Update docs on RC4 depreciation.#6179
Conversation
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds Kerberos (krb5.conf) guidance to the IWA login setup instructions, including stronger default encryption type recommendations and background on key properties.
Changes:
- Documented where to find and how to update
krb5.conf, including AES enctype recommendations. - Added detailed explanations for relevant
[libdefaults]/[realms]properties andpermitted_enctypes. - Added a version-gated step (7.0.0–7.2.0) to configure the JVM
krb5.confsystem property.
| ``` | ||
|
|
||
| 3. Open the `krb5.conf` file found in the `<IS_HOME>/repository/conf/identity` folder. By default, it contains the following configuration: | ||
|
|
| }; | ||
| ``` | ||
|
|
||
| 3. Open the `krb5.conf` file found in the `<IS_HOME>/repository/conf/identity` folder. By default, it contains the following configuration: |
| Open `<IS_HOME>/bin/wso2server.sh` and add the following parameter to the JVM startup arguments so that {{product_name}} loads the updated `krb5.conf` file at startup: | ||
|
|
||
| ``` bash | ||
| -Djava.security.krb5.conf="$CARBON_HOME/repository/conf/identity/krb5.conf" |
| {% if is_version in ["7.0.0", "7.1.0", "7.2.0"] %} | ||
| 4. Set the Kerberos configuration file location as a JVM system property. |
| ``` bash | ||
| -Djava.security.krb5.conf="$CARBON_HOME/repository/conf/identity/krb5.conf" | ||
| ``` | ||
| {% endif %} |
📝 WalkthroughWalkthroughThis PR adds documentation for configuring Kerberos encryption in IWA (Integrated Windows Authentication) setup, replacing weak RC4 algorithms with AES enctypes and providing version-specific JVM startup parameter configuration. ChangesIWA Kerberos Configuration Documentation
Possibly related issues
Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@en/includes/guides/authentication/enterprise-login/add-iwa-login.md`:
- Around line 75-110: The fenced code blocks inside the Jinja conditional
branches (the ``` java blocks within the "{% if is_version in [\"7.0.0\",
\"7.1.0\", \"7.2.0\"] %}" branch and the "{% else %}" branch) are missing
surrounding blank lines; add a single blank line before and after each fenced
code block so the opening and closing ``` fences are each separated by a blank
line from adjacent text (i.e., insert a blank line after the closing ``` in both
branches and ensure there's a blank line before the opening ``` in the else
branch as well) to fix the MD031 lint failures.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro
Run ID: e748ae1e-5340-489c-b727-fb53b26779d7
📒 Files selected for processing (1)
en/includes/guides/authentication/enterprise-login/add-iwa-login.md
| {% if is_version in ["7.0.0", "7.1.0", "7.2.0"] %} | ||
| ``` java | ||
| [libdefaults] | ||
| default_realm = WSO2.COM | ||
| default_tkt_enctypes = rc4-hmac | ||
| default_tgs_enctypes = rc4-hmac | ||
| dns_lookup_kdc = true | ||
| dns_lookup_realm = false | ||
|
|
||
| [realms] | ||
| WSO2.COM = { | ||
| kdc = 127.0.0.1 | ||
| } | ||
| ``` | ||
|
|
||
| The default configuration uses `rc4-hmac`, which is considered weak and is disabled by default in newer JDKs. Update `default_tkt_enctypes` and `default_tgs_enctypes` to use AES enctypes that are also permitted for the SPN account on your KDC. For most Active Directory environments, the following is a safe replacement: | ||
|
|
||
| ``` java | ||
| default_tkt_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 | ||
| default_tgs_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 | ||
| ``` | ||
| {% else %} | ||
| ``` java | ||
| [libdefaults] | ||
| default_realm = WSO2.COM | ||
| default_tkt_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 | ||
| default_tgs_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 | ||
| dns_lookup_kdc = true | ||
| dns_lookup_realm = false | ||
|
|
||
| [realms] | ||
| WSO2.COM = { | ||
| kdc = 127.0.0.1 | ||
| } | ||
| ``` | ||
| {% endif %} |
There was a problem hiding this comment.
Fix MD031 failures by adding blank lines around fenced blocks in both Jinja branches.
The fences opened at Line 76 and Line 97 are not surrounded by blank lines, which is causing the lint job to fail.
Suggested patch
{% if is_version in ["7.0.0", "7.1.0", "7.2.0"] %}
+
``` java
[libdefaults]
default_realm = WSO2.COM
@@
}
```
+
The default configuration uses `rc4-hmac`, which is considered weak and is disabled by default in newer JDKs. Update `default_tkt_enctypes` and `default_tgs_enctypes` to use AES enctypes that are also permitted for the SPN account on your KDC. For most Active Directory environments, the following is a safe replacement:
@@
default_tgs_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96
```
+
{% else %}
+
``` java
[libdefaults]
default_realm = WSO2.COM
@@
}
```
+
{% endif %}🧰 Tools
🪛 GitHub Actions: Markdown Lint / 0_lint.txt
[error] 76-76: markdownlint-cli2: MD031/blanks-around-fences - Fenced code blocks should be surrounded by blank lines. [Context: "``` java"]
🪛 GitHub Actions: Markdown Lint / lint
[error] 76-76: markdownlint-cli2/md031: Fenced code blocks should be surrounded by blank lines [Context: "``` java"].
🪛 GitHub Check: lint
[failure] 109-109: Fenced code blocks should be surrounded by blank lines
en/includes/guides/authentication/enterprise-login/add-iwa-login.md:109 MD031/blanks-around-fences Fenced code blocks should be surrounded by blank lines [Context: "```"] https://github.com/DavidAnson/markdownlint/blob/v0.38.0/doc/md031.md
[failure] 97-97: Fenced code blocks should be surrounded by blank lines
en/includes/guides/authentication/enterprise-login/add-iwa-login.md:97 MD031/blanks-around-fences Fenced code blocks should be surrounded by blank lines [Context: "``` java"] https://github.com/DavidAnson/markdownlint/blob/v0.38.0/doc/md031.md
[failure] 95-95: Fenced code blocks should be surrounded by blank lines
en/includes/guides/authentication/enterprise-login/add-iwa-login.md:95 MD031/blanks-around-fences Fenced code blocks should be surrounded by blank lines [Context: "```"] https://github.com/DavidAnson/markdownlint/blob/v0.38.0/doc/md031.md
[failure] 76-76: Fenced code blocks should be surrounded by blank lines
en/includes/guides/authentication/enterprise-login/add-iwa-login.md:76 MD031/blanks-around-fences Fenced code blocks should be surrounded by blank lines [Context: "``` java"] https://github.com/DavidAnson/markdownlint/blob/v0.38.0/doc/md031.md
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@en/includes/guides/authentication/enterprise-login/add-iwa-login.md` around
lines 75 - 110, The fenced code blocks inside the Jinja conditional branches
(the ``` java blocks within the "{% if is_version in [\"7.0.0\", \"7.1.0\",
\"7.2.0\"] %}" branch and the "{% else %}" branch) are missing surrounding blank
lines; add a single blank line before and after each fenced code block so the
opening and closing ``` fences are each separated by a blank line from adjacent
text (i.e., insert a blank line after the closing ``` in both branches and
ensure there's a blank line before the opening ``` in the else branch as well)
to fix the MD031 lint failures.
Sources: Linters/SAST tools, Pipeline failures
Related Issues:
This pull request enhances the documentation for configuring Integrated Windows Authentication (IWA) by providing detailed guidance on setting up the
krb5.conffile and explaining key Kerberos configuration properties. The update improves clarity for users configuring Kerberos environments, especially around encryption types and compatibility with Active Directory.Kerberos configuration guidance:
krb5.conffile, including default and recommended settings for different product versions, with a focus on using secure AES encryption types instead of the deprecatedrc4-hmac.[libdefaults]and[realms], clarifying their roles in Kerberos authentication and how they should be set for typical AD environments.default_tkt_enctypesanddefault_tgs_enctypesin the Kerberos authentication flow, emphasizing the need for alignment with the KDC's permitted encryption types.permitted_enctypesproperty and how to use it to further restrict allowed encryption algorithms for enhanced security.Product version-specific instructions: