SPNEGO in IdP 3.2

[Douglas E Engert]

On 11/20/2015 7:44 AM, Daniel Lutz wrote:
> Chris Franks schrieb am 20.11.15 um 10:40:
>> Sorry about this, after trying Java7, it looks like it’s a versioning
>> problem:
>
> Yes, it seems that the key available in the keytab on the IdP
> doesn't match the key that was used to encrypt the service
> ticket in the client's request.
>
> Could it be that the IdP service user's password changed on the KDC?


No, but if the KDC is AD, you have to specify on the
service principal HTTP/gateway.ncl.ac.uk at CAMPUS.NCL.AC.UK
that the password does not change. (With Microsoft,the KDC stores the password
and not the key, thus the same password can be used to generate
a key for any e-type on the fly.) But it does store a key version number KVNO.

Also with Microsoft, the password is on the account. An account can have
multiple service principal name. Changing the password on the account
changes the keys generated for all the service principals.

Based on the name for the principal, are you using it for more then one machine
say in some load balancer?
You must be careful when updating the keytab so both stay in sync with the KDC.

>
> Do you use the same keytab on the test IdP as on the V2 IdP?
> (In this case, I would expect that it works, actually, but
> I'm not sure.)
>
> I think that re-generating the IdP's keytab on the KDC and
> storing it on the IdP should solve the problem.

Also when changing the keytab keep the previous version of the key in the keytab
for as long as a user may still have a cached ticket for the service.

>
> I would be very interested in your findings.
> Currently, the documentation about the SPNEGO login flow
> doesn't contain a section about troubleshooting. I will
> add this soon.

The problem sounds like Kerberos administration issues, not SPNEGO
in particular.

>
> BTW, the reason that Java 8 gives a different error message than
> Java 7 is that Java 8 actually doesn't check for the key's version
> (for some compatibility reasons). The main problem should be
> the same.

Why would Java 8 do that? Could it be trying all the keys in the keytab
for the principal to see if any work thus avoiding some KVNO issues?

>
> -- Daniel
>

-- 

  Douglas E. Engert  <DEEngert at gmail.com>