Spark 2.5.3b1 SSO can''t find krb5.ini

Darren_Sykes · May 21, 2007, 1:50pm

OK. It’'s not a reverse lookup for the DC you need, but the Openfire server.

When you start Spark, pass the following to set the debug parameter:

-Dsun.security.krb5.debug=true

When you try to login you’‘ll get a better error message indicating the security principal it’'s looking for, as follows:

KRBError:

sTime is Mon May 21 09:41:41 BST 2007 1179736901000

suSec is 38126

error code is 7

error Message is Server not found in Kerberos database

realm is REALM.COM

sname is xmpp/server

msgType is 30

SNAME is the value you’'re looking for…

Message was edited by: DeeJay

Jay · May 21, 2007, 1:55pm

Its not reverse lookup for the DC that we are looking for, but for the Openfire server. (Though you need it for your DC as well, but thats a separate issue)

The issue sounds like the openfire server has a reverse lookup that is not the same as the name you used to create the service principal. They need to match.

papawu · May 21, 2007, 1:58pm

So I try launching spark by running the following in Start/Run

“C:\Program Files\Spark\Spark.exe” -Dsun.security.krb5.debug=true

But I get the same information in error.log and output.log in my Spark Logs.

Jay · May 21, 2007, 2:00pm

That will not work. You need the batch file from subversion to specify the extra java paramaters.

papawu · May 21, 2007, 2:09pm

I added “-Dsun.security.krb5.debug=true” to my startup.bat and my :debug section is listed below. But I still don’'t get any additional information.

start “Spark” “%JAVA_HOME%\bin\java” -Ddebugger=true -Ddebug.mode=true -Dsun.security.krb5.debug=true -XX:+HeapDumpOnOutOfMemoryError -Xdebug -Xint -server -Xnoagent -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=8000 -Dappdir=… -cp …/lib/windows/jmf.jar;…/lib/startup.jar;…/lib/windows/jdic.jar;…/resources; …/lib/windows; org.jivesoftware.launcher.Startup

Darren_Sykes · May 21, 2007, 2:14pm

The line I use is:

java -Dsun.security.krb5.debug=true -Dappdir=… -cp …/lib/windows/jmf.jar;…/lib/startup.jar;…/lib/windows/jdic.jar;…/resources; …/lib/windows; org.jivesoftware.launcher.Startup

However, not much will be logged unless you have a reverse lookup entry for your Openfire server’'s IP.

D

Jay · May 21, 2007, 2:24pm

Lets just double check all the names and principals quick. First, we can make sure the principal that is in your openfire keytab is the one we expect. Use the klist that comes with Java (not the Windows Resource Kit version) and run this command:

"C:\Program Files\Java\jdk1.6.0_01\bin\klist.exe" -k "C:\Program Files\Openfire\conf\jabber.keytab"

This tells you exactly what the service principal in that keytab is. It will look something like this:

Key tab: C:\Program Files\Openfire\conf\jabber.keytab, 1 entry found. [1] Service principal: xmpp/vm-win2003se.jivesoftware.com@JIVESOFTWARE.COM          KVNO: 3

Next, use DNS to double check the names. Lets start with the name from your keytab. So continuing my example, run this command:

nslookup vm-win2003se.jivesoftware.com

That should give you an IP address, say 10.12.23.34. So then do this:

nslookup 10.12.23.34

That should return the same name. If it dosnt, then you have a problem.

Now lets take a look at the xmpp domain name. If you are not using SRV records to look up the name, then its simple, just do an nslookup on the xmpp domain name. If you end up at the same IP address as the previous queries, then all is good. If you do use SRV records, then do a lookup on whatever the SRV records point to. They should return the same IP.

Also worth noting is this:

As it may be the cause of your problem.

papawu · May 21, 2007, 2:28pm

Got that to work and this is what I get.

