SSO is no fun :(, please help

Scott9 · March 25, 2008, 2:55pm

I work for a midsized manufacturing company here in Lexington KY. When I started here one of things I was tasked with was to find better ways for all the employee’s to communicate, enter Openfire and Spark.

The goals when I started this project were as follows.

Install Openfire and have it authenticate with AD.
Get SSO working so that they only have to login to Windows for everything to work.
Deploy Spark using group policy to all the machines in the building.

So far the only step I have been able to successfully complete is step 1, which brings me here. I have done the following in an attempt to make SSO work. I did everything on this document:

and this one:

I got no errors when doing any of this, everrything seemed to work perfect until I tried to log with Spark and got the error:

“Unable to connect using Single Sign On. Please check your principal and server settings”.

Once I got this I went back and checked every step to make sure I had it right and as far as I can tell I do. I then started to check the error logs and thats when I found this error in the Openfire warn.log:

"Caused by: GSSException: Invalid name provided (Mechanism level: Could not load configuration file C:\WINDOWS\krb5.ini (The system cannot find the file specified))

at sun.security.jgss.krb5.Krb5NameElement.getInstance(Unknown Source)

at sun.security.jgss.krb5.Krb5MechFactory.getNameElement(Unknown Source)

at sun.security.jgss.GSSManagerImpl.getNameElement(Unknown Source)

at sun.security.jgss.GSSNameImpl.getElement(Unknown Source)

at sun.security.jgss.GSSNameImpl.init(Unknown Source)

at sun.security.jgss.GSSNameImpl.<init>(Unknown Source)

at sun.security.jgss.GSSManagerImpl.createName(Unknown Source)"

So, after reading this error I thought “well that error makes sense, I must have forgotten to put the krb5.ini file on the server or on the cliet”. What is weird is that when I went to c:\WINDOWS\ krb5.ini was right there in front of my face. So I went and checked the client I was testing with and once again krb5.ini was in the correct place.

This has tottally stumped me, it’s saying it can’t find the file but it is there. Anybody had this happen before, or have any suggestions?

Thanks in advance.

NO_MESSAGES_OR_FRIEN · March 25, 2008, 3:03pm

It could be a permissions issue with the krb5.ini. I also attached the doc I use as a guide for 2 successful configs of openfire using SSO.

Scott9 · March 25, 2008, 3:22pm

Thanks for the quick reply mststravel, I’ll checked the permissions and they seem to be correct. Thanks for the link to your guide, I actually went through your guide as well and get the same error.

NO_MESSAGES_OR_FRIEN · March 25, 2008, 3:29pm

What OS is the server running on?

Scott9 · March 25, 2008, 3:31pm

Server is Windows 2003 and clients are xp sp2. I did all the registry changes too - are there additionaly registry changes I need to make to the server?

NO_MESSAGES_OR_FRIEN · March 25, 2008, 3:50pm

It could be that your krb5.ini is actually configured wrong, not that it can not find it.

Scott9 · March 25, 2008, 4:38pm

Thanks again for the reply. Below is my krb5.ini config:

default_realm = HUNTER.LOCAL

default_tkt_enctypes = rc4-hmac des3-cbc-sha1 des-cbc-crc des-cbc-md5

default_tgs_enctypes = rc4-hmac des3-cbc-sha1 des-cbc-crc des-cbc-md5

permitted_enctypes = rc4-hmac des3-cbc-sha1 des-cbc-crc des-cbc-md5

HUNTER.LOCAL = {

kdc = hunterdc1.hunter.local

admin_server = hunterdc1.hunter.local

default_domain = hunter.local

}

domain.com = HUNTER.LOCAL

.domain.com = HUNTER.LOCAL

It all looks right to me, but of course I could be wrong.

NO_MESSAGES_OR_FRIEN · March 25, 2008, 4:54pm

this is mine:

[libdefaults]
default_realm = DOMAIN.COM
noaddresses = true [realms]
DOMAIN.COM = {
kdc = pdcserver.domain.com
default_domain = domain.com
}

Scott9 · March 25, 2008, 5:08pm

I have changed mine to make it look like yours and still no help, below is what I have now.

default_realm = HUNTER.LOCAL

noaddresses = true

HUNTER.LOCAL = {

kdc = hunterdc1.hunter.local

default_domain = hunter.local

}

This chang did not work so I checked the warn.log again and see the same error, but do not know that is the problem as the log looks the same so it looks like it might be an old error.

I then checked my spark error logs on my client machine and found the error below in the error.log

Mar 25, 2008 1:01:05 PM org.jivesoftware.spark.util.log.Log warning

WARNING: Exception in Login:

XMPPError connecting to :5222.: remote-server-error(502) XMPPError connecting to :5222.

– caused by: java.net.ConnectException: Connection refused: connect

at org.jivesoftware.smack.XMPPConnection.connectUsingConfiguration(XMPPConnection. java:830)

at org.jivesoftware.smack.XMPPConnection.connect(XMPPConnection.java:1276)

at org.jivesoftware.LoginDialog$LoginPanel.login(LoginDialog.java:822)

at org.jivesoftware.LoginDialog$LoginPanel.access$400(LoginDialog.java:196)

at org.jivesoftware.LoginDialog$LoginPanel$1.construct(LoginDialog.java:594)

at org.jivesoftware.spark.util.SwingWorker$2.run(SwingWorker.java:129)

at java.lang.Thread.run(Unknown Source)

Nested Exception:

Hopefully this error will be of more help, it looks to me like it’s being blocked for some reason, but I can login when not using SSO with the same login credintials.

Also, just a general question (possibly a stupid one). I never told spark or openfire where to find krb5.ini, so how does it know where to look for it in the first place? Thanks again for all your help thus far :).

