Create Accounts

Create the two service accounts (zarafa-linux, httpd-linux) as mentioned above in your ActiveDirectory. They only have to be regular Domain Users.

Configure /etc/krb5.conf on DC

Check if your /etc/krb5.conf on the Samba4 DC at least contains the following (more entries are not neccesary on the DC)

[libdefaults]

default_realm = SYSTEM-FUCHS.EU

dns_lookup_realm = false

dns_lookup_kdc = true

[email protected]:~# samba-tool spn add zarafa/zarafa-server.system-fuchs.eu zarafa-linux

[email protected]:~# samba-tool spn add zarafa/[email protected] zarafa-linux

[email protected]:~# samba-tool spn add HTTP/zarafa-server.system-fuchs.eu httpd-linux

[email protected]:~# samba-tool spn add HTTP/[email protected] httpd-linux

[email protected]:~# samba-tool domain exportkeytab /tmp/keytab.zarafa --principal=zarafa/zarafa-server.system-fuchs.eu

[email protected]:~# samba-tool domain exportkeytab /tmp/keytab.apache --principal=HTTP/zarafa-server.system-fuchs.eu

[email protected]:~# klist -e -k /tmp/keytab.zarafa

Keytab name: FILE:/tmp/keytab.zarafa

KVNO Principal

---- --------------------------------------------------------------------------

1 zarafa/[email protected] (des-cbc-crc)

1 zarafa/[email protected] (des-cbc-md5)

1 zarafa/[email protected] (arcfour-hmac)

[email protected]:~# klist -e -k /tmp/keytab.apache

Keytab name: FILE:/tmp/keytab.apache

KVNO Principal

---- --------------------------------------------------------------------------

1 HTTP/[email protected] (des-cbc-crc)

1 HTTP/[email protected] (des-cbc-md5)

1 HTTP/[email protected] (arcfour-hmac)

[email protected]:~# scp /tmp/keytab.zarafa zarafa-server.system-fuchs.eu:/etc/zarafa/

[email protected]:~# scp /tmp/keytab.apache zarafa-server.system-fuchs.eu:/etc/apache2/

[email protected]:~# samba-tool dns add localhost system-fuchs.eu zarafa-server A <your ip address goes here> -UAdministrator

Configure /etc/krb5.conf

[libdefaults]

  default_realm = SYSTEM-FUCHS.EU

  default_keytab_name = /etc/zarafa/keytab.zarafa

  default_tgs_enctypes = des-cbc-md5 arcfour-hmac-md5

  default_tkt_enctypes = des-cbc-md5 arcfour-hmac-md5

  permitted_enctypes = des-cbc-md5 arcfour-hmac-md5

[realms]

SYSTEM-FUCHS.EU = {

  kdc = samba-dc1.system-fuchs.eu

  admin_server = samba-dc1.system-fuchs.eu

} 
[domain_realm]

 .system-fuchs.eu = SYSTEM-FUCHS.EU

  system-fuchs.eu = SYSTEM-FUCHS.EU

Zarafa Server configuration

To enable Outlook SSO with ZCP set the following in the server.cfg file:

enable_sso = yes

If the hostname of the Linux server (see the hostname command) does not equal the FQDN of the Linux server, the server_hostname variable will need to be changed in the server.cfg file:

server_hostname = zarafa-server.system-fuchs.eu

Restart the zarafa-server to activate all changes.

service zarafa-server restart

Apache configuration (for SSO with WebAccess)

Install the mod_auth_kerb Apache module, e.g. for Debian/Ubuntu

[email protected]:~# apt-get install libapache2-mod-auth-kerb

Open your Zarafa webaccess config file (e.g. /etc/apache2/sites-enabled/zarafa.conf) and modify your config according to the example below

Alias /webaccess /usr/share/zarafa-webaccess

<Directory /usr/share/zarafa-webaccess>

  AuthType Kerberos

  AuthName "Kerberos Login"

  KrbMethodNegotiate On

  KrbMethodK5Passwd Off

  KrbServiceName HTTP

  KrbAuthRealms SYSTEM-FUCHS.EU

  Krb5KeyTab /etc/apache2/keytab.apache

  require valid-user

</Directory>

Set the filesystem permissions of the keytab file to 400 and change the owner to the Apache user:

[email protected]:/etc/apache2# chmod 400 keytab.apache

[email protected]:/etc/apache2# chown www-data:www-data keytab.apache

Do a syntax check & restart Apache to activate all changes:

[email protected]:~# apache2ctl configtest

Syntax OK

[email protected]:~# apache2ctl restart

WebAccess configuration

To setup a Single Sign On environment for Zarafa Collaboration Platform, it’s necessary to make a trust between the Apache webserver and the Zarafa Storage Server. The trust is necessary to handle the WebAccess authentication by the Apache webserver, not by the Zarafa Storage Server anymore.To create this trust, add the running Apache user to the following line in the /etc/zarafa/server.cfg:

local_admin_users = root www-data

To configure the Zarafa WebAccess for Single Sign On change the following option in the /usr/share/zarafa-webaccess/config.php file:

define("LOGINNAME_STRIP_DOMAIN", true);

Restart the Zarafa-server processes to activate this change:

[email protected]:~# service zarafa-server restart

Browser configuration

Before Single Sign On can be used in a browser, configure the following settings:

Firefox:

1. Type in the addressbar about:config

2. Filter on auth Change the options: network.negotiate-auth.trusted-uris and network.negotiate-auth.delegation-uris to .system-fuchs.eu

Internet Explorer:

1. Go to Tools > Internet options > Advanced

2. Make sure the option Enable integrated Windows authentication is enabled

3. Add the url of the Zarafa Server ( http://zarafa-server.system-fuchs.eu ) to the Local Intranet sites.

Restart the browser and open the WebAccess via the FQDN ( http://zarafa-server.system-fuchs.eu/webaccess ). If the configuration is done correctly, the user will be logged in to the WebAccess without typing the username and password.

Now that SSO seems to work with the Linux server, it will automatically be used by zarafa-server. Now log on to a Windows workstation on the domain and create a new Outlook profile for the user just logged on, but leave the password field empty. Outlook should create the profile without the password.