Skip to content
Advertisement

CAS Spnego – KrbException: Checksum failed

I’m trying to use SPNEGO (Kerberos) authentication with Active Directory – with CAS server (github). Here is official instruction: https://apereo.github.io/cas/5.1.x/installation/SPNEGO-Authentication.html

I used this template: https://github.com/apereo/cas-overlay-template So pom.xmlis taken from there.

Unfortunately, I only receive this exception:

JavaScript

Question: What does it means? Which configuration element could make this issue?

Advertisement

Answer

I found the solution. In short: I have bad cas.authn.spnego.jcifsServicePrincipal in cas.properties.

Details:

  • Active Directory
  • JDK 1.8 + JCE
  • Apereo CAS 5.1
  • Tomcat 8.5.15 on Windows Server 2012 R2

CAS documentation suggest such configuration:

JavaScript

But be aware, that jcifsServicePrincipal is principal name – the name of the Active Directory user, which has SPN assigned. I have user cn=service_xxx which has servicePrincipalName attribute assigned to HTTP/machine1.domain.com and HTTP/machine1 (but I think, that only first is needed).

It’s worth to follow this tutorial: Kerberos / SPNEGO based SSO (Single Sign-On) in Weblogic.

How does my CAS works:

Using above tutorial, I create SPN for the existing user service_xxx (user which may log into machine1):

JavaScript

User service_xxx has such properties in Active Directory: AES 128 bit encryption and AES 256 bit encryption.

Both operations were done by Active Directory administrator (he has sufficient privileges).

So service_xxx is principal name (user name) and HTTP/machine1.domain.com is only SPN attribute assigned to the principal. As far as I understood – now CAS server running on machine machine1.domain.com (this is machine URL) can obtain any information from AD (LDAP) by user service_xxx. So CAS server can also authenticate any user using Kerberos protocol. In my opinion, this is why the CAS property jcifsServicePrincipal should point to principal service_xxx@domain.com (full principal name with @domain.com) and not to its SPN attribute name (unless they are equal strings).

My configuration details:

  1. Principal with AES attributes and SPN attribute set
  2. Java with Java Cryptography Extension (JCE) Unlimited Strength installed
  3. Keytab created using ktab.exe tool from JDK
  4. login.conf file – the same as in CAS documentation
  5. cas.properties and krb5.conf as shown below

Keytab

Key tab creation procedure (no any special privileges require):

JavaScript

-k specifies key tab output file name. -n 0 specifies KNVO number. Disclaimer: for my user cn=service_xxx in Active Directory there is no attribute msDS-KeyVersionNumber (KNVO), so I used 0. But I think that Windows ignores the KNVO number – see this comment.

One more information about keytab:

A lot of tutorials and even official documentation suggest to make keytab using ktpass.exe. Unfortunately this requires AD admin privilege, so this is not a good idea. Better use ktab.exe from JDK (as above). You only need to remember always generating new keytab after service_xxx password change.

To test key tab there several options:

cas.properties which works for me:

JavaScript

It is funny that paths like /etc/cas/config works also on Windows and points to C: drive root – so C:etccasconfig. Be aware, that all config here (and at all Java files) paths are using forward slash.

I also supply krb5.conf. This file is specific to your organization. Often you can find it somewhere inside C:Windows folder in any workstation connected to domain. So you can copy it, and edit as you want. You can also write it by hand (sample is in CAS Documentation).

The most important is to add there path to keytab:

JavaScript

As you can see – default_keytab_name parameter is under [libdefaults]. The same path is also inside login.conf file (see Apereo CAS documentation).

If you enable debug in CAS (cas.authn.spnego.kerberosDebug=true and change debug level inside log4j2.xml). Then you should see when CAS is using your keytab, something like:

JavaScript

Otherwise, you will see that CAS Looking for keys for: service_xxx@domain.com and then throws exception similar to below.

Troubleshooting 1:

If you see exception similar to this one:

JavaScript

it’s very likely, that you have wrong path to .keytab file (as pointed also here).

Troubleshooting 2:

If CAS complains about not supported encryption:

JavaScript

it’s likely that Java JCE isn’t installed or Java was updated and in the result JCE support was overwritten by update (install JCE again).

User contributions licensed under: CC BY-SA
3 People found this is helpful
Advertisement