NO_MESSAGES_OR_FRIEN · March 25, 2008, 5:21pm

I am not sure but I think windows by default looks in the Windows directory for the krb5.ini. Could you also post a copy of your openfire.xml from your server? Also what program did you use to create your config files (krb5.ini, etc)?

NO_MESSAGES_OR_FRIEN · March 25, 2008, 5:23pm

It may be easier to diagnose the issue if you attached the config files you created so we can look at them. Edit them for security as needed.

Scott9 · March 25, 2008, 5:25pm

I used notepad to create my .ini, wasn’t sure if this was right but none of the guides I saw said anything different and I have used notepad bofore for such things so I assumed this would work. Below you will find my openfire.xml file, and below that you will find my gss.conf file as well.

edit: am attaching files now.

thanks again for taking the time to look at this - I’ve been about ready to pull my hair out lol.

NO_MESSAGES_OR_FRIEN · March 25, 2008, 6:01pm

I made some minor modifications to the openfire.xml the others looked right except when I downloaded them the had double extensions .ini.txt and .conf.txt. I reattached all 3.

NO_MESSAGES_OR_FRIEN · March 25, 2008, 6:02pm

I made some minor modifications to the openfire.xml the others looked right except when I downloaded them the had double extensions .ini.txt and .conf.txt. I reattached all 3.

Scott9 · March 25, 2008, 6:14pm

I donloaded all three of those and replaced what I had with them. I still get the same error when I start spark, but when I look in the spark logs what I see is below:

javax.security.sasl.SaslException: GSS initiate failed

at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(Unknown Source)

at org.jivesoftware.smack.sasl.SASLGSSAPIMechanism.authenticate(SASLGSSAPIMechanis m.java:75)

at org.jivesoftware.smack.SASLAuthentication.authenticate(SASLAuthentication.java: 194)

at org.jivesoftware.smack.XMPPConnection.login(XMPPConnection.java:341)

at org.jivesoftware.LoginDialog$LoginPanel.login(LoginDialog.java:828)

at org.jivesoftware.LoginDialog$LoginPanel.access$400(LoginDialog.java:196)

at org.jivesoftware.LoginDialog$LoginPanel$1.construct(LoginDialog.java:594)

at org.jivesoftware.spark.util.SwingWorker$2.run(SwingWorker.java:129)

at java.lang.Thread.run(Unknown Source)

Caused by: GSSException: No valid credentials provided (Mechanism level: Identifier doesn’t match expected value (906))

at sun.security.jgss.krb5.Krb5Context.initSecContext(Unknown Source)

at sun.security.jgss.GSSContextImpl.initSecContext(Unknown Source)

… 9 more

Caused by: KrbException: Identifier doesn’t match expected value (906)

at sun.security.krb5.internal.PAData.<init>(Unknown Source)

at sun.security.krb5.internal.KRBError.<init>(Unknown Source)

at sun.security.krb5.KrbTgsRep.<init>(Unknown Source)

at sun.security.krb5.KrbTgsReq.getReply(Unknown Source)

at sun.security.krb5.internal.CredentialsUtil.serviceCreds(Unknown Source)

at sun.security.krb5.internal.CredentialsUtil.acquireServiceCreds(Unknown Source)

at sun.security.krb5.Credentials.acquireServiceCreds(Unknown Source)

… 12 more

Mar 25, 2008 2:08:38 PM org.jivesoftware.spark.util.log.Log warning

WARNING: Exception in Login:

not-authorized(401)

at org.jivesoftware.smack.NonSASLAuthentication.authenticate(NonSASLAuthentication .java:94)

at org.jivesoftware.smack.SASLAuthentication.authenticate(SASLAuthentication.java: 227)

at org.jivesoftware.smack.XMPPConnection.login(XMPPConnection.java:341)

at org.jivesoftware.LoginDialog$LoginPanel.login(LoginDialog.java:828)

at org.jivesoftware.LoginDialog$LoginPanel.access$400(LoginDialog.java:196)

at org.jivesoftware.LoginDialog$LoginPanel$1.construct(LoginDialog.java:594)

at org.jivesoftware.spark.util.SwingWorker$2.run(SwingWorker.java:129)

at java.lang.Thread.run(Unknown Source)

I also looked at the openfire logs, but none of them seem to have changed.

NO_MESSAGES_OR_FRIEN · March 25, 2008, 6:26pm

At this point you may need to put back your encryption strings in the krb5.ini. Also I would clear the logs of the server before each attempt for fresh errors. Have you rebooted after changing the in files as well (both server and client).

Scott9 · March 25, 2008, 6:44pm

Ok, I have put the encryption strings back in, clear the logs for server and client and rebooted both machines. I am still getting the same error in spark. Below are the errors I see in the logs.

spark user logs:

Mar 25, 2008 2:36:46 PM org.jivesoftware.spark.util.log.Log warning

WARNING: Exception in Login:

not-authorized(401)

at org.jivesoftware.smack.NonSASLAuthentication.authenticate(NonSASLAuthentication .java:94)

at org.jivesoftware.smack.SASLAuthentication.authenticate(SASLAuthentication.java: 227)

at org.jivesoftware.smack.XMPPConnection.login(XMPPConnection.java:341)

at org.jivesoftware.LoginDialog$LoginPanel.login(LoginDialog.java:828)

at org.jivesoftware.LoginDialog$LoginPanel.access$400(LoginDialog.java:196)

at org.jivesoftware.LoginDialog$LoginPanel$1.construct(LoginDialog.java:594)

at org.jivesoftware.spark.util.SwingWorker$2.run(SwingWorker.java:129)

at java.lang.Thread.run(Unknown Source)

spark logs in program files: