Comments on: Improved SPNEGO or Kerberos support with LoadRunner http://altentee.com/2009/improved-spnego-or-kerberos-support-with-loadrunner/ Performance and Test Automation Experts Tue, 02 Mar 2010 14:15:20 +1100 http://wordpress.org/?v=2.9 hourly 1 By: Tim http://altentee.com/2009/improved-spnego-or-kerberos-support-with-loadrunner/comment-page-1/#comment-314 Tim Tue, 20 Oct 2009 07:23:10 +0000 http://90kts.com/blog/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-314 OK good to know that. Didn't realise you could get help on the web_set_sockets_option. There's lots of resources out there about setting up krb5 config files and generating keytabs (although I didn't have to for our setup which was IBM WebSEAL / SSO/ AD) Good luck with it! Tim OK good to know that. Didn’t realise you could get help on the web_set_sockets_option. There’s lots of resources out there about setting up krb5 config files and generating keytabs (although I didn’t have to for our setup which was IBM WebSEAL / SSO/ AD)

Good luck with it!

Tim

]]> By: John http://altentee.com/2009/improved-spnego-or-kerberos-support-with-loadrunner/comment-page-1/#comment-313 John Tue, 20 Oct 2009 03:25:05 +0000 http://90kts.com/blog/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-313 Tim, thanks. The F1 help for 8.1 has no mention of the “INITIAL_BASIC_AUTH” however when i run the web_set_sockets_option("HELP",""); i can see the “INITIAL_BASIC_AUTH” option. web_set_sockets_option parameters ================================= INITIAL_BASIC_AUTH : Send basic authentithication to server before receiving HTTP error etc etc The error i'm receiving is the one mentioned previously above "Warning -26000: can't get initial credentials for username/password userxxxxx/Password1" I am looking into the krb5.ini file setup. Thought i had set it up right but getting it looked into. Cheers John Tim,

thanks. The F1 help for 8.1 has no mention of the “INITIAL_BASIC_AUTH” however when i run the

web_set_sockets_option(“HELP”,”");

i can see the “INITIAL_BASIC_AUTH” option.

web_set_sockets_option parameters =================================
INITIAL_BASIC_AUTH : Send basic authentithication to server before receiving HTTP error

etc etc

The error i’m receiving is the one mentioned previously above “Warning -26000: can’t get initial credentials for username/password userxxxxx/Password1″

I am looking into the krb5.ini file setup. Thought i had set it up right but getting it looked into.

Cheers
John

]]> By: Tim http://altentee.com/2009/improved-spnego-or-kerberos-support-with-loadrunner/comment-page-1/#comment-312 Tim Mon, 19 Oct 2009 08:11:13 +0000 http://90kts.com/blog/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-312 Not sure mate would have to go to HP on that one. As it stands this flag is not documented anywhere AFAIK. I was testing on 9+. Have a crack and post any error messages you get here. Regards, Tim Not sure mate would have to go to HP on that one. As it stands this flag is not documented anywhere AFAIK. I was testing on 9+. Have a crack and post any error messages you get here.

Regards,
Tim

]]> By: John http://altentee.com/2009/improved-spnego-or-kerberos-support-with-loadrunner/comment-page-1/#comment-311 John Mon, 19 Oct 2009 07:40:05 +0000 http://90kts.com/blog/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-311 Hey Tim, do you know if the "INITIAL_BASIC_AUTH" is supported by LR8.1 ? Cheers Hey Tim,

do you know if the “INITIAL_BASIC_AUTH” is supported by LR8.1 ?

Cheers

]]> By: Tim http://altentee.com/2009/improved-spnego-or-kerberos-support-with-loadrunner/comment-page-1/#comment-310 Tim Fri, 09 Oct 2009 09:42:34 +0000 http://90kts.com/blog/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-310 Mate you're missing the point! Don't put your webservers in there!! You need to put your domain controllers in there, the servers that look after your kerberos domain! If you don't know what I'm talking about I suggest you read here first or ask a sysadmin to help explain your security setup to you... Get familar with wireshark, observe a manual test case and watch how your authentication happens in your domain. Fiddler is also useful from a client point of view. http://en.wikipedia.org/wiki/Kerberos_(protocol) Mate you’re missing the point! Don’t put your webservers in there!! You need to put your domain controllers in there, the servers that look after your kerberos domain! If you don’t know what I’m talking about I suggest you read here first or ask a sysadmin to help explain your security setup to you… Get familar with wireshark, observe a manual test case and watch how your authentication happens in your domain. Fiddler is also useful from a client point of view.

http://en.wikipedia.org/wiki/Kerberos_(protocol)

