<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=FR link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Hi, <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Thank you for your help. I’m ok with you, DES in not the better choice.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>So, I try with RC4-HMAC<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>I have a “checksum” problem into Kerberos<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>The log of shibboleth<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>13:17:42.220 - DEBUG [ch.SWITCH.aai.idp.kerberos.HttpNegotiator:72] - HTTP: Returning response code '401'. Authorization header not found.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>13:17:42.234 - INFO [ch.SWITCH.aai.idp.kerberos.KrbLoginServlet:125] - kerberos idp servlet started<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>13:17:42.241 - DEBUG [ch.SWITCH.aai.idp.kerberos.KrbContextAcceptor:87] - Validating GSS token. Realm: CERSSO.COM<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>13:17:42.273 - DEBUG [ch.SWITCH.aai.idp.kerberos.KrbContextAcceptor:145] - GSS context created.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>13:17:42.284 - ERROR [ch.SWITCH.aai.idp.kerberos.KrbContextAcceptor:98] - Error validating security context<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>org.ietf.jgss.GSSException: Failure unspecified at GSS-API level (Mechanism level: Checksum failed)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:741) ~[na:1.6.0_29]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:323) ~[na:1.6.0_29]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:267) ~[na:1.6.0_29]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at sun.security.jgss.spnego.SpNegoContext.GSS_acceptSecContext(SpNegoContext.java:874) ~[na:1.6.0_29]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at sun.security.jgss.spnego.SpNegoContext.acceptSecContext(SpNegoContext.java:541) ~[na:1.6.0_29]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:323) ~[na:1.6.0_29]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:267) ~[na:1.6.0_29]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at ch.SWITCH.aai.idp.kerberos.KrbContextAcceptor.acceptRealmSecContext(KrbContextAcceptor.java:151) ~[kerberos-login-handler-1.0.jar:na]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at ch.SWITCH.aai.idp.kerberos.KrbContextAcceptor.acceptSecContext(KrbContextAcceptor.java:89) ~[kerberos-login-handler-1.0.jar:na]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at ch.SWITCH.aai.idp.kerberos.HttpNegotiator.authenticate(HttpNegotiator.java:86) [kerberos-login-handler-1.0.jar:na]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at ch.SWITCH.aai.idp.kerberos.KrbLoginServlet.service(KrbLoginServlet.java:144) [kerberos-login-handler-1.0.jar:na]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at ch.SWITCH.aai.idp.kerberos.KrbLoginServlet.service(KrbLoginServlet.java:115) [kerberos-login-handler-1.0.jar:na]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) [servlet-api.jar:na]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> </span><span style='color:#1F497D'>at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) [catalina.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) [shibboleth-identityprovider-2.3.5.jar:na]<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:81) [shibboleth-identityprovider-2.3.5.jar:na]<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) [shibboleth-common-1.3.4.jar:na]<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> </span><span lang=EN-US style='color:#1F497D'>at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) [catalina.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) [catalina.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) [catalina.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [catalina.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [catalina.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> </span><span style='color:#1F497D'>at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:291) [catalina.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> </span><span lang=EN-US style='color:#1F497D'>at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859) [tomcat-coyote.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:602) [tomcat-coyote.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489) [tomcat-coyote.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at java.lang.Thread.run(Thread.java:662) [na:1.6.0_29]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Caused by: sun.security.krb5.KrbCryptoException: Checksum failed<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHmacEType.java:85) ~[na:1.6.0_29]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHmacEType.java:77) ~[na:1.6.0_29]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at sun.security.krb5.EncryptedData.decrypt(EncryptedData.java:168) ~[na:1.6.0_29]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at sun.security.krb5.KrbApReq.authenticate(KrbApReq.java:268) ~[na:1.6.0_29]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at sun.security.krb5.KrbApReq.<init>(KrbApReq.java:134) ~[na:1.6.0_29]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at sun.security.jgss.krb5.InitSecContextToken.<init>(InitSecContextToken.java:79) ~[na:1.6.0_29]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:724) ~[na:1.6.0_29]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> ... 