Found NTLM token when expecting SPNEGO
The browser is not set up correctly to send a spnego token, go back to the client configuration, and double check the browser configuration. IE needs to be configured with Integrated Windows Authentication should be turned on and the site listed in the Intranet domain. IE also needs to be configured with automatic logon. After making these changes, make sure to restart IE.
Refer to this link for IE Settings:-
http://msdn.microsoft.com/en-us/library/ms995329.aspx
Something is wrong in your SPN definition. Either no SPN was defined for this service, or you have duplicate SPNs, which means that the SPN resolved in more than one principal associated with it. You can verify this by typing:
LDIFDE -d DC=yourdomain ,DC=com -f c:export.txt
This will export the list of AD objects to the file export.txt. Then look for your service (HTTP/) in the values of the attribute
ServicePrincipalName. If it shows more than once or not at all, you to overcome this exception remove the user account in AD and create again. Start all over the procedure from all over again.
Failure unspecified at GSS-API level (Mechanism level: Invalid argument (400) – Cannot find key of appropriate type to decrypt AP REP – RC4 with HMAC)
Active Directory account is configured to use the default
encryption type on Windows (RC4-HMAC). You can switch to use DES, by selecting “use DES encryption” in the AD account settings. After you switching to DES, reset the password.
In order to use RC4-HMAC, you’ll need to update the Kerberos configuration file to specify the encryption type.
default_tkt_enctypes = rc4-hmac
default_tgs_enctypes = rc4-hmac
Ref: – http://java.sun.com/javase/6/docs/technotes/guides/security/jgss/jgss-features.html
Pre-authentication information was invalid (24)
This means that the service account password in the Active Directory and the password in the keytab file does not match. Make sure you have the correct password specified while generating the keytab file. Also, this error could be due to invalid principal name in the krb5login.conf file. When generating the keytab file using the ktpass utility, the principal name will be changed to HTTP/. Make sure you specify the principal name in the keytab file as HTTP/.
Double check the validity of your keytab, or of the password that you have entered. If you are confident about your password, many times, refreshing the password for the user in the AD server may solve the problem. (by right clicking on the user, selecting “Reset Password” and re-entering the same password specified earlier).
Another reason for that problem to happen is if there exist another
principal with the same short name in the AD server (different DNs but same CN).This is likely to happen if the host that runs WebLogic server already belongs to the network domain, then it will have an account in the Computers section,and a password there too. In that case, you will run into SPN issues as well.
The best way out of this is to create a new user account, with a different CN, and map the HTTP SPN to the new account, (and remove the SPN from any other account).
If the WebLogic server host is also on the same domain (or registerd with the same KDC/AD) where you are creating the SPN then there must a machine name already exists which has the mapping for the same URL which you want to map with SPN. In such cases best way is to create a DNS alias for WebLogic host and map the DNS alias with the machine name.
Ref: – http://forums.oracle.com/forums/thread.jspa?threadID=876942&tstart=0
Known issue with Windows Server 2003 SP1. Contact Microsoft for a fix.
-http://support.microsoft.com/kb/919557/en-us
http://hotfixv4.microsoft.com/Windows%20Server%
202003/sp2/Fix183877/3790/free/277896_ENU_i386_zip.exe
Failure unspecified at GSS-API level (Mechanism level: Checksum failed)
If the keytab files being generated by the ( Ktabktpass) JDK shipped with either WLS 9.x or WLS 10.0, the SSO is getting failed. If the keytab files being generated with JDK < 1.5.0_8, SSO getting failed with unsupported algorithm exception for WLS 10 server.Use JDK >= 1.5.0_8 to generate keytab files, then issue solves and the SSO works.
Even applying the following HOT FIX Might Help
http://support.microsoft.com/default.aspx?scid=kb;en-us;833708
Client not found in Kerberos database while getting initial credentials
This means that the principal does not exist in AD. Check and make sure that the <serviceaccount@domain> matches exactly the user logon name in AD.
KDC has no support for encryption type (14)’ error.
Cause 1: Your KDC does not support the encryption type requested.
Solution 1: Sun’s implementation of Kerberos supports the following encryption types: des-cbc-md5, des-cbc-crc and des3-cbc-sha1.
Applications can select the desired encryption type by specifying following tags in the Kerberos Configuration file krb5.conf:
[libdefaults]
default_tkt_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1
default_tgs_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1
permitted_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1
If not specified, the default value is:
des-cbc-md5 des-cbc-crc des3-cbc-sha1
Cause 2: This exception is thrown when using native ticket cache on some Windows platforms. Microsoft has added a new feature in which they no longer export the session keys for Ticket-Granting Tickets (TGTs). As a result, the native TGT obtained on Windows has an “empty” session key and null EType. The effected platforms include: Windows Server 2003, Windows 2000 Server Service Pack 4 (SP4) and Windows XP SP2.
Solution 2: You need to update the Windows registry to disable this new feature. The registry key allowtgtsessionkey should be added–and set correctly–to allow session keys to be sent in the Kerberos Ticket-Granting Ticket.
On the Windows Server 2003 and Windows 2000 SP4, here is the required registry setting:
HKEY_LOCAL_MACHINESystemCurrentControlSetControlLsaKerberosParameters
Value Name: allowtgtsessionkey
Value Type: REG_DWORD
Value: 0x01 ( default is 0 )
By default, the value is 0; setting it to “0x01” allows a session key to be included in the TGT.
Here is the location of the registry setting on Windows XP SP2:
HKEY_LOCAL_MACHINESystemCurrentControlSetControlLsaKerberos
Value Name: allowtgtsessionkey
Value Type: REG_DWORD
Value: 0x01
Ref:-
http://java.sun.com/j2se/1.5.0/docs/guide/security/jgss/tutorials/Troubleshooting.html
GSSException: No valid credentials provided (Mechanism level: Attempt to obtain new ACCEPT credentials failed!
There are multiple reasons for this exception:
The principal exists in kerberos but the password is wrong. This is a
password problem. Double check the validity of your keytab, or of the password that you have entered. If you are confident about your password, many times, refreshing the password for the user in the AD server may solve the problem. (by right clicking on the user, selecting “Reset Password” and re-entering the same password specified earlier).
If there exist another principal with the same short name in the AD server (different DNs but same CN). This is likely to happen if the host that runs WebLogic server already belongs to the network domain, then it will have an account in the Computers section, and a password there too. In that case, you will run into SPN issues as well. The best way out of this is to create a new user account, with a different CN, and map the HTTP SPN to the new account, and remove the SPN from any other account).
If the WebLogic server host is also on the same domain (or registerd with the same KDC/AD) where you are creating the SPN then there must a machine name already exists which has the mapping for the same URL which you want to map with SPN. In such cases best way is to create a DNS alias for WebLogic host and map the DNS alias with the machine name.
Clock skew – If the time on the KDC and on the client differ significanlty (typically 5 minutes), this error can be returned. Synchronize the clocks (or have a system administrator do so).
The Kerberos realm name is not all uppercase. Make the Kerberos realm name all uppercase. Note: It is recommended to have all uppercase realm names. For details, refer to the Naming Conventions for the Realm Names and Hostnames section of this tutorial.
Ref: –
http://java.sun.com/j2se/1.5.0/docs/guide/security/jgss/tutorials/Troubleshooting.html
There is a known issue reported from SUN JDK 1.4.2_14, which also affects Jrockit JVM also.
http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6605907
This issue is fixed in JDK 1.4.2_18. http://java.sun.com/j2se/1.4.2/ReleaseNotes.html#142_18
(Check for the bug number: 6570062).
Also, the same issue is fixed in JRockit R27.6.2 also.