Found ticket for user1@DOMAIN.LOCAL to go to krbtgt/DOMAIN.LOCAL@DOMAIN.LOCAL ex

piring on Mon May 21 20:20:16 EDT 2007

Entered Krb5Context.initSecContext with state=STATE_NEW

Service ticket not found in the subject

>>> Credentials acquireServiceCreds: same realm

Using builtin default etypes for default_tgs_enctypes

default etypes for default_tgs_enctypes: 3 1 23 16 17.

>>> CksumType: sun.security.krb5.internal.crypto.RsaMd5CksumType

>>> EType: sun.security.krb5.internal.crypto.DesCbcMd5EType

>>> KrbKdcReq send: kdc=DC1.DOMAIN.LOCAL UDP:88, timeout=30000, number of re

tries =3, #bytes=1582

>>> KDCCommunication: kdc=DC1.DOMAIN.LOCAL UDP:88, timeout=30000,Attempt =1,

#bytes=1582

>>> KrbKdcReq send: #bytes read=97

>>> KDCRep: init() encoding tag is 126 req type is 13

>>>KRBError:

sTime is Mon May 21 10:21:55 EDT 2007 1179757315000

suSec is 359961

error code is 52

error Message is Response too big for UDP, retry with TCP

realm is DOMAIN.LOCAL

sname is xmpp/im.domain.com

msgType is 30

>>> KrbKdcReq send: kdc=DC1.DOMAIN.LOCAL TCP:88, timeout=30000, number of re

tries =3, #bytes=1582

>>>DEBUG: TCPClient reading 1518 bytes

>>> KrbKdcReq send: #bytes read=1518

>>> EType: sun.security.krb5.internal.crypto.DesCbcMd5EType

>>> KrbApReq: APOptions are 00000000 00000000 00000000 00000000

>>> EType: sun.security.krb5.internal.crypto.DesCbcMd5EType

Krb5Context setting mySeqNumber to: 797645535

Krb5Context setting peerSeqNumber to: 0

Created InitSecContextToken:

papawu · May 21, 2007, 2:35pm

Principal is:

xmpp/im.domain.com@DOMAIN.LOCAL

I am not using SRV records and there are reverse lookups for my XMPP server and for my domain controller.

Jay · May 21, 2007, 2:38pm

So just to be sure,

if you do nslookup im.domain.com to get some IP, then do an nslookup on that IP you get im.domain.com again, right?

papawu · May 21, 2007, 2:39pm

I found this in my Warn.log on my openfire server. On a side note I am running Openfire on Linux.

at org.jivesoftware.openfire.net.SASLAuthentication.handle(SASLAuthentication.java :220)

at org.jivesoftware.openfire.net.StanzaHandler.process(StanzaHandler.java:141)

at org.jivesoftware.openfire.nio.ConnectionHandler.messageReceived(ConnectionHandl er.java:132)

at org.apache.mina.common.support.AbstractIoFilterChain$TailFilter.messageReceived (AbstractIoFilterChain.java:703)

at org.apache.mina.common.support.AbstractIoFilterChain.callNextMessageReceived(Ab stractIoFilterChain.java:362)

at org.apache.mina.common.support.AbstractIoFilterChain.access$1100(AbstractIoFilt erChain.java:54)

at org.apache.mina.common.support.AbstractIoFilterChain$EntryImpl$1.messageReceive d(AbstractIoFilterChain.java:800)

at org.apache.mina.filter.codec.support.SimpleProtocolDecoderOutput.flush(SimplePr otocolDecoderOutput.java:62)

at org.apache.mina.filter.codec.ProtocolCodecFilter.messageReceived(ProtocolCodecF ilter.java:200)

at org.apache.mina.common.support.AbstractIoFilterChain.callNextMessageReceived(Ab stractIoFilterChain.java:362)

at org.apache.mina.common.support.AbstractIoFilterChain.access$1100(AbstractIoFilt erChain.java:54)

at org.apache.mina.common.support.AbstractIoFilterChain$EntryImpl$1.messageReceive d(AbstractIoFilterChain.java:800)

at org.apache.mina.filter.executor.ExecutorFilter.processEvent(ExecutorFilter.java :266)

at org.apache.mina.filter.executor.ExecutorFilter$ProcessEventsRunnable.run(Execut orFilter.java:326)

at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(Unknown Source)

at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)

at java.lang.Thread.run(Unknown Source)

