Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions .github/workflows/build-site.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
# This workflow takes the contents of the branches/tags and builds the production documentation site
name: Build production site

on:
push:
branches: [master]

jobs:
dispatch:
runs-on: ubuntu-latest
steps:
- name: Trigger build
run: curl -X POST -d {} https://api.netlify.com/build_hooks/6238ac2881e6d20c7db8e6c8
37 changes: 0 additions & 37 deletions .github/workflows/guide-website-update.yml

This file was deleted.

1 change: 1 addition & 0 deletions README.adoc
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
See the link:https://docs.hazelcast.com/tutorials/active-directory-authentication[tutorial].
3 changes: 0 additions & 3 deletions README.md

This file was deleted.

3 changes: 0 additions & 3 deletions doc/antora.yml

This file was deleted.

2 changes: 2 additions & 0 deletions docs/antora.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
name: tutorials
version: ~
Original file line number Diff line number Diff line change
@@ -1,18 +1,18 @@
hazelcast-client:
network:
cluster-members:
- 10.0.0.10
- 10.0.0.11
security:
kerberos:
security-realm: krb5Initiator
realms:
- name: krb5Initiator
authentication:
jaas:
- class-name: com.sun.security.auth.module.Krb5LoginModule
usage: REQUIRED
properties:
isInitiator: true
useTicketCache: true
doNotPrompt: true
hazelcast-client:
network:
cluster-members:
- 10.0.0.10
- 10.0.0.11
security:
kerberos:
security-realm: krb5Initiator
realms:
- name: krb5Initiator
authentication:
jaas:
- class-name: com.sun.security.auth.module.Krb5LoginModule
usage: REQUIRED
properties:
isInitiator: true
useTicketCache: true
doNotPrompt: true
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
[libdefaults]
default_realm = ACME.COM
[realms]
ACME.COM = {
kdc = dc1.acme.com
}
[domain_realm]
.acme.com = ACME.COM
[libdefaults]
default_realm = ACME.COM
[realms]
ACME.COM = {
kdc = dc1.acme.com
}
[domain_realm]
.acme.com = ACME.COM
Original file line number Diff line number Diff line change
@@ -1,21 +1,21 @@
:github-address: https://github.com/hazelcast-guides/active-directory-authentication
:templates-url: templates:ROOT:page$/

= Active Directory Authentication

This guide will get you started with the Hazelcast IMDG Enterprise Kerberos authentication
in Microsoft Active Directory domains.

include::{templates-url}/link-to-repo.adoc[]
:templates-url: templates:ROOT:page$/
:page-layout: tutorial
:page-product: imdg
:page-categories: Security, Deployment
:page-lang:
:page-enterprise: true
:page-est-time: 30 mins
:description: In this tutorial, you will learn how to configure Hazelcast IMDG Enterprise to authenticate cluster members and clients using Kerberos tickets in the Microsoft Active Directory domain.

== What You’ll Learn

In this guide, you will learn how to configure Hazelcast IMDG Enterprise to authenticate
cluster members and clients using Kerberos tickets in the Microsoft Active Directory domain.
We will also cover the role mapping based on the user's group membership in the
{description}

You will also cover the role mapping based on the user's group membership in the
Active Directory.

== Prerequisites
== Before you Begin

- Hazelcast IMDG Enterprise and its License Key (You can ask for a trial license through the https://hazelcast.com/get-started/#deploymenttype-imdg[license form]).
- Active Directory server (AD) and the 2nd Windows server connected in the Active Directory domain
Expand Down Expand Up @@ -70,7 +70,7 @@ port numbers (`5701-5703`). You can use the following PowerShell command:

[source,powershell]
----
include::example$allow-hazelcast-port.ps1[]
include::example$active-directory-authentication/allow-hazelcast-port.ps1[]
----

.Screenshot - Adding Windows Firewall Rule in PowerShell
Expand All @@ -88,7 +88,7 @@ on both servers.
.C:\Windows\krb5.ini
[source,powershell]
----
include::example$krb5.ini[]
include::example$active-directory-authentication/krb5.ini[]
----

NOTE: Kerberos protocol checks are often case-sensitive. Use the proper form
Expand Down Expand Up @@ -156,7 +156,7 @@ Following configuration is for the application server:
.C:\hazelcast-enterprise-4.1\demo\hazelcast.yml
[source,yaml]
----
include::example$hazelcast-simple.yml[]
include::example$active-directory-authentication/hazelcast-simple.yml[]
----

Use similar configuration on the domain controller. Just update principal name and
Expand Down Expand Up @@ -259,7 +259,7 @@ as a member of the "Acme Cache Czechia" group.

[source,powershell]
----
include::example$create-groups-and-map-user.ps1[]
include::example$active-directory-authentication/create-groups-and-map-user.ps1[]
----

=== Re-configure members
Expand All @@ -272,7 +272,7 @@ interface.
.C:\hazelcast-enterprise-4.1\demo\hazelcast.yml
[source,yaml]
----
include::example$hazelcast.yml[]
include::example$active-directory-authentication/hazelcast.yml[]
----

What's new here are the explicitly defined `Krb5LoginModule` configurations
Expand Down Expand Up @@ -337,7 +337,7 @@ within the Hazelcast installation.
.C:\hazelcast-enterprise-4.1\demo\hazelcast-client.yml
[source,yaml]
----
include::example$hazelcast-client.yml[]
include::example$active-directory-authentication/hazelcast-client.yml[]
----

The Kerberos configuration on the client side is similar to the member configuration.
Expand Down Expand Up @@ -386,7 +386,7 @@ Create the new `debug-logging.properties` file beside the batch file:

[source,properties]
----
include::example$debug-logging.properties[]
include::example$active-directory-authentication/debug-logging.properties[]
----

You can also add the `debug` option to `Krb5LoginModule` configuration. E.g.
Expand Down