Reg: Kerberos error

[Prasanna]

Hello all,

I have already done kerberos a year before. But when I tried to implement
kerberos in a new environment, I do get an different error which I never
come across before. I hope I have configured everything properly.

*Error:*

14:48:36.242 - ERROR [ch.SWITCH.aai.idp.kerberos.KrbContextAcceptor:99] -
Error validating security context
org.ietf.jgss.GSSException: *Failure unspecified at GSS-API level (Mechanism
level: Encryption type AES256 CTS mode with HMAC SHA1-96 is not
supported/enabled)*

Caused by: sun.security.krb5.KrbException*: Encryption type AES256 CTS mode
with HMAC SHA1-96 is not supported/enabled*
	at sun.security.krb5.EncryptionKey.findKey(Unknown Source) ~[na:1.7.0_21]
	at sun.security.krb5.KrbApReq.authenticate(Unknown Source) ~[na:1.7.0_21]
	at sun.security.krb5.KrbApReq.<init>(Unknown Source) ~[na:1.7.0_21]
	at sun.security.jgss.krb5.InitSecContextToken.<init>(Unknown Source)
~[na:1.7.0_21]
	... 34 common frames omitted
14:48:36.242 - ERROR [ch.SWITCH.aai.idp.kerberos.KrbLoginServlet:158] -
*Authentication process error.*

My krb5.conf file:

i tried with only rc4-hmac but it did not work, so I used all the crypto
type.

[libdefaults]
default_realm = YOUIDDEV.COM *(domain name)*
forwardable = true
proxiable = true
ticket_lifetime = 600
default_keytab_name = C:\opt\kerberos\shib2.keytab
default_tgs_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc
des-cbc-md5
default_tkt_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc
des-cbc-md5
permitted_enctypes = aes256-cts-hmac-sha1-96 rc4-hmac des-cbc-crc
des-cbc-md5

[realms]
YOUIDDEV.COM = {
kdc = devdc1.youiddev.com
kdc = devdc2.youiddev.com
admin_server = devdc1.youiddev.com
default_domain = YOUIDDEV.COM
}

[domain_realm]
.youiddev.com = YOUIDDEV.COM
 youiddev.com = YOUIDDEV.COM
 
.youiddev.com = DEVDC1.YOUIDDEV.COM *(domain controller)*
 youiddev.com = DEVDC1.YOUIDDEV.COM
 
.youiddev.com = DEVDC2.YOUIDDEV.COM *(domain controller)*
 youiddev.com = DEVDC2.YOUIDDEV.COM

[appdefaults]
kinit = {
renewable = true
fowardable = true
}

*handler.xml*

<ph:LoginHandler xsi:type="krb:KERBEROS"
                  kerberosCfg="C:\opt\kerberos\krb5.conf"
                  customUnauthorized="C:\Program Files
(x86)\Internet2\Shib2IdPInstall\src\main\webapp\unauthorized.html"
    >

       
<ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos</ph:AuthenticationMethod>
        <krb:Realm domain="YOUIDDEV.COM">
           
<krb:principal>HTTP/shib2.youiddev.com at YOUIDDEV.COM</krb:principal>
            <krb:keytab>C:\opt\kerberos\shib2.keytab</krb:keytab>
        </krb:Realm>

    </ph:LoginHandler>
If anyone pls can help me in resolving it.


Thanks
Pras




-----
Prasanna V B
--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Reg-Kerberos-error-tp7589682.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.