java - Spring Security Kerberos、Kerberos + AD - 错误 : Access Denied, 没有可存储的 key

Question

这来自 Kerberos 示例应用程序，位于 https://github.com/spring-projects/spring-security-kerberos/tree/master/spring-security-kerberos-samples/sec-server-win-auth对应http://docs.spring.io/spring-security-kerberos/docs/1.0.1.RELEASE/reference/htmlsingle/#samples-sec-server-win-auth 。

我所做的只是修改 src/main/resources/application.yml 以适合我的系统，并在创建 SPN 和 Keytab 文件之间来回切换。我的 Spring 申请似乎开始顺利。下面是通过控制台输出的 Kerberos 配置。

Debug is true storeKey true useTicketCache false useKeyTab true doNotPrompt true ticketCache is null isInitiator false KeyTab is /etc/client-server.keytab refreshKrb5Config is false principal is HTTP/client-server.example.org@REALM tryFirstPass is false useFirstPass is false storePass is false clearPass is false
principal is HTTP/client-server.example.org@REALM
Will use keytab
Commit Succeeded

所以我可以看到客户端应用程序到目前为止已经接受了我的设置。然后我尝试在另一台机器上通过chrome访问client-server:8080/hello。我收到的第一个错误是访问被拒绝(用户是匿名的)。这应该重定向到身份验证入口点。然后我得到以下信息，以“No key to store”结尾

[nio-8080-exec-4] w.a.SpnegoAuthenticationProcessingFilter : Received Negotiate Header for request client-server:8080/favicon.ico: Negotiate YIIHZAYGKwYBBQUCoIIHWDCCB1SgMDAuBgk……./9AdsoFH2ya7C
[nio-8080-exec-4] o.s.s.authentication.ProviderManager : Authentication attempt using org.springframework.security.kerberos.authentication.KerberosServiceAuthenticationProvider
[nio-8080-exec-4] .a.KerberosServiceAuthenticationProvider : Try to validate Kerberos Token
[nio-8080-exec-4] .a.KerberosServiceAuthenticationProvider : Succesfully validated myUsername@REALM
[nio-8080-exec-4] o.s.s.l.s.FilterBasedLdapUserSearch : Searching for user 'myUsername@REALM', with user search [ searchFilter: '', searchBase: 'DC=xxxxx', scope: subtree, searchTimeLimit: 0, derefLinkFlag: false ]
Debug is true storeKey true useTicketCache true useKeyTab true doNotPrompt true ticketCache is null isInitiator true KeyTab is null refreshKrb5Config is false principal is HTTP/client-server.example.org@REALM tryFirstPass is false useFirstPass is false storePass is false clearPass is false
Acquire TGT from Cache
Principal is HTTP/client-server.example.org@REALM
2015-11-27 11:38:47.906 DEBUG 3183 --- [nio-8080-exec-4] w.c.HttpSessionSecurityContextRepository : SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession. 2015-11-27 11:38:47.906 DEBUG 3183 --- [nio-8080-exec-4] s.s.w.c.SecurityContextPersistenceFilter : SecurityContextHolder now cleared, as request processing completed 2015-11-27 11:38:47.912 ERROR 3183 --- [nio-8080-exec-4] o.a.c.c.C.[.[.[/].[dispatcherServlet] : Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception org.springframework.ldap.AuthenticationException: No key to store; nested exception is javax.naming.AuthenticationException: No key to store [Root exception is javax.security.auth.login.LoginException: No key to store]

现在看来该应用程序能够验证我的用户，但我不知道它是否可以找到我的用户信息。在 cr.openjdk.java.net/~weijun/7201053/webrev.00/raw_files/new/src/share/classes/com/sun/security/auth/module/Krb5LoginModule.java 查看 Krb5LoginModule.java 的源代码，您通过简单的查找就可以发现登录异常，没有key来存储。代码显示我的 ktab(我猜测是 keytab)为空。奇怪的是，控制台输出确实表明，当我尝试使用浏览器导航时， key 表为空，即使在我启动应用程序时它不是空的。

有谁知道为什么当我有用户尝试访问我的应用程序时我的 key 表变为空？或者我的应用程序或系统配置有其他问题吗？

Answer 1

我遇到了类似的问题，根本原因实际上是 kinit 创建的损坏的 key 。解决方案是删除缓存(在/tmp/kbr5cc_[UID] 下以及 JAAS 配置文件中的 TicketCache="/home/solr/cache"设置的值中，并且在启动应用程序之前不要运行 kinit。

为了了解发生了什么，我向 JVM 添加了以下标志:-Dsun.security.krb5.debug=true

我看到 key 的开始和结束时间设置为纪元日期:

>>>DEBUG <CCacheInputStream> key type: 0
>>>DEBUG <CCacheInputStream> auth time: Thu Jan 01 00:00:00 UTC 1970
>>>DEBUG <CCacheInputStream> start time: null
>>>DEBUG <CCacheInputStream> end time: Thu Jan 01 00:00:00 UTC 1970
>>>DEBUG <CCacheInputStream> renew_till time: null