Comments on: Improved SPNEGO or Kerberos support with LoadRunner http://altentee.com/blogs/2009/improved-spnego-or-kerberos-support-with-loadrunner/ Performance and Test Automation Experts Mon, 09 May 2011 03:51:22 +0000 hourly 1 http://wordpress.org/?v=3.0.3 By: Siva http://altentee.com/blogs/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-6972 Siva Mon, 20 Sep 2010 03:00:35 +0000 http://90kts.com/blog/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-6972 Hi Tim, We are using VUGen 9.50 and LR 9.51. VU gen server is Windows 2003 SP2. We are planning to do a load test on a portal environment which is Kerberos based authentication. The Portal user id's are SCC1001 to SCC1100 and the password is same for all these users. We are logging into Vugen Windows server with a different user id(domain is same for both windows server as well as portal servers). I have recorded the script with Web(http/html) protocol and in the runtime settings, i set the Internet Protocol->Preferences->Options->Authentication->Enable Integrated Authentication Internet Protocol->Preferences->Advanced->WinInet [checked]: The generated script already contains web_set_user function. But it recorded the user as windows server and not the portal login user id, so I changed this to portal user. Is it correct? I have recorded a small script with the below steps 1. Login which loads home page 2. Click on MyWork tab 3. Click on Home tab ( this supposed to load the initial home page) 4. Logoff When I replay, the step 1 and Step 4 are working properly, but the output of step2 and step3 are not as expected. I did not see any session id's in the script that is passing for the links. But the application is generating session id’s while login My Questions are : 1 . What changes I should do to enable the script to run with expected behavior 2. I have created a krb5.ini file and kept at c:\windows. Do we need keytab file and if so do we need single file with all 100 users entries or do we need to keep a separate keytab file for each user? At present I kept one keytab file with one user details. 3. Do I need to set any settings in IE6.0? 4. With this scenario, can I do load test with 100 users from single loadgen? Regards Siva Hi Tim,

We are using VUGen 9.50 and LR 9.51. VU gen server is Windows 2003 SP2. We are planning to do a load test on a portal environment which is Kerberos based authentication. The Portal user id’s are SCC1001 to SCC1100 and the password is same for all these users. We are logging into Vugen Windows server with a different user id(domain is same for both windows server as well as portal servers).

I have recorded the script with Web(http/html) protocol and in the runtime settings, i set the
Internet Protocol->Preferences->Options->Authentication->Enable Integrated Authentication
Internet Protocol->Preferences->Advanced->WinInet [checked]:

The generated script already contains web_set_user function. But it recorded the user as windows server and not the portal login user id, so I changed this to portal user. Is it correct?

I have recorded a small script with the below steps
1. Login which loads home page
2. Click on MyWork tab
3. Click on Home tab ( this supposed to load the initial home page)
4. Logoff
When I replay, the step 1 and Step 4 are working properly, but the output of step2 and step3 are not as expected. I did not see any session id’s in the script that is passing for the links. But the application is generating session id’s while login

My Questions are :
1 . What changes I should do to enable the script to run with expected behavior
2. I have created a krb5.ini file and kept at c:\windows. Do we need keytab file and if so do we need single file with all 100 users entries or do we need to keep a separate keytab file for each user? At present I kept one keytab file with one user details.
3. Do I need to set any settings in IE6.0?
4. With this scenario, can I do load test with 100 users from single loadgen?

Regards
Siva

]]> By: romain http://altentee.com/blogs/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-6971 romain Mon, 26 Apr 2010 12:44:51 +0000 http://90kts.com/blog/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-6971 Hi Tim, we use LoadRunner 9.1. The thing I can't understand is how you manage to change the user onto Kerberos authentification. For example web_set_user("user1","pwd1"); user1 is connected on Windows. The user connected to app is user1. Now we try to make web_set_user("user2","pwd1"); user1 is connected on Windows. The script work fine but the user conencted on app is "user1" and not "user2". How to make that works. Thanks for your reply Hi Tim,
we use LoadRunner 9.1.
The thing I can’t understand is how you manage to change the user onto Kerberos authentification.
For example
web_set_user(“user1″,”pwd1″);
user1 is connected on Windows.
The user connected to app is user1.