]]> By: karan http://altentee.com/2009/improved-spnego-or-kerberos-support-with-loadrunner/comment-page-1/#comment-309 karan Fri, 09 Oct 2009 09:26:08 +0000 http://90kts.com/blog/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-309 Hi Tim, I've updated the Krb5.ini file but getting different error message now "Miscellaneous failure Server not found in Kerberos database [MsgId: MERR-27734]" I'm seeing Domain name as "YYYY", Server Name as "Webserver1", Domain DNS Name as "yyyy.asd.as.com" and Server DNS Name as "Webserver1.yyyy.asd.as.com" in the Wireshark. ----------------- Krb5.ini file is [libdefaults] default_realm = YYYY.ASD.AS.COM default_keytab_name = c:\winnt\krb5.keytab default_tkt_enctypes = des-cbc-md5 rc4-hmac default_tgs_enctypes = des-cbc-md5 rc4-hmac [realms] Webserver1.yyyy.asd.as.com = { kdc = Webserver1.yyyy.asd.as.com default_domain = yyyy.asd.as.com } Webserver.yyyy.asd.as.com = { kdc = Webserver2.yyyy.asd.as.com default_domain = yyyy.asd.as.com } Webserver3.yyyy.asd.as.com = { kdc = Webserver3.yyyy.asd.as.com default_domain = yyyy.asd.as.com } [domain_realm] .yyyy.asd.as.com = Webserver1.yyyy.asd.as.com .yyyy.asd.as.com = Webserver2.yyyy.asd.as.com .yyyy.asd.as.com = Webserver3.yyyy.asd.as.com --------------- Did I create the ini file in the right way? Thanks alot for your time & help. Karan Hi Tim, I’ve updated the Krb5.ini file but getting different error message now “Miscellaneous failure Server not found in Kerberos database [MsgId: MERR-27734]”

I’m seeing Domain name as “YYYY”, Server Name as “Webserver1″, Domain DNS Name as “yyyy.asd.as.com” and Server DNS Name as “Webserver1.yyyy.asd.as.com” in the Wireshark.

—————–
Krb5.ini file is

[libdefaults]
default_realm = YYYY.ASD.AS.COM
default_keytab_name = c:\winnt\krb5.keytab
default_tkt_enctypes = des-cbc-md5 rc4-hmac
default_tgs_enctypes = des-cbc-md5 rc4-hmac
[realms]
Webserver1.yyyy.asd.as.com = {
kdc = Webserver1.yyyy.asd.as.com
default_domain = yyyy.asd.as.com
}
Webserver.yyyy.asd.as.com = {
kdc = Webserver2.yyyy.asd.as.com
default_domain = yyyy.asd.as.com
}
Webserver3.yyyy.asd.as.com = {
kdc = Webserver3.yyyy.asd.as.com
default_domain = yyyy.asd.as.com
}
[domain_realm]
.yyyy.asd.as.com = Webserver1.yyyy.asd.as.com
.yyyy.asd.as.com = Webserver2.yyyy.asd.as.com
.yyyy.asd.as.com = Webserver3.yyyy.asd.as.com

—————

Did I create the ini file in the right way?

Thanks alot for your time & help.

Karan

]]> By: Karan http://altentee.com/2009/improved-spnego-or-kerberos-support-with-loadrunner/comment-page-1/#comment-308 Karan Fri, 09 Oct 2009 07:37:11 +0000 http://90kts.com/blog/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-308 Hi Tim, I've updated the Krb5.ini file but getting different error message now "Miscellaneous failure Server not found in Kerberos database [MsgId: MERR-27734]" I'm seeing Domain name as "YYYY", Server Name as "Webserver1", Domain DNS Name as "yyyy.asd.as.com" and Server DNS Name as "Webserver1.yyyy.asd.as.com" in the Wireshark. ----------------- Krb5.ini file is [libdefaults] default_realm = YYYY.ASD.AS.COM default_keytab_name = c:\winnt\krb5.keytab default_tkt_enctypes = des-cbc-md5 rc4-hmac default_tgs_enctypes = des-cbc-md5 rc4-hmac [realms] Webserver1.yyyy.asd.as.com = { kdc = Webserver1.yyyy.asd.as.com default_domain = yyyy.asd.as.com } Webserver2.yyyy.asd.as.com = { kdc = Webserver2.yyyy.asd.as.com default_domain = yyyy.asd.as.com } Webserver3.yyyy.asd.as.com = { kdc = Webserver3.yyyy.asd.as.com default_domain = yyyy.asd.as.com } [domain_realm] .yyyy.asd.as.com = Webserver1.yyyy.asd.as.com .yyyy.asd.as.com = Webserver2.yyyy.asd.as.com .yyyy.asd.as.com = Webserver3.yyyy.asd.as.com --------------- There are 3 web servers in the test bed. Did i create the ini file in the right way? Thanks alot for your help. Karan Hi Tim, I’ve updated the Krb5.ini file but getting different error message now “Miscellaneous failure Server not found in Kerberos database [MsgId: MERR-27734]”

I’m seeing Domain name as “YYYY”, Server Name as “Webserver1″, Domain DNS Name as “yyyy.asd.as.com” and Server DNS Name as “Webserver1.yyyy.asd.as.com” in the Wireshark.

