Question

我试图让本教程发挥作用：https://docs.oracle.com/javase/8/docs/technotes/guides/security/jgss/lab/part5.html

我在VM上运行Kerberos KDC并使用本指南进行设置：http://techpubs.spinlocksolutions.com/dklar/kerberos.html

我已经设置了两个princripals：jessica@REALM.COM和host/jessica-ThinkPad-X220@REALM.COM，第二个的密钥保存在一个keytab中，我从VM复制到我的测试机器。

我可以ping KDC并使用kinit获取门票。

我编译了所有代码示例（Jaas.java GssSpNegoServer.java和GssSpNegoClient.java）而未对教程进行任何更改。

这是我的jaas-krb5.conf：

client {
com.sun.security.auth.module.Krb5LoginModule required
principal="jessica";
};

server {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
storeKey=true
keyTab=krb5.keytab
principal="host/jessica-ThinkPad-X220";
};

我正在使用java -Djava.security.auth.login.config=jaas-krb5.conf GssSpNegoServer

启动服务器

然后，在另一个窗口中，我正在启动客户端 java -Djava.security.auth.login.config=jaas-krb5.conf GssSpNegoClient host hostname，它给了我以下错误：

$ java -Djava.security.auth.login.config=jaas-krb5.conf GssSpNegoClient host jessica-ThinkPad-X220
Kerberos-Password for jessica: 
Authenticated principal: [jessica@REALM.COM]
Connected to address jessica-ThinkPad-X220/192.168.178.78
Exception in thread "main" java.security.PrivilegedActionException: GSSException: No valid credentials provided (Mechanism level: No valid  credentials provided (Mechanism level: Server not found in Kerberos database (7) - LOOKING_UP_SERVER))
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAs(Subject.java:422)
at Jaas.loginAndAction(Jaas.java:53)
at GssSpNegoClient.main(GssSpNegoClient.java:56)
Caused by: GSSException: No valid credentials provided (Mechanism level: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7) - LOOKING_UP_SERVER))
at sun.security.jgss.spnego.SpNegoContext.initSecContext(SpNegoContext.java:454)
at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:248)
at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:179)
at GssSpNegoClient$GssClientAction.run(GssSpNegoClient.java:129)
... 4 more
Caused by: GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7) - LOOKING_UP_SERVER)
at sun.security.jgss.krb5.Krb5Context.initSecContext(Krb5Context.java:770)
at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:248)
at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:179)
at sun.security.jgss.spnego.SpNegoContext.GSS_initSecContext(SpNegoContext.java:882)
at sun.security.jgss.spnego.SpNegoContext.initSecContext(SpNegoContext.java:317)
... 7 more
Caused by: KrbException: Server not found in Kerberos database (7) - LOOKING_UP_SERVER
at sun.security.krb5.KrbTgsRep.<init>(KrbTgsRep.java:73)
at sun.security.krb5.KrbTgsReq.getReply(KrbTgsReq.java:259)
at sun.security.krb5.KrbTgsReq.sendAndGetCreds(KrbTgsReq.java:270)
at sun.security.krb5.internal.CredentialsUtil.serviceCreds(CredentialsUtil.java:302)
at sun.security.krb5.internal.CredentialsUtil.acquireServiceCreds(CredentialsUtil.java:120)
at sun.security.krb5.Credentials.acquireServiceCreds(Credentials.java:458)
at sun.security.jgss.krb5.Krb5Context.initSecContext(Krb5Context.java:693)
... 11 more
Caused by: KrbException: Identifier doesn't match expected value (906)
at sun.security.krb5.internal.KDCRep.init(KDCRep.java:140)
at sun.security.krb5.internal.TGSRep.init(TGSRep.java:65)
at sun.security.krb5.internal.TGSRep.<init>(TGSRep.java:60)
at sun.security.krb5.KrbTgsRep.<init>(KrbTgsRep.java:55)
... 17 more

我不知道自己做错了什么，有人可以帮忙吗？

Answer 1

首先检查它在 Kerberos 日志中寻找的服务器（对我来说位于 /var/log/auth.log）。你会在那里看到相应的登录：

krb5kdc[5157]: TGS_REQ (3 etypes {18 17 16}) x.x.x.x: LOOKING_UP_SERVER: authtime 0,  ex/admin@EXAMPLE for ex2/y.y.y.y@EXAMPLE, Server not found in Kerberos database

确保将y.y.y.y更改为对应系统的主机名，并将主机名添加到主机中（即/etc/hosts）

错误：带有SPNEGO的Java GSS-API：在Kerberos数据库中找不到服务器（7）

1 个答案: