SPNEGO in IdP 3.2

[Chris Franks]

Sorry about this, after trying Java7, it looks like it's a versioning problem:

2015-11-20 09:36:26,997 - DEBUG [net.shibboleth.idp.authn.spnego.impl.GSSContextAcceptor:175] - Validating the first GSS input token against service principal: HTTP/gateway.ncl.ac.uk at CAMPUS.NCL.AC.UK
2015-11-20 09:36:27,072 - DEBUG [net.shibboleth.idp.authn.spnego.impl.GSSContextAcceptor:188] - Error establishing security context
org.ietf.jgss.GSSException: Failure unspecified at GSS-API level (Mechanism level: Specified version of key is not available (44))
        at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:788)
Caused by: sun.security.krb5.KrbException: Specified version of key is not available (44)
        at sun.security.krb5.EncryptionKey.findKey(EncryptionKey.java:588)
2015-11-20 09:36:27,079 - DEBUG [net.shibboleth.idp.authn.spnego.impl.SPNEGOAuthnController:165] - Exception processing GSS token
org.ietf.jgss.GSSException: Failure unspecified at GSS-API level (Mechanism level: Specified version of key is not available (44))
        at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:788)
Caused by: sun.security.krb5.KrbException: Specified version of key is not available (44)
        at sun.security.krb5.EncryptionKey.findKey(EncryptionKey.java:588)
2015-11-20 09:36:27,146 - WARN [net.shibboleth.idp.authn.impl.ValidateExternalAuthentication:94] - Profile Action ValidateExternalAuthentication: External authentication produced exception
net.shibboleth.idp.authn.ExternalAuthenticationException: SPNEGONotAvailable
        at net.shibboleth.idp.authn.spnego.impl.SPNEGOAuthnController.continueSPNEGO(SPNEGOAuthnController.java:167)
Caused by: org.ietf.jgss.GSSException: Failure unspecified at GSS-API level (Mechanism level: Specified version of key is not available (44))
        at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:788)
Caused by: sun.security.krb5.KrbException: Specified version of key is not available (44)
        at sun.security.krb5.EncryptionKey.findKey(EncryptionKey.java:588)
2015-11-20 09:36:27,150 - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:130] - Profile Action SelectAuthenticationFlow: Moving incomplete flow authn/SPNEGO to intermediate set

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Chris Franks
Sent: 20 November 2015 09:25
To: users at shibboleth.net
Subject: SPNEGO in IdP 3.2

Hi,

I've just setup a test IdP installation to see how we can replicate our current SPNEGO setup in IdP 3.2 (Centos 6.7/apache-tomcat-8.0.26).

I'm getting a checksum error in the IdP logs:

2015-11-20 09:12:10,557 - DEBUG [net.shibboleth.idp.authn.spnego.impl.GSSContextAcceptor:175] - Validating the first GSS input token against service principal: HTTP/gateway.ncl.ac.uk at CAMPUS.NCL.AC.UK<mailto:HTTP/gateway.ncl.ac.uk at CAMPUS.NCL.AC.UK>
2015-11-20 09:12:10,567 - DEBUG [net.shibboleth.idp.authn.spnego.impl.GSSContextAcceptor:188] - Error establishing security context
org.ietf.jgss.GSSException: Failure unspecified at GSS-API level (Mechanism level: Checksum failed)
        at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:856)
Caused by: sun.security.krb5.KrbCryptoException: Checksum failed
        at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHmacEType.java:102)
Caused by: java.security.GeneralSecurityException: Checksum failed
        at sun.security.krb5.internal.crypto.dk.ArcFourCrypto.decrypt(ArcFourCrypto.java:408)
2015-11-20 09:12:10,572 - DEBUG [net.shibboleth.idp.authn.spnego.impl.SPNEGOAuthnController:165] - Exception processing GSS token
org.ietf.jgss.GSSException: Failure unspecified at GSS-API level (Mechanism level: Checksum failed)
        at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:856)
Caused by: sun.security.krb5.KrbCryptoException: Checksum failed
        at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHmacEType.java:102)
Caused by: java.security.GeneralSecurityException: Checksum failed
        at sun.security.krb5.internal.crypto.dk.ArcFourCrypto.decrypt(ArcFourCrypto.java:408)
2015-11-20 09:12:10,595 - WARN [net.shibboleth.idp.authn.impl.ValidateExternalAuthentication:94] - Profile Action ValidateExternalAuthentication: External authentication produced exception
net.shibboleth.idp.authn.ExternalAuthenticationException: SPNEGONotAvailable
        at net.shibboleth.idp.authn.spnego.impl.SPNEGOAuthnController.continueSPNEGO(SPNEGOAuthnController.java:167)
Caused by: org.ietf.jgss.GSSException: Failure unspecified at GSS-API level (Mechanism level: Checksum failed)
        at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:856)
Caused by: sun.security.krb5.KrbCryptoException: Checksum failed
        at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHmacEType.java:102)
Caused by: java.security.GeneralSecurityException: Checksum failed
        at sun.security.krb5.internal.crypto.dk.ArcFourCrypto.decrypt(ArcFourCrypto.java:408)
2015-11-20 09:12:10,596 - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:130] - Profile Action SelectAuthenticationFlow: Moving incomplete flow authn/SPNEGO to intermediate set

But the keytab itself works fine on the command line:

[root at devidp authn]# kinit ncf17
Password for ncf17 at CAMPUS.NCL.AC.UK<mailto:ncf17 at CAMPUS.NCL.AC.UK>:
[root at devidp authn]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: ncf17 at CAMPUS.NCL.AC.UK<mailto:ncf17 at CAMPUS.NCL.AC.UK>

Valid starting     Expires            Service principal
11/20/15 09:10:32  11/20/15 17:10:32  krbtgt/CAMPUS.NCL.AC.UK at CAMPUS.NCL.AC.UK<mailto:krbtgt/CAMPUS.NCL.AC.UK at CAMPUS.NCL.AC.UK>

Our krb5.conf has:

default_tgt_enctypes = arcfour-hmac
default_tgs_enctypes= arcfour-hmac

so it looks like the right decryption method is being used... could this be to do with the Java version (1.8.0_65)?

I remember keytabs/encryption types being a pain the last time we set this up but it's been a while so any pointers would be greatly received :)

Thanks,

Chris

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151120/d2c61c02/attachment-0001.html>