spring-security, spnego/kerberos/sso
Hi,
I have win 7 box and debian box.
On debian I have tomcat with web app having spnego (spring-security). I also have kerberos. I have created msm@PRIMESYSTEMS.COM as principal and also HTTP/pinkydebian.primesystems.com. I have copied the HTTP ticket into the web app.
Now on win 7 I login as Miten_Mehta and the network kerberos client is configured to get ticket as msm@PRIMESYSTEMS.COM. I use client to get kerb ticket.
When I open webapp url below from Internet Explorer
http://pinkydebian:8080/jsf-sso/secu...r_teller.xhtml (this is permissioned for ROLE_TELLER and ROLE_SUPERVISOR as per security.xml below)
I am prompted for basic auth. what user / password should I enter here so the it will do kerberos auth for sso ?
I have tried msm, Miten_Mehta, msm@PRIMESYSTEMS.COM but all causes errors where in web app is unable to get authentication done with kdc. I feel from log that it tried to reach to KDC but kdc logs do not show any such request. I guess in web app itself there is issue with credentials encoding.
Here is the catalina.out error.
Oct 04, 2012 5:53:27 PM org.springframework.security.extensions.kerberos.w eb.SpnegoAuthenticationProcessingFilter doFilter
WARNING: Negotiate Header was invalid: Negotiate TlRMTVNTUAABAAAAl4II4gAAAAAAAAAAAAAAAAAAAAAGAbEdAA AADw==
org.springframework.security.authentication.BadCre dentialsException: Kerberos validation not succesfull
at org.springframework.security.extensions.kerberos.S unJaasKerberosTicketValidator.validateTicket(SunJa asKerberosTicketValidator.java:69)
at org.springframework.security.extensions.kerberos.K erberosServiceAuthenticationProvider.authenticate( KerberosServiceAuthenticationProvider.java:86)
at org.springframework.security.authentication.Provid erManager.doAuthentication(ProviderManager.java:13 0)
at org.springframework.security.authentication.Abstra ctAuthenticationManager.authenticate(AbstractAuthe nticationManager.java:48)
at org.springframework.security.extensions.kerberos.w eb.SpnegoAuthenticationProcessingFilter.doFilter(S pnegoAuthenticationProcessingFilter.java:131)
at org.springframework.security.web.FilterChainProxy$ VirtualFilterChain.doFilter(FilterChainProxy.java: 381)
at org.springframework.security.web.context.SecurityC ontextPersistenceFilter.doFilter(SecurityContextPe rsistenceFilter.java:79)
at org.springframework.security.web.FilterChainProxy$ VirtualFilterChain.doFilter(FilterChainProxy.java: 381)
at org.springframework.security.web.FilterChainProxy. doFilter(FilterChainProxy.java:168)
at org.springframework.web.filter.DelegatingFilterPro xy.invokeDelegate(DelegatingFilterProxy.java:237)
at org.springframework.web.filter.DelegatingFilterPro xy.doFilter(DelegatingFilterProxy.java:167)
at org.apache.catalina.core.ApplicationFilterChain.in ternalDoFilter(ApplicationFilterChain.java:243)
at org.apache.catalina.core.ApplicationFilterChain.do Filter(ApplicationFilterChain.java:210)
at org.apache.catalina.core.StandardWrapperValve.invo ke(StandardWrapperValve.java:222)
at org.apache.catalina.core.StandardContextValve.invo ke(StandardContextValve.java:123)
at org.apache.catalina.authenticator.AuthenticatorBas e.invoke(AuthenticatorBase.java:472)
at org.apache.catalina.core.StandardHostValve.invoke( StandardHostValve.java:168)
at org.apache.catalina.valves.ErrorReportValve.invoke (ErrorReportValve.java:99)
at org.apache.catalina.valves.AccessLogValve.invoke(A ccessLogValve.java:929)
at org.apache.catalina.core.StandardEngineValve.invok e(StandardEngineValve.java:118)
at org.apache.catalina.connector.CoyoteAdapter.servic e(CoyoteAdapter.java:407)
at org.apache.coyote.http11.AbstractHttp11Processor.p rocess(AbstractHttp11Processor.java:1002)
at org.apache.coyote.AbstractProtocol$AbstractConnect ionHandler.process(AbstractProtocol.java:585)
at org.apache.tomcat.util.net.JIoEndpoint$SocketProce ssor.run(JIoEndpoint.java:312)
at java.util.concurrent.ThreadPoolExecutor.runWorker( ThreadPoolExecutor.java:1110)
at java.util.concurrent.ThreadPoolExecutor$Worker.run (ThreadPoolExecutor.java:603)
at java.lang.Thread.run(Thread.java:722)
Caused by: java.security.PrivilegedActionException: GSSException: Defective token detected (Mechanism level: GSSHeader did not find the right tag)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAs(Subject.java:415)
at org.springframework.security.extensions.kerberos.S unJaasKerberosTicketValidator.validateTicket(SunJa asKerberosTicketValidator.java:67)
... 26 more
Caused by: GSSException: Defective token detected (Mechanism level: GSSHeader did not find the right tag)
at sun.security.jgss.GSSHeader.<init>(GSSHeader.java: 97)
at sun.security.jgss.GSSContextImpl.acceptSecContext( GSSContextImpl.java:306)
at sun.security.jgss.GSSContextImpl.acceptSecContext( GSSContextImpl.java:285)
at org.springframework.security.extensions.kerberos.S unJaasKerberosTicketValidator$KerberosValidateActi on.run(SunJaasKerberosTicketValidator.java:146)
at org.springframework.security.extensions.kerberos.S unJaasKerberosTicketValidator$KerberosValidateActi on.run(SunJaasKerberosTicketValidator.java:136)
... 29 more
I expect that when I open web app it should pickup ticket from win 7 and not prompt for user/pass.
