SPNEGO/AES256 校验和失败

问题描述 投票：0回答：1

多年来，我们通过 Active Directory 成功地将 SPNEGO/Kerberos 身份验证用于我们的 Java Web 应用程序。使用了 RC4-HMAC1 加密。

现在系统管理员通知我们将使用 AES256 加密代替 RC4。同样，我按照 https://spnego.sourceforge.net/index.html 设置了一个测试框。预检进行得很顺利。但是访问 Tomcat 上的任何文件时，我都会遇到著名的“校验和失败”异常。 （系统详细信息：使用 SPNEGO 版本 R7 或 R9；Tomcat 8.5.84；Java JDK 1.8.0_361；Web 服务器 - Windows Server 2016 Standard；）

之前在 StackOverflow 上有非常相似的问题：SPNEGO / ActiveDirectory / AES256: Checksum failed ; 校验和失败：Kerberos / Spring / Active Directory (2008)。我尝试遵循这些问题和其他网络链接的建议/提示，但没有成功。

这是例外：

Message GSSException: Failure unspecified at GSS-API level (Mechanism level: Checksum failed)

Description The server encountered an unexpected condition that prevented it from fulfilling the request.

Exception
javax.servlet.ServletException: GSSException: Failure unspecified at GSS-API level (Mechanism level: Checksum failed)
    net.sourceforge.spnego.SpnegoHttpFilter.doFilter(SpnegoHttpFilter.java:287)
    org.apache.catalina.filters.HttpHeaderSecurityFilter.doFilter(HttpHeaderSecurityFilter.java:126)
    org.apache.catalina.filters.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:109)


Root Cause
GSSException: Failure unspecified at GSS-API level (Mechanism level: Checksum failed)
    sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:858)
    sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:342)
    sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:285)
    sun.security.jgss.spnego.SpNegoContext.GSS_acceptSecContext(SpNegoContext.java:908)
    sun.security.jgss.spnego.SpNegoContext.acceptSecContext(SpNegoContext.java:556)
    sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:342)
    sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:285)
    net.sourceforge.spnego.SpnegoAuthenticator.doSpnegoAuth(SpnegoAuthenticator.java:487)
    net.sourceforge.spnego.SpnegoAuthenticator.authenticate(SpnegoAuthenticator.java:327)
    net.sourceforge.spnego.SpnegoHttpFilter.doFilter(SpnegoHttpFilter.java:283)
    org.apache.catalina.filters.HttpHeaderSecurityFilter.doFilter(HttpHeaderSecurityFilter.java:126)
    org.apache.catalina.filters.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:109)


Root Cause
KrbException: Checksum failed
    sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType.decrypt(Aes256CtsHmacSha1EType.java:102)
    sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType.decrypt(Aes256CtsHmacSha1EType.java:94)
    sun.security.krb5.EncryptedData.decrypt(EncryptedData.java:175)
    sun.security.krb5.KrbApReq.authenticate(KrbApReq.java:281)
    sun.security.krb5.KrbApReq.<init>(KrbApReq.java:149)
    sun.security.jgss.krb5.InitSecContextToken.<init>(InitSecContextToken.java:140)
    sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:831)
    sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:342)
    sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:285)
    sun.security.jgss.spnego.SpNegoContext.GSS_acceptSecContext(SpNegoContext.java:908)
    sun.security.jgss.spnego.SpNegoContext.acceptSecContext(SpNegoContext.java:556)
    sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:342)
    sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:285)
    net.sourceforge.spnego.SpnegoAuthenticator.doSpnegoAuth(SpnegoAuthenticator.java:487)
    net.sourceforge.spnego.SpnegoAuthenticator.authenticate(SpnegoAuthenticator.java:327)
    net.sourceforge.spnego.SpnegoHttpFilter.doFilter(SpnegoHttpFilter.java:283)
    org.apache.catalina.filters.HttpHeaderSecurityFilter.doFilter(HttpHeaderSecurityFilter.java:126)
    org.apache.catalina.filters.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:109)


