CAS Spnego - KrbException：校驗和失敗

我正在嘗試使用Active Directory中的SPNEGO（Kerberos）身份驗證 - 使用CAS服務器（github）。下面是官方的指令：https://apereo.github.io/cas/5.1.x/installation/SPNEGO-Authentication.html CAS Spnego - KrbException：校驗和失敗

我用這個模板：https://github.com/apereo/cas-overlay-template 所以pom.xml從那裏取。

不幸的是，我只收到此異常：

>>> EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType 
jcifs.spnego.AuthenticationException: Error performing Kerberos authentication: java.lang.reflect.InvocationTargetException 
     at jcifs.spnego.Authentication.processKerberos(Authentication.java:447) 
     at jcifs.spnego.Authentication.processSpnego(Authentication.java:346) 
     at jcifs.spnego.Authentication.process(Authentication.java:235) 
     at jcifs.spnego.Authentication$$FastClassBySpringCGLIB$$c5958df9.invoke(<generated>) 
     at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:204) 
     at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.invokeJoinpoint(CglibAopProxy.java:738) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157) 
     at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:133) 
     at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:121) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) 
     at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:673) 
     at jcifs.spnego.Authentication$$EnhancerBySpringCGLIB$$84bb5e21.process(<generated>) 
     at org.apereo.cas.support.spnego.authentication.handler.support.JcifsSpnegoAuthenticationHandler.doAuthentication(JcifsSpnegoAuthenticationHandler.java:60) 
     at org.apereo.cas.authentication.handler.support.AbstractPreAndPostProcessingAuthenticationHandler.authenticate(AbstractPreAndPostProcessingAuthenticationHandler.java:40) 
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
     at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) 
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) 
     at java.lang.reflect.Method.invoke(Unknown Source) 
     at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:333) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:190) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157) 
     at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:133) 
     at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:121) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) 
     at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:213) 
     at com.sun.proxy.$Proxy118.authenticate(Unknown Source) 
     at org.apereo.cas.authentication.AbstractAuthenticationManager.authenticateAndResolvePrincipal(AbstractAuthenticationManager.java:174) 
     at org.apereo.cas.authentication.PolicyBasedAuthenticationManager.lambda$null$3(PolicyBasedAuthenticationManager.java:129) 
     at java.util.stream.MatchOps$1MatchSink.accept(Unknown Source) 
     at java.util.stream.ReferencePipeline$2$1.accept(Unknown Source) 
     at java.util.Spliterators$IteratorSpliterator.tryAdvance(Unknown Source) 
     at java.util.stream.ReferencePipeline.forEachWithCancel(Unknown Source) 
     at java.util.stream.AbstractPipeline.copyIntoWithCancel(Unknown Source) 
     at java.util.stream.AbstractPipeline.copyInto(Unknown Source) 
     at java.util.stream.AbstractPipeline.wrapAndCopyInto(Unknown Source) 
     at java.util.stream.MatchOps$MatchOp.evaluateSequential(Unknown Source) 
     at java.util.stream.MatchOps$MatchOp.evaluateSequential(Unknown Source) 
     at java.util.stream.AbstractPipeline.evaluate(Unknown Source) 
     at java.util.stream.ReferencePipeline.anyMatch(Unknown Source) 
     at org.apereo.cas.authentication.PolicyBasedAuthenticationManager.lambda$authenticateInternal$4(PolicyBasedAuthenticationManager.java:126) 
     at java.util.stream.MatchOps$1MatchSink.accept(Unknown Source) 
     at java.util.HashMap$KeySpliterator.tryAdvance(Unknown Source) 
     at java.util.stream.ReferencePipeline.forEachWithCancel(Unknown Source) 
     at java.util.stream.AbstractPipeline.copyIntoWithCancel(Unknown Source) 
     at java.util.stream.AbstractPipeline.copyInto(Unknown Source) 
     at java.util.stream.AbstractPipeline.wrapAndCopyInto(Unknown Source) 
     at java.util.stream.MatchOps$MatchOp.evaluateSequential(Unknown Source) 
     at java.util.stream.MatchOps$MatchOp.evaluateSequential(Unknown Source) 
     at java.util.stream.AbstractPipeline.evaluate(Unknown Source) 
     at java.util.stream.ReferencePipeline.anyMatch(Unknown Source) 
     at org.apereo.cas.authentication.PolicyBasedAuthenticationManager.authenticateInternal(PolicyBasedAuthenticationManager.java:124) 
