Hi, spent the better part of today struggling to get HTTP Negotiate authentication working using Java 6 and Windows 2008. Who can help me troubleshooting - The bottom line
is that I get "Client not found in Kerberos database (6)".
This is what I have so far:
Browser configuration:
* requests include the "Authorization: Negotiate [base64data]" header
Server side configuration (the Active Directory and the web server are the same in my test setup)
* I created a user "testuser" and added an SPN like this:
setspn -A "HTTP/my.example.org:8888@MY.EXAMPLE.COM"
I gave this user a password and unchecked 'must change password at first logon'
* The webserver (jetty) is started with the following system properties:
-Djava.security.krb5.conf=C:\test\krb5.conf -Djava.security.auth.login.config=C:\test\spnego.conf -Djavax.security.auth.useSubjectCredsOnly=false -Dsun.security.krb5.debug=true
* krb5.conf [contents omitted, lists the realm MY.EXAMPLE.COM with dc my.example.com]
* spnego.conf:
com.sun.security.jgss.krb5.accept {
com.sun.security.auth.module.Krb5LoginModule required useTicketCqche=true doNotPrompt=true debug=true storeKey=true useKeyTab=true keyTab="C:\test\test.keytab" principal="HTTP/my.example.com:8888@MY.EXAMPLE.COM"
};
* the test.keytab file was created like this:
ktpass "/princ HTTP/my.example.com:8888@MY.EXAMPLE.COM" /pass "secret" /ptype krb5_nt_principal /mapuser testuser
Output on stdout:
Targeting domain controller: WIN-C9....my.example.com
Using legacy password setting method
Successfully mapped HTTP/my.example.com:8888 to testuser
Key created.
Server code:
* A bit of code that replies with a "WWW-Authenticate: Negotiate" header if no "Authorization" header is present
* Decoding of the WWW-Authorization header
* When the Authorization header is present, the following code executes:
Oid spnegoOid = new Oid("1.3.6.1.5.5.2");
GSSManager manager = GSSManager.getInstance();
GSSCredential myCred = manager.createCredential(null, GSSCredential.DEFAULT_LIFETIME, spnegoOid, GSSCredential.ACCEPT_ONLY);
GSSContext context = manager.createContext(myCred);
//... (following code processes the base64 token from the "Authorization:" header)
When the createCredential method is called, I get an exception:
No valid credentials provided (Mechanism level: Attempt to obtain new ACCEPT credentials failed!)
Client not found in Kerberos database (6)
Client not found in Kerberos database (6)
Identifier doesn't match expected value (906)
Message: No valid credentials provided (Mechanism level: Attempt to obtain new ACCEPT credentials failed!)
Class: org.ietf.jgss.GSSException
Stacktrace:
sun.security.jgss.krb5.Krb5AcceptCredential.getInstance (Krb5AcceptCredential.java:87)
sun.security.jgss.krb5.Krb5MechFactory.getCredentialElement (Krb5MechFactory.java:111)
sun.security.jgss.GSSManagerImpl.getCredentialElement (GSSManagerImpl.java:178)
un.security.jgss.GSSManagerImpl.createCredential (GSSManagerImpl.java:139)
And the following output on stdout:
Debug is true storeKey true useTicketCache true useKeyTab true doNotPrompt true
ticketCache is null isInitiator true KeyTab is C:\test\spnego.keytab refreshKrb5
Config is false principal is HTTP/my.example.com:8888@MY.EXAMPLE.ORG tryFirs
tPass is false useFirstPass is false storePass is false clearPass is false
Acquire TGT from Cache
KinitOptions cache name is C:\Users\Administrator\krb5cc_Administrator
DEBUG <CCacheInputStream> client principal is Administrator@MY.EXAMPLE.COM
DEBUG <CCacheInputStream> server principal is krbtgt/MY.EXAMPLE.COM@KRB.DAI
DEBUG <CCacheInputStream> key type: 3
DEBUG <CCacheInputStream> auth time: Wed Jul 01 17:34:26 CEST 2009
DEBUG <CCacheInputStream> start time: Wed Jul 01 17:34:26 CEST 2009
DEBUG <CCacheInputStream> end time: Thu Jul 02 03:34:26 CEST 2009
DEBUG <CCacheInputStream> renew_till time: Thu Jan 01 01:00:00 CET 1970
CCacheInputStream: readFlags() INITIAL; PRE_AUTH;
DEBUG <CCacheInputStream>
KrbCreds found the default ticket granting ticket in credential cache.
LSA contains TGT for Administrator@MY.EXAMPLE.COM not HTTP/my.example.com:8888@MY.EXAMPLE.COM
KeyTabInputStream, readName(): MY.EXAMPLE.COM
KeyTabInputStream, readName(): HTTP
KeyTabInputStream, readName(): my.example.com
KeyTab: load() entry length: 73; type: 23
KeyTabInputStream, readName(): MY.EXAMPLE.COM
KeyTabInputStream, readName(): HTTP
KeyTabInputStream, readName(): my.example.com:8888
KeyTab: load() entry length: 78; type: 17
KeyTabInputStream, readName(): MY.EXAMPLE.COM
KeyTabInputStream, readName(): HTTP
KeyTabInputStream, readName(): my.example.com:8888
KeyTab: load() entry length: 78; type: 23
KeyTabInputStream, readName(): MY.EXAMPLE.COM
KeyTabInputStream, readName(): HTTP
KeyTabInputStream, readName(): my.example.com:8888
KeyTab: load() entry length: 86; type: 16
KeyTabInputStream, readName(): MY.EXAMPLE.COM
KeyTabInputStream, readName(): HTTP
KeyTabInputStream, readName(): my.example.com:8888
KeyTab: load() entry length: 70; type: 3
KeyTabInputStream, readName(): MY.EXAMPLE.COM
KeyTabInputStream, readName(): HTTP
KeyTabInputStream, readName(): my.example.com:8888
KeyTab: load() entry length: 70; type: 1
KrbAsReq calling createMessage
KrbAsReq in createMessage
KrbKdcReq send: kdc=my.example.com UDP:88, timeout=30000, number of retrie
KDCCommunication: kdc=my.example.com UDP:88, timeout=30000,Attempt =1, #by
KrbKdcReq send: #bytes read=104
KrbKdcReq send: #bytes read=104
KDCRep: init() encoding tag is 126 req type is 11
KRBError: