Zimbra Collaboration Administrator Guide

Administrator Guide

Your ticket as a domain user will be saved on the computer. The token will be picked up by the spnego-aware browser and sent in the Authorization header to the Zimbra server.

2.

Browse to the Zimbra Web Client log on page. You should be redirected to your ZWC inbox without being prompted for user name and password.

If spnego auth fails, the user is redirected to an error URL.

Troubleshooting setup

Make sure the following are true.





•

The browser is in the Intranet zone.

•

The user is accessing the server using a Hostname rather than IP address.

•

Integrated Windows authentication in Internet Explorer is enabled, and the host is trusted in Firefox.

•

The server is not local to the browser.

•

The client’s Kerberos system is authenticated to a domain controller.

If the browser display the "401 Unauthorized", it's most likely that the browser either did not send another request with Authorization in response to the 401, or had sent an Authorization which is not using the

GSS-API/SPNEGO scheme.

Check your browser settings, and make sure it is one of the supported browsers/platforms

If you are redirected to the error URL specified in

zimbraSpnegoAuthErrorURL

, that means The SPNEGO authentication sequence does not work.

Take a network trace, make sure the browser sends Authorization header in response to the 401. Make sure the Negotiate is using GSS-API/

SPNEGO, not NTLM (use a network packet decoder like Wireshark) .

After verifying that the browser is sending the correct Negotiate, if it still does not work, turn on the following debug and check Zimbra logs:

•

ADD "-DDEBUG=true -Dsun.security.spnego.debug=all" (note, not replace) to localconfig key spnego_java_options

•

Add log4j.logger.org.mortbay.log=DEBUG in log4j

Then restart the mailbox server.

Browse to the debug snoop page: http://{server}:{port}/spnego/snoop.jsp.

See if you can access the snoop.jsp

Check zmmailboxd.out and mailox.log for debug output.

382 Network Edition Zimbra Collaboration