     at org.apereo.cas.authentication.AbstractAuthenticationManager.authenticate(AbstractAuthenticationManager.java:140) 
     at org.apereo.cas.authentication.AbstractAuthenticationManager$$FastClassBySpringCGLIB$$12a86894.invoke(<generated>) 
     at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:204) 
     at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.invokeJoinpoint(CglibAopProxy.java:738) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157) 
     at org.springframework.aop.aspectj.MethodInvocationProceedingJoinPoint.proceed(MethodInvocationProceedingJoinPoint.java:85) 
     at org.apereo.inspektr.audit.AuditTrailManagementAspect.handleAuditTrail(AuditTrailManagementAspect.java:134) 
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
     at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) 
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) 
     at java.lang.reflect.Method.invoke(Unknown Source) 
     at org.springframework.aop.aspectj.AbstractAspectJAdvice.invokeAdviceMethodWithGivenArgs(AbstractAspectJAdvice.java:629) 
     at org.springframework.aop.aspectj.AbstractAspectJAdvice.invokeAdviceMethod(AbstractAspectJAdvice.java:618) 
     at org.springframework.aop.aspectj.AspectJAroundAdvice.invoke(AspectJAroundAdvice.java:70) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:168) 
     at org.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:92) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) 
     at com.ryantenney.metrics.spring.MeteredMethodInterceptor.invoke(MeteredMethodInterceptor.java:45) 
     at com.ryantenney.metrics.spring.MeteredMethodInterceptor.invoke(MeteredMethodInterceptor.java:32) 
     at com.ryantenney.metrics.spring.AbstractMetricMethodInterceptor.invoke(AbstractMetricMethodInterceptor.java:59) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) 
     at com.ryantenney.metrics.spring.TimedMethodInterceptor.invoke(TimedMethodInterceptor.java:48) 
     at com.ryantenney.metrics.spring.TimedMethodInterceptor.invoke(TimedMethodInterceptor.java:34) 
     at com.ryantenney.metrics.spring.AbstractMetricMethodInterceptor.invoke(AbstractMetricMethodInterceptor.java:59) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) 
     at com.ryantenney.metrics.spring.CountedMethodInterceptor.invoke(CountedMethodInterceptor.java:46) 
     at com.ryantenney.metrics.spring.CountedMethodInterceptor.invoke(CountedMethodInterceptor.java:32) 
     at com.ryantenney.metrics.spring.AbstractMetricMethodInterceptor.invoke(AbstractMetricMethodInterceptor.java:59) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) 
     at com.ryantenney.metrics.spring.MeteredMethodInterceptor.invoke(MeteredMethodInterceptor.java:45) 
     at com.ryantenney.metrics.spring.MeteredMethodInterceptor.invoke(MeteredMethodInterceptor.java:32) 
     at com.ryantenney.metrics.spring.AbstractMetricMethodInterceptor.invoke(AbstractMetricMethodInterceptor.java:59) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) 
     at com.ryantenney.metrics.spring.TimedMethodInterceptor.invoke(TimedMethodInterceptor.java:48) 
     at com.ryantenney.metrics.spring.TimedMethodInterceptor.invoke(TimedMethodInterceptor.java:34) 
     at com.ryantenney.metrics.spring.AbstractMetricMethodInterceptor.invoke(AbstractMetricMethodInterceptor.java:59) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) 
     at com.ryantenney.metrics.spring.CountedMethodInterceptor.invoke(CountedMethodInterceptor.java:46) 
     at com.ryantenney.metrics.spring.CountedMethodInterceptor.invoke(CountedMethodInterceptor.java:32) 
     at com.ryantenney.metrics.spring.AbstractMetricMethodInterceptor.invoke(AbstractMetricMethodInterceptor.java:59) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) 
     at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:673) 
     at org.apereo.cas.authentication.PolicyBasedAuthenticationManager$$EnhancerBySpringCGLIB$$5085e4b0.authenticate(<generated>) 
     at org.apereo.cas.authentication.DefaultAuthenticationTransactionManager.handle(DefaultAuthenticationTransactionManager.java:34) 
     at org.apereo.cas.authentication.DefaultAuthenticationSystemSupport.handleAuthenticationTransaction(DefaultAuthenticationSystemSupport.java:55) 
     at org.apereo.cas.authentication.DefaultAuthenticationSystemSupport.handleInitialAuthenticationTransaction(DefaultAuthenticationSystemSupport.java:41) 
     at org.apereo.cas.web.flow.resolver.impl.InitialAuthenticationAttemptWebflowEventResolver.resolveInternal(InitialAuthenticationAttemptWebflowEventResolver.java:69) 
     at org.apereo.cas.web.flow.resolver.impl.AbstractCasWebflowEventResolver.resolve(AbstractCasWebflowEventResolver.java:475) 
     at org.apereo.cas.web.flow.resolver.impl.AbstractCasWebflowEventResolver.resolveSingle(AbstractCasWebflowEventResolver.java:480) 
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
     at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) 
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) 
     at java.lang.reflect.Method.invoke(Unknown Source) 
     at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:333) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:190) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157) 
     at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:133) 
     at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:121) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) 
     at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:213) 
     at com.sun.proxy.$Proxy164.resolveSingle(Unknown Source) 
     at org.apereo.cas.web.flow.AbstractAuthenticationAction.doExecute(AbstractAuthenticationAction.java:59) 
     at org.springframework.webflow.action.AbstractAction.execute(AbstractAction.java:188) 
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
     at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) 
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) 
     at java.lang.reflect.Method.invoke(Unknown Source) 
     at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:333) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:190) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157) 
     at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:133) 
     at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:121) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) 
     at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:213) 
     at com.sun.proxy.$Proxy160.execute(Unknown Source) 
     at org.springframework.webflow.execution.ActionExecutor.execute(ActionExecutor.java:51) 
     at org.springframework.webflow.action.EvaluateAction.doExecute(EvaluateAction.java:77) 
     at org.springframework.webflow.action.AbstractAction.execute(AbstractAction.java:188) 
     at org.springframework.webflow.execution.ActionExecutor.execute(ActionExecutor.java:51) 
     at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:101) 
     at org.springframework.webflow.engine.State.enter(State.java:194) 
     at org.springframework.webflow.engine.Transition.execute(Transition.java:228) 
     at org.springframework.webflow.engine.impl.FlowExecutionImpl.execute(FlowExecutionImpl.java:395) 
     at org.springframework.webflow.engine.impl.RequestControlContextImpl.execute(RequestControlContextImpl.java:214) 
     at org.springframework.webflow.engine.TransitionableState.handleEvent(TransitionableState.java:116) 
     at org.springframework.webflow.engine.Flow.handleEvent(Flow.java:547) 
     at org.springframework.webflow.engine.impl.FlowExecutionImpl.handleEvent(FlowExecutionImpl.java:390) 
     at org.springframework.webflow.engine.impl.RequestControlContextImpl.handleEvent(RequestControlContextImpl.java:210) 
     at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:105) 
     at org.springframework.webflow.engine.State.enter(State.java:194) 
     at org.springframework.webflow.engine.Transition.execute(Transition.java:228) 
     at org.springframework.webflow.engine.impl.FlowExecutionImpl.execute(FlowExecutionImpl.java:395) 
     at org.springframework.webflow.engine.impl.RequestControlContextImpl.execute(RequestControlContextImpl.java:214) 
     at org.springframework.webflow.engine.TransitionableState.handleEvent(TransitionableState.java:116) 
     at org.springframework.webflow.engine.Flow.handleEvent(Flow.java:547) 
     at org.springframework.webflow.engine.impl.FlowExecutionImpl.handleEvent(FlowExecutionImpl.java:390) 
     at org.springframework.webflow.engine.impl.RequestControlContextImpl.handleEvent(RequestControlContextImpl.java:210) 
     at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:105) 
     at org.springframework.webflow.engine.State.enter(State.java:194) 
     at org.springframework.webflow.engine.Transition.execute(Transition.java:228) 
     at org.springframework.webflow.engine.impl.FlowExecutionImpl.execute(FlowExecutionImpl.java:395) 
     at org.springframework.webflow.engine.impl.RequestControlContextImpl.execute(RequestControlContextImpl.java:214) 