33 common frames omitted<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Caused by: java.security.GeneralSecurityException: Checksum failed<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at sun.security.krb5.internal.crypto.dk.ArcFourCrypto.decrypt(ArcFourCrypto.java:388) ~[na:1.6.0_29]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at sun.security.krb5.internal.crypto.ArcFourHmac.decrypt(ArcFourHmac.java:74) ~[na:1.6.0_29]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHmacEType.java:83) ~[na:1.6.0_29]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> ... 39 common frames omitted<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>13:17:42.285 - ERROR [ch.SWITCH.aai.idp.kerberos.KrbLoginServlet:158] - Authentication process error.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>javax.servlet.ServletException: It was not possible to established context. There is no gssapi data to continue the process.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at ch.SWITCH.aai.idp.kerberos.HttpNegotiator.authenticate(HttpNegotiator.java:142) ~[kerberos-login-handler-1.0.jar:na]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at ch.SWITCH.aai.idp.kerberos.KrbLoginServlet.service(KrbLoginServlet.java:144) [kerberos-login-handler-1.0.jar:na]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at ch.SWITCH.aai.idp.kerberos.KrbLoginServlet.service(KrbLoginServlet.java:115) [kerberos-login-handler-1.0.jar:na]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) [servlet-api.jar:na]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> </span><span style='color:#1F497D'>at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290) [catalina.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> at edu.internet2.middleware.shibboleth.idp.util.NoCacheFilter.doFilter(NoCacheFilter.java:50) [shibboleth-identityprovider-2.3.5.jar:na]<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> at edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter.doFilter(IdPSessionFilter.java:81) [shibboleth-identityprovider-2.3.5.jar:na]<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> at edu.internet2.middleware.shibboleth.common.log.SLF4JMDCCleanupFilter.doFilter(SLF4JMDCCleanupFilter.java:52) [shibboleth-common-1.3.4.jar:na]<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) [catalina.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) [catalina.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> </span><span lang=EN-US style='color:#1F497D'>at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219) [catalina.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) [catalina.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) [catalina.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) [catalina.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) [catalina.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> </span><span style='color:#1F497D'>at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:291) [catalina.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> </span><span lang=EN-US style='color:#1F497D'>at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:859) [tomcat-coyote.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:602) [tomcat-coyote.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489) [tomcat-coyote.jar:6.0.33]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> at java.lang.Thread.run(Thread.java:662) [na:1.6.0_29]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>13:17:42.285 - DEBUG [ch.SWITCH.aai.idp.kerberos.KrbLoginServlet:185] - Authentication failed.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>13:17:42.286 - DEBUG [ch.SWITCH.aai.idp.kerberos.KrbLoginHandler:262] - Redirecting to login page<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>13:17:42.287 - INFO [ch.SWITCH.aai.idp.kerberos.KrbLoginHandler:249] - 'auto login' cookie sent.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>The log of kerberos<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Dec 20, 2011 1:17:42 PM org.apache.catalina.core.StandardWrapperValve invoke<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>INFO: Debug is true storeKey true useTicketCache false useKeyTab true doNotPrompt false ticketCache is null isInitiator true KeyTab is /home/stcia/Desktop/idp.http.keytab refreshKrb5Config is true principal is HTTP/idp.cersso.theresis.org@CERSSO.COM tryFirstPass is false useFirstPass is false storePass is false clearPass is false<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Refreshing Kerberos configuration<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>> KdcAccessibility: reset<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>> KdcAccessibility: reset<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>> KeyTabInputStream, readName(): CERSSO.COM<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>> KeyTabInputStream, readName(): HTTP<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>> KeyTabInputStream, readName(): idp.cersso.theresis.org<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>> KeyTab: load() entry length: 74; type: 23<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Added key: 23version: 0<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Ordering keys wrt default_tkt_enctypes list<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>default etypes for default_tkt_enctypes: 23 23 1 3.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>0: EncryptionKey: keyType=23 kvno=0 keyValue (hex dump)=<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>0000: 5F EC 01 14 95 1A 6C 0D 7E CE 52 29 0E F2 7B 8B _.....l...R)....