HTTP/Spnego with Kerberos authentication for Finatra web server

Question

I try to use Spnego with Finatra web server but I don't succeed.

Here my GitHub project: https://github.com/glegoux/spnego-server-finatra

With wireshark:

error: KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN.

My server log:

...
Debug is  true  
storeKey true useTicketCache false useKeyTab true 
doNotPrompt true ticketCache is null 
isInitiator false KeyTab is /tmp/spnego-server.keytab 
refreshKrb5Config is true principal is HTTP/spnego-server@EXAMPLE.COM 
tryFirstPass is false 
useFirstPass is false storePass is false clearPass is false
Refreshing Kerberos configuration
Java config name: krb5.conf
Loaded from Java config
>>> KdcAccessibility: reset
>>> KdcAccessibility: reset
principal is HTTP/spnego-server@EXAMPLE.COM
Will use keytab
Commit Succeeded 

Found KeyTab /tmp/spnego-server.keytab for HTTP/spnego-server@EXAMPLE.COM
Found KeyTab /tmp/spnego-server.keytab for HTTP/spnego-server@EXAMPLE.COM
Found KeyTab /tmp/spnego-server.keytab for HTTP/spnego-server@EXAMPLE.COM
Found KeyTab /tmp/spnego-server.keytab for HTTP/spnego-server@EXAMPLE.COM
Entered SpNegoContext.acceptSecContext with state=STATE_NEW
SpNegoContext.acceptSecContext: receiving token = a0 82 03 be 30 82 03 ba ...
SpNegoToken NegTokenInit: reading Mechanism Oid = 1.3.6.1.5.2.5
SpNegoToken NegTokenInit: reading Mech Token
SpNegoContext.acceptSecContext: received token of type = SPNEGO NegTokenInit
SpNegoContext.acceptSecContext: mechanism wanted = null
SpNegoContext.acceptSecContext: negotiated result = REJECT
SpNegoContext.acceptSecContext: sending token of type = SPNEGO NegTokenTarg
SpNegoContext.acceptSecContext: sending token = a1 07 30 05 a0 03 0a 01 02 
The underlying mechanism context has not been initialized
[UnboundedFuturePool-2] INFO SpnegoFilter - Client principal: null
...

When I check my credentials, and don't have Ticket Granting-Service (TGS) for HTTP/spnego-server@EXAMPLE.COM:

$ klist -fe
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: bob@EXAMPLE.COM

Valid starting       Expires              Service principal
24/06/2018 21:17:20  25/06/2018 07:17:20  krbtgt/EXAMPLE.COM@EXAMPLE.COM
    renew until 25/06/2018 21:17:18, Flags: FPRIA
    Etype (skey, tkt): des3-cbc-sha1, des3-cbc-sha1

JAAS config
krb5 config

spnego-server keytab:

klist -kte /tmp/spnego-server.keytab
Keytab name: FILE:/tmp/spnego-server.keytab
KVNO Timestamp         Principal
---- ----------------- --------------------------------------------------------
   1 06/25/18 06:27:43 HTTP/spnego-server@EXAMPLE.COM (des3-cbc-sha1)

Do you know why?

(1) Please post your /etc/kb5.conf. (2) Please post the output of: *klist -k -t -V /tmp/spnego-server.keytab HTTP/spnego-server@EXAMPLE.COM* — T-Heron, Jun 25 '18 at 02:24
Also post the output of *klist -e /tmp/spnego-server.keytab* — T-Heron, Jun 25 '18 at 02:46
**1.** Java never stores service tickets in the cache **2.** Kerberos demands canonical DNS names _(although the Microsoft implementation is way more permissive, to fit their legacy networking mess)_ — Samson Scharfrichter, Jun 26 '18 at 07:26

score 0 · Answer 1 · answered Jun 25 '18 at 09:05

0

It works ;). I fixed post but HTTP/spnego-server.example.com@EXAMPLE.COM is correct for principal name, before it was HTTP/spnego-server@EXAMPLE.COM without .example.com suffix.

answered Jun 25 '18 at 09:05

glegoux

3,505
15
32

HTTP/Spnego with Kerberos authentication for Finatra web server

1 Answers1