Tomcat Kerberos Spnego 授权无效
Tomcat Kerberos Spnego authorization not working
我尝试使用基于 Kerberos 的内置 SPNEGO 身份验证器为 Tomcat 7.0.69 配置 WebSSO。当我访问该应用程序时，会弹出一个 HTTP BasicAuth 对话框，并在 catalina.out（见下文）中写入一个调试条目。
我的密钥表文件 sso.keytab 包含一个在我的 AD 服务器上注册的主体（通过 ktpass.exe 和 setspn.exe）。
我打开了 Kerberos 的调试模式，但我找不到问题所在。它只是在 输入注销 的某个点停止。您是否知道身份验证在哪一步停止，可能是什么原因？感谢您的帮助！
catalina.out
Debug is true storeKey true useTicketCache false useKeyTab true doNotPrompt false ticketCache is null isInitiator true KeyTab is /path/to/tomcat/apache-tomcat-7.0.69/conf/sso.keytab refreshKrb5Config is false principal is HTTP/my.host.com@MY.DOMAIN tryFirstPass is false useFirstPass is false storePass is false clearPass is false
Looking for keys for: HTTP/my.host.com@MY.DOMAIN
Added key: 23version: 0
Looking for keys for: HTTP/my.host.com@MY.DOMAIN
Added key: 23version: 0
default etypes for default_tkt_enctypes: 23 17.
>>> KrbAsReq creating message
>>> KrbKdcReq send: kdc=server001.my.domain UDP:88, timeout=30000, number of retries =3, #bytes=171
>>> KDCCommunication: kdc=server001.my.domain UDP:88, timeout=30000,Attempt =1, #bytes=171
>>> KrbKdcReq send: #bytes read=189
>>>Pre-Authentication Data:
PA-DATA type = 11
PA-ETYPE-INFO etype = 23, salt =
>>>Pre-Authentication Data:
PA-DATA type = 19
PA-ETYPE-INFO2 etype = 23, salt = null, s2kparams = null
>>>Pre-Authentication Data:
PA-DATA type = 2
PA-ENC-TIMESTAMP
>>>Pre-Authentication Data:
PA-DATA type = 16
>>>Pre-Authentication Data:
PA-DATA type = 15
>>> KdcAccessibility: remove server001.my.domain
>>> KDCRep: init() encoding tag is 126 req type is 11
>>>KRBError:
sTime is Thu Dec 15 15:35:42 CET 2016 1481812542000
suSec is 830454
error code is 25
error Message is Additional pre-authentication required
sname is krbtgt/MY.DOMAIN@MY.DOMAIN
eData provided.
msgType is 30
>>>Pre-Authentication Data:
PA-DATA type = 11
PA-ETYPE-INFO etype = 23, salt =
>>>Pre-Authentication Data:
PA-DATA type = 19
PA-ETYPE-INFO2 etype = 23, salt = null, s2kparams = null
>>>Pre-Authentication Data:
PA-DATA type = 2
PA-ENC-TIMESTAMP
>>>Pre-Authentication Data:
PA-DATA type = 16
>>>Pre-Authentication Data:
PA-DATA type = 15
KrbAsReqBuilder: PREAUTH FAILED/REQ, re-send AS-REQ
default etypes for default_tkt_enctypes: 23 17.
Looking for keys for: HTTP/my.host.com@MY.DOMAIN
Added key: 23version: 0
Looking for keys for: HTTP/my.host.com@MY.DOMAIN
Added key: 23version: 0
default etypes for default_tkt_enctypes: 23 17.
