Kerberos RC4-HMAC Checksum Failed using Java 6 and Windows 2003/XP
I am trying to get my IE6 client (running on XP) to authenticate to my JBoss server (on 2003) using the Active Directory on a 2003 box. I am using Java 6 Beta 2. My krb5.ini file is:
[libdefaults]
default_realm = DEVEL.OPENROADSCONSULTING.COM
default_tgs_enctypes = RC4-HMAC
default_tkt_enctypes = RC4-HMAC
[kadmin]
default_keys = v5 arcfour-hmac-md5
[realms]
DEVEL.OPENROADSCONSULTING.COM ={
kdc = interchange
kdc = 192.168.100.101
admin_server = interchange
default_domain = devel.openroadsconsulting.com
}
[domain_realm]
.devel.openroadsconsulting.com = DEVEL.OPENROADSCONSULTING.COM
[appdefaults]
autologin =true
forward =true
forwardable =true
encrypt =true
My JBoss authenticates itself with the AD and my IE6 does the same. However, when I try to have the IE client authenticate with JBoss, I get the following error:
2006-08-14 11:48:44,920 INFO [STDOUT] Entered Krb5Context.acceptSecContext with state=STATE_NEW
2006-08-14 11:48:44,920 INFO [STDOUT] >>> EType: sun.security.krb5.internal.crypto.ArcFourHmacEType
2006-08-14 11:48:44,920 ERROR [STDERR] Checksum failed !
2006-08-14 11:48:44,920 ERROR [STDERR] jcifs.spnego.AuthenticationException: Error performing Kerberos authentication: java.lang.reflect.InvocationTargetException
2006-08-14 11:48:44,920 ERROR [STDERR] at jcifs.spnego.Authentication.processKerberos(Authentication.java:447)
2006-08-14 11:48:44,920 ERROR [STDERR] at jcifs.spnego.Authentication.processSpnego(Authentication.java:346)
2006-08-14 11:48:44,920 ERROR [STDERR] at jcifs.spnego.Authentication.process(Authentication.java:235)
2006-08-14 11:48:44,920 ERROR [STDERR] at org.jboss.web.tomcat.security.NegotiateUtil.extractUserId(NegotiateUtil.java:161)
2006-08-14 11:48:44,920 ERROR [STDERR] at org.jboss.web.tomcat.security.HttpServletRequestResponseValve.authenticate(HttpServletRequestResponseValve.java:98)
2006-08-14 11:48:44,920 ERROR [STDERR] at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:490)
2006-08-14 11:48:44,920 ERROR [STDERR] at org.jboss.web.tomcat.security.HttpServletRequestResponseValve.invoke(HttpServletRequestResponseValve.java:70)
2006-08-14 11:48:44,920 ERROR [STDERR] at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:74)
2006-08-14 11:48:44,920 ERROR [STDERR] at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126)
2006-08-14 11:48:44,920 ERROR [STDERR] at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:105)
2006-08-14 11:48:44,998 ERROR [STDERR] at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:107)
2006-08-14 11:48:44,998 ERROR [STDERR] at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148)
2006-08-14 11:48:44,998 ERROR [STDERR] at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:869)
2006-08-14 11:48:44,998 ERROR [STDERR] at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java:664)
2006-08-14 11:48:44,998 ERROR [STDERR] at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:527)
2006-08-14 11:48:44,998 ERROR [STDERR] at org.apache.tomcat.util.net.MasterSlaveWorkerThread.run(MasterSlaveWorkerThread.java:112)
2006-08-14 11:48:44,998 ERROR [STDERR] at java.lang.Thread.run(Unknown Source)
2006-08-14 11:48:44,998 ERROR [STDERR] Caused by: java.lang.reflect.InvocationTargetException
2006-08-14 11:48:44,998 ERROR [STDERR] at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
2006-08-14 11:48:44,998 ERROR [STDERR] at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
2006-08-14 11:48:44,998 ERROR [STDERR] at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
2006-08-14 11:48:44,998 ERROR [STDERR] at java.lang.reflect.Method.invoke(Unknown Source)
2006-08-14 11:48:44,998 ERROR [STDERR] at jcifs.spnego.Authentication.processKerberos(Authentication.java:430)
2006-08-14 11:48:44,998 ERROR [STDERR] ... 16 more
2006-08-14 11:48:44,998 ERROR [STDERR] Caused by: java.security.PrivilegedActionException: java.lang.reflect.InvocationTargetException
2006-08-14 11:48:44,998 ERROR [STDERR] at java.security.AccessController.doPrivileged(Native Method)
2006-08-14 11:48:44,998 ERROR [STDERR] at javax.security.auth.Subject.doAsPrivileged(Unknown Source)
