Hi Arslan Nawaz,
The below information on AD configuration should help for SPNEGO :
On Active Directory, there are two steps that must be performed:
´ Create a dedicated user for the SPN.
Add the SPN to this user using 'ktpass.exe' (this will generate the keytab).
NOTE: You must set a password for the user. User must change password on next logon should not be enabled, and Password neverexpires should be enabled.
The SPN must be added in this format: HTTP/[email protected] The SPN iscase sensitive. Note the order of uppercase, lowercase and upper case.
´ For Active Directory 2008, the commands 'ktpass' and 'setspn' are already installed. For Active Directory 2003, an add-on pack is required. Before adding the SPN, it's a good idea to make sure it doesn't already exist. This will help avoid ticket decryption issues on Junos Pulse Access Control Service. On the endpoint, the MAG Series device must be added as a trusted host(with Internet Explorer or Firefox). This can also be done with an Active Directory group policy. Without this, the browser will not participate in SPNEGO.
On the MAG Series device, you must upload the keytab file and verify thatthediode turns green (indicating a successful join).SPNEGOdoes not workunless the diode is green.
Sample Active Directory Commands
To search for a particular SPN:
C:\>setspn -Q HTTP/dev94.abc-domain.lab.test.com
To search for all the SPNs of user 'spnuser':
C:\>setspn -Lspnuser
To delete this SPN of user 'spnuser':
C:\>setspn -d HTTP/dev94.abc-domain.lab.test.com spnuser
In this example, the MAG Series device FQDN is: xyz.abc-domain.lab.test.com and the
AD realm is: ABC-DOMAIN.LAB.JUNIPER.NET. This adds an SPN to the user:
Additional Information
The 'kerbtray.exe' program is helpful for viewing and deleting Kerberos tickets on the endpoint.Old ticketsmust be purgedfromthe endpoint ifSPNs are updatedor passwords
are changed (assuming the endpoint still has a cached copy of the ticket from a prior SPNEGOrequest to the MAG Series device. During testing,you should purge tickets before
each authentication request.
A similar program to 'kerbtray.exe' is klist.exe. This is a command line program to view and purge tickets. This can be downloaded from Microsoft's site.
When troubleshooting, Juniper Network recommends that you restart the browser between auth requests to avoid cache issues.
If Internet Explorer pops-up a Windows dialog box during authentication, this signifies that the ICisn't trusted for SPNEGO. You should add the MAG Series device FQDN underOptions -> Security -> Local Intranet -> Sites ->Advanced.
In Firefox, you can install the 'Live HTTP Headers' plug-in to monitor HTTP traffic. You should verify that the ticket is being sent as base64 data. To add the MAG Series device as a trusted host in Firefox, load URL about:config in the address window and set:network.negotiate-auth.trusted-uris.
Note: If I have answered your questions, you could mark this post as accepted solution, that way it could help others as well. Kudo will be a bonus thanks!
Regards,
Kannan