     at org.springframework.webflow.engine.TransitionableState.handleEvent(TransitionableState.java:116) 
     at org.springframework.webflow.engine.Flow.handleEvent(Flow.java:547) 
     at org.springframework.webflow.engine.impl.FlowExecutionImpl.handleEvent(FlowExecutionImpl.java:390) 
     at org.springframework.webflow.engine.impl.RequestControlContextImpl.handleEvent(RequestControlContextImpl.java:210) 
     at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:105) 
     at org.springframework.webflow.engine.State.enter(State.java:194) 
     at org.springframework.webflow.engine.Transition.execute(Transition.java:228) 
     at org.springframework.webflow.engine.DecisionState.doEnter(DecisionState.java:51) 
     at org.springframework.webflow.engine.State.enter(State.java:194) 
     at org.springframework.webflow.engine.Transition.execute(Transition.java:228) 
     at org.springframework.webflow.engine.impl.FlowExecutionImpl.execute(FlowExecutionImpl.java:395) 
     at org.springframework.webflow.engine.impl.RequestControlContextImpl.execute(RequestControlContextImpl.java:214) 
     at org.springframework.webflow.engine.TransitionableState.handleEvent(TransitionableState.java:116) 
     at org.springframework.webflow.engine.Flow.handleEvent(Flow.java:547) 
     at org.springframework.webflow.engine.impl.FlowExecutionImpl.handleEvent(FlowExecutionImpl.java:390) 
     at org.springframework.webflow.engine.impl.RequestControlContextImpl.handleEvent(RequestControlContextImpl.java:210) 
     at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:105) 
     at org.springframework.webflow.engine.State.enter(State.java:194) 
     at org.springframework.webflow.engine.Transition.execute(Transition.java:228) 
     at org.springframework.webflow.engine.impl.FlowExecutionImpl.execute(FlowExecutionImpl.java:395) 
     at org.springframework.webflow.engine.impl.RequestControlContextImpl.execute(RequestControlContextImpl.java:214) 
     at org.springframework.webflow.engine.TransitionableState.handleEvent(TransitionableState.java:116) 
     at org.springframework.webflow.engine.Flow.handleEvent(Flow.java:547) 
     at org.springframework.webflow.engine.impl.FlowExecutionImpl.handleEvent(FlowExecutionImpl.java:390) 
     at org.springframework.webflow.engine.impl.RequestControlContextImpl.handleEvent(RequestControlContextImpl.java:210) 
     at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:105) 
     at org.springframework.webflow.engine.State.enter(State.java:194) 
     at org.springframework.webflow.engine.Flow.start(Flow.java:527) 
     at org.springframework.webflow.engine.impl.FlowExecutionImpl.start(FlowExecutionImpl.java:368) 
     at org.springframework.webflow.engine.impl.FlowExecutionImpl.start(FlowExecutionImpl.java:223) 
     at org.springframework.webflow.executor.FlowExecutorImpl.launchExecution(FlowExecutorImpl.java:140) 
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
     at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) 
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) 
     at java.lang.reflect.Method.invoke(Unknown Source) 
     at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:333) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:190) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157) 
     at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:133) 
     at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:121) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) 
     at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:213) 
     at com.sun.proxy.$Proxy158.launchExecution(Unknown Source) 
     at org.springframework.webflow.mvc.servlet.FlowHandlerAdapter.handle(FlowHandlerAdapter.java:263) 
     at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:963) 
     at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:897) 
     at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:970) 
     at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:861) 
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:635) 
     at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846) 
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:742) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.apereo.cas.web.support.AuthenticationCredentialsLocalBinderClearingFilter.doFilter(AuthenticationCredentialsLocalBinderClearingFilter.java:28) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.apereo.cas.security.RequestParameterPolicyEnforcementFilter.doFilter(RequestParameterPolicyEnforcementFilter.java:261) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.apereo.cas.security.ResponseHeadersEnforcementFilter.doFilter(ResponseHeadersEnforcementFilter.java:238) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.springframework.boot.actuate.trace.WebRequestTraceFilter.doFilterInternal(WebRequestTraceFilter.java:110) 