2006-08-14 11:48:44,998 ERROR [STDERR] ... 21 more
2006-08-14 11:48:44,998 ERROR [STDERR] Caused by: java.lang.reflect.InvocationTargetException
2006-08-14 11:48:44,998 ERROR [STDERR] at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
2006-08-14 11:48:44,998 ERROR [STDERR] at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
2006-08-14 11:48:44,998 ERROR [STDERR] at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
2006-08-14 11:48:44,998 ERROR [STDERR] at java.lang.reflect.Method.invoke(Unknown Source)
2006-08-14 11:48:44,998 ERROR [STDERR] at jcifs.spnego.Authentication$ServerAction.run(Authentication.java:517)
2006-08-14 11:48:44,998 ERROR [STDERR] ... 23 more
2006-08-14 11:48:44,998 ERROR [STDERR] Caused by: GSSException: Failure unspecified at GSS-API level (Mechanism level: Checksum failed)
2006-08-14 11:48:44,998 ERROR [STDERR] at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Unknown Source)
2006-08-14 11:48:44,998 ERROR [STDERR] at sun.security.jgss.GSSContextImpl.acceptSecContext(Unknown Source)
2006-08-14 11:48:44,998 ERROR [STDERR] at sun.security.jgss.GSSContextImpl.acceptSecContext(Unknown Source)
2006-08-14 11:48:44,998 ERROR [STDERR] ... 28 more
2006-08-14 11:48:44,998 ERROR [STDERR] Caused by: KrbException: Checksum failed
2006-08-14 11:48:44,998 ERROR [STDERR] at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(Unknown Source)
2006-08-14 11:48:44,998 ERROR [STDERR] at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(Unknown Source)
2006-08-14 11:48:44,998 ERROR [STDERR] at sun.security.krb5.EncryptedData.decrypt(Unknown Source)
2006-08-14 11:48:44,998 ERROR [STDERR] at sun.security.krb5.KrbApReq.authenticate(Unknown Source)
2006-08-14 11:48:44,998 ERROR [STDERR] at sun.security.krb5.KrbApReq.<init>(Unknown Source)
2006-08-14 11:48:44,998 ERROR [STDERR] at sun.security.jgss.krb5.InitSecContextToken.<init>(Unknown Source)
2006-08-14 11:48:44,998 ERROR [STDERR] ... 31 more
2006-08-14 11:48:44,998 ERROR [STDERR] Caused by: java.security.GeneralSecurityException: Checksum failed
2006-08-14 11:48:44,998 ERROR [STDERR] at sun.security.krb5.internal.crypto.dk.ArcFourCrypto.decrypt(Unknown Source)
2006-08-14 11:48:44,998 ERROR [STDERR] at sun.security.krb5.internal.crypto.ArcFourHmac.decrypt(Unknown Source)
2006-08-14 11:48:44,998 ERROR [STDERR] ... 37 more
I loaded Ethereal and got the following authentication packet via HTTP:
No.TimeSourceDestinationProtocol Info
4310 4.782602192.168.100.125192.168.100.127HTTPGET /VicadsAdmin/GetFrontPage.event HTTP/1.1
Frame 4310 (686 bytes on wire, 686 bytes captured)
Ethernet II, Src: Dell_a6:00:f2 (00:13:72:a6:00:f2), Dst: Dell_63:73:e5 (00:13:72:63:73:e5)
Internet Protocol, Src: 192.168.100.125 (192.168.100.125), Dst: 192.168.100.127 (192.168.100.127)
Transmission Control Protocol, Src Port: 1081 (1081), Dst Port: 8080 (8080), Seq: 1461, Ack: 1, Len: 632
Reassembled TCP Segments (2092 bytes): #4309(1460), #4310(632)
Hypertext Transfer Protocol
GET /VicadsAdmin/GetFrontPage.event HTTP/1.1\r\n
Request Method: GET
Request URI: /VicadsAdmin/GetFrontPage.event
Request Version: HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n
Accept-Language: en-us\r\n
Accept-Encoding: gzip, deflate\r\n
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)\r\n
Host: vicads0:8080\r\n
Connection: Keep-Alive\r\n
Authorization: Negotiate YIIFDgYGKwYBBQUCoIIFAjCCBP6gJDAiBgkqhkiC9xIBAgIGCSqGSIb3EgECAgYKKwYBBAGCNwICCqKCBNQEggTQYIIEzAYJKoZIhvcSAQICAQBuggS7MIIEt6ADAgEFoQMCAQ6iBwMFACAAAACjggPUYYID0DCCA8ygAwIBBaEfGx1ERVZFTC5PUEVOUk9BRFNDT05TVUxUSU5HLkNPTa
GSS-API Generic Security Service Application Program Interface
OID: 1.3.6.1.5.5.2 (SPNEGO - Simple Protected Negotiation)
SPNEGO
negTokenInit
mechTypes: 3 items
Item: 1.2.840.48018.1.2.2 (MS KRB5 - Microsoft Kerberos 5)
Item: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5)
Item: 1.3.6.1.4.1.311.2.2.10 (NTLMSSP - Microsoft NTLM Security Support Provider)
mechToken: 608204CC06092A864886F71201020201006E8204BB308204...
krb5_blob: 608204CC06092A864886F71201020201006E8204BB308204...
