针对Active Directory的Java身份验证，身份验证不匹配？

时间：2012-11-28 00:15:31

标签： java active-directory kerberos gssapi

所以我有一些代码正在测试，以确保它可以很好地进行身份验证。它可以很好地对抗直接的kerberos，所以我认为应该只有一些与AD的轻微打嗝。不幸的是，我无法解决KrbException：KDC不支持加密类型（14）。

我知道错误是加密类型不匹配。但我可以开得很好，这只是在我遇到问题的代码中。我没有设置任何东西，所以我认为它应该继承与kinit相同的默认值，但显然情况并非如此。

代码 - 

System.setProperty("sun.security.krb5.debug", "true");
System.setProperty("java.security.krb5.realm", "TEST.SQRRL.COM");
System.setProperty("java.security.krb5.kdc", "172.16.101.128");
System.setProperty("java.security.auth.login.config", "./conf/jaas.conf");
System.setProperty("javax.security.auth.useSubjectCredsOnly", "true");

// "Client" references the JAAS configuration in the jaas.conf file.
LoginContext loginCtx = null;
loginCtx = new LoginContext("Server", new LoginCallbackHandler("test".toCharArray()));
loginCtx.login();
subject = loginCtx.getSubject();

和jaas.conf 

Server {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=false
storeKey=true
useTicketCache=true
principal="accumulo@test.SQRRL.COM";
};

并且，堆栈跟踪 - 

>>>KRBError:
     sTime is Tue Nov 27 18:16:36 EST 2012 1354058196000
     suSec is 257213
     error code is 14
     error Message is KDC has no support for encryption type
     realm is test.SQRRL.COM
     sname is krbtgt/test.SQRRL.COM
     msgType is 30
javax.security.auth.login.LoginException: KDC has no support for encryption type (14)
    at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:696)
    at com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:542)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
    at java.lang.reflect.Method.invoke(Method.java:597)
    at javax.security.auth.login.LoginContext.invoke(LoginContext.java:769)
    at javax.security.auth.login.LoginContext.access$000(LoginContext.java:186)
    at javax.security.auth.login.LoginContext$4.run(LoginContext.java:683)
    at java.security.AccessController.doPrivileged(Native Method)
    at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)
    at javax.security.auth.login.LoginContext.login(LoginContext.java:579)
    at authenticators.KerberosAuthenticator.<init>(KerberosAuthenticator.java:37)
    at main.ServerImpl.<init>(ServerImpl.java:91)
    at main.PlugServer.run(PlugServer.java:22)
    at main.PlugServer.main(PlugServer.java:42)
Caused by: KrbException: KDC has no support for encryption type (14)
    at sun.security.krb5.KrbAsRep.<init>(KrbAsRep.java:66)
    at sun.security.krb5.KrbAsReq.getReply(KrbAsReq.java:446)
    at sun.security.krb5.Credentials.sendASRequest(Credentials.java:401)
    at sun.security.krb5.Credentials.acquireTGT(Credentials.java:373)
    at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:662)
    ... 15 more
Caused by: KrbException: Identifier doesn't match expected value (906)
    at sun.security.krb5.internal.KDCRep.init(KDCRep.java:133)
    at sun.security.krb5.internal.ASRep.init(ASRep.java:58)
    at sun.security.krb5.internal.ASRep.<init>(ASRep.java:53)
    at sun.security.krb5.KrbAsRep.<init>(KrbAsRep.java:50)
    ... 19 more
Exception in thread "main" java.lang.RuntimeException: javax.security.auth.login.LoginException: KDC has no support for encryption type (14)
    at main.PlugServer.run(PlugServer.java:36)
    at main.PlugServer.main(PlugServer.java:42)
Caused by: javax.security.auth.login.LoginException: KDC has no support for encryption type (14)
    at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:696)
    at com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:542)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
    at java.lang.reflect.Method.invoke(Method.java:597)
    at javax.security.auth.login.LoginContext.invoke(LoginContext.java:769)
    at javax.security.auth.login.LoginContext.access$000(LoginContext.java:186)
    at javax.security.auth.login.LoginContext$4.run(LoginContext.java:683)
    at java.security.AccessController.doPrivileged(Native Method)
    at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)
    at javax.security.auth.login.LoginContext.login(LoginContext.java:579)
    at authenticators.KerberosAuthenticator.<init>(KerberosAuthenticator.java:37)
    at main.ServerImpl.<init>(ServerImpl.java:91)
    at main.PlugServer.run(PlugServer.java:22)
    ... 1 more
Caused by: KrbException: KDC has no support for encryption type (14)
    at sun.security.krb5.KrbAsRep.<init>(KrbAsRep.java:66)
    at sun.security.krb5.KrbAsReq.getReply(KrbAsReq.java:446)
    at sun.security.krb5.Credentials.sendASRequest(Credentials.java:401)
    at sun.security.krb5.Credentials.acquireTGT(Credentials.java:373)
    at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:662)
    ... 15 more
Caused by: KrbException: Identifier doesn't match expected value (906)
    at sun.security.krb5.internal.KDCRep.init(KDCRep.java:133)
    at sun.security.krb5.internal.ASRep.init(ASRep.java:58)
    at sun.security.krb5.internal.ASRep.<init>(ASRep.java:53)
    at sun.security.krb5.KrbAsRep.<init>(KrbAsRep.java:50)
    ... 19 more

3 个答案:

答案 0 :(得分：7)

所以，我已经超越了这个阶段。我只能猜测Windows Server 2012的活动目录中的DES支持被破坏了，因为我最终调整了我的krb5.conf文件，并将两个默认的票证类型和允许的类型设置为aes256-cts-hmac-sha1-96和它适用于一个用户。在AD中为其他用户启用aes256后，它继续工作。

答案 1 :(得分：2)

您需要访问该用户的帐户并选中“使用kerberos DES加密类型”复选框。

当然，您需要以管理员身份登录DS才能执行此操作。

答案 2 :(得分：0)

查看init() in KDCRep.java，看起来可能抛出错误的唯一部分是： 

    150           if ((subDer.getTag() & 0x1F) == 0x00) {
    151               pvno = subDer.getData().getBigInteger().intValue();
    152               if (pvno != Krb5.PVNO) {
    153                   throw new KrbApErrException(Krb5.KRB_AP_ERR_BADVERSION);
    154               }
    155           } else {
    156               throw new Asn1Exception(Krb5.ASN1_BAD_ID);
    157           }

将错误打印为KrbException似乎有点奇怪，但它可以正常工作，因为KrbApErrException是KrbException的子类。 init()不能抛出KrbException的任何其他子类。

抓一点。更好的可能性是它是Asn1Exception中的KrbException之一，因为the constructor in KrbAsRep.java捕获并重新抛出这些错误initCause s（具有匹配的相应"Identifier doesn't match expected value (906)"以及堆栈跟踪）。

Asn1Exception(Krb5.ASN1_BAD_ID)让我相信它正在抛出init()，since Krb5.ASN1_BAD_ID has value 906。这并没有太大帮助，因为这似乎是DerValue中的默认错误。

查看您是否可以生成与您的配置相对应的init()并手动检查，查看"KDC has no support for encryption type"拒绝它的位置，然后从那里向后退一步，查看配置的哪个部分创建了错误位。

经过进一步检查后，{{1}}消息让我相信Krb5.KDC_ERR_ETYPE_NOSUPP必须已被使用。但是，正如only used for the default instance of Etype那样，这可能意义不大。

相关问题
最新问题