GSSException: Failure unspecified at GSS-API level (Mechanism level: Integrity check on decrypted field failed (31)
In case of multiple domain controllers where there is one root domain beatest.com and two children domains viz. child-a.beatest.com and
child-b.beatest.com, SSO works for request from user logged in child-a but fails when sent from a user logged in child-b with the following exception:
GSSException: Failure unspecified at GSS-API level (Mechanism level:
Integrity check on decrypted field failed (31))
This error occurs when you haven’t sufficiently purged your tickets. Meaning you changed the SPN but the client tried to use an old ticket so the server couldn’t decrypt it with the service principal key. Make sure you purge your tickets with kerbtray.exe after you set the password on the service account.
Ref:-
http://forums.sun.com/thread.jspa?threadID=5358178&tstart=0
Fais,This info is very useful dude.We are providing the same to our customers as resolutionRegards,Hari
thanks Hari 🙂
HiFaisal,
Iam configuring kerberoes with weblogic10.3.2 on windows 2008.kinit command throughing below error.
JDK:Jrockit Jdk 1.6.0_17
Exception: krb_error 24 Pre-authentication information was invalid (24) Pre-auth
entication information was invalid
KrbException: Pre-authentication information was invalid (24)
at sun.security.krb5.KrbAsRep.(KrbAsRep.java:66)
at sun.security.krb5.KrbAsReq.getReply(KrbAsReq.java:449)
at sun.security.krb5.internal.tools.Kinit.sendASRequest(Kinit.java:306)
at sun.security.krb5.internal.tools.Kinit.(Kinit.java:257)
at sun.security.krb5.internal.tools.Kinit.main(Kinit.java:107)
Caused by: KrbException: Identifier doesn’t match expected value (906)
at sun.security.krb5.internal.KDCRep.init(KDCRep.java:133)
at sun.security.krb5.internal.ASRep.init(ASRep.java:58)
at sun.security.krb5.internal.ASRep.(ASRep.java:53)
at sun.security.krb5.KrbAsRep.(KrbAsRep.java:50)
… 4 more
We created so many users and keytabs also:(.
Refreshing the passwords also done.
Looking for wardfor yur help.
Hi Vidya, the various reasons for the error is mentioned in the post. If u still need further help u can mail me and we can set up a webmeeting.. u can mail me at [email protected]
Hi Faiz,
Kerberos giving :
<Exception com.bea.common.security.internal.utils.negotiate.NegotiateTokenException: GSSException: No valid credentials provided (Mechanism level: Attempt to obtain new ACCEPT credentials failed!)
com.bea.common.security.internal.utils.negotiate.NegotiateTokenException: GSSException: No valid credentials provided (Mechanism level: Attempt to obtain new ACCEPT credentials failed!)
at com.bea.common.security.internal.utils.negotiate.SPNEGONegotiateToken.getUsername(SPNEGONegotiateToken.java:180)
at weblogic.security.providers.authentication.NegotiateIdentityAsserterProviderImpl.assertChallengeIdentity(NegotiateIdentityAsserterProviderImpl.java:213)