     at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99) 
     at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.springframework.web.filter.HttpPutFormContentFilter.doFilterInternal(HttpPutFormContentFilter.java:105) 
     at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:81) 
     at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.apereo.cas.logging.web.ThreadContextMDCServletFilter.doFilter(ThreadContextMDCServletFilter.java:90) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.springframework.boot.actuate.autoconfigure.MetricsFilter.doFilterInternal(MetricsFilter.java:106) 
     at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:197) 
     at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.springframework.boot.web.support.ErrorPageFilter.doFilter(ErrorPageFilter.java:115) 
     at org.springframework.boot.web.support.ErrorPageFilter.access$000(ErrorPageFilter.java:59) 
     at org.springframework.boot.web.support.ErrorPageFilter$1.doFilterInternal(ErrorPageFilter.java:90) 
     at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
     at org.springframework.boot.web.support.ErrorPageFilter.doFilter(ErrorPageFilter.java:108) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.apereo.inspektr.common.web.ClientInfoThreadLocalFilter.doFilter(ClientInfoThreadLocalFilter.java:64) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.apache.logging.log4j.web.Log4jServletFilter.doFilter(Log4jServletFilter.java:71) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198) 
     at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) 
     at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:478) 
     at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140) 
     at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:80) 
     at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:624) 
     at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) 
     at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342) 
     at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:799) 
     at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) 
     at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:861) 
     at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1455) 
     at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) 
     at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) 
     at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) 
     at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) 
     at java.lang.Thread.run(Unknown Source) 
Caused by: java.lang.reflect.InvocationTargetException 
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
     at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) 
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) 
     at java.lang.reflect.Method.invoke(Unknown Source) 
     at jcifs.spnego.Authentication$ServerAction.run(Authentication.java:517) 
     at jcifs.spnego.Authentication.processKerberos(Authentication.java:430) 
     ... 274 more 
Caused by: GSSException: Failure unspecified at GSS-API level (Mechanism level: Checksum failed) 
     at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Unknown Source) 
     at sun.security.jgss.GSSContextImpl.acceptSecContext(Unknown Source) 
     at sun.security.jgss.GSSContextImpl.acceptSecContext(Unknown Source) 
     ... 280 more 
Caused by: KrbException: Checksum failed 
     at sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType.decrypt(Unknown Source) 
     at sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType.decrypt(Unknown Source) 
     at sun.security.krb5.EncryptedData.decrypt(Unknown Source) 
     at sun.security.krb5.KrbApReq.authenticate(Unknown Source) 
     at sun.security.krb5.KrbApReq.<init>(Unknown Source) 
     at sun.security.jgss.krb5.InitSecContextToken.<init>(Unknown Source) 
     ... 283 more 
Caused by: java.security.GeneralSecurityException: Checksum failed 
     at sun.security.krb5.internal.crypto.dk.AesDkCrypto.decryptCTS(Unknown Source) 
     at sun.security.krb5.internal.crypto.dk.AesDkCrypto.decrypt(Unknown Source) 
     at sun.security.krb5.internal.crypto.Aes256.decrypt(Unknown Source) 
     ... 289 more

