Single Sign On using Kerberos and Active Directory

I am attempting to write a proof of concept of Single Sign On using Kerberos and Active Directory.

I have searched through these forums and found several suggestions which I have attempted to use, in fact my code snippet below comes from these forums.

I have set the registry setting (allowtgtsessionkey) on (both of) our Windows 2000 SP4 Active Directory Servers.

As an aside there seems to be a difference of opinion as to whether this is a REG_DWORD or REG_SZ see (but I have tried both):

http://support.microsoft.com/kb/308339 and

http://java.sun.com/j2se/1.5.0/docs/guide/security/jgss/tutorials/Troubleshooting.html

I have ticked the check box "Use DES Encryption" against my test user and reset the password in Active Directory.

I still get the error message "KDC has no support for encryption type (14)", what have I missed? Has anyone got this working?

I am using Java version 1.5.0_11

This is the configuration file I used:

JaasSample{

com.sun.security.auth.module.Krb5LoginModule required client=true debug=true useTicketCache=true doNotPrompt=true;

};

com.sun.security.jgss.initiate{

com.sun.security.auth.module.Krb5LoginModule required client=true debug=true useTicketCache=true doNotPrompt=true;

};

This is the code I am using:

publicclass KerberosExample{

publicstaticvoid main(String[] args){

java.util.Properties p =new java.util.Properties(System.getProperties());

//p.setProperty("java.security.krb5.conf", KRB5_CONF);

p.setProperty("java.security.krb5.realm", REALM);

p.setProperty("java.security.krb5.kdc", KDC);

p.setProperty("java.security.auth.login.config", LOGIN_CONFIG);

p.setProperty("javax.security.auth.useSubjectCredsOnly","false");

p.setProperty("sun.security.krb5.debug","true");

System.setProperties(p);

LoginContext lc =null;

try{

lc =new LoginContext("JaasSample",new TextCallbackHandler());

lc.login();

}catch (LoginException le){

System.err.println("Authentication attempt failed" + le);

System.exit(-1);

}

Subject.doAs(lc.getSubject(),new LDAPAction());

}

class LDAPActionimplements java.security.PrivilegedAction{

public Object run(){

Hashtable env =new Hashtable();

env.put(Context.INITIAL_CONTEXT_FACTORY,"com.sun.jndi.ldap.LdapCtxFactory");

env.put(Context.PROVIDER_URL, KerberosExample.LDAP_URL);

env.put(Context.SECURITY_AUTHENTICATION,"GSSAPI");

env.put("javax.security.sasl.server.authentication","true");

try{

DirContext ctx =new InitialDirContext(env);

Attributes aAnswer = ctx.getAttributes(KerberosExample.USER_ACCOUNT);

NamingEnumeration enumUserInfo = aAnswer.getAll();

while (enumUserInfo.hasMoreElements()){

System.out.println(enumUserInfo.nextElement().toString());

}

ctx.close();

}catch (NamingException e){

e.printStackTrace();

}

returnnull;

}

Any help would be gratefully received.

[5057 byte] By [michael_623a] at [2007-11-26 21:01:36]

Java programming resources: FAQs, tutorials, compiler and browser download sites, documentation, books lists, IDEs, etc.

Single Sign On using Kerberos and Active Directory

Security New Topic

Security Hot Topic

Security

All Classified