升级到JRE 6更新45后，kerberos身份验证失败

Question

我们使用kerberos身份验证来执行SSO。早些时候，我们的产品在JRE 6 Update 22上运行，一切正常。我们最近迁移到JRE 6 update 45，kerberos身份验证失败。

因此，代码基本上执行两个步骤——连接和登录1。“连接”步骤测试SPN名称和凭据（密码或密钥表）是否可以登录到由领域和KDC信息标识的域控制器。2.“登录”步骤执行相同的操作，然后还尝试使用GSSAPI身份验证机制绑定到AD LDAP服务。因此，它正在尝试执行GSSAPI绑定，而在这一步，它现在失败了。

下面是正在发生的事情-

Server(our product) sends AS-REQ to KDC
KDC responds  back with error_code: KRB5KDC_ERR_PREAUTH_REQUIRED (25)
Server again sends AS-REQ to KDC with the timestamp
KDC responds back ( AS-REP) with TGT
MCIM sends the TGS-REQ – From our analysis, this is the problem area, this request is populated with incorrect details as explained below.
KDC responds back with  error_code: KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN (7)

现在，这里的问题是，当服务器发送TGS-REQ时，它使用服务器名（未知）发送：ldap/10.213.177.3，而在较旧的JRE版本中，它使用ldap/win2008发送TGS-REQ。麦克苏瓦。hari（kdc的主机名），即使给定了kdc IP。现在，KDC没有使用ldap和IP注册SPN，而是使用KDC的ldap/主机名注册SPN

如果我们显式地为ldap/执行setspn命令，那么一切都开始工作。那么，是什么改变了JRE 6的更高版本，导致了这个问题呢。这对我们来说确实是一个拦路虎，我们不知道如何解决这个问题。任何帮助/指导都将不胜感激。

这样做的代码-

 LDAPConnection connection = new LDAPConnection(request.getServer(), request.getPort());
    GSSAPIBindRequest bindRequest = new GSSAPIBindRequest(request.getAuthnId(), null, "N/A",      null, null, "");
    connection.bind(bindRequest); //throws exception

这会引发以下异常

*

    Caused by: com.unboundid.ldap.sdk.LDAPException: Unable to create the initial GSSAPI      SASL request:  javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7))] caused by GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7)) caused by KrbException: Server not found in Kerberos database (7) caused by KrbException: Identifier doesn't match expected value (906)
  at com.unboundid.ldap.sdk.SASLHelper.processSASLBind(SASLHelper.java:120)
  at com.unboundid.ldap.sdk.GSSAPIBindRequest.run(GSSAPIBindRequest.java:1022)
  ... 56 common frames omitted
Caused by: javax.security.sasl.SaslException: GSS initiate failed
  at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(Unknown Source)
  at com.unboundid.ldap.sdk.SASLHelper.processSASLBind(SASLHelper.java:114)
  ... 57 common frames omitted
Caused by: org.ietf.jgss.GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7))
  at sun.security.jgss.krb5.Krb5Context.initSecContext(Unknown Source)
  at sun.security.jgss.GSSContextImpl.initSecContext(Unknown Source)
  at sun.security.jgss.GSSContextImpl.initSecContext(Unknown Source)
  ... 59 common frames omitted
Caused by: sun.security.krb5.KrbException: Server not found in Kerberos database (7)
  at sun.security.krb5.KrbTgsRep.<init>(Unknown Source)
  at sun.security.krb5.KrbTgsReq.getReply(Unknown Source)
  at sun.security.krb5.internal.CredentialsUtil.serviceCreds(Unknown Source)
  at sun.security.krb5.internal.CredentialsUtil.acquireServiceCreds(Unknown Source)
  at sun.security.krb5.Credentials.acquireServiceCreds(Unknown Source)
  ... 62 common frames omitted
Caused by: sun.security.krb5.Asn1Exception: Identifier doesn't match expected value (906)
  at sun.security.krb5.internal.KDCRep.init(Unknown Source)
  at sun.security.krb5.internal.TGSRep.init(Unknown Source)
  at sun.security.krb5.internal.TGSRep.<init>(Unknown Source)*

Answer 1

两件事：简要回顾一下JDK6中的变化，就会发现在22到45之间有一些关于LDAP的提到。我无法立即发现任何相关信息——也许你必须仔细检查所有的变化。

无界解决方案的LDAPSDKJava的发行说明也可以提供一些指示。也许您需要升级SDK来弥补JDK的变化。