問：這是什麼意思？哪個配置元素可能會導致此問題？

來源

2017-07-04 jsosnowski

我找到了解決方案。總之：我在cas.properties的cas.authn.spnego.jcifsServicePrincipal有問題。

詳情：

的Active Directory
JDK 1.8 + JCE
Apereo CAS 5.1
的Tomcat 8.5.15在Windows Server 2012 R2

CAS documentation建議這樣的配置：

cas.authn.spnego.jcifsServicePrincipal=HTTP/[email protected]

但要知道，這是jcifsServicePrincipal主要名 - 在Active Directory用戶，這SPN分配的名稱。我有用戶cn=service_xxx其中servicePrincipalName屬性分配給HTTP/machine1.domain.com和HTTP/machine1（但我認爲，只有第一個需要）。

值得關注本教程：Kerberos/SPNEGO based SSO (Single Sign-On) in Weblogic。

如何做我的CAS的工作原理：

使用上面的教程中，我創建SPN爲現有用戶service_xxx（用戶可登錄到MACHINE1）：

setspn -s HTTP/machine1.domain.com service_xxx

用戶service_xxx在Active Directory中具有此類屬性：AES 128位加密和AES 256位加密。

這兩個操作都是由Active Directory管理員完成的（他有足夠的權限）。

所以service_xxx是主體名稱（用戶名）和HTTP/machine1.domain.com是隻分配給主體的SPN屬性。據我瞭解 - 現在運行在機器machine1.domain.com（這是機器URL）上的CAS服務器可以從用戶service_xxx從AD（LDAP）獲得任何信息。所以CAS服務器也可以使用Kerberos協議來認證任何用戶。在我看來，這就是爲什麼CAS屬性jcifsServicePrincipal應該指向主體[email protected]（完整主體名稱@ domain.com），而不是它的SPN屬性名稱（除非它們是相同的字符串）。

我的配置細節：

首席，AES屬性和SPN屬性設置
與Java Java加密擴展（JCE）安裝

密鑰表無限強度使用從JDK ktab.exe工具創建
login.conf file - 與CAS documentation相同
cas.properties和krb5.conf如下圖所示

密鑰表

密鑰選項卡創建過程（無任何特殊權限要求）：

"C:\Program Files\Java\jre1.8.0_131\bin\ktab.exe" -a service_xxx -n 0 -k cas.keytab

-k指定TAB鍵輸出文件名。 -n 0指定KNVO編號。免責聲明：對於我的用戶cn = service_xxx在Active Directory中沒有屬性msDS-KeyVersionNumber（KNVO），所以我用0.但我認爲Windows忽略KNVO號碼 - 請參閱this comment。

One的詳細信息有關密鑰表：

很多教程，甚至官方documentation建議，使密鑰表使用ktpass.exe。不幸的是，這需要AD管理員權限，所以這不是一個好主意。更好地使用JDK的ktab.exe（如上所述）。您只需要記住在service_xxx密碼更改後始終生成新的密鑰表。

在那裏測試TAB鍵幾個選項：

使用kinit命令來收集Kerberos票據（爲service_xxx本金）。這也是由JDK提供的工具。
從SO試試這個由@Ivan維謝洛夫斯基寫小程序：https://stackoverflow.com/a/13859217/5162026

cas.properties這對我的作品：

cas.authn.spnego.kerberosConf=/etc/cas/config/krb5.conf 
cas.authn.spnego.jcifsServicePrincipal=service_[email protected] 
cas.authn.spnego.loginConf=file:/etc/cas/config/login.conf 
cas.authn.spnego.kerberosRealm=DOMAIN.COM 