>>> EType: sun.security.krb5.internal.crypto.ArcFourHmacEType
>>> KrbAsReq creating message
>>> KrbKdcReq send: kdc=server001.my.domain UDP:88, timeout=30000, number of retries =3, #bytes=254
>>> KDCCommunication: kdc=server001.my.domain UDP:88, timeout=30000,Attempt =1, #bytes=254
>>> KrbKdcReq send: #bytes read=104
>>> KrbKdcReq send: kdc=server001.my.domain TCP:88, timeout=30000, number of retries =3, #bytes=254
>>> KDCCommunication: kdc=server001.my.domain TCP:88, timeout=30000,Attempt =1, #bytes=254
>>>DEBUG: TCPClient reading 1666 bytes
>>> KrbKdcReq send: #bytes read=1666
>>> KdcAccessibility: remove server001.my.domain
Looking for keys for: HTTP/my.host.com@MY.DOMAIN
Added key: 23version: 0
>>> EType: sun.security.krb5.internal.crypto.ArcFourHmacEType
>>> KrbAsRep cons in KrbAsReq.getReply HTTP/my.host.com
principal is HTTP/my.host.com@MY.DOMAIN
Will use keytab
[LoginContext]: login success
Commit Succeeded
[LoginContext]: commit success
Found KeyTab /path/to/tomcat/apache-tomcat-7.0.69/conf/sso.keytab for HTTP/my.host.com@MY.DOMAIN
Found KeyTab /path/to/tomcat/apache-tomcat-7.0.69/conf/sso.keytab for HTTP/my.host.com@MY.DOMAIN
Found ticket for HTTP/my.host.com@MY.DOMAIN to go to krbtgt/MY.DOMAIN@MY.DOMAIN expiring on Fri Dec 16 01:35:42 CET 2016
Entered SpNegoContext.acceptSecContext with state=STATE_NEW
SpNegoContext.acceptSecContext: receiving token = a0 82 13 79 30 82 13 75 a0 30 30 2e 06 09 2a 86 48 86 f7 12 01 02 02
SpNegoToken NegTokenInit: reading Mechanism Oid = 1.2.840.113554.1.2.2
SpNegoToken NegTokenInit: reading Mechanism Oid = 1.2.840.48018.1.2.2
SpNegoToken NegTokenInit: reading Mechanism Oid = 1.3.6.1.4.1.311.2.2.30
SpNegoToken NegTokenInit: reading Mechanism Oid = 1.3.6.1.4.1.311.2.2.10
SpNegoToken NegTokenInit: reading Mech Token
SpNegoContext.acceptSecContext: received token of type = SPNEGO NegTokenInit
SpNegoContext: negotiated mechanism = 1.2.840.113554.1.2.2
Entered Krb5Context.acceptSecContext with state=STATE_NEW
Looking for keys for: HTTP/my.host.com@MY.DOMAIN
Added key: 23version: 0
[Krb5LoginModule]: Entering logout
[Krb5LoginModule]: logged out Subject
[LoginContext]: logout success
收到的令牌长了很多，我把它缩短了
krb5.ini
[libdefaults]
default_realm = MY.DOMAIN
default_keytab_name = FILE:/path/to/tomcat/apache-tomcat-7.0.69/conf/sso.keytab
default_tkt_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96
default_tgs_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96
permitted_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96
[realms]
MY.DOMAIN = {
kdc = server001.my.domain
admin_server = server001.my.domain
default_domain = MY.DOMAIN
}
[domain_realm]
.my.domain = MY.DOMAIN
my.domain = MY.DOMAIN
jaas.conf
spnego-client {
com.sun.security.auth.module.Krb5LoginModule required;
};
spnego-server {
com.sun.security.auth.module.Krb5LoginModule required
storeKey=true
useKeyTab=true
keyTab="/path/to/tomcat/apache-tomcat-7.0.69/conf/sso.keytab"
principal="HTTP/my.host.com@MY.DOMAIN"
debug=true;
};
web.xml