at com.bea.common.security.internal.legacy.service.ChallengeIdentityAssertionProviderImpl$ChallengeIdentityAsserterV2Adapter.assertChallengeIdentity(ChallengeIdentityAssertionProviderImpl.java:130)
at com.bea.common.security.internal.service.ChallengeIdentityAssertionTokenServiceImpl.assertChallengeIdentity(ChallengeIdentityAssertionTokenServiceImpl.java:120)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at com.bea.common.security.internal.utils.Delegator$ProxyInvocationHandler.invoke(Delegator.java:57)
at $Proxy12.assertChallengeIdentity(Unknown Source)
at com.bea.common.security.internal.service.ChallengeIdentityAssertionServiceImpl.assertChallengeIdentity(ChallengeIdentityAssertionServiceImpl.java:112)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at com.bea.common.security.internal.utils.Delegator$ProxyInvocationHandler.invoke(Delegator.java:57)
at $Proxy18.assertChallengeIdentity(Unknown Source)
at com.bea.common.security.internal.service.NegotiateIdentityAsserterServiceImpl$NegotiateHandler.assertChallengeContext(NegotiateIdentityAsserterServiceImpl.java:327)
at com.bea.common.security.internal.service.NegotiateIdentityAsserterServiceImpl$NegotiateHandler.process(NegotiateIdentityAsserterServiceImpl.java:212)
at com.bea.common.security.internal.service.NegotiateIdentityAsserterServiceImpl.process(NegotiateIdentityAsserterServiceImpl.java:130)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at com.bea.common.security.internal.utils.Delegator$ProxyInvocationHandler.invoke(Delegator.java:57)
at $Proxy19.process(Unknown Source)
at weblogic.security.providers.authentication.NegotiateIdentityAsserterServletAuthenticationFilter.doFilter(NegotiateIdentityAsserterServletAuthenticationFilter.java:33)
at weblogic.servlet.security.internal.AuthFilterChain.doFilter(AuthFilterChain.java:37)
at weblogic.servlet.security.internal.SecurityModule$ServletAuthenticationFilterAction.run(SecurityModule.java:631)
at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:121)
at weblogic.servlet.security.internal.SecurityModule.invokeAuthFilterChain(SecurityModule.java:520)
at weblogic.servlet.security.internal.FormSecurityModule.checkUserPerm(FormSecurityModule.java:220)
at weblogic.servlet.security.internal.FormSecurityModule.checkAccess(FormSecurityModule.java:92)
at weblogic.servlet.security.internal.ChainedSecurityModule.checkAccess(ChainedSecurityModule.java:79)
at weblogic.servlet.security.internal.ServletSecurityManager.checkAccess(ServletSecurityManager.java:82)
at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2204)
at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2174)
at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1446)
at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
Now I have already worked on your suggestions.
Looking for a word from you.
Regards,
T
Now I think I have gained some progress.
Now the HTTP Headers are showing:
GET /adamapp/ HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: its37:7015
