Tomcat Kerberos Spnego授權不起作用

我嘗試使用Kerberos內置的SPNEGO身份驗證器爲Tomcat 7.0.69配置WebSSO。當我訪問應用程序時，會彈出一個HTTP BasicAuth對話框，並在catalina.out中寫入一個調試條目（見下文）。Tomcat Kerberos Spnego授權不起作用

我的密鑰表文件sso.keytab包含一個在我的AD服務器上註冊的校長（通過ktpass.exe & setspn.exe）。

我打開了調試模式的Kerberos，但我找不到問題。它只是停止在某一點輸入註銷。你有什麼想法，認證在哪一步停止，可能是什麼原因？任何幫助表示讚賞！

catalina.out的

Debug is true storeKey true useTicketCache false useKeyTab true doNotPrompt false ticketCache is null isInitiator true KeyTab is /path/to/tomcat/apache-tomcat-7.0.69/conf/sso.keytab refreshKrb5Config is false principal is HTTP/[email protected] tryFirstPass is false useFirstPass is false storePass is false clearPass is false 
Looking for keys for: HTTP/[email protected] 
Added key: 23version: 0 
Looking for keys for: HTTP/[email protected] 
Added key: 23version: 0 
default etypes for default_tkt_enctypes: 23 17. 
>>> KrbAsReq creating message 
>>> KrbKdcReq send: kdc=server001.my.domain UDP:88, timeout=30000, number of retries =3, #bytes=171 
>>> KDCCommunication: kdc=server001.my.domain UDP:88, timeout=30000,Attempt =1, #bytes=171 
>>> KrbKdcReq send: #bytes read=189 
>>>Pre-Authentication Data: 
    PA-DATA type = 11 
    PA-ETYPE-INFO etype = 23, salt = 

>>>Pre-Authentication Data: 
    PA-DATA type = 19 
    PA-ETYPE-INFO2 etype = 23, salt = null, s2kparams = null 

>>>Pre-Authentication Data: 
    PA-DATA type = 2 
    PA-ENC-TIMESTAMP 
>>>Pre-Authentication Data: 
    PA-DATA type = 16 

>>>Pre-Authentication Data: 
    PA-DATA type = 15 

>>> KdcAccessibility: remove server001.my.domain 
>>> KDCRep: init() encoding tag is 126 req type is 11 
>>>KRBError: 
    sTime is Thu Dec 15 15:35:42 CET 2016 1481812542000 
    suSec is 830454 
    error code is 25 
    error Message is Additional pre-authentication required 
    sname is krbtgt/[email protected] 
    eData provided. 
    msgType is 30 
>>>Pre-Authentication Data: 
    PA-DATA type = 11 
    PA-ETYPE-INFO etype = 23, salt = 

>>>Pre-Authentication Data: 
    PA-DATA type = 19 
    PA-ETYPE-INFO2 etype = 23, salt = null, s2kparams = null 

>>>Pre-Authentication Data: 
    PA-DATA type = 2 
    PA-ENC-TIMESTAMP 
>>>Pre-Authentication Data: 
    PA-DATA type = 16 

>>>Pre-Authentication Data: 
    PA-DATA type = 15 

KrbAsReqBuilder: PREAUTH FAILED/REQ, re-send AS-REQ 
default etypes for default_tkt_enctypes: 23 17. 
Looking for keys for: HTTP/[email protected] 
Added key: 23version: 0 
Looking for keys for: HTTP/[email protected] 
Added key: 23version: 0 
default etypes for default_tkt_enctypes: 23 17. 
>>> EType: sun.security.krb5.internal.crypto.ArcFourHmacEType 
>>> KrbAsReq creating message 
>>> KrbKdcReq send: kdc=server001.my.domain UDP:88, timeout=30000, number of retries =3, #bytes=254 
>>> KDCCommunication: kdc=server001.my.domain UDP:88, timeout=30000,Attempt =1, #bytes=254 
>>> KrbKdcReq send: #bytes read=104 
>>> KrbKdcReq send: kdc=server001.my.domain TCP:88, timeout=30000, number of retries =3, #bytes=254 
>>> KDCCommunication: kdc=server001.my.domain TCP:88, timeout=30000,Attempt =1, #bytes=254 
>>>DEBUG: TCPClient reading 1666 bytes 
>>> KrbKdcReq send: #bytes read=1666 
>>> KdcAccessibility: remove server001.my.domain 
Looking for keys for: HTTP/[email protected] 
Added key: 23version: 0 
>>> EType: sun.security.krb5.internal.crypto.ArcFourHmacEType 
>>> KrbAsRep cons in KrbAsReq.getReply HTTP/my.host.com 
principal is HTTP/[email protected] 
Will use keytab 
    [LoginContext]: login success 
Commit Succeeded 

