文档建议反馈控制台
首页
学习
活动
专区
圈层
工具
MCP广场
文章/答案/技术大牛
发布
社区首页 >问答首页 >Spring Security Kerberos windows身份验证出错

问Spring Security Kerberos windows身份验证出错
EN

Stack Overflow用户
提问于 2015-12-18 02:36:45
回答 2查看 6K关注 0票数 5

我正在尝试在我们的环境中设置基于Spring的安全Web应用程序。如http://docs.spring.io/spring-security-kerberos/docs/1.0.1.RELEASE/reference/htmlsingle/#setupwinkerberos中所述

为了确认所有设置都正确无误，我尝试运行Spring Boot Security示例应用程序(构建方式如下：http://docs.spring.io/spring-security-kerberos/docs/1.0.1.RELEASE/reference/htmlsingle/#samples-sec-server-win-auth )

以下是我们在测试域中的测试环境：

Active Directory (称为AD服务器)域控制器，Windows2008 R2 64位

计算机名称: adjavatest1

计算机全名: adjavatest1.test.company.info

用户:测试\管理员

客户端PC、Windows 7

计算机名称: adjavatest2

计算机全名: adjavatest2.test.company.info

用户:测试\管理员

应用程序服务器(称为Web服务器)

计算机名称: kpiq-dev

计算机全名: kpiq-dev.test.company.info

用户:测试\管理员

到目前为止，我已经执行了以下步骤来配置环境和应用程序

1)在AD服务器上设置SPN

代码语言：javascript
复制
setspn -A HTTP/adjavatest1.test.company.info TEST\administrator

(许多来源建议创建SPN "HTTP/adjavatest1“和"HOST/adjavatest1”-我已经尝试过了，没有任何区别。)

2)验证AD服务器上的SPN

代码语言：javascript
复制
>setspn -L TEST\administrator
Registered ServicePrincipalNames for CN=Administrator,CN=Users,DC=test,DC=company,DC=info:
HTTP/adjavatest1.test.company.info

3)在AD服务器上映射用户/服务并生成密钥表文件

代码语言：javascript
复制
>ktpass -princ HTTP/adjavatest1.test.company.info@TEST.COMPANY.INFO -pass pswd123 -mapuser TEST\Administrator -out .\ adjavatest1.HTTP.keytab -ptype KRB5_NT_PRINCIPAL -crypto All
Targeting domain controller:  adjavatest1.test.company.info
Using legacy password setting method
Successfully mapped HTTP/adjavatest1.test.company.info to Administrator.
Key created.
Key created.
Key created.
Key created.
Key created.
Output keytab to .\ adjavatest1.HTTP.keytab:
Keytab version: 0x502
keysize 85 HTTP/adjavatest1.test.company.info@TEST.COMPANY.INFO ptype 1 (KRB5_NT_PRINCIPAL) vno 5 etype 0x1 (DES-CBC-CRC) keylength 8 (0x6da81379831f37ad)
keysize 85 HTTP/adjavatest1.test.company.info@TEST.COMPANY.INFO ptype 1 (KRB5_NT_PRINCIPAL) vno 5 etype 0x3 (DES-CBC-MD5) keylength 8 (0x6da81379831f37ad)
keysize 93 HTTP/adjavatest1.test.company.info@TEST.COMPANY.INFO ptype 1 (KRB5_NT_PRINCIPAL) vno 5 etype 0x17 (RC4-HMAC ) keylength 16 (0xe32edb70a8df744e3b0f87ea7ff515f7)
keysize 109 HTTP/adjavatest1.test.company.info@TEST.COMPANY.INFO ptype 1 (KRB5_NT_PRINCIPAL) vno 5 etype 0x12 (AES256-SHA1) keylength 32 (0xf744e212c2e48e34c815364c0b5290a68b37b6c65a7cd0befcbcc2625e3e6c79)
keysize 93 HTTP/adjavatest1.test.company.info@TEST.COMPANY.INFO ptype 1 (KRB5_NT_PRINCIPAL) vno 5 etype 0x11 (AES128-SHA1) keylength 16 (0x20f3474a818d4d326136449a8a660e2c)

