webspherekerberosspnegospnkeytab

Is it possible to configure SPENGO irrespective of fully qualified host name


I have configured SPENGO for WebSphere and current SPENGO is working fine for fully qualified hostname say appserver.robo.com, I want a SPENGO configuration which can work for both appserver.robo.com/productName as well as appserver/productName.

Is there such configuration is possible ?


Solution

  • Yes, it is possible. Make sure your keytab and SPNEGO configuration is for real hostname, and then enable Use the alias host name for the application server setting in the SPNEGO web authentication enablement (https://www.ibm.com/support/knowledgecenter/en/SSAW57_8.5.5/com.ibm.websphere.nd.doc/ae/usec_kerb_SPNEGO_config.html).

    Also make sure that both names are correctly recognized by the browser as localIntranet or trusted sites and enabled for integrated authentication.

    The other option is to create several keytabs and merge them, but it is not recommended as discussed here - https://www.ibm.com/developerworks/websphere/library/techarticles/0809_lansche/0809_lansche.html