SPNEGO in IdP 3.2

[Chris Franks]

> Based on the name for the principal, are you using it for more then one machine say in some load balancer?
You must be careful when updating the keytab so both stay in sync with the KDC.

The keytab lives directly on the IdP server(s), we're not load balancing yet.

This keytab hasn't been updated since... August 2012 and is still working fine on out v2 IdPs, I've copied it through to our v3 devidp and, like I said, it's working fine on the command line just not with the IdP software/Java.

Chris

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Douglas E Engert
Sent: 20 November 2015 15:52
To: users at shibboleth.net
Subject: Re: SPNEGO in IdP 3.2



On 11/20/2015 7:44 AM, Daniel Lutz wrote:
> Chris Franks schrieb am 20.11.15 um 10:40:
>> Sorry about this, after trying Java7, it looks like it's a versioning
>> problem:
>
> Yes, it seems that the key available in the keytab on the IdP doesn't 
> match the key that was used to encrypt the service ticket in the 
> client's request.
>
> Could it be that the IdP service user's password changed on the KDC?


No, but if the KDC is AD, you have to specify on the service principal HTTP/gateway.ncl.ac.uk at CAMPUS.NCL.AC.UK
that the password does not change. (With Microsoft,the KDC stores the password and not the key, thus the same password can be used to generate a key for any e-type on the fly.) But it does store a key version number KVNO.

Also with Microsoft, the password is on the account. An account can have multiple service principal name. Changing the password on the account changes the keys generated for all the service principals.

Based on the name for the principal, are you using it for more then one machine say in some load balancer?
You must be careful when updating the keytab so both stay in sync with the KDC.

>
> Do you use the same keytab on the test IdP as on the V2 IdP?
> (In this case, I would expect that it works, actually, but I'm not 
> sure.)
>
> I think that re-generating the IdP's keytab on the KDC and storing it 
> on the IdP should solve the problem.

Also when changing the keytab keep the previous version of the key in the keytab for as long as a user may still have a cached ticket for the service.

>
> I would be very interested in your findings.
> Currently, the documentation about the SPNEGO login flow doesn't 
> contain a section about troubleshooting. I will add this soon.

The problem sounds like Kerberos administration issues, not SPNEGO in particular.

>
> BTW, the reason that Java 8 gives a different error message than Java 
> 7 is that Java 8 actually doesn't check for the key's version (for 
> some compatibility reasons). The main problem should be the same.

Why would Java 8 do that? Could it be trying all the keys in the keytab for the principal to see if any work thus avoiding some KVNO issues?

>
> -- Daniel
>

-- 

  Douglas E. Engert  <DEEngert at gmail.com>

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net