SPNEGO in IdP 3.2

[Douglas E Engert]

 From your logs in this thread there appears to be two different problems:
  Failure unspecified at GSS-API level (Mechanism level: Specified version of key is not available (44))
Which is a KVNO versioning problem.

  Failure unspecified at GSS-API level (Mechanism level: Checksum failed)
Google for the message there are several others having that problem.
It could be for Java 8 you need:
http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html

You did not say if you are using AD for the KDC. If you are read this:
  http://shibboleth.net/pipermail/users/2012-January/002299.html
If you are using ktpass, consider using msktutil on linux.

On 11/23/2015 4:16 AM, Chris Franks wrote:
> For info, using a different keytab (for a differnet service principal) has made SPNEGO work.  There must be something wrong/corrupt about the file on our dev-gateway but the SPNEGO authn handler is working fine (tested with Java 7 and 8).
>
> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Chris Franks
> Sent: 23 November 2015 08:40
> To: Shib Users <users at shibboleth.net>
> Subject: RE: SPNEGO in IdP 3.2
>
> Hi Daniel,
>
> Yes, this is the same keytab we're using on the v2 IdP; it's working fine there.
>
> I'll do some more digging and try and find out why it's not working with v3.
>
> Best,
>
> Chris
>
> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Daniel Lutz
> Sent: 20 November 2015 13:45
> To: Shib Users <users at shibboleth.net>
> Subject: Re: SPNEGO in IdP 3.2
>
> Chris Franks schrieb am 20.11.15 um 10:40:
>> Sorry about this, after trying Java7, it looks like it's a versioning
>> problem:
>
> Yes, it seems that the key available in the keytab on the IdP doesn't match the key that was used to encrypt the service ticket in the client's request.
>
> Could it be that the IdP service user's password changed on the KDC?
>
> Do you use the same keytab on the test IdP as on the V2 IdP?
> (In this case, I would expect that it works, actually, but I'm not sure.)
>
> I think that re-generating the IdP's keytab on the KDC and storing it on the IdP should solve the problem.
>
> I would be very interested in your findings.
> Currently, the documentation about the SPNEGO login flow doesn't contain a section about troubleshooting. I will add this soon.
>
> BTW, the reason that Java 8 gives a different error message than Java 7 is that Java 8 actually doesn't check for the key's version (for some compatibility reasons). The main problem should be the same.
>
> -- Daniel
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>

-- 

  Douglas E. Engert  <DEEngert at gmail.com>