<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>principal's key obtained from the keytab<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Acquire TGT using AS Exchange<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>default etypes for default_tkt_enctypes: 23 23 1 3.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>> KrbAsReq calling createMessage<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>> KrbAsReq in createMessage<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>> KrbKdcReq send: kdc=AD.CERSSO.COM UDP:88, timeout=30000, number of retries =3, #bytes=159<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>> KDCCommunication: kdc=AD.CERSSO.COM UDP:88, timeout=30000,Attempt =1, #bytes=159<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>> KrbKdcReq send: #bytes read=177<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>> KrbKdcReq send: #bytes read=177<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>> KdcAccessibility: remove AD.CERSSO.COM<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>> KDCRep: init() encoding tag is 126 req type is 11<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>>KRBError:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> sTime is Tue Dec 20 13:17:39 CET 2011 1324383459000<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> suSec is 822750<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> error code is 25<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> error Message is Additional pre-authentication required<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> realm is CERSSO.COM<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> sname is krbtgt/CERSSO.COM<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> eData provided.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> msgType is 30<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>>Pre-Authentication Data:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> PA-DATA type = 11<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> PA-ETYPE-INFO etype = 23<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> PA-ETYPE-INFO salt = <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>>Pre-Authentication Data:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> PA-DATA type = 19<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> PA-ETYPE-INFO2 etype = 23<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> PA-ETYPE-INFO2 salt = null<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>>Pre-Authentication Data:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> PA-DATA type = 2<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> PA-ENC-TIMESTAMP<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>>Pre-Authentication Data:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> PA-DATA type = 16<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>>Pre-Authentication Data:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> PA-DATA type = 15<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>AcquireTGT: PREAUTH FAILED/REQUIRED, re-send AS-REQ<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>>KrbAsReq salt is CERSSO.COMHTTPidp.cersso.theresis.org<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>default etypes for default_tkt_enctypes: 23 23 1 3.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Pre-Authenticaton: find key for etype = 23<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>AS-REQ: Add PA_ENC_TIMESTAMP now<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>> EType: sun.security.krb5.internal.crypto.ArcFourHmacEType<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>> KrbAsReq calling createMessage<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>> KrbAsReq in createMessage<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>> KrbKdcReq send: kdc=AD.CERSSO.COM UDP:88, timeout=30000, number of retries =3, #bytes=242<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>> KDCCommunication: kdc=AD.CERSSO.COM UDP:88, timeout=30000,Attempt =1, #bytes=242<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>> KrbKdcReq send: #bytes read=1394<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>> KrbKdcReq send: #bytes read=1394<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>> KdcAccessibility: remove AD.CERSSO.COM<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>> EType: sun.security.krb5.internal.crypto.ArcFourHmacEType<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>> KrbAsRep cons in KrbAsReq.getReply HTTP/idp.cersso.theresis.org<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>principal is HTTP/idp.cersso.theresis.org@CERSSO.COM<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>EncryptionKey: keyType=23 keyBytes (hex dump)=0000: 5F EC 01 14 95 1A 6C 0D 7E CE 52 29 0E F2 7B 8B _.....l...R)....<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Added server's keyKerberos Principal HTTP/idp.cersso.theresis.org@CERSSO.COMKey Version 0key EncryptionKey: keyType=23 keyBytes (hex dump)=<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>0000: 5F EC 01 14 95 1A 6C 0D 7E CE 52 29 0E F2 7B 8B _.....l...R)....