---
title: CITSmart auto-login -SSO
slug: admin-en/citsmart-auto-login-sso
description: Learn how to create a user in Active Directory and configure the Wildfly server with this comprehensive document. Discover step-by-step instructions for accessing the Users and Computers section, setting passwords, and configuring account settings. Explor
docTags: 
createdAt: 2021-10-27T01:10:50.000Z
---

**Branchs**:

- Sso (itsm)
- Spnego 1.0 (artifactory)

## Create user AD

1. Access "**create user**" in **Users and Computers of the Active Directory**, as in the image below:

![](https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/KGsXn-6wBwmSdUi5cCyNm_image.png "Figure 1 - Creating User")

2\. Create a password: 

::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/YUtZMoWF-ojYhhwAMLaY2_image.png" size="62" width="371" height="275" caption="Figure 2 - Password" position="flex-start" showCaption="true"}

3\. Click on the right side of the mouse, in the button user/properties:

::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/jLtoL4WP6dDzuUv0ja-Y9_image.png" size="84" width="468" height="479" caption="Figure 3 - Button User/Properties" position="center" showCaption="true"}

4\. Select the "**This account supports 256-bit encryption**" option, apply it, and check "**OK**", as below:

::Image[]{src="https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/JOu5gDwFrmN1neoUDz17f_image.png" size="78" width="410" height="478" caption="Figure 4 - Configuring Account" position="center" showCaption="true"}

5\. Open the **ADSI Edit**. Then, connect in the **AD**, click on users and locate the user newly created, as below:

![](https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/rrI29X1MIYQW62Q3O5B9i_image.png "Figure 5 - Verifying User")

6\. Right-click and select the Properties option. Then, search for the **ServicePrincipalName** (SPN);

7\. Add **HTTP/hom-itsm.centralit.com.br**, click on "**OK**", as in the image below:

![](https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/RoZvWo2z7AfJd1Rw5QE27_image.png "Figure 6 - Adding Value")

8\. Open the CMD as Administrator and put the following commands. Remember that the first sets the SPN and the second creates the Keytab (which will be used in the Wildfly):

- setspn -s HTTP/hom-itsm.centralit.com.br citsmart2
- ktpass / princ HTTP/hom-itsm.centralit.com.br /mapuser citsmart2  /pass
  central\@123 /ptype KRB5\_NT\_Principal/outcitsmart2.keytab /crypto ALL

9\. Making the steps above, the AD will be configured. 

## Configure the Wildfly server

1. Copy the **war** generated from the branch **sso**;
2. Copy the file krb5.conf (validate the information according to the AD) to the folder standalone/configuration (wildfly):

````sh
    ```sh
    [libdefaults]
    default_tkt_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 rc4-hmac
    default_tgs_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 rc4-hmac
    permitted_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 rc4-hmac
    [realms]
    ```
    
    ```sh
    citgosrv004.cit.local  = {
    kdc = citsmartsrv.citsmartsrv.bigdata-team.com
    default_domain = citsmartsrv.citsmartsrv.bigdata-team.com }     
    ```
    
    ```sh
    [domain_realm]
    .citsmartsrv.citsmartsrv.bigdata-team.com = citsmartsrv.citsmartsrv.bigdata-team.com
    ```
````

Copy the file login.conf (validate the information according to the AD) to the folder standalone / configuration (wildfly):

````sh
    ```sh
    custom-client {
    com.sun.security.auth.module.Krb5LoginModule required
    storeKey=true
    useKeyTab=true
    keyTab="file:///opt/wildfly-12.0.0.Final/standalone/configuration/lightkeytab.keytab"
    principal=HTTP/light-desenvolvimento.citsmartcloud.com\@CITSMARTSRV.BIGDATA-TEAM.COM;
    };
    ```
````

1. Copy the lightkeytab.keytab file (generated by the command in AD) to the standalone / configuration (wildfly) folder;
2. Fix standalone.xlm by adding the following information:

In **\\\<system-properties>**

````java
    ```java
    \<property name="sun.security.krb5.debug" value="true"/\>
    \<property name="java.security.krb5.kdc" value="CITSMARTSRV.BIGDATA-TEAM.COM"/\>
    \<property name="java.security.krb5.realm"value="CITSMARTSRV.BIGDATA-TEAM.COM"/\>
    \<property name="java.security.krb5.conf"value="/opt/wildfly-12.0.0.Final/standalone/configuration/krb5.conf"/\>
    \<property name="java.security.auth.login.config"value="/opt/wildfly-12.0.0.Final/standalone/configuration/login.conf"/\>
    \<property name="krb.keyTab"value="/opt/wildfly-12.0.0.Final/standalone/configuration/lightkeytab.keytab"/\>
    \<property name="krb.principal"value="HTTP/light-desenvolvimento.citsmartcloud.com\@CITSMARTSRV.BIGDATA-TEAM.COM"/\>
    ```
````

In **\\\<security-domains>**

````java
    ```java
    \<security-domain name="spnego-server"\>
    \<authentication\>
    \<login-module code="com.sun.security.auth.module.Krb5LoginModule"flag="required"\>
    \<module-option name="storeKey" value="true"/\>
    \<module-option name="useKeyTab" value="true"/\>
    \<module-option name="keyTab" value="\${krb.keyTab}"/\>
    \<module-option name="principal" value="\${krb.principal}"/\>
    \<module-option name="isInitiator" value="false"/\>
    \</login-module\>
    \</authentication\>
    \</security-domain\>
    \<security-domain name="SPNEGO" cache-type="default"\>
    \<authentication\>
    \<login-module code="Kerberos" flag="required"\>
    \<module-option name="storeKey" value="true"/\>
    \<module-option name="refreshKrb5Config" value="true"/\>
    \<module-option name="useKeyTab" value="true"/\>
    \<module-option name="doNotPrompt" value="true"/\>
    \</login-module\>
    \</authentication\>
    \</security-domain\>
    ```
````

1. If you do not have changed the jar of the policy of JAVA (JCE - Java Cryptography Extension), download the files and put in jdk/jre/lib/security/policy/limited and jdk/jre/lib/security/policy/unlimited;
2. Import (synchronize) users of LDAP in ITSM.

:::hint{type="warning"}
⚠️ <u>**Attention**</u>**!&#x20;**

The DN Alias should be the same as the network domain (example: CIT\user), than the DN Alias = CIT, as below:
:::

![](https://api.archbee.com/api/optimize/pu5VMc-2TW3GQX4ly5Xp7/MxstjGn2domoCyJEGjEY__image.png "Figure 7 - Defining DN")

:::hint{type="warning"}
⚠️ <u>**Attention**</u>**!&#x20;**

It is recommended to read the following support materials: [https://ss64.com/nt/setspn.html](https://ss64.com/nt/setspn.html) and [http://spnego.sourceforge.net/](http://spnego.sourceforge.net/) 
:::