KRB5 OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5)
krb5_tok_id: KRB5_AP_REQ (0x0001)
Kerberos AP-REQ
Pvno: 5
MSG Type: AP-REQ (14)
Padding: 0
APOptions: 20000000 (Mutual required)
.0.. .... .... .... .... .... .... .... = Use Session Key: Do NOT use the session key to encrypt the ticket
..1. .... .... .... .... .... .... .... = Mutual required: MUTUAL authentication is REQUIRED
Ticket
Tkt-vno: 5
Realm: DEVEL.OPENROADSCONSULTING.COM
Server Name (Service and Instance): HTTP/vicads0.devel.openroadsconsulting.com
Name-type: Service and Instance (2)
Name: HTTP
Name: vicads0.devel.openroadsconsulting.com
enc-part rc4-hmac
Encryption type: rc4-hmac (23)
Kvno: 2
enc-part: 05709AD578CD120E1292C1123131A078DEA84E68D6DE4AE8...
Authenticator rc4-hmac
Encryption type: rc4-hmac (23)
Authenticator data: 2AA7237E8F20DBA7090E3630FCF01EB7D29780CAEF6E8053...
\r\n
I am suspicious of the APOptions not to use the session key but I cannot find how to change this (I have tried setting AllowTgtSessionKey to 1 but this does not change anything).
I've been beeting my head against the wall for a solid 3 days, can anyone please help me?
Thanks, David
[10697 byte] By [
kc7bfia] at [2007-10-3 2:43:34]
I've tried changing my krb5.ini to include des-cbc-crc and then setting the Active Directory user accounts to "Use DES" but the authentication from IE6 still comes back as RC4-HMAC. Is it a problem with IE6? I cannot figure what is going on. Help, David
Please check your Kerberos configuration. Few things to check out:
1) Kerberos account setup to use RC4-HMAC.
Windows ActiveDirectory defaults to RC4-HMAC, make sure "use DES"
option is NOT selected, and reset your password to ensure appropriate
keys are generated.
2) Set-up Kerberos configuration file to use RC4-HMAC
[libdefaults]
default_tkt_enctypes = rc4-hmac
default_tgs_enctypes = rc4-hmac
Ensure you are providing this Kerberos configuration file when running your
Java application, using system property -Djava.security.krb5.conf="krb5.conf"
Ensure KDC/realm provided in krb5.conf is correct.
3) Just try a simple JAAS login, to ensure your Kerberos configuration is set-up correctly.
Looking at your trace log, it appears that you are trying to use HTTP/SPNEGO.
Java SE 6 includes support for HTTP/SPNEGO. Are you trying to use this
feature, or are you trying to authenticate using SPNEGO with Java GSS.
Please clarify your usage.
Seema
Hello all,
I'm experiencing the same issue,
I'm trying to authenticate a user using the new support for SPNEGO (java 6 beta 2). basically i'm trying to implement a tomcat kerberos filter
my jaas config file is set to:
KRB5Authenticator {
com.sun.security.auth.module.Krb5LoginModule
required
debug=true
client=true
storeKey=true;
};
my kerberos conf file is set to:
[libdefaults]
default_realm = DOMAIN
default_tkt_enctypes = rc4-hmac des3-hmac-sha1 des-cbc-crc
default_tgs_enctypes = rc4-hmac des3-hmac-sha1 des-cbc-crc
dns_lookup_kdc = true
dns_lookup_realm = false
[realms]
DOMAIN = {
kdc = domaincontroller
admin_server = domaincontroller
}
[domain_realm]
.domain = DOMAIN
[logging]
kdc = SYSLOG:DEBUG:DAEMON
kdc = FILE:/logs/kdc.log
default = FILE:/logs/kdc.log
i am able to login to the kdc and obtain a principal so i guess my kerberos configuration is OK.
