个人中心
gpt4 book ai didi

java - Windows Server 上 Tomcat 中的 Spnego keytab 身份验证失败

转载 作者：行者123 更新时间：2023-11-30 11:28:43 25 4
gpt4 key购买 nike

我正在 Tomcat 6 服务器上测试 Spengo API。我在浏览器中调用的文件是:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
    <title>Hello SPNEGO Example</title>
</head>
<body>
Hello <%= request.getRemoteUser() %> !
</body>
</html>

我将 spnego-r7.jar 添加到我的 %TOMCAT_HOME%\lib 并将以下过滤器添加到我的 %TOMCAT_HOME%\conf\web.xml:

<filter>
    <filter-name>SpnegoHttpFilter</filter-name>
    <filter-class>net.sourceforge.spnego.SpnegoHttpFilter</filter-class>

    <init-param>
        <param-name>spnego.allow.basic</param-name>
        <param-value>true</param-value>
    </init-param>

    <init-param>
        <param-name>spnego.allow.localhost</param-name>
        <param-value>true</param-value>
    </init-param>

    <init-param>
        <param-name>spnego.allow.unsecure.basic</param-name>
        <param-value>true</param-value>
    </init-param>

    <init-param>
        <param-name>spnego.login.client.module</param-name>
        <param-value>spnego-client</param-value>
    </init-param>

    <init-param>
        <param-name>spnego.krb5.conf</param-name>
        <param-value>krb5.conf</param-value>
    </init-param>

    <init-param>
        <param-name>spnego.login.conf</param-name>
        <param-value>login.conf</param-value>
    </init-param>

    <init-param>
        <param-name>spnego.preauth.username</param-name>
        <param-value></param-value>
    </init-param>

    <init-param>
        <param-name>spnego.preauth.password</param-name>
        <param-value></param-value>
    </init-param>

    <init-param>
        <param-name>spnego.login.server.module</param-name>
        <param-value>spnego-server</param-value>
    </init-param>

    <init-param>
        <param-name>spnego.prompt.ntlm</param-name>
        <param-value>true</param-value>
    </init-param>

    <init-param>
        <param-name>spnego.logger.level</param-name>
        <param-value>1</param-value>
    </init-param>
</filter>

<filter-mapping>
    <filter-name>SpnegoHttpFilter</filter-name>
    <url-pattern>*.jsp</url-pattern>
</filter-mapping>

在 %TOMCAT_HOME% 中是一个 krb5.conf、一个 login.conf 和 sys-spn.keytab。

sys-spn.keytab 已使用独立的 java 程序进行测试并且可以正常工作。

krb5.conf 如下:

[libdefaults]
    default_tkt_enctypes = rc4-hmac
    default_tgs_enctypes = rc4-hmac
    permitted_enctypes   = rc4-hmac
    default_realm        = TEST.LOCAL

[realms]
    TEST.LOCAL  = {
        kdc = dc2.test.local 
        default_domain = TEST.LOCAL 
}

[domain_realm]
    .TEST.LOCAL = TEST.LOCAL

我的login.conf如下:

spnego-client {
    com.sun.security.auth.module.Krb5LoginModule required;
};

spnego-server {
    com.sun.security.auth.module.Krb5LoginModule required
    storeKey=true
    useKeyTab=true
    keyTab="C:/sys-spn.keytab"
    principal="HTTP/as1.test.local@TEST.LOCAL";
};

DC2 是我的 KDC，AS1 是我的应用服务器。当我从不使用 key 表(登录并通过 SPN)的网络浏览器调用 hello_spnego.jsp 时，握手是正确的，我得到了 Hello !当我不使用登录并通过 key 表文件时，我收到以下错误:

SEVERE: Servlet.service() for servlet jsp threw exception
KrbException: Specified version of key is not available (44)
    at sun.security.krb5.EncryptionKey.findKey(Unknown Source)
    at sun.security.krb5.KrbApReq.authenticate(Unknown Source)
    at sun.security.krb5.KrbApReq.<init>(Unknown Source)
    at sun.security.jgss.krb5.InitSecContextToken.<init>(Unknown Source)
    at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Unknown Source)
    at sun.security.jgss.GSSContextImpl.acceptSecContext(Unknown Source)
    at sun.security.jgss.GSSContextImpl.acceptSecContext(Unknown Source)
    at sun.security.jgss.spnego.SpNegoContext.GSS_acceptSecContext(Unknown Source)
    at sun.security.jgss.spnego.SpNegoContext.acceptSecContext(Unknown Source)
    at sun.security.jgss.GSSContextImpl.acceptSecContext(Unknown Source)
    at sun.security.jgss.GSSContextImpl.acceptSecContext(Unknown Source)
    at net.sourceforge.spnego.SpnegoAuthenticator.doSpnegoAuth(SpnegoAuthenticator.java:444)
    at net.sourceforge.spnego.SpnegoAuthenticator.authenticate(SpnegoAuthenticator.java:283)
    at net.sourceforge.spnego.SpnegoHttpFilter.doFilter(SpnegoHttpFilter.java:229)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293)
    at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:861)
    at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:606)
    at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
    at java.lang.Thread.run(Unknown Source)

我的问题是什么？

最佳答案

我的 key 表文件有一个错误的 KVNO。提示:如有疑问，请始终重新生成您的 key 表文件!

关于java - Windows Server 上 Tomcat 中的 Spnego keytab 身份验证失败，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/18783886/

25 4 0
文章推荐： javascript - 获取被点击的特定按钮的 ID。
文章推荐： swift - 如何通过 swift 中的函数调用打开弹出窗口(单独的 View Controller )
文章推荐： swift - 过渡到上一个 View 时呈现模式
文章推荐： javascript - 在 div id 中放置一个名称值
行者123
个人简介

我是一名优秀的程序员,十分优秀！

滴滴打车优惠券免费领取
滴滴打车优惠券
全站热门文章
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com