Java GSS/Kerberos issue - Autheticating server
Laurence
daceilo at gmail.com
Tue Nov 29 16:39:44 EST 2005
Debug is true storeKey false useTicketCache false useKeyTab false
doNotPrompt false ticketCache is null KeyTab is null refreshKrb5Config
is false principal is another/admin tryFirstPass is false useFirstPass
is false storePass is false clearPass is false
[Krb5LoginModule] user entered username:
another/admin
principal is another/admin at REALM.COM
Acquire TGT using AS Exchange
EncryptionKey: keyType=3 keyBytes (hex dump)=0000: 6E 98 91 1C 01 C7 1C
89
EncryptionKey: keyType=1 keyBytes (hex dump)=0000: 6E 98 91 1C 01 C7 1C
89
EncryptionKey: keyType=16 keyBytes (hex dump)=0000: EF 4A 7F DC C2 5B
45 02 B9 86 9E 37 26 9E C2 92 .J...[E....7&...
0010: B3 5E 98 37 8C 20 AE 7C
[Krb5LoginModule] authentication failed
Integrity check on decrypted field failed (31) - PREAUTH_FAILED
- Failed to get login context:
javax.security.auth.login.LoginException: Integrity check on decrypted
field failed (31) - PREAUTH_FAILED
org.apache.ws.security.WSSecurityException: The security token could
not be authenticated or authorized (Failed authentication to Kerberos
Server)
at
org.apache.ws.security.kerberos.GSSAuthorizor.authorize(GSSAuthorizor.java:112)
at
org.apache.ws.security.kerberos.KerberosAuthorizor.authorize(KerberosAuthorizor.java:65)
at
org.apache.ws.security.processor.KerberosProcessor.handleToken(KerberosProcessor.java:75)
at
org.apache.ws.security.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:287)
at
org.apache.ws.security.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:190)
at
org.apache.ws.axis.security.WSDoAllReceiver.invoke(WSDoAllReceiver.java:166)
at
org.apache.axis.strategies.InvocationStrategy.visit(InvocationStrategy.java:32)
at
org.apache.axis.SimpleChain.doVisiting(SimpleChain.java:118)
at org.apache.axis.SimpleChain.invoke(SimpleChain.java:83)
at
org.apache.axis.strategies.InvocationStrategy.visit(InvocationStrategy.java:32)
at
org.apache.axis.SimpleChain.doVisiting(SimpleChain.java:118)
at org.apache.axis.SimpleChain.invoke(SimpleChain.java:83)
at
org.apache.axis.handlers.soap.SOAPService.invoke(SOAPService.java:453)
at
org.apache.axis.server.AxisServer.invoke(AxisServer.java:281)
at
org.apache.axis.transport.http.AxisServlet.doPost(AxisServlet.java:699)
at
javax.servlet.http.HttpServlet.service(HttpServlet.java:709)
at
org.apache.axis.transport.http.AxisServletBase.service(AxisServletBase.java:327)
at
javax.servlet.http.HttpServlet.service(HttpServlet.java:802)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:252)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:213)
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:178)
at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126)
at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:105)
at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:107)
at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148)
at
org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:868)
at
org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java:663)
at
org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:527)
at
org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFollowerWorkerThread.java:80)
at
org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:684)
at java.lang.Thread.run(Thread.java:595)
On the same box I run the client side, which looks like:
Debug is true storeKey false useTicketCache false useKeyTab false
doNotPrompt false ticketCache is null KeyTab is null refreshKrb5Config
is false principal is null tryFirstPass is false useFirstPass is false
storePass is false clearPass is true
[Krb5LoginModule] user entered username: laurence/admin
principal is laurence/admin at REALM.COM
Acquire TGT using AS Exchange
EncryptionKey: keyType=3 keyBytes (hex dump)=0000: 25 0D A7 B9 89 D5 A2
CE
EncryptionKey: keyType=1 keyBytes (hex dump)=0000: 25 0D A7 B9 89 D5 A2
CE
EncryptionKey: keyType=16 keyBytes (hex dump)=0000: 3E A1 75 68 C2 CB
D5 94 0D 32 3B 1C 6D F8 A1 07 >.uh.....2;.m...
0010: 49 51 16 2A 1A 4A E9 1C
Commit Succeeded
Passwords are being used in both cases and if I configure the client to
authenticate with the servers principal it works fine (From the client
side). So I know the username/password is correct (At least when I'm
going to exceute the code).
More information about the Kerberos
mailing list