<login-config>
<auth-method>SPNEGO</auth-method>
</login-config>
<security-constraint>
<web-resource-collection>
<web-resource-name>SSO Login</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>*</role-name>
</auth-constraint>
</security-constraint>
建筑
- AD 服务器 Windows 服务器 2016
- 带有 Oracle JVM 和 Tomcat 7.0.69
的应用程序服务器 Unix-Redhat6
- 客户端 Windows 10 与 Internet Explorer 11
感谢 T-Heron，我能够找到解决方案。 keytab 文件是用错误的加密类型生成的。对于 Windows7/10 并且在我的环境中，它必须明确设置为 AES256-SHA1
正确的 ktpass 调用：
ktpass -out D:\TEMP\sso.keytab -mapuser MYUSER -princ HTTP/my.host.com@MY.DOMAIN -ptype KRB5_NT_PRINCIPAL -kvno 0 -crypto AES256-SHA1 -pass ****
非常感谢您的支持！！！
我尝试使用基于 Kerberos 的内置 SPNEGO 身份验证器为 Tomcat 7.0.69 配置 WebSSO。当我访问该应用程序时，会弹出一个 HTTP BasicAuth 对话框，并在 catalina.out（见下文）中写入一个调试条目。
我的密钥表文件 sso.keytab 包含一个在我的 AD 服务器上注册的主体（通过 ktpass.exe 和 setspn.exe）。
我打开了 Kerberos 的调试模式，但我找不到问题所在。它只是在 输入注销 的某个点停止。您是否知道身份验证在哪一步停止，可能是什么原因？感谢您的帮助！
catalina.out
Debug is true storeKey true useTicketCache false useKeyTab true doNotPrompt false ticketCache is null isInitiator true KeyTab is /path/to/tomcat/apache-tomcat-7.0.69/conf/sso.keytab refreshKrb5Config is false principal is HTTP/my.host.com@MY.DOMAIN tryFirstPass is false useFirstPass is false storePass is false clearPass is false
Looking for keys for: HTTP/my.host.com@MY.DOMAIN
Added key: 23version: 0
Looking for keys for: HTTP/my.host.com@MY.DOMAIN
Added key: 23version: 0
default etypes for default_tkt_enctypes: 23 17.
>>> KrbAsReq creating message
>>> KrbKdcReq send: kdc=server001.my.domain UDP:88, timeout=30000, number of retries =3, #bytes=171
>>> KDCCommunication: kdc=server001.my.domain UDP:88, timeout=30000,Attempt =1, #bytes=171
>>> KrbKdcReq send: #bytes read=189
>>>Pre-Authentication Data:
PA-DATA type = 11
PA-ETYPE-INFO etype = 23, salt =
>>>Pre-Authentication Data:
PA-DATA type = 19
PA-ETYPE-INFO2 etype = 23, salt = null, s2kparams = null
>>>Pre-Authentication Data:
PA-DATA type = 2
PA-ENC-TIMESTAMP
>>>Pre-Authentication Data:
PA-DATA type = 16
>>>Pre-Authentication Data:
PA-DATA type = 15
>>> KdcAccessibility: remove server001.my.domain
>>> KDCRep: init() encoding tag is 126 req type is 11
>>>KRBError:
sTime is Thu Dec 15 15:35:42 CET 2016 1481812542000
suSec is 830454
error code is 25
error Message is Additional pre-authentication required
sname is krbtgt/MY.DOMAIN@MY.DOMAIN
eData provided.
msgType is 30
>>>Pre-Authentication Data:
PA-DATA type = 11
PA-ETYPE-INFO etype = 23, salt =
>>>Pre-Authentication Data:
PA-DATA type = 19
PA-ETYPE-INFO2 etype = 23, salt = null, s2kparams = null
>>>Pre-Authentication Data:
PA-DATA type = 2
PA-ENC-TIMESTAMP
>>>Pre-Authentication Data:
PA-DATA type = 16
>>>Pre-Authentication Data:
PA-DATA type = 15
KrbAsReqBuilder: PREAUTH FAILED/REQ, re-send AS-REQ
default etypes for default_tkt_enctypes: 23 17.
Looking for keys for: HTTP/my.host.com@MY.DOMAIN
Added key: 23version: 0
Looking for keys for: HTTP/my.host.com@MY.DOMAIN
Added key: 23version: 0
default etypes for default_tkt_enctypes: 23 17.
>>> EType: sun.security.krb5.internal.crypto.ArcFourHmacEType
>>> KrbAsReq creating message
>>> KrbKdcReq send: kdc=server001.my.domain UDP:88, timeout=30000, number of retries =3, #bytes=254
>>> KDCCommunication: kdc=server001.my.domain UDP:88, timeout=30000,Attempt =1, #bytes=254
>>> KrbKdcReq send: #bytes read=104
>>> KrbKdcReq send: kdc=server001.my.domain TCP:88, timeout=30000, number of retries =3, #bytes=254
>>> KDCCommunication: kdc=server001.my.domain TCP:88, timeout=30000,Attempt =1, #bytes=254
>>>DEBUG: TCPClient reading 1666 bytes
>>> KrbKdcReq send: #bytes read=1666
>>> KdcAccessibility: remove server001.my.domain
Looking for keys for: HTTP/my.host.com@MY.DOMAIN
Added key: 23version: 0
>>> EType: sun.security.krb5.internal.crypto.ArcFourHmacEType
>>> KrbAsRep cons in KrbAsReq.getReply HTTP/my.host.com
principal is HTTP/my.host.com@MY.DOMAIN
Will use keytab
[LoginContext]: login success
Commit Succeeded
[LoginContext]: commit success
Found KeyTab /path/to/tomcat/apache-tomcat-7.0.69/conf/sso.keytab for HTTP/my.host.com@MY.DOMAIN
Found KeyTab /path/to/tomcat/apache-tomcat-7.0.69/conf/sso.keytab for HTTP/my.host.com@MY.DOMAIN
Found ticket for HTTP/my.host.com@MY.DOMAIN to go to krbtgt/MY.DOMAIN@MY.DOMAIN expiring on Fri Dec 16 01:35:42 CET 2016
Entered SpNegoContext.acceptSecContext with state=STATE_NEW
SpNegoContext.acceptSecContext: receiving token = a0 82 13 79 30 82 13 75 a0 30 30 2e 06 09 2a 86 48 86 f7 12 01 02 02
SpNegoToken NegTokenInit: reading Mechanism Oid = 1.2.840.113554.1.2.2
SpNegoToken NegTokenInit: reading Mechanism Oid = 1.2.840.48018.1.2.2
SpNegoToken NegTokenInit: reading Mechanism Oid = 1.3.6.1.4.1.311.2.2.30
SpNegoToken NegTokenInit: reading Mechanism Oid = 1.3.6.1.4.1.311.2.2.10
SpNegoToken NegTokenInit: reading Mech Token
SpNegoContext.acceptSecContext: received token of type = SPNEGO NegTokenInit
SpNegoContext: negotiated mechanism = 1.2.840.113554.1.2.2
Entered Krb5Context.acceptSecContext with state=STATE_NEW
Looking for keys for: HTTP/my.host.com@MY.DOMAIN
Added key: 23version: 0
[Krb5LoginModule]: Entering logout
[Krb5LoginModule]: logged out Subject
[LoginContext]: logout success
收到的令牌长了很多，我把它缩短了
krb5.ini
[libdefaults]
default_realm = MY.DOMAIN
default_keytab_name = FILE:/path/to/tomcat/apache-tomcat-7.0.69/conf/sso.keytab
default_tkt_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96
default_tgs_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96
permitted_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96
[realms]
MY.DOMAIN = {
kdc = server001.my.domain
admin_server = server001.my.domain
default_domain = MY.DOMAIN
}
[domain_realm]
.my.domain = MY.DOMAIN
my.domain = MY.DOMAIN
jaas.conf
spnego-client {
com.sun.security.auth.module.Krb5LoginModule required;
};
spnego-server {
com.sun.security.auth.module.Krb5LoginModule required
storeKey=true
useKeyTab=true
keyTab="/path/to/tomcat/apache-tomcat-7.0.69/conf/sso.keytab"
principal="HTTP/my.host.com@MY.DOMAIN"
debug=true;
};
web.xml
<login-config>
<auth-method>SPNEGO</auth-method>
</login-config>
<security-constraint>
<web-resource-collection>
<web-resource-name>SSO Login</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>*</role-name>
</auth-constraint>
</security-constraint>
建筑
- AD 服务器 Windows 服务器 2016
- 带有 Oracle JVM 和 Tomcat 7.0.69 的应用程序服务器 Unix-Redhat6
- 客户端 Windows 10 与 Internet Explorer 11
感谢 T-Heron，我能够找到解决方案。 keytab 文件是用错误的加密类型生成的。对于 Windows7/10 并且在我的环境中，它必须明确设置为 AES256-SHA1
正确的 ktpass 调用：
ktpass -out D:\TEMP\sso.keytab -mapuser MYUSER -princ HTTP/my.host.com@MY.DOMAIN -ptype KRB5_NT_PRINCIPAL -kvno 0 -crypto AES256-SHA1 -pass ****
非常感谢您的支持！！！