4)将密钥表文件复制到C;\SpringSSO目录下的Web服务器上

5)在Web服务器上验证keytab

代码语言：javascript
复制
 With kinit from MIT kerberos tool c:\SpringSSO>kinit -V -k -t  adjavatest1.HTTP.keytab HTTP/adjavatest1.test.company.info@TEST.COMPANY.INFO     Using existing cache: Initial default ccache     Using principal: HTTP/adjavatest1.test.company.info@TEST.COMPANY.INFO     Using keytab:  adjavatest1.HTTP.keytab     Authenticated to Kerberos v5     With kinit from jdk     c:\SpringSSO>kinit -k -t  adjavatest1.HTTP.keytab HTTP/adjavatest1.test.company.info@TEST.COMPANY.INFO         New ticket is stored in cache file C:\Users\administrator.TEST\krb5cc\_administrator

6)在Web Server的jre/lib/security中安装'Kerberos and Unlimited Policy‘，这两个位置：

代码语言：javascript
复制
c:\Program Files\Java\jre1.8.0_65\lib\security\
c:\Program Files\Java\jdk1.8.0_65\jre\lib\security\

7)检查Web服务器上的windows注册表：

代码语言：javascript
复制
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\
Value Name: allowtgtsessionkey
Value: 0x1

8)使用application.yml中的配置属性构建取自https://github.com/spring-projects/spring-security-kerberos/tree/master/spring-security-kerberos-samples的spring-security-kerberos-samples\sec-server-win-auth应用程序

代码语言：javascript
复制
server:
    port: 80
app:
    ad-domain: TEST.COMPANY.INFO
    ad-server: ldap://ADJAVATEST1.TEST.COMPANY.INFO/
    service-principal: HTTP/adjavatest1.test.company.info@TEST.COMPANY.INFO
    keytab-location:  adjavatest1.HTTP.keytab
    ldap-search-base: DC=TEST,DC=COMPANY,DC=INFO
    ldap-search-filter: "(| (userPrincipalName={0}) (sAMAccountName={0}))"

9)将Spring引导应用程序部署到C:\SpringSSO目录下的Web服务器

10)启动web服务器上的Web应用程序c:\SpringSSO>java -Dsun.security.krb5.debug=true -Djava.security.krb5.conf=.\krb5.conf -jar sec- Server -win-auth-1.0.2 Start SNAPSHOT.jar

krb5.conf中的Kerberos配置(我尝试过不同的加密类型，“arcfour hmac-md5”只是最后的实验)

代码语言：javascript
复制
[libdefaults]
 default_realm = TEST.COMPANY.INFO
 permitted_enctypes = arcfour-hmac-md5 rc4-hmac aes256-cts aes128-cts des3-cbc-sha1 des-cbc-md5 des-cbc-crc
 default_tgs_enctypes = arcfour-hmac-md5 rc4-hmac aes256-cts aes128-cts des3-cbc-sha1 des-cbc-md5 des-cbc-crc
 default_tkt_enctypes = arcfour-hmac-md5 rc4-hmac aes256-cts aes128-cts des3-cbc-sha1 des-cbc-md5 des-cbc-crc
 dns_lookup_kdc = true
 dns_lookup_realm = false

[realms]
 TEST.COMPANY.INFO = {
     kdc =  ADJAVATEST1.TEST.COMPANY.INFO
     admin_server =  ADJAVATEST1.TEST.COMPANY.INFO
     master_kdc =  ADJAVATEST1.TEST.COMPANY.INFO
     default_domain = TEST.COMPANY.INFO
 }

