Spring Security Kerberos+AD，校验和失败

Question

我正在尝试使用Active Directory凭据执行Spring SecurityKerberos，如http://docs.Spring.io/spring-security-kerberos/docs/1.0.1.release/reference/htmlsingle/#samples-sec-server-win-auth中所述。我想说，我已经把大部分东西都放下了(SPN、键控等）。现在我有一个校验和失败。假设我更改了主体名，我会得到一个AES加密错误。

我正在RHEL 6上使用Spring Boot with Oracle Java 1.8+JCE示例，来自https://github.com/spring-projects/spring-security-kerberos/tree/master/spring-security-kerberos-samples/sec-server-win-auth

...

原因：org.ietf.jgss.gssexception：GSS-API级别未指定的失败（机制级别：校验和失败）

    at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:856)
    at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:342)
    at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:285)
    at sun.security.jgss.spnego.SpNegoContext.GSS_acceptSecContext(SpNegoContext.java:906)
    at sun.security.jgss.spnego.SpNegoContext.acceptSecContext(SpNegoContext.java:556)
    at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:342)
    at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:285)
    at org.springframework.security.kerberos.authentication.sun.SunJaasKerberosTicketValidator$KerberosValidateAction.run(SunJaasKerberosTicketValidator.java:170)
    at org.springframework.security.kerberos.authentication.sun.SunJaasKerberosTicketValidator$KerberosValidateAction.run(SunJaasKerberosTicketValidator.java:153)
    ... 48 common frames omitted

由:sun.security.krb5.krbCryptoException引起：校验和失败

    at sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType.decrypt(Aes256CtsHmacSha1EType.java:102)
    at sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType.decrypt(Aes256CtsHmacSha1EType.java:94)
    at sun.security.krb5.EncryptedData.decrypt(EncryptedData.java:175)
    at sun.security.krb5.KrbApReq.authenticate(KrbApReq.java:281)
    at sun.security.krb5.KrbApReq.<init>(KrbApReq.java:149)
    at sun.security.jgss.krb5.InitSecContextToken.<init>(InitSecContextToken.java:108)
    at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:829)
    ... 56 common frames omitted

    at sun.security.krb5.internal.crypto.dk.AesDkCrypto.decryptCTS(AesDkCrypto.java:451)
    at sun.security.krb5.internal.crypto.dk.AesDkCrypto.decrypt(AesDkCrypto.java:272)
    at sun.security.krb5.internal.crypto.Aes256.decrypt(Aes256.java:76)
    at sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType.decrypt(Aes256CtsHmacSha1EType.java:100)
    ... 62 common frames omitted

• /etc/krb5.conf确实有default_tgs_enctypes和default_tkt_enctypes以包括AES256-CTS-HMAC-SHA1-96
• 默认keytab位置在应用程序和krb5.conf之间匹配
• 正在windows服务器上生成键选项卡，然后将其复制到RHEL

Answer 1

我似乎与现有的服务主体映射发生了冲突。一旦我把它清理干净，错误就不再发生了。这个链接帮助我找到了解决方案--https://developer.jboss.org/wiki/configuringjbossnegotiationinanallwindowsdomain?_sscc=t