
	}	     
	
}
#############################################################
#  Main procedure
#############################################################
puts stdout "Run like this: wsadmin -f ConfigTA.jacl"

puts ">configTA"
configTA
saveConfig

$AdminTask createKrbConfigFile 
    {    
         -krbPath \java\jre\lib\security\krb5.conf 
         -realm  
         -kdcHost  
         -dns  
         -keytabPath 
    }
    

def configspnegojvm(cellName, nodeName, serverName):
   global AdminConfig
   
   krb5conf = "C:/IBM/WebSphere/AppServer/java/jre/lib/security/krb5.conf"   
   javasrv = AdminConfig.getid("/Cell:" + cellName + "/Node:" + nodeName + 
   "/Server:" + serverName + "/")
   
   # Checking for existence of server
   print "Checking for existence of server " + serverName
   if len(javasrv) == 0:
      print "Error -- server not found for name " + serverName + " :: /Cell:" + 
      cellName + "/Node:" + nodeName + "/Server:" + serverName + "/"
      return
   else:
      print "OK. " + javasrv
         
   #======================add JVM Custom Properties=====================
   javaproc = AdminConfig.list('JavaProcessDef', javasrv)
   prop = AdminConfig.list('Property', javaproc)
   jvmp = AdminConfig.list('JavaVirtualMachine', javaproc)
   
   if (prop.find("com.ibm.ws.security.spnego.isEnabled") >= 0):
   		print "INFO: JVM properties seem already exist:"
   		print prop
   		return
   
  
   AdminConfig.create('Property', jvmp, [['name', 'com.ibm.ws.security.
   spnego.isEnabled'], ['value', 'true'], ['required', 'false']])
   AdminConfig.create('Property', jvmp, [['name', 'java.security.krb5.conf'], 
   ['value', krb5conf], ['required', 'false']])      
   AdminConfig.save()
   print "==========Current JVM Custom Properties=========="
   prop = AdminConfig.list('Property', jvmp)
   print prop
   

#Main:
#./wsadmin -lang jython -user wasadmin -password wasadmin -f configspnegojvm.py 
Your_Cell_Name Your_Node_Name Your_ServerInstance_Name

if (len(sys.argv) != 3):
   print "This script. requires 3 parameters"
   print "e.g.:./wsadmin -lang jython -user wasadmin -password wasadmin -f 
   configspnegojvm.py Your_Cell_Name Your_Node_Name Your_ServerInstance_Name" 
else:
   cellName = sys.argv[0]
   nodeName = sys.argv[1]
   serverName = sys.argv[2]

   print "cellName: " + cellName
   print "nodeName: " + nodeName
   print "serverName: " + serverName
   print
   configspnegojvm(cellName, nodeName, serverName)   
 

    JSESSIONID
    LtpaToken
    LtpaToken2

RewriteEngine On
RewriteCond %{REQUEST_URI} /(.*)/ibm_security_logout(.*)
RewriteCond %{QUERY_STRING}  !=logoutExitPage=
RewriteRule /(.*)/ibm_security_logout(.*)
    /$1/ibm_security_logout?logoutExitPage=
   [noescape,L,R]