now when i try to authenticate a user i get the same checksum error, i can c that a decrypt attempt is made using ArcFourCrypto class so i have no idea why the checksum fails, here's the stack trace:
13:14:13 [E:HttpProcessor[8080][4]] GSSException: Failure unspecified at GSS-API level (Mechanism level: Checksum failed)
at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:739)
at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:323)
at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:267)
at sun.security.jgss.spnego.SpNegoContext.GSS_acceptSecContext(SpNegoContext.java:869)
at sun.security.jgss.spnego.SpNegoContext.acceptSecContext(SpNegoContext.java:536)
at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:323)
at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:267)
at telemessage.util.auth.KRB5Authenticator$KRB5Handler.run(KRB5Authenticator.java:89)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAs(Subject.java:337)
at telemessage.util.auth.KRB5Authenticator.doAs(KRB5Authenticator.java:232)
at telemessage.web.servlet.AuthServlet.authenticate(AuthServlet.java:105)
at telemessage.web.servlet.AuthServlet.doAuthenticate(AuthServlet.java:139)
at telemessage.web.servlet.AuthServlet.doFilter(AuthServlet.java:493)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:213)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:256)
at org.apache.catalina.core.StandardPipeline$StandardPipelineValveContext.invokeNext(StandardPipeline.java:643)
at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:480)
at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:995)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
at org.apache.catalina.core.StandardPipeline$StandardPipelineValveContext.invokeNext(StandardPipeline.java:643)
at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:480)
at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:995)
at org.apache.catalina.core.StandardContext.invoke(StandardContext.java:2417)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:180)
at org.apache.catalina.core.StandardPipeline$StandardPipelineValveContext.invokeNext(StandardPipeline.java:643)
at org.apache.catalina.valves.ErrorDispatcherValve.invoke(ErrorDispatcherValve.java:171)
at org.apache.catalina.core.StandardPipeline$StandardPipelineValveContext.invokeNext(StandardPipeline.java:641)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:172)
at org.apache.catalina.core.StandardPipeline$StandardPipelineValveContext.invokeNext(StandardPipeline.java:641)
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:577)
at org.apache.catalina.core.StandardPipeline$StandardPipelineValveContext.invokeNext(StandardPipeline.java:641)
at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:480)
at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:995)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:174)
at org.apache.catalina.core.StandardPipeline$StandardPipelineValveContext.invokeNext(StandardPipeline.java:643)
at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:480)
at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:995)
at org.apache.catalina.connector.http.HttpProcessor.process(HttpProcessor.java:1040)
at org.apache.catalina.connector.http.HttpProcessor.run(HttpProcessor.java:1151)
at java.lang.Thread.run(Thread.java:619)
Caused by: KrbException: Checksum failed
at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHmacEType.java:85)
at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHmacEType.java:77)
at sun.security.krb5.EncryptedData.decrypt(EncryptedData.java:168)
at sun.security.krb5.KrbApReq.authenticate(KrbApReq.java:267)
at sun.security.krb5.KrbApReq.<init>(KrbApReq.java:134)
at sun.security.jgss.krb5.InitSecContextToken.<init>(InitSecContextToken.java:79)
at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:722)
... 41 more
Caused by: java.security.GeneralSecurityException: Checksum failed
at sun.security.krb5.internal.crypto.dk.ArcFourCrypto.decrypt(ArcFourCrypto.java:388)
at sun.security.krb5.internal.crypto.ArcFourHmac.decrypt(ArcFourHmac.java:74)
at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHmacEType.java:83)
... 47 more
in ethreal i can see that indeed i get valid GSS data (SPNEGO) that uses rc4-hmac encryption, here's the packet:
Authorization: Negotiate YIIEuwYGKwYBBQUCoIIErzCCBKugJDAiBgkqhkiC9xIBAgIGCSqGSIb3EgECAgYKKwYBBAGCNwICCqKCBIEEggR9YIIEeQYJKoZIhvcSAQICAQBuggRoMIIEZKADAgEFoQMCAQ6iBwMFACAAAACjggOIYYIDhDCCA4CgAwIBBaETGxFURUxFTUVTU0FHRS5DTy5JTKIZMBegAwIBAqEQMA
GSS-API Generic Security Service Application Program Interface
OID: 1.3.6.1.5.5.2 (SPNEGO - Simple Protected Negotiation)
SPNEGO
negTokenInit
mechTypes: 3 items
Item: 1.2.840.48018.1.2.2 (MS KRB5 - Microsoft Kerberos 5)
Item: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5)
Item: 1.3.6.1.4.1.311.2.2.10 (NTLMSSP - Microsoft NTLM Security Support Provider)
mechToken: 6082047906092A864886F71201020201006E820468308204...
krb5_blob: 6082047906092A864886F71201020201006E820468308204...