cas.authn.spnego.principal.principalAttribute=sAMAccountName 

cas.authn.spnego.ldap.ldapUrl=ldap://path.to.ldap.domain.com 
cas.authn.spnego.ldap.baseDn=DC=domain,DC=com #this is base dn where LDAP starts searching for users 
cas.authn.spnego.ldap.bindDn=cn=SERVICE_XXX,DC=domain,DC=com #it's a kind of login to LDAP 
cas.authn.spnego.ldap.failFast=false 
cas.authn.spnego.ldap.subtreeSearch=true 
cas.authn.spnego.ldap.useSsl=false 
cas.authn.spnego.ldap.searchFilter=cn={host}

很有趣的是路徑像/etc/cas/config作品也可以在Windows和點到C:驅動器根 - 所以C:\etc\cas\config。請注意，此處（和所有Java文件）路徑中的所有配置都使用正斜槓。

我也提供krb5.conf。該文件特定於您的組織。通常您可以在連接到域的任何工作站中的C:\Windows文件夾中找到它。所以你可以複製它，並根據需要進行編輯。您也可以手動編寫它（樣本位於CAS文檔中）。

最重要的是添加有路徑密鑰表：

[libdefaults] 
    default_keytab_name = C:/Users/SERVICE_XXX/my_keytab/cas.keytab

正如你所看到的 - default_keytab_name參數[libdefaults]下。 login.conf文件中也有相同的路徑（請參閱Apereo CAS文檔）。

如果您在CAS中啓用調試（cas.authn.spnego.kerberosDebug=true並更改log4j2.xml中的調試級別）。那麼你應該在CAS正在使用您的密鑰表，像看到：

2017-07-04 19:56:29,613 DEBUG [org.apereo.cas.support.spnego.authentication.handler.support.JcifsSpnegoAuthenticationHandler] - <Processing SPNEGO authentication> 
Java config name: /etc/cas/config/krb5.conf 
Loaded from Java config 
Found KeyTab Default keytab 
Entered Krb5Context.acceptSecContext with state=STATE_NEW 
>>> KeyTabInputStream, readName(): DOMAIN.COM 
>>> KeyTabInputStream, readName(): SERVICE_XXX 
>>> KeyTab: load() entry length: 79; type: 18 

// ... edited 

Added key: 23version: 0 
Added key: 16version: 0 
Added key: 17version: 0 
Added key: 18version: 0

否則，你會看到，CAS Looking for keys for: [email protected]，然後拋出類似下面的例外。

故障1：

如果你看到類似這樣的例外：

Caused by: GSSException: Failure unspecified at GSS-API level (Mechanism level: Invalid argument (400) - Cannot find key of appropriate type to decrypt AP REP - AES256 CTS mode with HMAC SHA1-96) 
     at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Unknown Source) 
     at sun.security.jgss.GSSContextImpl.acceptSecContext(Unknown Source) 
     at sun.security.jgss.GSSContextImpl.acceptSecContext(Unknown Source) 
     ... 280 more 
Caused by: KrbException: Invalid argument (400) - Cannot find key of appropriate type to decrypt AP REP - AES256 CTS mode with HMAC SHA1-96 
     at sun.security.krb5.KrbApReq.authenticate(Unknown Source) 
     at sun.security.krb5.KrbApReq.<init>(Unknown Source) 
     at sun.security.jgss.krb5.InitSecContextToken.<init>(Unknown Source) 
     ... 283 more

它很可能，你已經走錯了路，以.keytab文件（如指出也here）。

故障2：

如果抱怨不支持CAS加密：

Encryption type AES256 CTS mode with HMAC SHA1-96 is not supported/enabled

很可能是Java的JCE未安裝或Java進行了更新，並在結果JCE支持由覆蓋更新（再次安裝JCE）。

來源

2017-07-05 09:49:03 jsosnowski

你可以接受你自己的答案在這一個。 –

CAS Spnego - KrbException：校驗和失敗

回答

相關問題