Questions[spnego](server)

I have a standalone httpd+Tomcat 8.5.65 installation on OpenJDK 11 with OpenCms 11.0.2 for my client's internal website.

They have a LDAP network and they're requesting the automated logon using Kerberos (krb5).

We configured SPNego and it works on Tomcat: a test JSP page including the code:

 <%= request.getRemoteUser() %> 

works as intended (prints the username) when accessed through tomcat directly (port 8080). But when I access OpenCms via Tomcat, this authentication doesn't work. Specifically, the CmsJspLoginBean object's isLoggedIn() method returns false. In other words, the current user is [Guest].

Is there anything I have to do to "connect" OpenCms to Kerberos on the OpenCms side, knowing that Tomcat is already correctly configured?

Also: OpenCms has the LDAP Connector installed and it works, I don't think it has anything to do with this.

We encountered this problem with different versions of OS & Subversion on the server side, the following details being the same:

• We used https protocol to access the SVN repositories.
• We used Apache HTTPD + mod_dav_svn + mod_authz_svn. We also used either mod_auth_kerb or mod_auth_gssapi.
• The users authenticated with Windows Integrated Authentication. Members of a certain group were allowed to access the SVN repos.
• The clients were Windows workstations, with fairly recent SVN versions (1.13-1.14).

Some clients worked OK, others got a HTTP 400 Bad Request error on accessing the SVN repository. On the server side the error manifested in a "NO AUTH DATA Client did not send any authentication headers" message in the SSL error log.

Some users consistently succeeded, others consistently failed to access the SVN repos.

We have a slightly complicated IDAM setup:

I.e. the end user's machine and browser sit in one network with the parent AD, and our Jetty-based application and the AD that it can talk to (local AD) sit in the other.

There is a two-way trust between the two ADs. The browser in the parent network has the local domain in trusted sites.

The Jetty server's setup is as follows:

• it uses a keytab file generated against a principal in the local AD
• it is running as a Windows service under a user defined in the local AD
• the realm, domain-realm mapping and kdc are defined against the domain of the local AD
• it uses spnego - isInitiator is set to false; doNotPrompt is true; storeKey is true

The problem is:

• as a test, accessing the server from a browser inside the local network (ie linked to the local AD) works - Kerberos debug info appears in the logs, I can see correct Kerberos negotiation in the HTTP traffic, and the user is signed in automatically. Brilliant.

• however, accessing the server from a browser inside the parent network (which is how our users will do things) doesn't work! The browser gets a 401 unauth back but then prompts for credentials, which when entered give a blank screen. Then clicking into the address bar and hitting Enter does one of two things, depending on whether the credentials are for the remote or local AD:

  • local AD credentials then log in fine, with Kerberos from scratch in the logs (GET request, 401 unauth response, Kerberos headers request, etc)
  • remote AD credentials do not log in (GET request, 401 unauth response, what looks like an NTLM header: Authorization: Negotiate <60 or so random chars>)

Either way, the fact that it's prompting is wrong!

Is there an explanation for these symptoms? Can the setup we have do what we want?

In terms of what about the above description could be wrong: any configuration I've mentioned regarding the Jetty server should be accurate, as I did it. I'm happy to provide more details. Any config regarding either AD or the parent network browser is potentially suspect, because it's not under my control and I've had the configuration reported to me rather than seen it for myself.

I was trying to set up a Java service using the SPNEGO servlet filter and a listen port of 8080 for authentication on a host that is also running web applications hosted in IIS7.

I followed the SPNEGO installation instructions and created an SPN for HTTP/canonical.host.name, bound to the user performing the authentication for the Java service.

After this change, the Java service is able to authenticate clients via SPNEGO, but IIS7 application pools running with custom identities (i.e. user names instead of ApplicationPoolIdentity) are suddenly unable to authenticate.

What I don't understand here:

• How does Kerberos authentication work for IIS when there is no SPN for HTTP/canonical.host.name defined using (as checked via setspn -Q)? Clients still request and receive tickets for exactly this SPN.
• Out of interest, we tried running the application pools with the identity of the Java service that successfully authenticates. It still did not work as long as the SPN was defined - attempts to authenticate with a Kerberos ticket failed with a KRB_AP_ERR_MODIFIED returned. Running the application pool as the user that the SPN was registered to did not change this behaviour.
• Microsoft specifies SPNs to include a port number, but IE does not conform to this and never sends a port number in the SPN (Firefox and Chrome follow in this behaviour).

So, is there any way to have multiple independent SPNEGO authenticated services on the same host?

I am trying to implement kerberos SSO in our network using spnego on a tomcat server.

We have created an account (TCNKRBGINA) on the domain for the preauthentication, and setspn'ed it to the http server:

Setspn -A HTTPS/testtech.etat-ge.ch TCNKRBGINA
Setspn -A HTTP/testtech.etat-ge.ch TCNKRBGINA

But the client (IE or Firefox) sends an NTLM token instead of a kerberos ticket.

The problem doesn't seem to be on the server side because, when no Authorization header is sent, it correctly returns a 401 status code with a WWW-Authenticate: Negotiate header. The next request sent by the client contains the NTLM token, before the server had a chance to contact the domain controller.