Kerberos Authn default realm

[Terry Fleury]

Hello,

I'm setting up a new IdP for XSEDE. I'm attempting to use Shibboleth IdP
v.3.2.1 with the native Kerberos authentication method as documented at
https://wiki.shibboleth.net/confluence/x/f4EEAQ :

<bean id="shibboleth.authn.Krb5.ServicePrincipal"
class="java.lang.String" c:_0="HTTP/idp.xsede.org at TERAGRID.ORG" />
<bean id="shibboleth.authn.Krb5.Keytab" class="java.lang.String"
c:_0="%{idp.home}/credentials/HTTP-idp.xsede.org.keytab" />


I installed the "unlimited" cryptography files from Oracle for Java 8.


Contents of the keytab file:

# klist -e -k -t
/opt/shibboleth-idp-xsede/credentials/HTTP-idp.xsede.org.keytab
Keytab name:
FILE:/opt/shibboleth-idp-xsede/credentials/HTTP-idp.xsede.org.keytab
KVNO Timestamp         Principal
---- -----------------
--------------------------------------------------------
   3 09/22/16 15:10:32 HTTP/idp.xsede.org at TERAGRID.ORG
(aes256-cts-hmac-sha1-96)
   3 09/22/16 15:10:32 HTTP/idp.xsede.org at TERAGRID.ORG (des3-cbc-sha1)
   3 09/22/16 15:10:32 HTTP/idp.xsede.org at TERAGRID.ORG (des-cbc-crc)


I get error messages when the /etc/krb5.conf default_realm is set to
something other than TERAGRID.ORG:

[libdefaults]
        forwardable = true
        default_realm = NCSA.EDU

        dns_lookup_realm = false
        dns_lookup_kdc = false


Error message in logs/log-process.log:

2016-09-26 09:34:44,254 - INFO
[net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstKerberos:212]
- Profile Action ValidateUsernamePasswordAgainstKerberos: Login by
tfleury failed
javax.security.auth.login.LoginException: Checksum failed
        at
com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:804)
Caused by: sun.security.krb5.KrbCryptoException: Checksum failed
        at
sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType.decrypt(Aes256CtsHmacSha1EType.java:102)
Caused by: java.security.GeneralSecurityException: Checksum failed
        at
sun.security.krb5.internal.crypto.dk.AesDkCrypto.decryptCTS(AesDkCrypto.java:451)


When I change krb5.conf to "default_realm = TERAGRID.ORG", the login
succeeds.


So I see the easy solution is to simply set "default_realm =
TERAGRID.ORG" in /etc/krb5.conf, but this requires users of the box to
now specify @NCSA.EDU for kinit.


Is there a bean for default realm in krb5-authn-config.xml ? Or is there
some other method to specify a default realm for Shib IdP v.3? I'm not a
Kerberos expert, so perhaps I'm simply not using the keytab correctly.

Thank you for any help you can provide.

-- 
Terry Fleury
tfleury at illinois.edu