Login errors in V3 when using Kerberos authentication

[Wessel, Keith]

Doug,

I in fact am supplying an incorrect password intentionally. Perhaps I'm not understanding your answer, but my problem is it's passing that raw message back to the template instead of associating it with my bad-password message in authn-messages.properties. I'm on a modern version of Java (1.8.0.45). And we're using a modern version of AD.

Is there an easy way to have the friendly error message about an incorrect password displayed? Is this a bug, or is something just missing from my configuration?

Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Douglas E Engert
Sent: Saturday, August 08, 2015 7:39 PM
To: users at shibboleth.net
Subject: Re: Login errors in V3 when using Kerberos authentication



On 8/8/2015 3:10 PM, Keith Wessel wrote:
> On Sat, Aug 08, 2015 at 04:08:28PM +0000, Cantor, Scott wrote:
>> If you're using Java/JAAS to do Kerberos, it should be returning PREAUTH_FAILED, and that's already mapped appropriately. What is the implementation here that's different?
>

This might help:
http://docs.oracle.com/javase/7/docs/technotes/guides/security/jgss/tutorials/Troubleshooting.html

javax.security.auth.login.LoginException: KrbException: Pre-authentication information was invalid (24) - Preauthentication failed


Also look at:
http://stackoverflow.com/questions/9738756/jaas-kerberos-login-exception-on-wrong-username-password


If you are seeing the error for some users, especially if the account name was changed of they have mixed case user names, it could be related to this:

https://bugs.openjdk.java.net/browse/JDK-6942448?page=com.atlassian.jira.plugin.system.issuetabpanels:changehistory-tabpanel

There are other possible issues, that could apply to only some users.
A Wireshark network trace would show the Kerberos packets, including the principal, domain and salt, e-types, and other info

Or this shows how to get the info from the java log:

http://stackoverflow.com/questions/21728619/how-to-integrate-windows-authentication-sso-in-my-custom-web-server-java-based


(Back in 2004, it was found that Java was making some wrong assumptions about the kerberos protocols, assuming it knew
what was the salt, but it should have asked the KDC first. The KDC would return error 24 rather then 25.)
These should have been fixed in Java 6.


> We are using JAAS with all the config items set apropriately from Tom's
> message, left as they were in the default distribution.
>
> The error that I included in my original note is the result of an
> Kerberos auth against AD. Do I only need to add that specific error
> string to the same list in password-authn-config.xml where I already see
> PRAUTH_FAILED (the entry with key "InvalidPassword")?
>
> Or should PREAUTH_FAILED already be working with AD Kerberos?
>
> Keith
>

-- 

  Douglas E. Engert  <DEEngert at gmail.com>

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net