SSO Configuration with Weblogic 11g OEL

Question

I'm receiving following error in Weblogic while accessing application through AD user for SSO.

> <> <> <1471875042422> <BEA-000000> <com.bea.common.security.internal.legacy.service.ChallengeIdentityAssertionProviderImpl$ChallengeIdentityAsserterV2Adapter.assertChallengeIdentity(Authorization.Negotiate)>
####<22-Aug-2016 15:10:42 o'clock BST> <Debug> <SecurityAtn> <ndl-wln-100.centricait.com> <ND_Manage1> <[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <> <> <1471875042422> <BEA-000000> <GSSExceptionInfo:>
####<22-Aug-2016 15:10:42 o'clock BST> <Debug> <SecurityAtn> <ndl-wln-100.centricait.com> <ND_Manage1> <[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <> <> <1471875042423> <BEA-000000> <   major: (13) : No valid credentials provided>
####<22-Aug-2016 15:10:42 o'clock BST> <Debug> <SecurityAtn> <ndl-wln-100.centricait.com> <ND_Manage1> <[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <> <> <1471875042423> <BEA-000000> <   minor: (-1) : Failed to find any Kerberos credentails>
####<22-Aug-2016 15:10:42 o'clock BST> <Debug> <SecurityAtn> <ndl-wln-100.centricait.com> <ND_Manage1> <[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <> <> <1471875042423> <BEA-000000> <acceptGssInitContextToken failed
com.bea.security.utils.kerberos.KerberosException: No valid credentials provided (Mechanism level: Failed to find any Kerberos credentails)
        at com.bea.security.utils.kerberos.KerberosTokenHandler.acceptGssInitContextTokenInDoAs(KerberosTokenHandler.java:334)
        at com.bea.security.utils.kerberos.KerberosTokenHandler.access$000(KerberosTokenHandler.java:41)
        at com.bea.security.utils.kerberos.KerberosTokenHandler$1.run(KerberosTokenHandler.java:226)
        at java.security.AccessController.doPrivileged(Native Method)
        at javax.security.auth.Subject.doAsPrivileged(Subject.java:536)
        at com.bea.security.utils.kerberos.KerberosTokenHandler.acceptGssInitContextToken(KerberosTokenHandler.java:224)
        at com.bea.security.utils.kerberos.KerberosTokenHandler.acceptGssInitContextToken(KerberosTokenHandler.java:152)
        at com.bea.common.security.internal.utils.negotiate.SPNEGONegotiateToken.getUsername(SPNEGONegotiateToken.java:57)
        at weblogic.security.providers.authentication.NegotiateIdentityAsserterProviderImpl.assertChallengeIdentity(NegotiateIdentityAsserterProviderImpl.java:210)
        at com.bea.common.security.internal.legacy.service.ChallengeIdentityAssertionProviderImpl$ChallengeIdentityAsserterV2Adapter.assertChallengeIdentity(ChallengeIdentityAssertionProviderImpl.j

I already have verified keytab using kinit -V -k -t negotestserver.keytab HTTP/WL-HOST@MYDOMAIN.COM its successfully Authenticated. Wonder whats the solution of this issue any help will be appreciated.