    [LoginContext]: commit success 
Found KeyTab /path/to/tomcat/apache-tomcat-7.0.69/conf/sso.keytab for HTTP/[email protected] 
Found KeyTab /path/to/tomcat/apache-tomcat-7.0.69/conf/sso.keytab for HTTP/[email protected] 
Found ticket for HTTP/[email protected] to go to krbtgt/[email protected] expiring on Fri Dec 16 01:35:42 CET 2016 
Entered SpNegoContext.acceptSecContext with state=STATE_NEW 
SpNegoContext.acceptSecContext: receiving token = a0 82 13 79 30 82 13 75 a0 30 30 2e 06 09 2a 86 48 86 f7 12 01 02 02 
SpNegoToken NegTokenInit: reading Mechanism Oid = 1.2.840.113554.1.2.2 
SpNegoToken NegTokenInit: reading Mechanism Oid = 1.2.840.48018.1.2.2 
SpNegoToken NegTokenInit: reading Mechanism Oid = 1.3.6.1.4.1.311.2.2.30 
SpNegoToken NegTokenInit: reading Mechanism Oid = 1.3.6.1.4.1.311.2.2.10 
SpNegoToken NegTokenInit: reading Mech Token 
SpNegoContext.acceptSecContext: received token of type = SPNEGO NegTokenInit 
SpNegoContext: negotiated mechanism = 1.2.840.113554.1.2.2 
Entered Krb5Context.acceptSecContext with state=STATE_NEW 
Looking for keys for: HTTP/[email protected] 
Added key: 23version: 0 
     [Krb5LoginModule]: Entering logout 
     [Krb5LoginModule]: logged out Subject 
    [LoginContext]: logout success

的收到令牌是長了不少，我縮短它

krb5.ini

[libdefaults] 
    default_realm = MY.DOMAIN 
    default_keytab_name = FILE:/path/to/tomcat/apache-tomcat-7.0.69/conf/sso.keytab 
    default_tkt_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96 
    default_tgs_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96 
    permitted_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96 

[realms] 
    MY.DOMAIN = { 
     kdc = server001.my.domain 
     admin_server = server001.my.domain 
     default_domain = MY.DOMAIN 
} 

[domain_realm] 
    .my.domain = MY.DOMAIN 
    my.domain = MY.DOMAIN

的Jaas.conf

spnego-client { 
    com.sun.security.auth.module.Krb5LoginModule required; 
}; 

spnego-server { 
    com.sun.security.auth.module.Krb5LoginModule required 
    storeKey=true 
    useKeyTab=true 
    keyTab="/path/to/tomcat/apache-tomcat-7.0.69/conf/sso.keytab" 
    principal="HTTP/[email protected]" 
    debug=true; 
};

的web.xml

<login-config> 
    <auth-method>SPNEGO</auth-method> 
</login-config> 

<security-constraint> 
    <web-resource-collection> 
    <web-resource-name>SSO Login</web-resource-name> 
    <url-pattern>/*</url-pattern> 
    </web-resource-collection> 
    <auth-constraint> 
    <role-name>*</role-name> 
    </auth-constraint> 
</security-constraint>

架構

服務器的Windows Server 2016
應用程序服務器的Unix-Redhat6與Oracle JVM和Tomcat 7.0.69
客戶端Windows 10與Internet Explorer 11

來源

2016-12-20 user2043423

我們可以獲得關於您的體系結構的更多詳細信息 - Tomcat運行在哪個操作系統上，並且它是否在Active Directory（AD）域控制器（希望）獨立的服務器上運行？您的客戶端在運行/使用什麼操作系統版本和Web瀏覽器/版本？你有哪個AD版本？我有一種感覺是什麼導致了'PREAUTH FAILED/REQ'的消息，但我想先從你那裏得到這些細節。 –

@ T-Heron感謝你的迴應！我將信息添加到描述中。 AD版本，在我的測試環境中出現'PREAUTH FAILED/REQ'消息，因此我認爲這可能是不相關的 – user2043423

'PREAUTH FAILED/REQ'消息可能由於幾個原因而失敗其中之一是有問題的服務器沒有使用正確的密鑰表，你能驗證它嗎？在該Tomcat服務器上，在與密鑰表本身相同的目錄中，運行此命令，以查看是否可以使用密鑰表獲取Kerberos票證：_kinit -V -k -t /path/to/tomcat/apache-tomcat-7.0 .69/conf/sso.keytab HTTP/[email protected]_ –

感謝T-Heron，我能找到解決方案。 keytab文件是使用錯誤的加密類型生成的。針對windows7/10，在我的環境，它必須明確設置爲AES256-SHA1

正確的ktpass電話：

ktpass -out D:\TEMP\sso.keytab -mapuser MYUSER -princ HTTP/[email protected] -ptype KRB5_NT_PRINCIPAL -kvno 0 -crypto AES256-SHA1 -pass ****

非常感謝您的支持！

來源

2017-01-04 14:43:58 user2043423

很高興聽到它！ –

Tomcat Kerberos Spnego授權不起作用

回答

相關問題