limit tomcat's access to a specific domain controller

[former_member401188]

Hello Experts.

We have this challenge. Our BO enviroments tomcat access the domain controller in domain A (std. kerberos setup) . The domain controller returns all domain controllers it knows, but the tomcat doesn't have access to all of the them due there location/ firewall etc etc. So when you log on with SSO, sometimes it take a long time due to the tomcat is trying to get the ticket verified by one of the domain controlleres that it cant reach - so it takes the next in line and so on, and finally it reach one that is available, and you are logged on. So my question is, can we somehow tell the tomcat, that no matter what the DC return, you shall always use this DC to authenticate ???

Thanks

Henrik

[Joe_Peters]

I'm no Kerberos expert, but can't you just explicitly list the DCs you want to connect to in krb5.ini?

[Oldskoolskater · Accepted solution]

Hi,

How about this SAP note?

1958936 - How to force SSO to use a specific domain controller

[Oldskoolskater]

Great news Henrik - Glad it did the trick 🙂

[former_member401188]

Hi Stephen,

The users was delayed depending on which DC they where authenticated against.

But the note that you have found did the trick ! It is incredible that I didn't find that, taken into account that I have spend many hours on google and launchpad.support.sap.com... .;-)

Thanks a lot !

Cheers Henrik

[Oldskoolskater]

A question Henrik,

When you are delays with SSO are all users sessions affected or just single users?

[former_member401188]

Yes I can, but I have only specified one - but when the tomcat queries the specified DC, then it will receive all domain controllers and that is the problem.