Question

对于Java项目，我使用SPNEGO的Spring Security进行身份验证。我按照链接http://anmoljains.wordpress.com/2014/01/19/java-single-sign-on-using-spnego-and-jboss-eap-6-1-0/中说明的每个步骤进行了操作，但是，当我尝试使用与服务器不同的计算机对IE进行身份验证时，出现以下错误：

协商头部是无效的：协商YIGeBgYrBgEFBQKggZMwgZCgGjAYBgorBgEEAYI3AgIeBgorBgEEAYI3AgIKonIEcE5FR09FWFRTAAAAAAAAAABgAAAAcAAAAEu8iH + 9PA / ykFHFoL0fcG4pSiUY / 1uV4d6rsrMhDt1gQWYkR7WJ + / z5C7xHvZptngAAAAAAAAAAYAAAAAEAAAAAAAAAAAAAAEVyfDIyRYtIv9kqa6BepAo =：org.springframework.security.authentication.BadCredentialsException：Kerberos的验证不succesfull ... 按引起： java.security.GeneralSecurityException：校验和失败

这是我的applicationContext-security.xml：

<http entry-point-ref="spnegoEntryPoint" use-expressions="true">
<intercept-url pattern="/**" access="isAuthenticated()"/>
<intercept-url pattern="/report" filters="none"/>
<custom-filter ref="spnegoAuthenticationProcessingFilter" position="BASIC_AUTH_FILTER"/>
<intercept-url pattern="/css/**" filters="none"/>
<intercept-url pattern="/resources/**" filters="none"/>
<intercept-url pattern="/js/**" filters="none"/>
<form-login login-page="/login" default-target-url="/report" authentication-failure-url="/accessDenied"/>
<logout logout-url=""/>
</http>
<beans:bean id="spnegoEntryPoint" class="org.springframework.security.extensions.kerberos.web.SpnegoEntryPoint"/>
<beans:bean id="spnegoAuthenticationProcessingFilter" class="org.springframework.security.extensions.kerberos.web.SpnegoAuthenticationProcessingFilter">
<beans:property name="authenticationManager" ref="authenticationManager"/>
</beans:bean>
<authentication-manager alias="authenticationManager">
<authentication-provider ref="kerberosServiceAuthenticationProvider"/>
<authentication-provider ref="kerberosAuthenticationProvider" /> 
</authentication-manager>
<beans:bean id="kerberosServiceAuthenticationProvider" class="org.springframework.security.extensions.kerberos.KerberosServiceAuthenticationProvider">
<beans:property name="ticketValidator">
<beans:bean class="org.springframework.security.extensions.kerberos.SunJaasKerberosTicketValidator">
<beans:property name="servicePrincipal" value="HTTP/web.team.it@team.it/>

其中userDetailsService是我对org.springframework.security.core.userdetails.UserDetailsService的实现。

以下是我如何生成keytab.pass：

C：\ Windows \ System32＆gt; ktpass / out http-web.keytab / mapuser http-web.team.it@team.it / princ HTTP/pc-web.team.it@team.it / crypto AES256- SHA1 / pType KR B5_NT_PRINCIPAL -kvno 0 / pass Password01

使用Wireshark，我得到以下信息：

接受：text / html，application / xhtml + xml， / 接受语言：it-IT User-Agent：Mozilla / 5.0（兼容; MSIE 10.0; Windows NT 6.1; WOW64; Trident / 6.0） Accept-Encoding：gzip，deflate 主持人：web.team.it：8080 DNT：1 连接：保持活力 Cookie：JSESSIONID = PDY3d6UIDOARlxk92scldt8Z.undefined 授权：协商YIGeBgYrBgEFBQKggZMwgZCgGjAYBgorBgEEAYI3AgIeBgorBgEEAYI3AgIKonIEcE5FR09FWFRTAAAAAAAAAABgAAAAcAAAAEu8iH + 9PA / ykFHFoL0fcG4pSiUY / 1uV4d6rsrMhDt1gQWYkR7WJ + / z5C7xHvZptngAAAAAAAAAAYAAAAAEAAAAAAAAAAAAAAEVyfDIyRYtIv9kqa6BepAo =

尝试仅使用短机器名称（web而不是web.team.it）更改主体，我收到错误：

使用HMAC SHA1-96无法找到适当类型的密钥来解密AP REP-AES256 CTS模式

我使用的是Spring Security 3.0.5和spring-security-kerberos-core-1.0.0.M2.jar。获得这种身份验证的完整示例也很有用。谢谢大家。

Answer 1

添加到您的krb5.conf default_tkt_enctypes = aes256-cts-hmac-sha1-96 default_tgs_enctypes = aes256-cts-hmac-sha1-96

Spring Security / SPNEGO身份验证问题：校验和失败

1 个答案: