MQSeries.net :: View topic - Kerberos token propagation in SOAPRequest node in IIB

IIBDVLPR97 · Posted: Mon Apr 25, 2016 8:38 am Post subject:

Our installation uses Kerberos authentication based on user name, and it works fine on a direct request to an IIB application (key store is defined and connects successfully); If I need to call one of those applications from within another, using a SOAPRequest node, the Kerberos token does not get propagated, and it results in a "401 - Unauthorized URL ..." error. I read all of the documentation provided by the IBM knowledge center and the 3 posts on this site that had similar problems but are not entirely addressing the same case. I also experimented with various combinations of identity mapping/source combinations; What I noticed is that the token is not an available value in the input message, and even though the token is supposed to be generated from the user id, passing that as the token has no effect; I also tried adding policy and binding for propagation but I was not able to determine how any Kerberos token extraction would be defined in those containers; If anyone has had any direct experience with this problem please share the results.
What I have tried:
1) Am not able to see the Token in the input message received by the first application. I am not even sure if I should be able to see the K token in the input msg? but from other postings it seems that for x509 the token is visible, also the http log show the token was negotiated successfully.

2) The input does show that Kerberos was used to start the application:
IdentitySourceType:CHARACTER:kerberosTicket
IdentitySourceToken:CHARACTER: user id
IdentitySourceIssuedBy: The value is set to the correct URL
spn:CHARACTER:HTTP/server fully qualified (4 nodes) @xxx.xxx.COM

3) because of 1,I tried to set the user or the spn as the token in the IdentitySource and mapping in combination with various token types (username, usernameAndPassword, kerberosTicket); In the last case I get the error 2720 indicating that no ticket is available or a 401 (not auth).
I used the default propagation both in the Soap Input node and the Soap request, and even set up a profile just for propagation;

4) I tried setting up the policy/Binding but could not find a place that would ask anything about Kerberos token propagation (also added a PEP node to see if the token would become available somehow but it did not)

5) To complicate things further the above problem happens when I try to call another application from within one of the remote servers but when I try the same process within my local machine IIB integration node I am able to call another module (on my localhost). In this case in the soap.http. ...indentity.kerberosTicket I see an additional tag called sid (which I do not see when I call the remote server). That I think is the password of my key store and I tried also passing that hard coded to see if it would work(N/L)

6)Probably tried something else I can't remember.
Thank you very much.