[domain_realm]
 .TEST.COMPANY.INFO = TEST.COMPANY.INFO
 TEST.COMPANY.INFO = TEST.COMPANY.INFO

11)在客户端的IE浏览器中，将IE浏览器的路径*.test.company.info添加为intranet pattern point browser

12)将浏览器指向http:// kpiq-dev.test.company.info/hello

13)检查Web服务器上的日志，指出服务器不能编码

代码语言：javascript
复制
2015-12-17 08:55:35.893 DEBUG 1876 --- [p-nio-80-exec-3] w.a.SpnegoAuthenticationProcessingFilter : Received Negotiate Header for request http:// kpiq-dev.test.company.info/hello: Negotiate YIIH ...trucated... H4qgvsM
2015-12-17 08:55:35.893 DEBUG 1876 --- [p-nio-80-exec-3] o.s.s.authentication.ProviderManager     : Authentication attempt using org.springframework.security.kerberos.authentication.KerberosServiceAuthenticationProvider
2015-12-17 08:55:35.893 DEBUG 1876 --- [p-nio-80-exec-3] .a.KerberosServiceAuthenticationProvider : Try to validate Kerberos Token
Found KeyTab c:\SpringSSO\ adjavatest1.HTTP.keytab for HTTP/adjavatest1.test.company.info@TEST.COMPANY.INFO
Found KeyTab c:\SpringSSO\ adjavatest1.HTTP.keytab for HTTP/adjavatest1.test.company.info@TEST.COMPANY.INFO
Entered Krb5Context.acceptSecContext with state=STATE_NEW
Java config name: .\krb5.conf
Loaded from Java config
>>> KeyTabInputStream, readName(): TEST.COMPANY.INFO
>>> KeyTabInputStream, readName(): HTTP
>>> KeyTabInputStream, readName():  adjavatest1.test.company.info
>>> KeyTab: load() entry length: 85; type: 1
>>> KeyTabInputStream, readName(): TEST.COMPANY.INFO
>>> KeyTabInputStream, readName(): HTTP
>>> KeyTabInputStream, readName():  adjavatest1.test.company.info
>>> KeyTab: load() entry length: 85; type: 3
>>> KeyTabInputStream, readName(): TEST.COMPANY.INFO
>>> KeyTabInputStream, readName(): HTTP
>>> KeyTabInputStream, readName():  adjavatest1.test.company.info
>>> KeyTab: load() entry length: 93; type: 23
>>> KeyTabInputStream, readName(): TEST.COMPANY.INFO
>>> KeyTabInputStream, readName(): HTTP
>>> KeyTabInputStream, readName():  adjavatest1.test.company.info
>>> KeyTab: load() entry length: 109; type: 18
>>> KeyTabInputStream, readName(): TEST.COMPANY.INFO
>>> KeyTabInputStream, readName(): HTTP
>>> KeyTabInputStream, readName():  adjavatest1.test.company.info
>>> KeyTab: load() entry length: 93; type: 17
Looking for keys for: HTTP/adjavatest1.test.company.info@TEST.COMPANY.INFO
Added key: 17version: 5
Added key: 18version: 5
Added key: 23version: 5
Found unsupported keytype (3) for HTTP/adjavatest1.test.company.info@TEST.COMPANY.INFO
Found unsupported keytype (1) for HTTP/adjavatest1.test.company.info@TEST.COMPANY.INFO
>>> EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType
2015-12-17 08:55:36.236  WARN 1876 --- [p-nio-80-exec-3] w.a.SpnegoAuthenticationProcessingFilter : Negotiate Header was invalid: Negotiate YIIHNAYGKwYBBQU ...trucated... dH4qgvsM

org.springframework.security.authentication.BadCredentialsException: Kerberos validation not successful
            at org.springframework.security.kerberos.authentication.sun.SunJaasKerberosTicketValidator.validateTicket(SunJaasKerberosTicketValidator.java:71)
            at org.springframework.security.kerberos.authentication.KerberosServiceAuthenticationProvider.authenticate(KerberosServiceAuthenticationProvider.java:64)
            at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:156)
            at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:177)
            at org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter$AuthenticationManagerDelegator.authenticate(WebSecurityConfigurerAdapter.java:446)
            at org.springframework.security.kerberos.web.authentication.SpnegoAuthenticationProcessingFilter.doFilter(SpnegoAuthenticationProcessingFilter.java:145)
            at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
...trucated...
            at java.lang.Thread.run(Unknown Source)
Caused by: java.security.PrivilegedActionException: null
            at java.security.AccessController.doPrivileged(Native Method)
            at javax.security.auth.Subject.doAs(Unknown Source)
            at org.springframework.security.kerberos.authentication.sun.SunJaasKerberosTicketValidator.validateTicket(SunJaasKerberosTicketValidator.java:68)
            ... 45 common frames omitted
Caused by: org.ietf.jgss.GSSException: Failure unspecified at GSS-API level (Mechanism level: Checksum failed)
            at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Unknown Source)
            at sun.security.jgss.GSSContextImpl.acceptSecContext(Unknown Source)
            at sun.security.jgss.GSSContextImpl.acceptSecContext(Unknown Source)
            at sun.security.jgss.spnego.SpNegoContext.GSS_acceptSecContext(Unknown Source)
            at sun.security.jgss.spnego.SpNegoContext.acceptSecContext(Unknown Source)
            at sun.security.jgss.GSSContextImpl.acceptSecContext(Unknown Source)
            at sun.security.jgss.GSSContextImpl.acceptSecContext(Unknown Source)
            at org.springframework.security.kerberos.authentication.sun.SunJaasKerberosTicketValidator$KerberosValidateAction.run(SunJaasKerberosTicketValidator.java:170)
            at org.springframework.security.kerberos.authentication.sun.SunJaasKerberosTicketValidator$KerberosValidateAction.run(SunJaasKerberosTicketValidator.java:153)
            ... 48 common frames omitted
Caused by: sun.security.krb5.KrbCryptoException: Checksum failed
            at sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType.decrypt(Unknown Source)
            at sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType.decrypt(Unknown Source)
            at sun.security.krb5.EncryptedData.decrypt(Unknown Source)
            at sun.security.krb5.KrbApReq.authenticate(Unknown Source)
            at sun.security.krb5.KrbApReq.<init>(Unknown Source)
            at sun.security.jgss.krb5.InitSecContextToken.<init>(Unknown Source)
            ... 57 common frames omitted
Caused by: java.security.GeneralSecurityException: Checksum failed
            at sun.security.krb5.internal.crypto.dk.AesDkCrypto.decryptCTS(Unknown Source)
            at sun.security.krb5.internal.crypto.dk.AesDkCrypto.decrypt(Unknown Source)
            at sun.security.krb5.internal.crypto.Aes256.decrypt(Unknown Source)
            ... 63 common frames omitted

