I hope this is a newbie question for you guys out there since I've been googling for a solution for days but no luck so far.
I am trying to learn JAAS programming and got started from a very simple example where a client authenticate to kerberos and send messages to a echo server. I am using kerberos from MIT and it's running on a linux box. "krb5.conf" is as following:
[libdefaults]
ticket_lifetime = 600
default_realm = AMAIL.COM
#default_tkt_enctypes = des-cbc-crc
#default_tgs_enctypes = des-cbc-crc
#permitted_enctypes = des-cbc-crc des-cbc-md5
[realms]
AMAIL.COM = {
kdc = amail1.amail.com:88
admin_server = amail1.amail.com:749
default_domain = amail.com
}
[domain_realm]
.amail.com = AMAIL.COM
amail.com = AMAIL.COM
[logging]
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmin.log
default = FILE:/var/log/krb5lib.log
the configuration file for the echo server and client is as following:
GSSClient{
com.sun.security.auth.module.Krb5LoginModule required debug=true;
};
GSSServer{
com.sun.security.auth.module.Krb5LoginModule required
storeKey=true debug=true;
};
The problems is when I run the client programme, the server outputs :
"GSSException: Failure unspecified at GSS-API level (Mechanism level: Checksum failed)"
However, when I uncomment "#permitted_enctypes = des-cbc-crc des-cbc-md5 " in krb5.conf, the server outputs:
"GSSException: Failure unspecified at GSS-API level (Mechanism level: Integrity check on decrypted field failed (31))"
I can see that I authenticated to kerberos successfully but the server fails when exchanging tokens with the client. Do I need to do any configurations on the echo server side or even the client side( there's a krb5.ini file in the windows folder and I modified it to have the same content as krb5.conf and I found varies sites mentioned keytab files but I am using username and password to authenticate client and server to kerberos)? I've tried to run the server and client on both Java 1.5 and Java 1.6 but got the same errors. Following is the full output of the server:
Debug is true storeKey true useTicketCache false useKeyTab false doNotPrompt false ticketCache is null isInitiator true KeyTab is null refreshKrb5Config is false principal is null tryFirstPass is false useFirstPass is false storePass is false clearPass is false
[Krb5LoginModule] user entered username: root
Using builtin default etypes for default_tkt_enctypes
default etypes for default_tkt_enctypes: 3 1 23 16 17.
Acquire TGT using AS Exchange
Using builtin default etypes for default_tkt_enctypes
default etypes for default_tkt_enctypes: 3 1 23 16 17.
KrbAsReq calling createMessage
KrbAsReq in createMessage
KrbKdcReq send: kdc=10.10.10.1 UDP:88, timeout=30000, number of retries =3, #bytes=139
KDCCommunication: kdc=10.10.10.1 UDP:88, timeout=30000,Attempt =1, #bytes=139
KrbKdcReq send: #bytes read=492
KrbKdcReq send: #bytes read=492
EType: sun.security.krb5.internal.crypto.DesCbcMd5EType
KrbAsRep cons in KrbAsReq.getReply root
GSSServer starts... Waiting for incoming connection
EType: sun.security.krb5.internal.crypto.DesCbcCrcEType
crc32: 8bc7ac62
crc32: 10001011110001111010110001100010
Someone please help as I've already spent a week on searching a solution for this problem. Thanks in advance!!