Using Kerberos 5 keytab to authenticate LDAP resolver with 3.2.1

[King, David]

Hello everyone,

I am working on converting our Shibboleth IdP 2.x configuration to 3.2.1.  Most of the conversion has been straightforward but LDAP authentication for resolving attributes is not working.  The LDAP server is running OpenLDAP compiled from source and keytab authentication works for other services besides IdP 2.x.  I have looked through the wiki, the mailing list, and the ldaptive site but have not seen anything that helps debug the problem.  I have already raise the idp.loglevel.ldap and idp.loglevel.idp levels to DEBUG.

I get the following error in the log file:

2016-02-03 12:15:09,453 - ERROR [net.shibboleth.idp.attribute.resolver.dc.ldap.impl.ConnectionFactoryValidator:95] - Connection factory validation failed
org.ldaptive.LdapException: javax.naming.AuthenticationException: GSSAPI [Root exception is javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid crede
ntials provided (Mechanism level: Failed to find any Kerberos tgt)]]
        at org.ldaptive.provider.ProviderUtils.throwOperationException(ProviderUtils.java:77)
Caused by: javax.naming.AuthenticationException: GSSAPI
        at com.sun.jndi.ldap.sasl.LdapSasl.saslBind(LdapSasl.java:169)
Caused by: javax.security.sasl.SaslException: GSS initiate failed
        at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:211)
Caused by: org.ietf.jgss.GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)
        at sun.security.jgss.krb5.Krb5InitCredential.getInstance(Krb5InitCredential.java:147)
2016-02-03 12:15:09,459 - ERROR [net.shibboleth.idp.attribute.resolver.dc.ldap.impl.LDAPDataConnector:143] - Data Connector 'myLDAP': Invalid connector configuration

My current 3.2.1 test configuration is has the following in attribute-resolver:

    <resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
        ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
        baseDN="%{idp.attribute.resolver.LDAP.baseDN}"
        authenticationType="GSSAPI" >
        <dc:FilterTemplate>
            <![CDATA[
                %{idp.attribute.resolver.LDAP.searchFilter}
            ]]>
        </dc:FilterTemplate>
        <dc:StartTLSTrustCredential id="LDAPtoIdPCredential" xsi:type="sec:X509ResourceBacked">
            <sec:Certificate>%{idp.attribute.resolver.LDAP.trustCertificates}</sec:Certificate>
        </dc:StartTLSTrustCredential>
    </resolver:DataConnector>

And I have modified the Jetty start.ini to include:

-Djava.security.auth.login.config=/usr/local/shibboleth-idp/conf/login.config

That login.config contains:

com.sun.security.jgss.initiate {
   com.sun.security.auth.module.Krb5LoginModule required
      useTicketCache="true"
      ticketCache="/tmp/krb5cc_idp_ldap"
      renewTGT="true"
      useKeyTab="true"
      keyTab="/opt/shibboleth-idp/credentials/shib-user-instance.keytab "
      principal="shib-user/instance at bu.edu"
      foobar="true"
      doNotPrompt="true";
};

ldaptive {
   com.sun.security.auth.module.Krb5LoginModule required
      useTicketCache="true"
      ticketCache="/tmp/krb5cc_idp_ldap"
      renewTGT="true"
      useKeyTab="true"
      keyTab="/opt/shibboleth-idp/credentials/shib-user-instance.keytab"
      principal="shib-user/instance at bu.edu"
      foobar="true"
      doNotPrompt="true";
};

Our working 2.x configuration has the following in the attribute-resolver.xml:

   <resolver:DataConnector id="myLDAP" xsi:type="LDAPDirectory" xmlns="urn:mace:shibboleth:2.0:resolver:dc"
        ldapURL="ldap://ldap-test.bu.edu" baseDN="dc=bu,dc=edu" authenticationType="GSSAPI">
        <FilterTemplate>
            <![CDATA[
                (uid=$requestContext.principalName)
            ]]>
        </FilterTemplate>
    </resolver:DataConnector>

And the following in the JAAS login.config:

com.sun.security.jgss.initiate {
   com.sun.security.auth.module.Krb5LoginModule required
      useTicketCache="true"
      ticketCache="/tmp/krb5cc_idp_ldap"
      renewTGT="true"
      useKeyTab="true"
      keyTab="/opt/shibboleth-idp/credentials/shib-user-instance.keytab"
      principal="shib-user/instance at bu.edu"
      doNotPrompt="true";
};

Has anyone used GSSAPI with a Kerberos keytab to authenticate the LDAP resolver with 3.x?  If so, how did you configure it?  Is there any resource that I missed on how to configure/debug this?

Thanks in advance for the help,
David

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160203/a1bd2e32/attachment.html>