KRB5 OID: 1.2.840.113554.1.2.2 (KRB5 - Kerberos 5)
krb5_tok_id: KRB5_AP_REQ (0x0001)
Kerberos AP-REQ
Pvno: 5
MSG Type: AP-REQ (14)
Padding: 0
APOptions: 20000000 (Mutual required)
.0.. .... .... .... .... .... .... .... = Use Session Key: Do NOT use the session key to encrypt the ticket
..1. .... .... .... .... .... .... .... = Mutual required: MUTUAL authentication is REQUIRED
Ticket
Tkt-vno: 5
Realm: TELEMESSAGE.CO.IL
Server Name (Service and Instance): HTTP/daniel
Name-type: Service and Instance (2)
Name: HTTP
Name: daniel
enc-part rc4-hmac
Encryption type: rc4-hmac (23)
Kvno: 39
enc-part: 360DA3300C332F8489C812197DE307990FB4DD29683F4109...
Authenticator rc4-hmac
Encryption type: rc4-hmac (23)
Authenticator data: FE6334159350A47E049F8A6B24A06CB3D28558252F270AE7...
has anyone solved this issue?
thanks in advance
Daniel.
From your stack trace it appears that your Server is not able to handle
SPNEGO tokens. Check your Server configuration and setup.
Please try the following:
Part I : Validate Kerberos configurationn
Try a simple JAAS Kerberos login using rc4-hmac encryption type.
See following for details.
krb5.conf
--
[libdefaults]
default_tkt_enctypes = rc4-hmac
default_tgs_enctypes = rc4-hmac
jaas.conf
client {
com.sun.security.auth.module.Krb5LoginModule required
debug=true;
};
Here is the sample for a JAAS Kerberos login.
System.setProperty("java.security.auth.login.config", "jaas.conf");
System.setProperty("java.security.krb5.conf", "krb5.conf");
LoginContext lc = new LoginContext("client",
new com.sun.security.auth.callback.TextCallbackHandler());
// Attempt authentication
lc.login();
System.out.println(lc.getSubject());
Part II : Check you application using Java GSS.
Are you using Kerberos or SPNEGO ? Check the OIDs used.
Seema
Hey seema, i realy appriciate your help
Indeed i am tring to use SPNEGO since that is what IE sends while using integrated auth.
in my app i successfully login and when i try to authenticate a token i do use the correct OID inorder to obtain the proper credentials. i also tried the code u suggested and it works but i still the checksum error.
Oid spnego = new Oid("1.3.6.1.5.5.2");
again here's the full log i get (includes the details of my Subject):
Debug is true storeKey true useTicketCache false useKeyTab true doNotPrompt false ticketCache is null KeyTab is C:TeleMessagerunkworkmpFileskerb5.keytab refreshKrb5Config is false principal is null tryFirstPass is false useFirstPass is false storePass is false clearPass is false
Key for the principal daniel@TELEMESSAGE.CO.IL not available in C:TeleMessagerunkworkmpFileskerb5.keytab
[Krb5LoginModule] user entered username: daniel
principal is daniel@TELEMESSAGE.CO.IL
Acquire TGT using AS Exchange
EncryptionKey: keyType=23 keyBytes (hex dump)=0000: 9C 6A 7F F4 46 4F 6C D586 03 D4 99 D7 0D E7 BD .j..FOl.........
Added server's keyKerberos Principal daniel@TELEMESSAGE.CO.ILKey Version 0key EncryptionKey: keyType=23 keyBytes (hex dump)=
0000: 9C 6A 7F F4 46 4F 6C D586 03 D4 99 D7 0D E7 BD .j..FOl.........
[Krb5LoginModule] added Krb5Principal daniel@TELEMESSAGE.CO.IL to Subject
Commit Succeeded
14:33:42 [D:HttpProcessor[8080][4]] logged in with subject - Subject:
Principal: daniel@TELEMESSAGE.CO.IL
Private Credential: Ticket (hex) =
0000: 61 82 04 15 30 82 04 11A0 03 02 01 05 A1 13 1B a...0...........
0010: 11 54 45 4C 45 4D 45 5353 41 47 45 2E 43 4F 2E .TELEMESSAGE.CO.
0020: 49 4C A2 26 30 24 A0 0302 01 00 A1 1D 30 1B 1B IL.&0$.......0..
0030: 06 6B 72 62 74 67 74 1B11 54 45 4C 45 4D 45 53 .krbtgt..TELEMES
0040: 53 41 47 45 2E 43 4F 2E49 4C A3 82 03 CB 30 82 SAGE.CO.IL....0.
0050: 03 C7 A0 03 02 01 17 A103 02 01 02 A2 82 03 B9 ................
0060: 04 82 03 B5 CA 21 5B 7860 5C 3E BB 2F 03 0F A2 .....![x`\>./...
