<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(32, 31, 30); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important">>
IdP is reachable at idp.example.org, which is a CNAME to server1.example.org.</span><br style="color: rgb(32, 31, 30); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255)">
<span style="color: rgb(32, 31, 30); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important">>
The client may try to get a service ticket for HTTP/server1.example.org@EXAMPLE.ORG.</span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(32, 31, 30); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important"><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(32, 31, 30); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important">I've
found it handy to do a klist after an attempt to see which service tickets my client has to verify the service principal names that I'm expecting.</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color: rgb(32, 31, 30); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important"><br>
</span></div>
<div style=""><font color="#201f1e"><span style="font-size: 14.6667px;">My team has observed that certain clients will follow CNAMES to A records and some won't, depending on OS+browser combos. The only solution that seemed to work for almost all cases was
to have everything be A records.</span></font></div>
<div style=""><font color="#201f1e"><span style="font-size: 14.6667px;"><br>
</span></font></div>
<div style=""><font color="#201f1e"><span style="font-size: 14.6667px;">You can try toggling things like rdns = false to see if that helps.</span></font></div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Daniel Lutz <daniel.lutz@switch.ch><br>
<b>Sent:</b> Tuesday, October 29, 2019 7:31 AM<br>
<b>To:</b> users@shibboleth.net <users@shibboleth.net><br>
<b>Subject:</b> Re: Help with SPNEGO error</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Wessel, Keith [28.10.19 23:00]:<br>
> We're experimenting more with SPNEGO and are currently running into an error resulting in a SPNEGONOTAVAILABLE exception:<br>
> <br>
> 2019-10-28 16:05:50,237 - ERROR [net.shibboleth.idp.authn.spnego.impl.SPNEGOAuthnController:180] - Error extracting principal name from security context, check for hostname mismatch or other causes of a missing service ticket<br>
> <br>
> I see a reference to this in the list archives from a few years ago with no real resolution:
<a href="https://shibboleth.1660669.n2.nabble.com/SPNEGO-amp-IDP-3-2-1-td7625753.html">
https://shibboleth.1660669.n2.nabble.com/SPNEGO-amp-IDP-3-2-1-td7625753.html</a><br>
> <br>
> The explanation from SWITCH was that the client had a valid Kerberos ticket, but the service for getting a "service ticket" was not available.<br>
<br>
While searching my archives, I found a hint to the solution to the problem described<br>
in <a href="https://shibboleth.1660669.n2.nabble.com/SPNEGO-amp-IDP-3-2-1-td7625753.html">
https://shibboleth.1660669.n2.nabble.com/SPNEGO-amp-IDP-3-2-1-td7625753.html</a>.<br>
(Unfortunately we missed to send a comment to the list and to add a note<br>
to the documentation back then.)<br>
<br>
Is your service DNS name a CNAME pointing to another DNS name?<br>
In this case, the client may use a wrong service principal name (SPN).<br>
<br>
Please can you check your DNS names of your IdP service?<br>
<br>
Example (according to my understanding):<br>
<br>
IdP is reachable at idp.example.org, which is a CNAME to server1.example.org.<br>
The client may try to get a service ticket for HTTP/server1.example.org@EXAMPLE.ORG.<br>
<br>
(See e.g. <a href="https://docs.microsoft.com/en-us/previous-versions/office/sharepoint-server-2010/gg502606(v=office.14)#kerberos-authentication-and-dns-cnames">
https://docs.microsoft.com/en-us/previous-versions/office/sharepoint-server-2010/gg502606(v=office.14)#kerberos-authentication-and-dns-cnames</a>)<br>
<br>
(Why Java "accepts" the ticket in this case is not clear to me. This could be a bug, as mentioned<br>
by Scott.)<br>
<br>
This problem seems to affect some browsers (IEs) only. Have you tried with other browsers<br>
(Firefox, Chrome) too?<br>
<br>
Daniel<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</body>
</html>