为什么安全尝试加密Aes256CtsHmacSha1EType，而不是rc4-hmac？

有什么建议我下一步可以尝试吗？

提前谢谢你。

spring-security-kerberos
security
spring-security
active-directory
spnego
EN

回答 2

Stack Overflow用户

发布于 2018-08-09 15:15:21

两个可能的错误：

1) krb5.conf加载不正确

2)服务主体配置不正确

第一个的解决方案:

  • in point 8)在spring安全项目中的application.yaml
  • create中添加app：kerberos-conf: //xyz/krb5.conf

@Configuration公共类KerberosGlobalConfig { @Value("${app.kerberos-conf}")私有字符串kerberosGlobalConfPath；@Bean公共globalSunJaasKerberosConfig globalSunJaasKerberosConfig() { GlobalSunJaasKerberosConfig GlobalSunJaasKerberosConfig = GlobalSunJaasKerberosConfig()；//TODO remove hardcoding globalSunJaasKerberosConfig.setDebug(true)；Bean return globalSunJaasKerberosConfig；} }

票数 0
EN

Stack Overflow用户

发布于 2018-11-13 21:54:02

失败的原因是因为在票证验证器中，您正在尝试验证NTLM令牌，而不是kerberos票证。这一行在您的日志中显示以下内容：

>>> EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType 2015-12-17 08:55:36.236 WARN 1876 --- [p-nio-80-exec-3] w.a.SpnegoAuthenticationProcessingFilter : Negotiate Header was invalid: Negotiate YIIHNAYGKwYBBQU ...trucated... dH4qgvsM

以YII开头的标头是NTLM，这意味着您的初始验证无法获得Kerberos票证，因此浏览器将按优先级顺序尝试下一个协议，在本例中为NTLM。

看起来你的SPN是正确的，我建议检查一些关于帐户和密钥表文件的东西。确保您要映射到SPN并用于生成密钥表的用户帐户在active directory用户管理中选择了正确的选项，即允许使用Kerberos进行126位和256位加密，并允许将该帐户用于kerberos委派。

此外，阅读此链接很重要：https://www.chromium.org/developers/design-documents/http-authentication

此链接概述了Chrome如何从请求URL构造SPN以执行SPNEGO/SSO。基本上，您可能需要在DNS中设置一个转发区域来帮助解决您遇到的问题。Chrome浏览器从IE获取设置，因此在IE中设置intranet设置应该可以处理此问题，但对于SPN解析，它将尝试将URL中的值解析为CNAME，然后解析为DNS中的A条目。这可能会导致您看到的行为。通常，当您看到发送的是NTLM令牌而不是Kerberos票证时，可以追踪到浏览器试图使用错误的SPN来查询和获取Kerberos票证。如果您可以使从浏览器构造的SPN与映射到您正在使用的服务帐户的SPN保持同步，那么您就可以开始工作了。

票数 0
EN
页面原文内容由Stack Overflow提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：

https://stackoverflow.com/questions/34341870

复制
相关文章

相似问题

领券

腾讯云开发者

扫码关注腾讯云开发者

扫码关注腾讯云开发者

领取腾讯云代金券

热门产品

热门推荐

更多推荐

Copyright © 2013 - 2026 Tencent Cloud. All Rights Reserved. 腾讯云 版权所有 

深圳市腾讯计算机系统有限公司 ICP备案/许可证号：粤B2-20090059 粤公网安备44030502008569号

腾讯云计算（北京）有限责任公司 京ICP证150476号 |  京ICP备11018762号

问题归档专栏文章快讯文章归档关键词归档开发者手册归档开发者手册 Section 归档