0070: A3 69 87 76 D1 4F 69 E7B2 EF 7D 15 8C C2 1F 9D .i.v.Oi.........
0080: CD 0F 26 31 E6 03 8C 9628 81 7A 3B F5 96 D7 42 ..&1....(.z;...B
0090: 8F 1B 92 33 EA 30 15 419F B6 A8 95 10 FC 89 08 ...3.0.A........
00A0: 5E 44 00 AA 91 26 84 481D A6 0E 67 34 FC 5F FC ^D...&.H...g4._.
00B0: F8 1D A3 3E 1B C1 A3 8727 EA EA B6 5E E1 80 9B ...>....'...^...
00C0: 0C FE 32 ED 29 74 AE B85E 1D 7F 78 09 F1 24 E7 ..2.)t..^..x..$.
00D0: 11 86 C6 21 3F 84 AD C6D0 B9 05 6D 5D 94 0D 99 ...!?......m]...
00E0: 3B 6B F8 5C 57 BB 4A 4078 96 1C FD 9F 3D 83 32 ;k.\W.J@x....=.2
00F0: 22 99 DB DC 88 44 EB 1B88 3E 21 34 29 12 91 FF "....D...>!4)...
0100: 82 2A EF BA B8 33 F7 C60E 5D 92 F7 0F D0 C3 96 .*...3...]......
0110: 2A 24 91 15 F0 CE B8 3944 DB 06 0E E5 A8 02 5A *$.....9D......Z
0120: 1C 45 22 2B 79 BB EE 285E 66 74 BC 73 52 09 AD .E"+y..(^ft.sR..
0130: 40 54 A1 B8 AB 92 AB 8EE5 CD A2 50 0E E0 1B 52 @T.........P...R
0140: 22 1C 30 4A 97 DB 24 3A34 C9 31 15 78 44 C3 2E ".0J..$:4.1.xD..
0150: 7E 11 77 82 E3 46 AF 2CCF 90 35 3D 0E 07 8E 2C ..w..F.,..5=...,
0160: 22 F3 4E 7E F8 13 82 424A E8 4D 9C 00 70 B5 30 ".N....BJ.M..p.0
0170: 54 19 AA 25 BD 3F 26 AAA1 CD 9F 85 37 C6 4D DD T..%.?&.....7.M.
0180: 83 F0 63 43 45 B6 EF 0F79 E9 89 33 F7 69 60 96 ..cCE...y..3.i`.
0190: 34 48 46 C1 EB EC 21 9BED 8C BC 7B 34 DF 53 0E 4HF...!.....4.S.
01A0: 14 98 71 4E CD EE 01 4A87 A7 03 88 95 28 69 30 ..qN...J.....(i0
01B0: 8A D5 EA D6 D0 A7 F5 38C9 C9 40 1B 62 4E 65 3A .......8..@.bNe:
01C0: B0 D9 F0 D7 BF 04 96 FC60 97 38 6B A0 61 B4 1A ........`.8k.a..
01D0: C1 26 38 A1 15 2F E2 E29D 8D 9C 4A 7A 95 96 13 .&8../.....Jz...
01E0: 45 2E 84 45 55 FA 4D 4044 8B 4F E5 3F 33 CF 39 E..EU.M@D.O.?3.9
01F0: 53 60 E3 FF D1 33 BF 4D9B 2A 12 87 CA 35 40 1E S`...3.M.*...5@.
0200: 34 A7 77 89 B1 AC B0 E80B CD 62 EC 15 77 0C FB 4.w.......b..w..
0210: 9D 02 1B 51 17 D4 68 0C21 52 5D 28 14 8C 62 DB ...Q..h.!R](..b.
0220: 48 79 3B 24 04 47 ED B653 AE 20 2D 01 A6 2E 85 Hy;$.G..S. -....
0230: BB 46 E3 7F A2 61 73 33D4 90 73 80 AE 49 81 0B .F...as3..s..I..
0240: 89 CB DF DE F0 A7 4A 0530 E9 1F 7A 61 AE 6A 2D ......J.0..za.j-
0250: 00 1E 67 6A 14 45 EB EE68 24 9E 3F 18 77 C6 BA ..gj.E..h$.?.w..
0260: 7E BE AF 95 26 53 B9 27C7 CB 8E AE 79 7F 19 BC ....&S.'....y...
0270: 02 BD FE AB BF F2 6B 031D C0 22 35 29 00 6C 1B ......k..."5).l.
0280: 30 1E 8B 92 01 4B D9 3DE5 5C BE 8F 63 46 66 5C 0....K.=.\..cFf\
0290: F6 CA FE 99 9A 7E FE B7CC 77 A3 38 38 87 E9 25 .........w.88..%
02A0: 4D 22 D6 2F B0 73 02 FA23 92 94 EA F5 41 A6 27 M"./.s..#....A.'