Root Cause
java.security.GeneralSecurityException: Checksum failed
    sun.security.krb5.internal.crypto.dk.AesDkCrypto.decryptCTS(AesDkCrypto.java:451)
    sun.security.krb5.internal.crypto.dk.AesDkCrypto.decrypt(AesDkCrypto.java:272)
    sun.security.krb5.internal.crypto.Aes256.decrypt(Aes256.java:76)
    sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType.decrypt(Aes256CtsHmacSha1EType.java:100)
    sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType.decrypt(Aes256CtsHmacSha1EType.java:94)
    sun.security.krb5.EncryptedData.decrypt(EncryptedData.java:175)
    sun.security.krb5.KrbApReq.authenticate(KrbApReq.java:281)
    sun.security.krb5.KrbApReq.<init>(KrbApReq.java:149)
    sun.security.jgss.krb5.InitSecContextToken.<init>(InitSecContextToken.java:140)
    sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:831)
    sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:342)
    sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:285)
    sun.security.jgss.spnego.SpNegoContext.GSS_acceptSecContext(SpNegoContext.java:908)
    sun.security.jgss.spnego.SpNegoContext.acceptSecContext(SpNegoContext.java:556)
    sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:342)
    sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:285)
    net.sourceforge.spnego.SpnegoAuthenticator.doSpnegoAuth(SpnegoAuthenticator.java:487)
    net.sourceforge.spnego.SpnegoAuthenticator.authenticate(SpnegoAuthenticator.java:327)
    net.sourceforge.spnego.SpnegoHttpFilter.doFilter(SpnegoHttpFilter.java:283)
    org.apache.catalina.filters.HttpHeaderSecurityFilter.doFilter(HttpHeaderSecurityFilter.java:126)
    org.apache.catalina.filters.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:109)

这是 krb5.conf:

[libdefaults]
    default_realm = COMPANY.REALM
    default_tkt_enctypes = aes256-cts-hmac-sha1-96 
    default_tgs_enctypes = aes256-cts-hmac-sha1-96 
    permitted_enctypes   = aes256-cts-hmac-sha1-96 
    forwardable = true
    renewable = true
    noaddresses = true
    clockskew = 300
    

[realms]
    COMPANY.REALM  = {
        kdc = COMPANY.AD.CONTROLLER.HOST
        default_domain = COMPANY.REALM
}
    

[domain_realm]
    .company.realm = COMPANY.REALM
    COMPANY.REALM = COMPANY.REALM

这是 login.conf:

spnego-client {
    com.sun.security.auth.module.Krb5LoginModule required;
};

spnego-server {
    com.sun.security.auth.module.Krb5LoginModule required
    storeKey=True   
    debug=True
    isInitiator=false;
};

这是 web.xml 的一部分：

<!--==================== SPNEGO FILTER - Kerberos SSO ===================== -->  
<filter>
    <filter-name>SpnegoHttpFilter</filter-name>
    <filter-class>net.sourceforge.spnego.SpnegoHttpFilter</filter-class>
    <init-param>
        <param-name>spnego.allow.basic</param-name>
        <param-value>true</param-value>
    </init-param>    
    <init-param>
        <param-name>spnego.allow.localhost</param-name>
        <param-value>true</param-value>
    </init-param>    
    <init-param>
        <param-name>spnego.allow.unsecure.basic</param-name>
        <param-value>true</param-value>
    </init-param>    
    <init-param>
        <param-name>spnego.login.client.module</param-name>
        <param-value>spnego-client</param-value>
    </init-param>    
    <init-param>
        <param-name>spnego.krb5.conf</param-name>
        <param-value>krb5.conf</param-value>
    </init-param>    
    <init-param>
        <param-name>spnego.login.conf</param-name>
        <param-value>login.conf</param-value>
    </init-param>   
    <init-param>
        <param-name>spnego.preauth.username</param-name>
        <param-value>fakeusername</param-value>
    </init-param>    
    <init-param>
        <param-name>spnego.preauth.password</param-name>
        <param-value>fakepassword</param-value>
    </init-param>   
    <init-param>
        <param-name>spnego.login.server.module</param-name>
        <param-value>spnego-server</param-value>
    </init-param>    
    <init-param>
        <param-name>spnego.prompt.ntlm</param-name>
        <param-value>true</param-value>
    </init-param>    
    <init-param>
        <param-name>spnego.logger.level</param-name>
        <param-value>1</param-value>
    </init-param>
    <init-param>
        <param-name>spnego.allow.delegation</param-name>
        <param-value>true</param-value>
     </init-param>
</filter>
<filter-mapping>
    <filter-name>SpnegoHttpFilter</filter-name>
    <url-pattern>*.jsp</url-pattern>
</filter-mapping>

我试过Using keytab或者重置PN账号密码。同样的错误。

有什么建议吗？

active-directory kerberos spnego
1个回答
0
投票

我面临着类似的问题，我正在使用不同的环境（开发和质量），带有 spring 框架的 kerberos 在开发环境中工作得很好，但是在测试质量环境时相同的用户，其中一些正在接收和错误（GSSException：检测到有缺陷的令牌），并且他们在测试开始时收到错误，一天后 kerberos 身份验证为他们工作，似乎是在使用不同的环境进行测试时出现 EDGe 缓存问题，我无法找到一种方法来理解什么正在发生，以及如何避免这种行为。

最新问题
© www.soinside.com 2019 - 2024. All rights reserved.