—————–
Krb5.ini file is

[libdefaults]
default_realm = YYYY.ASD.AS.COM
default_keytab_name = c:\winnt\krb5.keytab
default_tkt_enctypes = des-cbc-md5 rc4-hmac
default_tgs_enctypes = des-cbc-md5 rc4-hmac
[realms]
Webserver1.yyyy.asd.as.com = {
kdc = Webserver1.yyyy.asd.as.com
default_domain = yyyy.asd.as.com
}
Webserver2.yyyy.asd.as.com = {
kdc = Webserver2.yyyy.asd.as.com
default_domain = yyyy.asd.as.com
}
Webserver3.yyyy.asd.as.com = {
kdc = Webserver3.yyyy.asd.as.com
default_domain = yyyy.asd.as.com
}
[domain_realm]
.yyyy.asd.as.com = Webserver1.yyyy.asd.as.com
.yyyy.asd.as.com = Webserver2.yyyy.asd.as.com
.yyyy.asd.as.com = Webserver3.yyyy.asd.as.com

—————

There are 3 web servers in the test bed.

Did i create the ini file in the right way?

Thanks alot for your help.

Karan

]]> By: Tim http://altentee.com/2009/improved-spnego-or-kerberos-support-with-loadrunner/comment-page-1/#comment-307 Tim Fri, 09 Oct 2009 06:18:07 +0000 http://90kts.com/blog/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-307 The problem is you haven't updated the domain controllers in your [realms] to point to real DCs. You're just using my example file i.e. dc01.domain.local. You need to find out what the names are of your DCs and update accordingly. You can normally figure this out with a wireshark trace, or just ask your system admin type people. The error message is basically telling you this, i.e. it can't get the username/password for rmatte/Merrill1009 Cheers, Tim The problem is you haven’t updated the domain controllers in your [realms] to point to real DCs. You’re just using my example file i.e. dc01.domain.local. You need to find out what the names are of your DCs and update accordingly. You can normally figure this out with a wireshark trace, or just ask your system admin type people. The error message is basically telling you this, i.e. it can’t get the username/password for rmatte/Merrill1009

Cheers,
Tim

]]> By: Karan http://altentee.com/2009/improved-spnego-or-kerberos-support-with-loadrunner/comment-page-1/#comment-306 Karan Fri, 09 Oct 2009 05:48:49 +0000 http://90kts.com/blog/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-306 Hi Tim, Thanks a lot for your help. Here are the details. currently we are using 9.5 version. ---------- Script web_set_sockets_option("INITIAL_BASIC_AUTH","1"); web_set_user("yyyy\\userid", "pwd", "app.com:80"); web_url("HomePage", "URL=http://app.com/", "TargetFrame=", "Resource=0", "RecContentType=text/html", "Referer=", "Snapshot=t1.inf", "Mode=HTML", LAST); ----------------------- ------------- Error message Action.c(27): Continuing after Error -27734: Internal Error - can't get initial credentials for username/password rmatte/Merrill1009 [MsgId: MERR-27734] ----------------- ------------- Krb5.ini [libdefaults] default_realm = DOMAIN.LOCAL default_keytab_name = FILE:c:\winnt\krb5.keytab default_tkt_enctypes = des-cbc-md5 rc4-hmac default_tgs_enctypes = des-cbc-md5 rc4-hmac [realms] dc01.domain.local = { kdc = dc01.domain.local default_domain = domain.local } [domain_realm] .domain.local = dc01.domain.local ------------- Did I create the Krb5.ini file in the right format? Thanks & Regards Karan Hi Tim, Thanks a lot for your help.
Here are the details. currently we are using 9.5 version.
———-
Script
web_set_sockets_option(“INITIAL_BASIC_AUTH”,”1″);

web_set_user(“yyyy\\userid”, “pwd”, “app.com:80″);

web_url(“HomePage”,
“URL=http://app.com/”,
“TargetFrame=”,
“Resource=0″,
“RecContentType=text/html”,
“Referer=”,
“Snapshot=t1.inf”,
“Mode=HTML”,
LAST);
———————–

————-
Error message
Action.c(27): Continuing after Error -27734: Internal Error – can’t get initial credentials for username/password rmatte/Merrill1009 [MsgId: MERR-27734]

—————–

————-
Krb5.ini
[libdefaults]
default_realm = DOMAIN.LOCAL
default_keytab_name = FILE:c:\winnt\krb5.keytab
default_tkt_enctypes = des-cbc-md5 rc4-hmac
default_tgs_enctypes = des-cbc-md5 rc4-hmac
[realms]
dc01.domain.local = {
kdc = dc01.domain.local
default_domain = domain.local
}
[domain_realm]
.domain.local = dc01.domain.local
————-

Did I create the Krb5.ini file in the right format?

Thanks & Regards
Karan

]]> By: Tim http://altentee.com/2009/improved-spnego-or-kerberos-support-with-loadrunner/comment-page-1/#comment-305 Tim Fri, 09 Oct 2009 05:23:21 +0000 http://90kts.com/blog/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-305 In the end I didn't have a keytab file. Can you post the error here? In the end I didn’t have a keytab file. Can you post the error here?

]]>