Hi all! I’ve been trying to configure a new installation of Openfire v4.4.4 to support SSO. After days of Googling and reading this forum I’ve decided to open a topic about the issue. Over the past 10+ years there have been multiple posts on this topic with various solutions. I’ve read all these and tried them but unfortunately, I couldn’t solve my issue. Hopefully someone here can help me out!
Environment:
DC (Name: srv-dc02): Windows Server 2016 Standard with 2008R2 functional level (there are 3 DCs in the forest, one of them is still 2008 R2)
Openfire server (Name: srv-chat01): Windows Server 2016 Std with a remote MSSQL database server. The installed Openfire version is 4.4.4 with integrated Java (install path: E:\Openfire)
AD Domain: domain.local
Public DNS domain (split DNS, all DCs are zone masters internally): public.hu
Authentication was working before I attempted to configure SSO.
Steps:
- Created DNS records: chat.domain.hu CNAME srv-chat01.public.hu and the following SRV records (as the Admin Console suggested):
_xmpp-client._tcp.chat.public.hu IN SRV 0 5 5222 srv-chat01.domain.local
_xmpp-server._tcp_chat.public.hu IN SRV 0 5 5269 srv-chat01.domain.local
_xmpps-client._tcp.chat.public.hu IN SRV 0 5 5223 srv-chat01.domain.local
_xmpps-server._tcp.chat.public.hu IN SRV 0 5 5270 srv-chat01.domain.local
There is a reverse DNS record for the server, which points to srv-chat01.domain.local - Created the AD accounts. _svc_openfire is used to query LDAP and access the database, and _openfire_keytab is used for the SPN records. Both are regular domain users and the passwords never expire. The keytab account has “This account supports Kerberos AES 128bit encryption” and “Do not require Kerberos preauthentication” checked.
- Created SPN records for the keytab account. Setspn –L shows the following SPNs: xmpp/chat.public.hu, xmpp/srv-chat01.domain.local, xmpp/chat.public.hu@domain.local
- Exported the keytab with ktpass with “-crypto all” and “-ptype KRB5_NT_PRINCIPAL”. Also tried this step with the ktab.exe on the Openfire server, which did not make a difference.
- Added the allowtgtsession REG_DWORD key on both the server and the client. (Also tried with REG_SZ as some documentation said it’s not DWORD).
- Disabled Virtualization Based Security in local policy (Administrative Templates -> System -> Device Guard) on both the server and the client
- In the Openfire Admin Console, I’ve added the required System Properties: sasl.gssapi.config: E:\Openfire\conf\gss.conf, sasl.gssapi.debug: true, sasl.gssapi.useSubjectCredsOnly: false, sasl.mechs: GSSAPI, sasl.realm: DOMAIN.LOCAL
- Created krb5.ini, placed it in C:\Windows on the Openfire server. Also created the gss.conf file and placed it in E:\Openfire\conf folder.
krb5.ini:
[libdefaults]
default_realm = DOMAIN.LOCAL
dns_lookup_realm = false
[realms]
DOMAIN.LOCAL = {
kdc = srv-dc02.domain.local
admin_server = srv-dc02.domain.local
default_domain = domain.local
}
[domain_realms]
domain.local = DOMAIN.LOCAL
.domain.local = DOMAIN.LOCAL
Also tried adding a few values to this file like ticket_lifetime, renew_lifetime, default_ccache_name but these did not make any difference either.
gss.conf:
com.sun.security.jgss.accept {
com.sun.security.auth.module.Krb5LoginModule
required
storeKey=true
keyTab=“E:/Openfire/resources/openfire.keytab”
doNotPrompt=true
useKeyTab=true
isInitiator=false
realm=“DOMAIN.LOCAL”
principal=“xmpp/chat.public.hu@DOMAIN.LOCAL”
debug=true;
};
If I start Spark with administrative rights on the client and enable SSO, the username and account fields are populated automatically.
When I fill the domain field with chat.public.hu login fails. The following error message is display in the Spark client warn log:
dec. 04, 2019 9:29:07 DE org.jivesoftware.spark.util.log.Log warning
WARNING: Exception in Login: org.jivesoftware.smack.sasl.SASLErrorException: SASLError using GSSAPI: not-authorized at org.jivesoftware.smack.SASLAuthentication.authenticationFailed(SASLAuthentication.java:365) at org.jivesoftware.smack.tcp.XMPPTCPConnection$PacketReader.parsePackets(XMPPTCPConnection.java:1052) at org.jivesoftware.smack.tcp.XMPPTCPConnection$PacketReader.access$300(XMPPTCPConnection.java:956) at org.jivesoftware.smack.tcp.XMPPTCPConnection$PacketReader$1.run(XMPPTCPConnection.java:971) at java.lang.Thread.run(Unknown Source)
Unfortunately, it did not work as expected, though the error message was not the same as the one I get now. That’s when I started browsing through every post mentioning SSO here and got to the “not-authorized” message which I didn’t find a solution to.