.

OpenAFS client and Kerberos on Windows 10


The installation of the OpenAFS client in 64-bit Windows 10 requires three software packages, a configuration file (krb5.conf) and a proper sequence of installation steps.
The packages and the configuration file are provided in the following sections of this page, but more information can be found on OpenAFS Windows Web Site. The site at this moment refers to Windows versions up to Windows 8 but the client suggested on this page has been tested to work properly also on Windows 10.
Short descriptions of how to get a Kerberos Ticket / AFS token and how to map a directory in AFS file system as a Windows Network Drive are also provided.
 

Download required components


The software packages are:
  • Kerberos: the Heimdal implementation of Kerberos 5 protocol [ Heimdal site]
  • Network Identity Manager: a GUI application for Kerberos Ticket  & AFS token [ NIM site]
  • OpenAFS client: the OpenAFS client packed by Auristor [ Auristor site]

For simplicity a set of these packages is available on this site (ENEAGRID credential required)


The configuration  krb5.conf file, with different version optimized for some of the main ENEA site (ENEAGRID credential required):


In case of wandering clients (e.g. laptops) don't worry, all the configuration files work everywhere and the most used site should be selected. When in doubt, select Frascati.

Installation steps


An administrator user should go through the following steps in the given order :

  1. Download the packages and the configuration file.
  2. Install Heimdal Kerberos for Windows.
  3. Change the default configuration file C:\ProgramData\Kerberos5\krb5.conf with the one specific for ENEAGRID (take into account the note about the ProgramData folder at the end of this page).
  4. System reboot.
  5. Install Network Identity Manager.
  6. System reboot.
  7. Install OpenAFS client, with all default values, but specifying the enea.it as the Default Cell.
  8. System reboot.


Obtaining a Kerberos ticket and an AFS token


To get a Kerberos Ticket and AFS tokens, click Start and select Network Identity Manager.
Select the option "Credentials" and choose "New Credentials -> Obtain new credentials" and provide the ENEAGRID userid as the Username. Click Next. In the following window the Lifetime of the Ticket/Token  can be modified. The default is 10 hours, but a several days lifetime is surely acceptable, Click Finish.

Select again the option option "Credentials" and choose "New Credentials -> Obtain new credentials" and provide the password. If successful the main window of Network Identity Manager at this point will show the new active ticket/token information. Close the window. An icon for Network Identity Manager will appear in the taskbar notification area, at the lower left corner of the screen.

The Kerberos ticket and the AFS token can also be obtained from the command line by issuing the commands:
  • kinit USERID     [where USERID is the ENEAGRID userid]
  • aklog
and the availability of the ticket/token can be checked by the comands
  • klist
  • tokens
There are cases where the application "Network Identity Manager" does not work properly and so the command line approach is the alternative solution. The command line prompt in WIndows 10 can be accessed with WindowsKey+X selecting "Command Prompt" option.

Mapping an AFS directory as a Windows Network Drive


To map an AFS directory as a Windows network Drive, you will need to open the File Explorer, for example by clicking the folder icon in the Taskbar.
On the File Explorer windows, select "This PC" and the "Computer" Tab.

Select "Connect to a Network Drive". In the resulting menu, provide the root path of the enea.it AFS cell in the format \\afs\enea.it (take care that the separator in the path is the backslash) and navigate to find the desired folder.

For example for the user "carciofo" the folder path would be \\afs\enea.it\user\c\carciofo , but any accessible afs folder can be selected. If the folder ACL is set so that it is accessible only by the user "carciofo" a token for this user must be available in advance , see Obtaining a Kerberos ticket and an AFS token.

The menu suggests also a Drive identification letter, which normally can be used without problems.


A note about C:\ProgramData folder


With default Windows 10 settings, folders as C:\ProgramData are hidden folders.
To access it, you will need to change the defaults, opening the File Explorer, for example by clicking the folder icon in the Taskbar.
On the File Explorer window select View, select Options and find the "folder options" dialog.
Select the View Tab and switch on the radio button "Show Hidden Files, Folders and Drives". You should now be able to see and access the "C:\Program Data" folder.
Of course default Windows 10 configuration can be restored later, after the application of the desired modification.