SPNEGO in IdP 3.2

[Chris Franks]

For info, using a different keytab (for a differnet service principal) has made SPNEGO work.  There must be something wrong/corrupt about the file on our dev-gateway but the SPNEGO authn handler is working fine (tested with Java 7 and 8).

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Chris Franks
Sent: 23 November 2015 08:40
To: Shib Users <users at shibboleth.net>
Subject: RE: SPNEGO in IdP 3.2

Hi Daniel,

Yes, this is the same keytab we're using on the v2 IdP; it's working fine there.

I'll do some more digging and try and find out why it's not working with v3.

Best,

Chris

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Daniel Lutz
Sent: 20 November 2015 13:45
To: Shib Users <users at shibboleth.net>
Subject: Re: SPNEGO in IdP 3.2

Chris Franks schrieb am 20.11.15 um 10:40:
> Sorry about this, after trying Java7, it looks like it's a versioning
> problem:

Yes, it seems that the key available in the keytab on the IdP doesn't match the key that was used to encrypt the service ticket in the client's request.

Could it be that the IdP service user's password changed on the KDC?

Do you use the same keytab on the test IdP as on the V2 IdP?
(In this case, I would expect that it works, actually, but I'm not sure.)

I think that re-generating the IdP's keytab on the KDC and storing it on the IdP should solve the problem.

I would be very interested in your findings.
Currently, the documentation about the SPNEGO login flow doesn't contain a section about troubleshooting. I will add this soon.

BTW, the reason that Java 8 gives a different error message than Java 7 is that Java 8 actually doesn't check for the key's version (for some compatibility reasons). The main problem should be the same.

-- Daniel

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net