Connection: Keep-Alive
Cookie: JSESSIONID=6pvKMnFp0pR6qLgQ2pkr1JfBwCCTyzLg9hmdpbPS1JXBmrGJvhpv!1053817966
HTTP/1.1 401 Unauthorized
Cache-Control: no-cache=”Set-Cookie”
Connection: close
Date: Thu, 25 Nov 2010 11:20:51 GMT
Content-Length: 1518
Content-Type: text/html
WWW-Authenticate: Negotiate
Set-Cookie: JSESSIONID=GjpNMnGTK1TL27DQTHLDPc5NkqXp92pvbP1WRQgkhcPCLDqpDH7H!659302533; path=/
X-Powered-By: Servlet/2.5 JSP/2.1
GET /adamapp/ HTTP/1.1
Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Accept-Encoding: gzip, deflate
Host: its37:7015
Connection: Keep-Alive
Authorization: Negotiate YIIEywYGKwYBBQUCoIIEvzCCBLugJDAiBgkqhkiC9xIBAgIGCSqGSIb3EgECAgYKKwYBBAGCNwICCqKCBJEEggSNYIIEiQYJKoZIhvcSAQICAQBuggR4MIIEdKADAgEFoQMCAQ6iBwMFACAAAACjggOkYYIDoDCCA5ygAwIBBaERGw9JVFNIQVNUUkEuTE9DQUyiKDAmoAMCAQKhHzAdGwRIVFRQGxVpdHMzNy5pdHNoYXN0cmEubG9jYWyjggNWMIIDUqADAgEDoQMCAQKiggNEBIIDQNNEgcx1rdwkt1Pu0UjWaFxtC6/igqno6LRu8Y4uLOtjoAAPYbCvthp7YTO02dpChLFaSzRKIjvdqQKOtEGr36O8HXBdf5DNAlloSAmAyGcZmc5C3dtv2KjedzvEW9HU0cHwjmtIN494kPaQ0AJhBRJFm/hgR1EgVTEnctw7x2bKmIhtcc4oJMp4eML8uH0Y2k57SqY86Rb4bUOGotlYWPQqYUkK8EjMBQYck0JmP2Z9fAAu8DM12kxg4HkbT+eNUN1H+aQdR1RCe/FeGOj3HVt6sr9VqWeMzpZ0bt7ENsP/TbFgq6Uv4T2lBg83CsWdAL+kifTOIqbLnuMry3N+0I0HGiZvEYKcbMYYZQRwAFJKmsKkqa7lUqH6/APjKlfDMV00zNF2xo0xnBEFSlRJIfHOIFUfh6fFJfJ7ya7fLU+t6OfEvr59Lh/KIY4KFI2+S/mESixopGbEfS825pVZ9PwltEfyxYfaFRgXXjDFA8FUXOtyTDe4WlUC4pRc9mjjJDI7fqNWg75Pwa9z7u4lFPMP+jaF13jhXANpt0QqdIE475VvMACFHTdNn87+N19jQpRFAC1Wh2w65avQxEi9Ab/MsRQVdER2su5VGJCPo+cULzRPgr8BMMYSSzZ6Te01xzo9RUrvPAgWPVH9cPSVJaJacvAr4Tu6adcUWR7hyyJ0D3sQBXtXz87fqXstDey1J HcI0mwaZb8aInAN9eFhQH1Oy++bjRetQ6bAFpAc7qC31INMPXNe5R0EB33F3KGHpGFuYV9e1asyCYKfmwcj9ayfnZQo7RRduPJ6s4cUkGQ3mC2UfKyiKy2+wrmBnqUFuUWjn+Xct4O7WZ7GnEuEKj3vEGv3gZx165eUcePH53W2RJclSHvFJgnp6H3NPSLST03dMEy0G2caehleWaRrR8No+MgxYr91/WPiGK4dQlGXyus7JgSWppBFPyxCFYSCUFUvPrjoNoirfjdcJUrnrmWPpxEiUI9+koq+cFHAue/f1h3i3sxNjXZIj4dT0595UqwzXGSFS0KkwS16Me7jt+cQUDPkUucJdO1Z2CdvptyCu3YxZIu7yJbqkQx9IMti3O66IbsKtRzVUFZfb8yLaz+kgbYwgbOgAwIBA6KBqwSBqPpn0RCfkjLvfw4fLHJuIhCmmoI+DUbuC5fNbcxQpxbvVvDS9+hZPvfB+S3++Hk7VapcBmPj8BBEjczMhkkgaRV6LWJEIb9FJmwvuyV9erQYmv//QbL8O5m3ZHUzSVAhcpYfLCGi94HTCFw3lKjDORV97GxqyDHZpuR+G/gBpF1n59nvgj4jOSUNAPcea4rGJmHFgEDq91HKi3tTZbtub3SLeCkBHvhXrw==
Cookie: JSESSIONID=GjpNMnGTK1TL27DQTHLDPc5NkqXp92pvbP1WRQgkhcPCLDqpDH7H!659302533
HTTP/1.1 401 Unauthorized
Connection: close
Date: Thu, 25 Nov 2010 11:20:51 GMT
Content-Length: 1518
Content-Type: text/html
X-Powered-By: Servlet/2.5 JSP/2.1
But at the server console I am getting below error:
It will be very helpfull if you provide any input for above problem.
@ vidya sagar:
If you’re having trouble configuring WLS with Windows 2008 as KDC, note that Windows 2008, by default uses
AES256-CTS-HMAC-SHA1-96
AES128-CTS-HMAC-SHA1-96
RC4-HMAC
Enctypes. DES is disabled by default in Windows 2008 and WLS seems to only support DES and RC4-HMAC in some cases.