Jazz Forum Welcome to the Jazz Community Forum Connect and collaborate with IBM Engineering experts and users

Log in failed in RTC Eclipse client using Kerberos/SPNEGO authentication type

 hi,


recently we enabled SSO with Kerberos/SPNEGO on our CCM application which works well using the web browser.
however with any client like eclipse or visual studio when trying to change the authentication type to Kerberos/SPNEGO the following error appears:
main error : CRJAZ6106E the client cannot log in into the following server because the Kerberos/SPNEGO ticket is not valid or has expired : <server name>
in the details section the error looks like : CRJAZ2901 the following URL could not be reached because your Kerberos/SPNEGO ticket is not valid or has expired : /ccm/server/com.ibm.team.repository.common.internal.IRepositoryRemoteService.


I followed the below document for enabling SSO in WebShpere  (for Single Server SPNEGO Configuration) :


I have not made any configuration on my client,Is there anything else I must to do in order for the Eclipse client (or visual studio client) to also be able to use Kerberos/SPNEGO authentication type?

thanks in advanced.

Lior

0 votes



One answer

Permanent link

You should make changes to the clients to properly use Kerberos/SPNEGO SSO. The second link in the below document talks about various aspects of the client configuration.
https://jazz.net/help-dev/clm/topic/com.ibm.jazz.install.doc/topics/c_kerSso_config.html

0 votes

Comments

Hi Nong,


thanks, I was able to find the missing parts.
the first thing was to add 'user-agent^=Mozilla|Opera|spnego-enabled' to the SPNEGO web authentication section ->Filters section, for the relevant (KDC) host name.
the 2nd thing was to add the 'allowtgtsessionkey' type REG_DWORD parameter to the registry in both locations:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos

once I did both things I was able to login from both RTC Eclipse and VS clients.

Lior

Your answer

Register or log in to post your answer.

Dashboards and work items are no longer publicly available, so some links may be invalid. We now provide similar information through other means. Learn more here.

Search context
Follow this question

By Email: 

Once you sign in you will be able to subscribe for any updates here.

By RSS:

Answers
Answers and Comments
Question details

Question asked: Mar 18 '18, 10:40 a.m.

Question was seen: 3,048 times

Last updated: Mar 20 '18, 5:43 a.m.

Confirmation Cancel Confirm