Need help with transparent single sign-on servlet filter

[Chup Rush]

Hi all,

I am trying to see if I can write a servlet filter to do transparent single sign-on using Kerberos authentication ticket; however, this is over my head

I get the following error:
GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos Key)

I am not sure if my code is being able to read the keytab or even if I am doing this correct . I appreciate any help.

   

        if(request.getHeader("authorization") == null){
        	response.setStatus(response.SC_UNAUTHORIZED);
        	response.addHeader("WWW-Authenticate", "NEGOTIATE");
	}

	if(request.getHeader("authorization") != null){

                 boolean kerberosshowconfig = true;

		String kerberosauthloginconfig = "C:/tomcat/webapps/ROOT/sakai-jaas.conf";
		String kerberoskrb5conf = "C:/tomcat/webapps/ROOT/krb5.ini";

	        System.setProperty("java.security.krb5.conf", "C:/krb5.conf");
	        System.setProperty("java.security.auth.login.config", "C:/sa.conf");



		byte[] token = null;
		byte[] tokenForPeer = null;
		byte[] tokenForEndpoint = new byte[0];

		String endpointSPN = null;

		GSSManager manager = GSSManager.getInstance();

		GSSContext context = null;

		GSSCredential clientCred = null;
		GSSCredential myCred = null;

		try {
		
		
		//GSSManager manager = GSSManager.getInstance();
		
		     Oid krb5Mechanism = new Oid("1.2.840.113554.1.2.2");
		     Oid krb5PrincipalNameType = new Oid("1.2.840.113554.1.2.2.1");
		
		// Acquire credentials for the server
		     GSSCredential serverCreds = manager.createCredential(null, 
		                                             GSSCredential.DEFAULT_LIFETIME, 
		                                             krb5Mechanism, 
                                             GSSCredential.ACCEPT_ONLY); 
		  

...
 

[Himanshu Kansal]

Hello Chup,

Please use proper [code] tags.

Do krb5.conf and sa.conf have proper format?

[Chup Rush]

I think I have the proper keytab and krb5 configuration since I can use kinit and get ticket from the kdc.

 
com.sun.security.jgss.initiate {
        com.sun.security.auth.module.Krb5LoginModule required
        principal="HTTP/sakaidev.mytest.org@ MYTEST.ORG" useKeyTab=true
        keyTab="c:/sakai2.keytab" storeKey=true debug=true doNotPrompt=true;
};

com.sun.security.jgss.accept {
        com.sun.security.auth.module.Krb5LoginModule required
        principal="HTTP/sakaidev. mytest.org@ MYTEST.ORG" useKeyTab=true
        keyTab="c:/sakai2.keytab" storeKey=true doNotPrompt=true;
};  

 

krb5.conf

  
[libdefaults]
 default_realm = MYTEST.ORG
 ticket_lifetime = 10h
 forwardable = yes

[realms]
 MYTEST.ORG = {
  kdc = 206.110.88.182:88
  admin_server = 206.110.88.182:749
  default_domain = MYTEST.ORG
 }

[domain_realm]
 .mytest.org = MYTEST.ORG
 mytest.org = MYTEST.ORG

[appdefaults]
 pam = {
   debug = true
   ticket_lifetime = 36000
   renew_lifetime = 36000
   forwardable = true
   krb4_convert = false
 }

  

[Pat Gonzalez]

Here's an open source project http://spnego.sourceforge.net with documentation, examples and a tutorial. It does exactly what you are trying to do