<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Calibri" size="2"><span style="font-size:11pt;">
<div>Hi,</div>
<div> </div>
<div>I've just setup a test IdP installation to see how we can replicate our current SPNEGO setup in IdP 3.2 (Centos 6.7/apache-tomcat-8.0.26).</div>
<div> </div>
<div>I'm getting a checksum error in the IdP logs:</div>
<div> </div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;">2015-11-20 09:12:10,557 - DEBUG [net.shibboleth.idp.authn.spnego.impl.GSSContextAcceptor:175] - Validating the first GSS input token against service principal: HTTP/gateway.ncl.ac.uk@CAMPUS.NCL.AC.UK</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;">2015-11-20 09:12:10,567 - DEBUG [net.shibboleth.idp.authn.spnego.impl.GSSContextAcceptor:188] - Error establishing security context</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;">org.ietf.jgss.GSSException: <b>Failure unspecified at GSS-API level</b> (<b>Mechanism level: Checksum failed</b>)</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;"> at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:856)</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;">Caused by: sun.security.krb5.KrbCryptoException: Checksum failed</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;"> at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHmacEType.java:102)</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;">Caused by: java.security.GeneralSecurityException: Checksum failed</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;"> at sun.security.krb5.internal.crypto.dk.ArcFourCrypto.decrypt(ArcFourCrypto.java:408)</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;">2015-11-20 09:12:10,572 - DEBUG [net.shibboleth.idp.authn.spnego.impl.SPNEGOAuthnController:165] - Exception processing GSS token</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;">org.ietf.jgss.GSSException: Failure unspecified at GSS-API level (Mechanism level: Checksum failed)</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;"> at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:856)</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;">Caused by: sun.security.krb5.KrbCryptoException: Checksum failed</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;"> at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHmacEType.java:102)</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;">Caused by: java.security.GeneralSecurityException: Checksum failed</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;"> at sun.security.krb5.internal.crypto.dk.ArcFourCrypto.decrypt(<b>ArcFourCrypto.java</b>:408)</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;">2015-11-20 09:12:10,595 - WARN [net.shibboleth.idp.authn.impl.ValidateExternalAuthentication:94] - Profile Action ValidateExternalAuthentication: External authentication produced exception</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;">net.shibboleth.idp.authn.ExternalAuthenticationException: SPNEGONotAvailable</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;"> at net.shibboleth.idp.authn.spnego.impl.SPNEGOAuthnController.continueSPNEGO(SPNEGOAuthnController.java:167)</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;">Caused by: org.ietf.jgss.GSSException: Failure unspecified at GSS-API level (Mechanism level: Checksum failed)</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;"> at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:856)</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;">Caused by: sun.security.krb5.KrbCryptoException: Checksum failed</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;"> at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHmacEType.java:102)</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;">Caused by: java.security.GeneralSecurityException: Checksum failed</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;"> at sun.security.krb5.internal.crypto.dk.ArcFourCrypto.decrypt(ArcFourCrypto.java:408)</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;">2015-11-20 09:12:10,596 - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:130] - Profile Action SelectAuthenticationFlow: Moving incomplete flow authn/SPNEGO to intermediate set</span></font></div>
<div> </div>
<div>But the keytab itself works fine on the command line:</div>
<div> </div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;">[root@devidp authn]# kinit ncf17</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;">Password for ncf17@CAMPUS.NCL.AC.UK:</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;">[root@devidp authn]# klist</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;">Ticket cache: FILE:/tmp/krb5cc_0</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;">Default principal: ncf17@CAMPUS.NCL.AC.UK</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;"> </span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;">Valid starting Expires Service principal</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;">11/20/15 09:10:32 11/20/15 17:10:32 <a href="mailto:krbtgt/CAMPUS.NCL.AC.UK@CAMPUS.NCL.AC.UK"><font color="#0563C1"><u>krbtgt/CAMPUS.NCL.AC.UK@CAMPUS.NCL.AC.UK</u></font></a></span></font></div>
<div> </div>
<div>Our krb5.conf has:</div>
<div> </div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;">default_tgt_enctypes = arcfour-hmac</span></font></div>
<div><font face="Consolas" size="2"><span style="font-size:10pt;">default_tgs_enctypes= arcfour-hmac</span></font></div>
<div> </div>
<div>so it looks like the right decryption method is being used… could this be to do with the Java version (1.8.0_65)?</div>
<div> </div>
<div>I remember keytabs/encryption types being a pain the last time we set this up but it's been a while so any pointers would be greatly received <font face="Wingdings">J</font></div>
<div> </div>
<div>Thanks,</div>
<div> </div>
<div>Chris</div>
<div> </div>
</span></font>
</body>
</html>