Unable to connect using Single Sign-On

[jackynek]

Hello,

after January Windows updates Spark (2.9.4) giving this errors during loging in:

org.jivesoftware.smack.SmackException$NoResponseException: No response received within reply timeout. Timeout was 10000ms (~10s). While waiting for stream compression feature
at org.jivesoftware.smack.SmackException$NoResponseException.newWith(SmackException.java:93)
at org.jivesoftware.smack.SynchronizationPoint.checkForResponse(SynchronizationPoint.java:317)
at org.jivesoftware.smack.SynchronizationPoint.checkIfSuccessOrWait(SynchronizationPoint.java:160)
at org.jivesoftware.smack.tcp.XMPPTCPConnection.loginInternal(XMPPTCPConnection.java:408)
at org.jivesoftware.smack.AbstractXMPPConnection.login(AbstractXMPPConnection.java:546)
at org.jivesoftware.LoginDialog$LoginPanel.login(LoginDialog.java:1128)
at org.jivesoftware.LoginDialog$LoginPanel.access$900(LoginDialog.java:370)
at org.jivesoftware.LoginDialog$LoginPanel$3.construct(LoginDialog.java:910)
at org.jivesoftware.spark.util.SwingWorker.lambda$new$1(SwingWorker.java:139)
at java.lang.Thread.run(Unknown Source)

Does anybody have any idea how to fix this problem?

Thank you very much.

[ilyaHlevnoy]

Hey!
It looks like Windows fixed this in the latest updates, unfortunately I can’t verify that.

What Java are you using in Openfire and in Spark?

Perhaps these topics will help you:

Issues with SSO on Spark

Hello everyone. For a long time we have been using spark just fine and now suddenly no one can log in using SSO. I have red several of the forum posts and done several walkthrough’s with no success. The client side details show this org.jivesoftware.smack.sasl.SASLErrorException: SASLError using GSSAPI: not-authorized at org.jivesoftware.smack.SASLAuthentication.authenticationFailed(SASLAuthentication.java:292) at org.jivesoftware.smack.tcp.XMPPTCPConnection$PacketReader.parsePackets(XMPPTC…

Spark SSO error: Empty nameStrings not allowed

Hello. I’ve spent about 2 week testing strange error with Spark SSO login procedure with Samba4 Active Directory domain. My Openfire settings are typical and working with Miranda NG (with and w/o SSO), web client conversejs.js (w/o SSO) and Spark w/o SSO. With SSO in Spark there is a mentioned in subject error if User’s domain account satisfies at least 1 of 2 conditions: displayName attribute length > 4 symbols sAMAccountName attribute length > 9 symbols Otherwise SSO in Spark works. OS fo…

https://bugs.openjdk.org/browse/JDK-8139348

[jackynek]

Unfortunately Windows Updates looks like breaks this… I tried to rollback updates, but it didn´t help.

Strange is, that sometimes I can log in, but sometimes it giving mi this error. Before updates it worked normally without any issues.

javafx.runtime.version=8.0.202
javafx.runtime.build=b07

[jackynek]

Now the error is different (shorter), but the same scenario. Sometimes it pass through and I can normally login and sometimes it ending with this errror:

org.jivesoftware.smack.sasl.SASLErrorException: SASLError using GSSAPI: not-authorized
at org.jivesoftware.smack.SASLAuthentication.authenticationFailed(SASLAuthentication.java:292)
at org.jivesoftware.smack.tcp.XMPPTCPConnection$PacketReader.parsePackets(XMPPTCPConnection.java:1200)
at org.jivesoftware.smack.tcp.XMPPTCPConnection$PacketReader.access$1000(XMPPTCPConnection.java:1092)
at org.jivesoftware.smack.tcp.XMPPTCPConnection$PacketReader$1.run(XMPPTCPConnection.java:1112)
at java.lang.Thread.run(Unknown Source)

[jackynek]

OK, I solved my problem again by myself.

I needed to recreate a new keytab file with AES256-SHA1 encryption, after that it started working like a charm.

[ilyaHlevnoy]

@jackynek

h AES256-SH

SHA1,3DES,RC4 very old.
I’m glad you found a solution

[jackynek]

Yes it is, but it is still a default microsoft option when you creating keytab.

Everybody who can have this problem after Windows Update (Especially Novemeber 2022 and later) recreate a new keytab file with this command:

ktpass /princ xmpp/openfireserver.domain.local@DOMAIN.LOCAL -mapUser xmpp-openfire@DOMAIN.LOCAL /pass * /crypto AES256-SHA1 /ptype KRB5_NT_PRINCIPAL /out c:\file.keytaab

[arturo]

and for those , who have a problem with SSO spark login - empty principal/username after updating windows 11 to 22H2 you need to add entries to the windows registry:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
“LsaCfgFlags”=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard]
“LsaCfgFlags”=dword:00000000