02B0: 15 A2 63 BA 05 3A 3F D2D1 2C 9C 0B 2E B9 95 70 ..c..:?..,.....p
02C0: E9 F9 4F 95 B4 74 28 2E33 09 2B 3F 35 CE 13 BE ..O..t(.3.+?5...
02D0: 6B 77 90 4B 04 7C 2B 8662 5C 67 72 17 0A 89 0A kw.K..+.b\gr....
02E0: E2 BB 06 5F 37 E0 AF 9660 2B BA 52 62 38 F8 84 ..._7...`+.Rb8..
02F0: 23 22 BD 29 12 1E 1B 3E9E 0A A8 06 26 1C 79 4B #".)...>....&.yK
0300: 61 B6 4D 70 92 DA DA BD83 CA C2 F3 88 CA C8 11 a.Mp............
0310: 34 AF CE 36 30 41 2D B6C9 63 AF E1 CC A2 09 34 4..60A-..c.....4
0320: 44 48 1C 36 29 CE FC 97FC E0 8F 27 C6 64 7A 15 DH.6)......'.dz.
0330: 06 57 CA E3 7A 9E EE 95F3 2E 80 2A 10 90 6E 55 .W..z......*..nU
0340: F9 9B 33 A7 84 BD 22 585A CD C7 03 6D 52 12 63 ..3..."XZ...mR.c
0350: 66 D0 EA 1C 01 35 58 D64A DC 73 49 89 A5 BB 69 f....5X.J.sI...i
0360: 97 DD 1A F2 8E 33 99 D47A 28 F5 04 95 0D 5E 67 .....3..z(....^g
0370: 4B 29 3A 9E E6 7C 0A 21FF EF FF C5 B3 96 4C 93 K):....!......L.
0380: 0A 1A A8 4B E2 51 50 AD6C 40 C7 BC 4C 92 9B 7E ...K.QP.l@..L...
0390: B9 54 6C 27 DC 0C A8 8590 4A 9E E3 91 C3 EA 23 .Tl'.....J.....#
03A0: 27 9B 69 CB F8 4A 41 CCD3 13 C3 D4 77 15 7C 65 '.i..JA.....w..e
03B0: CB AC 14 B3 B6 D8 06 0389 48 42 D6 DC 41 89 96 .........HB..A..
03C0: F1 FA 80 D9 E1 45 F9 312A CF 22 A7 67 F2 2C 36 .....E.1*.".g.,6
03D0: 6F 98 16 8C 8A 7F 86 51B8 DB 2B FA 8F A6 EE BC o......Q..+.....
03E0: 13 A5 5E B9 90 7D 3B 7999 93 D4 C6 83 F2 BF C9 ..^...;y........
03F0: 45 3D E1 A1 C0 50 E3 EB15 15 81 59 62 2E F5 26 E=...P.....Yb..&
0400: 17 03 30 15 25 91 C8 7A66 31 D8 49 6E 58 13 96 ..0.%..zf1.InX..
0410: D8 17 5E 35 54 E3 33 2F5E..^5T.3/^
Client Principal = daniel@TELEMESSAGE.CO.IL
Server Principal = krbtgt/TELEMESSAGE.CO.IL@TELEMESSAGE.CO.IL
Session Key = EncryptionKey: keyType=23 keyBytes (hex dump)=
0000: 6B 2B DF 50 BF 1F 6E 7D18 6A EB 0A D9 A2 C2 2F k+.P..n..j...../
Forwardable Ticket false
Forwarded Ticket false
Proxiable Ticket false
Proxy Ticket false
Postdated Ticket false
Renewable Ticket false
Initial Ticket false
Auth Time = Wed Aug 16 14:33:41 GMT 2006
Start Time = Wed Aug 16 14:33:41 GMT 2006
End Time = Wed Aug 16 20:00:00 GMT 2006
Renew Till = null
Client Addresses Null
Private Credential: Kerberos Principal daniel@TELEMESSAGE.CO.ILKey Version 0key EncryptionKey: keyType=23 keyBytes (hex dump)=
0000: 9C 6A 7F F4 46 4F 6C D586 03 D4 99 D7 0D E7 BD .j..FOl.........
14:33:52 [D:HttpProcessor[8080][4]] created principal - daniel
14:33:54 [D:HttpProcessor[8080][4]] created server gss credentials - [GSSCredential:
daniel 1.3.6.1.5.5.2 Accept [sun.security.jgss.spnego.SpNegoCredElement@fb2ac4]]
14:33:56 [D:HttpProcessor[8080][4]] got gss context - sun.security.jgss.GSSContextImpl@836869
Checksum failed !
14:34:01 [E:HttpProcessor[8080][4]] GSSException: Failure unspecified at GSS-API level (Mechanism level: Checksum failed)
at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:739)
at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:323)
at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:267)
at sun.security.jgss.spnego.SpNegoContext.GSS_acceptSecContext(SpNegoContext.java:869)
at sun.security.jgss.spnego.SpNegoContext.acceptSecContext(SpNegoContext.java:536)
at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:323)
at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:267)
at telemessage.util.auth.KRB5Authenticator$KRB5Handler.run(KRB5Authenticator.java:90)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAs(Subject.java:337)
at telemessage.util.auth.KRB5Authenticator.doAs(KRB5Authenticator.java:241)
at telemessage.web.servlet.AuthServlet.authenticate(AuthServlet.java:105)
at telemessage.web.servlet.AuthServlet.doAuthenticate(AuthServlet.java:139)
at telemessage.web.servlet.AuthServlet.doFilter(AuthServlet.java:493)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:213)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:256)
at org.apache.catalina.core.StandardPipeline$StandardPipelineValveContext.invokeNext(StandardPipeline.java:643)
at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:480)
at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:995)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
at org.apache.catalina.core.StandardPipeline$StandardPipelineValveContext.invokeNext(StandardPipeline.java:643)
at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:480)
at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:995)
at org.apache.catalina.core.StandardContext.invoke(StandardContext.java:2417)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:180)
at org.apache.catalina.core.StandardPipeline$StandardPipelineValveContext.invokeNext(StandardPipeline.java:643)
at org.apache.catalina.valves.ErrorDispatcherValve.invoke(ErrorDispatcherValve.java:171)
at org.apache.catalina.core.StandardPipeline$StandardPipelineValveContext.invokeNext(StandardPipeline.java:641)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:172)
at org.apache.catalina.core.StandardPipeline$StandardPipelineValveContext.invokeNext(StandardPipeline.java:641)
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:577)
at org.apache.catalina.core.StandardPipeline$StandardPipelineValveContext.invokeNext(StandardPipeline.java:641)
at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:480)
at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:995)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:174)
at org.apache.catalina.core.StandardPipeline$StandardPipelineValveContext.invokeNext(StandardPipeline.java:643)
at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:480)
at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:995)
at org.apache.catalina.connector.http.HttpProcessor.process(HttpProcessor.java:1040)
at org.apache.catalina.connector.http.HttpProcessor.run(HttpProcessor.java:1151)
at java.lang.Thread.run(Thread.java:619)
Caused by: KrbException: Checksum failed
at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHmacEType.java:85)
at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHmacEType.java:77)
at sun.security.krb5.EncryptedData.decrypt(EncryptedData.java:168)
at sun.security.krb5.KrbApReq.authenticate(KrbApReq.java:267)
at sun.security.krb5.KrbApReq.<init>(KrbApReq.java:134)
at sun.security.jgss.krb5.InitSecContextToken.<init>(InitSecContextToken.java:79)
at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:722)
... 41 more
Caused by: java.security.GeneralSecurityException: Checksum failed
at sun.security.krb5.internal.crypto.dk.ArcFourCrypto.decrypt(ArcFourCrypto.java:388)
at sun.security.krb5.internal.crypto.ArcFourHmac.decrypt(ArcFourHmac.java:74)
at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHmacEType.java:83)
... 47 more
Looking at your results, the JAAS Kerberos authentication does work correctly using rc4-hmac.Check your server. Have you setup to use the service principal "http/<hostname>@realm" correctly ? Are you providing the complete hostname with FQDN ?Seema
Hey seema,No i am using the regular user name principal, i read that i need to create a new SPN (http/<hostname>@<realm>) is that the only way it will work?also do i have to use a keytab?D.
Hey Seema,
Indeed my server's principal was not the correct one, now everything is cool with rc4 encryption.
for all u dudes out there in need of Java HTTP kerberos auth here's a few simple configuration procedures:
1. on the Domain Controller add an HTTP SPN to the account running the web service (use setspn.exe). the SPN has to be in format HTTP/host@Realm or HTTP/host (this SPN worked for me). if u dont know exactly which SPN u need u can sniff an HTTP session on ethereal look for Kerberos AP Req-->ticket-->Server Name. from what i gather this is the principal the clients use.
2. on the DC add a mapping to the newly created SPN (use ktpass.exe)
3. on the host running the service create a keytab file containing the newly created HTTP principal (use java's ktab.exe)
4. make sure the SPN is set up OK by running kinit and pass the newly created keytab file and the newly created SPN.
once u recieve an ok result you are good to go (login and authenticate users)
hope this helps
Daniel.
