We are trying to setup a tomcat server on RHEL 6.5 to use Kerberos authentication. We have tried to follow this guide, but it seems more appropriate for a Windows implementation.

In our environment, the tomcat service will run under a local user account although the server itself is part of the AD.

My query is related to the keytab file:

  1. Does the keytab file need to be linked with a specific user? Below is the sample command from the tomcat guide:

    ktpass /out c:\tomcat.keytab /mapuser **tc01@DEV.LOCAL**
            /princ HTTP/win-tc01.dev.local@DEV.LOCAL
            /pass tc01pass /kvno 0
  2. Does the user need to be part of the AD or can it also be a local user?

  • 1
    It will help if people downvoting can at least leave a comment to improve the question. – sidprasher Sep 18 '17 at 10:04
  • In one breath you say "will run under a local user account" and then you ask "does the user need to be part of AD or can it be a local user" -- have you decided, or are you asking? – Jeff Schaller Sep 18 '17 at 10:59
  • The keytab creation example suggests a domain account but the current setup that we have is with a local account. Unless it is mandatory to use a domain account we would like to continue using a local account. This bit is not clear and hence the query. – sidprasher Sep 18 '17 at 11:07

The short answers:

  1. Yes
  2. Yes

The Linux server does not need to be part of the domain, nor does the user that the Tomcat process runs as on the Linux machine. However, the user you associate with Tomcat in the keytab file does need to be a domain user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.