If that is not right then based on auth form user it should send across ticket but not ask for pass.
Here is my security.xml configuration:
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:sec="http://www.springframework.org/schema/security" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schem...-beans-3.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.0.3.xsd">
<sec:http entry-point-ref="spnegoEntryPoint">
<sec:intercept-url pattern="/secure/extreme/**" access="ROLE_SUPERVISOR" />
<sec:intercept-url pattern="/supervisor_teller.xhtml" access="ROLE_TELLER,ROLE_SUPERVISOR"/>
<sec:intercept-url pattern="/authenticated.xhtml" access="IS_AUTHENTICATED_FULLY"/>
<sec:intercept-url pattern="/deny.xhtml" filters="none" />
<!-- <sec:intercept-url pattern="/index.xhtml" access="permitAll" /-->
<sec:custom-filter ref="spnegoAuthenticationProcessingFilter"
position="BASIC_AUTH_FILTER" />
<sec:intercept-url pattern="/secure/**" access="ROLE_TELLER" />
</sec:http>
<bean id="spnegoEntryPoint"
class="org.springframework.security.extensions.ker beros.web.SpnegoEntryPoint" />
<bean id="spnegoAuthenticationProcessingFilter"
class="org.springframework.security.extensions.ker beros.web.SpnegoAuthenticationProcessingFilter">
<property name="authenticationManager" ref="authenticationManager" />
</bean>
<sec:authentication-manager alias="authenticationManager">
<sec:authentication-provider ref="kerberosServiceAuthenticationProvider" />
</sec:authentication-manager>
<bean id="kerberosServiceAuthenticationProvider"
class="org.springframework.security.extensions.ker beros.KerberosServiceAuthenticationProvider">
<property name="ticketValidator">
<bean
class="org.springframework.security.extensions.ker beros.SunJaasKerberosTicketValidator">
<property name="servicePrincipal" value="HTTP/pinkydebian.primesystems.com" />
<property name="keyTabLocation" value="classpath:http-web.keytab" />
</bean>
</property>
<property name="userDetailsService" ref="dummyUserDetailsService" />
</bean>
<bean
class="org.springframework.security.extensions.ker beros.GlobalSunJaasKerberosConfig">
<property name="debug" value="true" />
</bean>
<bean id="dummyUserDetailsService" class="com.primesystems.sso.DummyUserDetailsServic e" />
</beans>
I am not sure how to verify that the http ticket generated is good / bad. Here is my attempt to verify:
command I used to create http ticket:
addprinc -policy service -randkey HTTP/pinkydebian.primesystems.com
ktadd -k /http-web.keytab HTTP/pinkydebian.primesystems.com
verifiy:
root@pinkydebian:/# kinit -k -t /http-web.keytab
kinit: Key table entry not found while getting initial credentials
Here is kerberos log output:
Oct 06 20:00:05 pinkydebian krb5kdc[920](info): AS_REQ (4 etypes {18 17 16 23}) 192.168.1.2: NEEDED_PREAUTH: host/pinkydebian.primesystems.com@PRIMESYSTEMS.COM for krbtgt/PRIMESYSTEMS.COM@PRIMESYSTEMS.COM, Additional pre-authentication required
using ktutil:
root@pinkydebian:/# ktutil
ktutil: rkt /http-web.keytab
ktutil: l
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
1 2 HTTP/pinkydebian.primesystems.com@PRIMESYSTEMS.COM
2 2 HTTP/pinkydebian.primesystems.com@PRIMESYSTEMS.COM
3 2 HTTP/pinkydebian.primesystems.com@PRIMESYSTEMS.COM
4 2 HTTP/pinkydebian.primesystems.com@PRIMESYSTEMS.COM
Let me know if above test has any point that proves I need to generate ticket again or differently.
Regards,
Miten.
Reply With Quote
Originally Posted by marre90