<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> </span><span lang=EN-US style='color:#1F497D'>[Krb5LoginModule] added Krb5Principal HTTP/idp.cersso.theresis.org@CERSSO.COM to Subject<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Commit Succeeded <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Search Subject for SPNEGO ACCEPT cred (<<DEF>>, sun.security.jgss.spnego.SpNegoCredElement)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Search Subject for Kerberos V5 ACCEPT cred (<<DEF>>, sun.security.jgss.krb5.Krb5AcceptCredential)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Found key for HTTP/idp.cersso.theresis.org@CERSSO.COM(23)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Entered Krb5Context.acceptSecContext with state=STATE_NEW<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>>>> EType: sun.security.krb5.internal.crypto.ArcFourHmacEType<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Checksum failed !<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> [Krb5LoginModule]: Entering logout<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'> [Krb5LoginModule]: logged out Subject<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>If you have any idea<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>Frederic<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>De :</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> users-bounces@shibboleth.net [mailto:users-bounces@shibboleth.net] <b>De la part de</b> Rod Widdowson<br><b>Envoyé :</b> mardi 20 décembre 2011 08:46<br><b>À :</b> 'Shib Users'<br><b>Objet :</b> RE: Crypto with the Kerberos Login Handler<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span lang=EN-GB style='color:#1F497D'>Frederic,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-GB style='color:#1F497D'>I eventually gave up on using krb against AD and I now use LDAP which works quite well – and as an added benefit relieves you from having to map principals.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-GB style='color:#1F497D'>In a recent situation when I had to work against a (non AD) Krb I had to do the enable_weak_crypto thing as well as setting the <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>default_tkt_enctypes = des-cbc-crc<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>default_tgs_enctypes = des-cbc-crc<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>in [libdefaults]<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-GB style='color:#1F497D'>However, I should note that I am far from a being a Kerberos expert, and that you should think very seriously before enabling weakened security on any system.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-GB style='color:#1F497D'>Rod<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-GB style='color:#1F497D'><o:p> </o:p></span></p><div style='border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt'><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> users-bounces@shibboleth.net [mailto:users-bounces@shibboleth.net] <b>On Behalf Of </b>MOTTE Frederic<br><b>Sent:</b> 20 December 2011 07:09<br><b>To:</b> users@shibboleth.net<br><b>Subject:</b> Crypto with the Kerberos Login Handler<o:p></o:p></span></p></div></div><p class=MsoNormal><span lang=EN-GB><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:10.0pt;font-family:"Verdana","sans-serif";color:black;background:white'>Hi,<span class=apple-converted-space> </span></span><span lang=EN-US style='font-size:10.0pt;font-family:"Verdana","sans-serif";color:black'><br><br><span style='background:white'>I have a AD on a windows 2008R2 and the idp is on a debian (jdk 1.6.0_29-b11)<span class=apple-converted-space> </span></span><br><br><span style='background:white'>I have some problem using the kerberos login handler.<span class=apple-converted-space> </span></span><br><span style='background:white'>My first test was to create a keytab using the RC4-HMAC crypto.<span class=apple-converted-space> </span></span><br><span style='background:white'>C:\Users\Administrateur>ktpass -princ <a href="mailto:HTTP/idp.cersso.com@CERSSO.COM">HTTP/idp.cersso.com@CERSSO.COM</a> -pass Master2008 -mapuser idp -out c:\temp\idp.http.keytab -ptype KRB5_NT_PRINCIPAL -crypto RC4-HMAC-NT kvno 0<span class=apple-converted-space> </span></span><br><br><span style='background:white'>When I use it on the debian platform to realise the kinit, it's OK but when I use is into the loginHandler configuration, I have a checksum exception. In the wiki, the possible solutions are to activate the DES into the user profil or update the JKD version (if under 1.5.xxx)<span class=apple-converted-space> </span></span><br><br><span style='background:white'>consequently, I try to realise a keytab with the DES-CBC-MD5 crypto option, and when I realise the kinit in order to validate the keytab, I have the following error :<span class=apple-converted-space> </span></span><br><br><span style='background:white'>kinit (v5), KDC has no support for encrytpion type while getting initial credentials.<span class=apple-converted-space> </span></span><br><br><span style='background:white'>Can you help me in order to solve the crypto problem?<span class=apple-converted-space> </span></span><br><br></span><span style='font-size:10.0pt;font-family:"Verdana","sans-serif";color:black;background:white'>Thanks for any help.<span class=apple-converted-space> </span></span><span style='font-size:10.0pt;font-family:"Verdana","sans-serif";color:black'><br><br><span style='background:white'>Frederic<span class=apple-converted-space> </span></span></span><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal>[@@THALES GROUP RESTRICTED@@]<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p></div></div></body></html>