Does this happen for different users? Does this happen on different workstations? Which browser do you use? — misha2400, Aug 22 '16 at 15:37
also see my comment at http://stackoverflow.com/questions/28041640/weblogic-kerberos-sso/28223529#28223529 to change logging level to see more info in the log. — misha2400, Aug 22 '16 at 16:08
misha2400: i m using a test AD user which has assigned roles in Oracle Internet Directory.. I am using IE11... nop i hav't try any other user..and using single client workstation which logged in through VDI — Muhammad Faheem Khan, Aug 22 '16 at 17:14
i have already enable weblgoc atn & atz debugging and have also enable -Dsun.security.krb5.debug=true — Muhammad Faheem Khan, Aug 22 '16 at 17:18
did you set up SPN in your AD? Is your IE11 configured to use Integrated Windows Authentication? — misha2400, Aug 22 '16 at 17:26
yup i have configured SPN and test it from my OEL Weblogic server using command kinit -V-k -t and it says Authenticated.. also have configure IE 11 for Integrated Windows Authentication.. — Muhammad Faheem Khan, Aug 22 '16 at 17:42
i am working since two days on it.. its really frustrating me.. :/ — Muhammad Faheem Khan, Aug 22 '16 at 17:43
if you run klist command on workstation, does it show any cached tickets? — misha2400, Aug 22 '16 at 18:22
[root@WLHOST-100 Domain]# kinit -V -k -t new.keytab HTTP/WLHOST-100@MYDOMAIN.COM Using default cache: persistent:380206332:krb_ccache_IlAjdoE Using principal: HTTP/WLHOST-100@MYDOMAIN.COM Using keytab: new.keytab Authenticated to Kerberos v5 [root@wl-100 DOMAIN]# klist Ticket cache: KEYRING:persistent:380206332:krb_ccache_IlAjdoE Default principal: HTTP/NDL-WLN-100@MYDOMAIN.COM Valid starting Expires Service principal 22/08/16 19:51:37 22/08/16 20:01:37 krbtgt/MYDOMAIN.COM@MYDOMAIN.COM — Muhammad Faheem Khan, Aug 22 '16 at 18:54
yup on client windows machine klist shows tickets as following... D:\Users\NDelius01>klist Current LogonId is 0:0x2b66043 Cached Tickets: (7) #0> Client: NDelius01 @ CENTRICAIT.COM Server: krbtgt/CENTRICAIT.COM @ CENTRICAIT.COM KerbTicket Encryption Type: RSADSI RC4-HMAC(NT) Ticket Flags 0x60a00000 -> forwardable forwarded renewable pre_authen..... — Muhammad Faheem Khan, Aug 23 '16 at 13:50
can you check Event Viewer on windows machine for any Kerberos errors? — misha2400, Aug 23 '16 at 14:28

score 0 · Accepted Answer · answered Aug 23 '16 at 19:58

0

Most probably the ticket that's sent from browser to Weblogic is not Kerberos ticket, but NTLM. There can be many reasons why IE would use NTLM over Kerberos, most of the time it's incorrect setup or Windows settings. Can you check the ticket in your log? If it looks something like this:

YIGCBgYrBgEFBQKgeDB2oDAwLgYKKwYBBAGCNwICCgYJKoZIgvcSAQICBgkqhkiG9xIBAgIGCisGAQQBgjcCAh6iQgRATlRMTVNTUAABAAAAl7II4g4ADgAyAAAACgAKACgAAAAGAbEdAAAAD0xBUFRPUC0yNDVMSUZFQUNDT1VOVExMQw==

it's NTLM. Kerberos ticket is at least twice as long.

answered Aug 23 '16 at 19:58

misha2400

195
2
9

after patch jdk security files as per this oracle document For Oracle JDK 7: Download Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 7 from Link : http://www.oracle.com/technetwork/java/javase/downloads/jce-7-download-432124.html . Overwrite 2 jar files under “/jre/lib/security” directory with 2 jar files inside downloaded zip file the credentials issue seems to resolved but now facing Token not supported by Negotiate Filter, ignoring: NTLM" yup you are right browser is sending NTLM instead of Kerberos.. any fix for this ? – Muhammad Faheem Khan Aug 24 '16 at 09:24
there were two entries of weblogic host in AD setspn -l machinename after removing them and create new keytab with fully qualified domain name setspn -S HTTP/machinename.domain.com@DOMAIN.COM and ktpass also with FQDN im able to make sso work for weblogic console...but applicaion still not workng – Muhammad Faheem Khan Aug 24 '16 at 23:24
What are you typing in the browser to get to the application? Same URL as in SPN - machinename.domain.com ? – misha2400 Aug 25 '16 at 12:48
Also, can you post the log section with authentication attempt? And your config files will be helpful, too. – misha2400 Aug 25 '16 at 13:24
i tried both.. the weblogic console is working with sso on http://servername:7001/console but application is not working.. i haven't any document how to setup application for sso.. i have CLIENT_CERT configured in web.xml – Muhammad Faheem Khan Aug 25 '16 at 16:28
finaly i make it work after changing nodemanager.properties file with startscriptenable=true :) cheers – Muhammad Faheem Khan Sep 08 '16 at 08:48

SSO Configuration with Weblogic 11g OEL

1 Answers1