Caused by: GSSException: No valid credentials provided (Mechanism level: Attempt to obtain new ACCEPT credentials failed!)

at sun.security.jgss.krb5.Krb5AcceptCredential.getInstance(Unknown Source)

at sun.security.jgss.krb5.Krb5MechFactory.getCredentialElement(Unknown Source)

at sun.security.jgss.GSSManagerImpl.getCredentialElement(Unknown Source)

at sun.security.jgss.GSSCredentialImpl.add(Unknown Source)

at sun.security.jgss.GSSCredentialImpl.<init>(Unknown Source)

at sun.security.jgss.GSSManagerImpl.createCredential(Unknown Source)

… 20 more

Caused by: javax.security.auth.login.LoginException: Cannot get kdc for realm DOMAIN.LOCAL

at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Unknown Source)

at com.sun.security.auth.module.Krb5LoginModule.login(Unknown Source)

at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)

at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)

at java.lang.reflect.Method.invoke(Unknown Source)

at javax.security.auth.login.LoginContext.invoke(Unknown Source)

at javax.security.auth.login.LoginContext.access$000(Unknown Source)

at javax.security.auth.login.LoginContext$5.run(Unknown Source)

at java.security.AccessController.doPrivileged(Native Method)

at javax.security.auth.login.LoginContext.invokeCreatorPriv(Unknown Source)

at javax.security.auth.login.LoginContext.login(Unknown Source)

at sun.security.jgss.GSSUtil.login(Unknown Source)

at sun.security.jgss.krb5.Krb5Util.getKeys(Unknown Source)

at sun.security.jgss.krb5.Krb5AcceptCredential$1.run(Unknown Source)

at java.security.AccessController.doPrivileged(Native Method)

… 26 more

Caused by: KrbException: Cannot get kdc for realm DOMAIN.LOCAL

at sun.security.krb5.KrbKdcReq.send(Unknown Source)

at sun.security.krb5.KrbAsReq.send(Unknown Source)

at sun.security.krb5.Credentials.sendASRequest(Unknown Source)

at sun.security.krb5.Credentials.acquireTGT(Unknown Source)

… 42 more

papawu · May 21, 2007, 2:40pm

Correct,

That is how I verified reverse lookup is working.

Jay · May 21, 2007, 2:42pm

Same deal as with Spark- Openfire needs to know what realm and KDC to use. You need to either make sure the krb5.ini is in a place it can read (like you did for spark), or use the batch file process to start it with the paramaters specifying the realm and KDC (like I had in my howto)

papawu · May 21, 2007, 2:44pm

Well I have to figure out how to do it in linux since it looks like your howto is for running openfire on windows.

Jay · May 21, 2007, 2:46pm

You never stated the server was running on Linux. Take your krb5.ini file, and put it on your linux server as /etc/krb5.conf . If you already have a krb5.conf, just merge your changes in.

papawu · May 21, 2007, 2:59pm

Sorry I forgot to mention that part.

This is what I am getting now:

2007.05.21 10:52:23 No AuthorizationProvider’'s found. Loading DefaultAuthorizationPolicy

2007.05.21 10:52:23 user1@DOMAIN.LOCAL not authorized to user1

2007.05.21 10:52:23 SaslException

javax.security.sasl.SaslException: Problem with callback handler Caused by javax.security.sasl.SaslException: user1@DOMAIN.LOCAL is not authorized to connect as user1

at com.sun.security.sasl.gsskerb.GssKrb5Server.doHandshake2(Unknown Source)

at com.sun.security.sasl.gsskerb.GssKrb5Server.evaluateResponse(Unknown Source)

at org.jivesoftware.openfire.net.SASLAuthentication.handle(SASLAuthentication.java :281)

at org.jivesoftware.openfire.net.StanzaHandler.process(StanzaHandler.java:144)