Now we try to make
web_set_user(“user2″,”pwd1″);
user1 is connected on Windows.
The script work fine but the user conencted on app is “user1″ and not “user2″.
How to make that works.
Thanks for your reply

]]> By: Tim http://altentee.com/blogs/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-6970 Tim Tue, 20 Oct 2009 07:23:10 +0000 http://90kts.com/blog/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-6970 OK good to know that. Didn't realise you could get help on the web_set_sockets_option. There's lots of resources out there about setting up krb5 config files and generating keytabs (although I didn't have to for our setup which was IBM WebSEAL / SSO/ AD) Good luck with it! Tim OK good to know that. Didn’t realise you could get help on the web_set_sockets_option. There’s lots of resources out there about setting up krb5 config files and generating keytabs (although I didn’t have to for our setup which was IBM WebSEAL / SSO/ AD)

Good luck with it!

Tim

]]> By: John http://altentee.com/blogs/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-6969 John Tue, 20 Oct 2009 03:25:05 +0000 http://90kts.com/blog/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-6969 Tim, thanks. The F1 help for 8.1 has no mention of the “INITIAL_BASIC_AUTH” however when i run the web_set_sockets_option("HELP",""); i can see the “INITIAL_BASIC_AUTH” option. web_set_sockets_option parameters ================================= INITIAL_BASIC_AUTH : Send basic authentithication to server before receiving HTTP error etc etc The error i'm receiving is the one mentioned previously above "Warning -26000: can't get initial credentials for username/password userxxxxx/Password1" I am looking into the krb5.ini file setup. Thought i had set it up right but getting it looked into. Cheers John Tim,

thanks. The F1 help for 8.1 has no mention of the “INITIAL_BASIC_AUTH” however when i run the

web_set_sockets_option(“HELP”,”");

i can see the “INITIAL_BASIC_AUTH” option.

web_set_sockets_option parameters =================================
INITIAL_BASIC_AUTH : Send basic authentithication to server before receiving HTTP error

etc etc

The error i’m receiving is the one mentioned previously above “Warning -26000: can’t get initial credentials for username/password userxxxxx/Password1″

I am looking into the krb5.ini file setup. Thought i had set it up right but getting it looked into.

Cheers
John

]]> By: Tim http://altentee.com/blogs/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-6968 Tim Mon, 19 Oct 2009 08:11:13 +0000 http://90kts.com/blog/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-6968 Not sure mate would have to go to HP on that one. As it stands this flag is not documented anywhere AFAIK. I was testing on 9+. Have a crack and post any error messages you get here. Regards, Tim Not sure mate would have to go to HP on that one. As it stands this flag is not documented anywhere AFAIK. I was testing on 9+. Have a crack and post any error messages you get here.

Regards,
Tim

]]> By: John http://altentee.com/blogs/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-6967 John Mon, 19 Oct 2009 07:40:05 +0000 http://90kts.com/blog/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-6967 Hey Tim, do you know if the "INITIAL_BASIC_AUTH" is supported by LR8.1 ? Cheers Hey Tim,

do you know if the “INITIAL_BASIC_AUTH” is supported by LR8.1 ?

Cheers

]]> By: Tim http://altentee.com/blogs/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-6966 Tim Fri, 09 Oct 2009 09:42:34 +0000 http://90kts.com/blog/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-6966 Mate you're missing the point! Don't put your webservers in there!! You need to put your domain controllers in there, the servers that look after your kerberos domain! If you don't know what I'm talking about I suggest you read here first or ask a sysadmin to help explain your security setup to you... Get familar with wireshark, observe a manual test case and watch how your authentication happens in your domain. Fiddler is also useful from a client point of view. http://en.wikipedia.org/wiki/Kerberos_(protocol) Mate you’re missing the point! Don’t put your webservers in there!! You need to put your domain controllers in there, the servers that look after your kerberos domain! If you don’t know what I’m talking about I suggest you read here first or ask a sysadmin to help explain your security setup to you… Get familar with wireshark, observe a manual test case and watch how your authentication happens in your domain. Fiddler is also useful from a client point of view.

http://en.wikipedia.org/wiki/Kerberos_(protocol)

]]> By: karan http://altentee.com/blogs/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-6965 karan Fri, 09 Oct 2009 09:26:08 +0000 http://90kts.com/blog/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-6965 Hi Tim, I've updated the Krb5.ini file but getting different error message now "Miscellaneous failure Server not found in Kerberos database [MsgId: MERR-27734]" I'm seeing Domain name as "YYYY", Server Name as "Webserver1", Domain DNS Name as "yyyy.asd.as.com" and Server DNS Name as "Webserver1.yyyy.asd.as.com" in the Wireshark. ----------------- Krb5.ini file is [libdefaults] default_realm = YYYY.ASD.AS.COM default_keytab_name = c:\winnt\krb5.keytab default_tkt_enctypes = des-cbc-md5 rc4-hmac default_tgs_enctypes = des-cbc-md5 rc4-hmac [realms] Webserver1.yyyy.asd.as.com = { kdc = Webserver1.yyyy.asd.as.com default_domain = yyyy.asd.as.com } Webserver.yyyy.asd.as.com = { kdc = Webserver2.yyyy.asd.as.com default_domain = yyyy.asd.as.com } Webserver3.yyyy.asd.as.com = { kdc = Webserver3.yyyy.asd.as.com default_domain = yyyy.asd.as.com } [domain_realm] .yyyy.asd.as.com = Webserver1.yyyy.asd.as.com .yyyy.asd.as.com = Webserver2.yyyy.asd.as.com .yyyy.asd.as.com = Webserver3.yyyy.asd.as.com --------------- Did I create the ini file in the right way? Thanks alot for your time & help. Karan Hi Tim, I’ve updated the Krb5.ini file but getting different error message now “Miscellaneous failure Server not found in Kerberos database [MsgId: MERR-27734]”

I’m seeing Domain name as “YYYY”, Server Name as “Webserver1″, Domain DNS Name as “yyyy.asd.as.com” and Server DNS Name as “Webserver1.yyyy.asd.as.com” in the Wireshark.

—————–
Krb5.ini file is

[libdefaults]
default_realm = YYYY.ASD.AS.COM
default_keytab_name = c:\winnt\krb5.keytab
default_tkt_enctypes = des-cbc-md5 rc4-hmac
default_tgs_enctypes = des-cbc-md5 rc4-hmac
[realms]
Webserver1.yyyy.asd.as.com = {
kdc = Webserver1.yyyy.asd.as.com
default_domain = yyyy.asd.as.com
}
Webserver.yyyy.asd.as.com = {
kdc = Webserver2.yyyy.asd.as.com
default_domain = yyyy.asd.as.com
}
Webserver3.yyyy.asd.as.com = {
kdc = Webserver3.yyyy.asd.as.com
default_domain = yyyy.asd.as.com
}
[domain_realm]
.yyyy.asd.as.com = Webserver1.yyyy.asd.as.com
.yyyy.asd.as.com = Webserver2.yyyy.asd.as.com
.yyyy.asd.as.com = Webserver3.yyyy.asd.as.com

—————

Did I create the ini file in the right way?

Thanks alot for your time & help.

Karan

]]> By: Karan http://altentee.com/blogs/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-6964 Karan Fri, 09 Oct 2009 07:37:11 +0000 http://90kts.com/blog/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-6964 Hi Tim, I've updated the Krb5.ini file but getting different error message now "Miscellaneous failure Server not found in Kerberos database [MsgId: MERR-27734]" I'm seeing Domain name as "YYYY", Server Name as "Webserver1", Domain DNS Name as "yyyy.asd.as.com" and Server DNS Name as "Webserver1.yyyy.asd.as.com" in the Wireshark. ----------------- Krb5.ini file is [libdefaults] default_realm = YYYY.ASD.AS.COM default_keytab_name = c:\winnt\krb5.keytab default_tkt_enctypes = des-cbc-md5 rc4-hmac default_tgs_enctypes = des-cbc-md5 rc4-hmac [realms] Webserver1.yyyy.asd.as.com = { kdc = Webserver1.yyyy.asd.as.com default_domain = yyyy.asd.as.com } Webserver2.yyyy.asd.as.com = { kdc = Webserver2.yyyy.asd.as.com default_domain = yyyy.asd.as.com } Webserver3.yyyy.asd.as.com = { kdc = Webserver3.yyyy.asd.as.com default_domain = yyyy.asd.as.com } [domain_realm] .yyyy.asd.as.com = Webserver1.yyyy.asd.as.com .yyyy.asd.as.com = Webserver2.yyyy.asd.as.com .yyyy.asd.as.com = Webserver3.yyyy.asd.as.com --------------- There are 3 web servers in the test bed. Did i create the ini file in the right way? Thanks alot for your help. Karan Hi Tim, I’ve updated the Krb5.ini file but getting different error message now “Miscellaneous failure Server not found in Kerberos database [MsgId: MERR-27734]”

I’m seeing Domain name as “YYYY”, Server Name as “Webserver1″, Domain DNS Name as “yyyy.asd.as.com” and Server DNS Name as “Webserver1.yyyy.asd.as.com” in the Wireshark.

—————–
Krb5.ini file is

[libdefaults]
default_realm = YYYY.ASD.AS.COM
default_keytab_name = c:\winnt\krb5.keytab
default_tkt_enctypes = des-cbc-md5 rc4-hmac
default_tgs_enctypes = des-cbc-md5 rc4-hmac
[realms]
Webserver1.yyyy.asd.as.com = {
kdc = Webserver1.yyyy.asd.as.com
default_domain = yyyy.asd.as.com
}
Webserver2.yyyy.asd.as.com = {
kdc = Webserver2.yyyy.asd.as.com
default_domain = yyyy.asd.as.com
}
Webserver3.yyyy.asd.as.com = {
kdc = Webserver3.yyyy.asd.as.com
default_domain = yyyy.asd.as.com
}
[domain_realm]
.yyyy.asd.as.com = Webserver1.yyyy.asd.as.com
.yyyy.asd.as.com = Webserver2.yyyy.asd.as.com
.yyyy.asd.as.com = Webserver3.yyyy.asd.as.com

—————

There are 3 web servers in the test bed.

Did i create the ini file in the right way?

Thanks alot for your help.

Karan

]]> By: Tim http://altentee.com/blogs/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-6963 Tim Fri, 09 Oct 2009 06:18:07 +0000 http://90kts.com/blog/2009/improved-spnego-or-kerberos-support-with-loadrunner/#comment-6963 The problem is you haven't updated the domain controllers in your [realms] to point to real DCs. You're just using my example file i.e. dc01.domain.local. You need to find out what the names are of your DCs and update accordingly. You can normally figure this out with a wireshark trace, or just ask your system admin type people. The error message is basically telling you this, i.e. it can't get the username/password for rmatte/Merrill1009 Cheers, Tim The problem is you haven’t updated the domain controllers in your [realms] to point to real DCs. You’re just using my example file i.e. dc01.domain.local. You need to find out what the names are of your DCs and update accordingly. You can normally figure this out with a wireshark trace, or just ask your system admin type people. The error message is basically telling you this, i.e. it can’t get the username/password for rmatte/Merrill1009

Cheers,
Tim

]]>