CAS Spnego - KrbException：校验和失败

问题描述：

我正在尝试使用Active Directory中的SPNEGO（Kerberos）身份验证 - 使用CAS服务器（github）。下面是官方的指令：https://apereo.github.io/cas/5.1.x/installation/SPNEGO-Authentication.html CAS Spnego - KrbException：校验和失败

我用这个模板：https://github.com/apereo/cas-overlay-template 所以pom.xml从那里取。

不幸的是，我只收到此异常：

>>> EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType 
jcifs.spnego.AuthenticationException: Error performing Kerberos authentication: java.lang.reflect.InvocationTargetException 
     at jcifs.spnego.Authentication.processKerberos(Authentication.java:447) 
     at jcifs.spnego.Authentication.processSpnego(Authentication.java:346) 
     at jcifs.spnego.Authentication.process(Authentication.java:235) 
     at jcifs.spnego.Authentication$$FastClassBySpringCGLIB$$c5958df9.invoke(<generated>) 
     at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:204) 
     at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.invokeJoinpoint(CglibAopProxy.java:738) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157) 
     at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:133) 
     at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:121) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) 
     at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:673) 
     at jcifs.spnego.Authentication$$EnhancerBySpringCGLIB$$84bb5e21.process(<generated>) 
     at org.apereo.cas.support.spnego.authentication.handler.support.JcifsSpnegoAuthenticationHandler.doAuthentication(JcifsSpnegoAuthenticationHandler.java:60) 
     at org.apereo.cas.authentication.handler.support.AbstractPreAndPostProcessingAuthenticationHandler.authenticate(AbstractPreAndPostProcessingAuthenticationHandler.java:40) 
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
     at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) 
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) 
     at java.lang.reflect.Method.invoke(Unknown Source) 
     at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:333) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:190) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157) 
     at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:133) 
     at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:121) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) 
     at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:213) 
     at com.sun.proxy.$Proxy118.authenticate(Unknown Source) 
     at org.apereo.cas.authentication.AbstractAuthenticationManager.authenticateAndResolvePrincipal(AbstractAuthenticationManager.java:174) 
     at org.apereo.cas.authentication.PolicyBasedAuthenticationManager.lambda$null$3(PolicyBasedAuthenticationManager.java:129) 
     at java.util.stream.MatchOps$1MatchSink.accept(Unknown Source) 
     at java.util.stream.ReferencePipeline$2$1.accept(Unknown Source) 
     at java.util.Spliterators$IteratorSpliterator.tryAdvance(Unknown Source) 
     at java.util.stream.ReferencePipeline.forEachWithCancel(Unknown Source) 
     at java.util.stream.AbstractPipeline.copyIntoWithCancel(Unknown Source) 
     at java.util.stream.AbstractPipeline.copyInto(Unknown Source) 
     at java.util.stream.AbstractPipeline.wrapAndCopyInto(Unknown Source) 
     at java.util.stream.MatchOps$MatchOp.evaluateSequential(Unknown Source) 
     at java.util.stream.MatchOps$MatchOp.evaluateSequential(Unknown Source) 
     at java.util.stream.AbstractPipeline.evaluate(Unknown Source) 
     at java.util.stream.ReferencePipeline.anyMatch(Unknown Source) 
     at org.apereo.cas.authentication.PolicyBasedAuthenticationManager.lambda$authenticateInternal$4(PolicyBasedAuthenticationManager.java:126) 
     at java.util.stream.MatchOps$1MatchSink.accept(Unknown Source) 
     at java.util.HashMap$KeySpliterator.tryAdvance(Unknown Source) 
     at java.util.stream.ReferencePipeline.forEachWithCancel(Unknown Source) 
     at java.util.stream.AbstractPipeline.copyIntoWithCancel(Unknown Source) 
     at java.util.stream.AbstractPipeline.copyInto(Unknown Source) 
     at java.util.stream.AbstractPipeline.wrapAndCopyInto(Unknown Source) 
     at java.util.stream.MatchOps$MatchOp.evaluateSequential(Unknown Source) 
     at java.util.stream.MatchOps$MatchOp.evaluateSequential(Unknown Source) 
     at java.util.stream.AbstractPipeline.evaluate(Unknown Source) 
     at java.util.stream.ReferencePipeline.anyMatch(Unknown Source) 
     at org.apereo.cas.authentication.PolicyBasedAuthenticationManager.authenticateInternal(PolicyBasedAuthenticationManager.java:124) 
     at org.apereo.cas.authentication.AbstractAuthenticationManager.authenticate(AbstractAuthenticationManager.java:140) 
     at org.apereo.cas.authentication.AbstractAuthenticationManager$$FastClassBySpringCGLIB$$12a86894.invoke(<generated>) 
     at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:204) 
     at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.invokeJoinpoint(CglibAopProxy.java:738) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157) 
     at org.springframework.aop.aspectj.MethodInvocationProceedingJoinPoint.proceed(MethodInvocationProceedingJoinPoint.java:85) 
     at org.apereo.inspektr.audit.AuditTrailManagementAspect.handleAuditTrail(AuditTrailManagementAspect.java:134) 
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
     at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) 
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) 
     at java.lang.reflect.Method.invoke(Unknown Source) 
     at org.springframework.aop.aspectj.AbstractAspectJAdvice.invokeAdviceMethodWithGivenArgs(AbstractAspectJAdvice.java:629) 
     at org.springframework.aop.aspectj.AbstractAspectJAdvice.invokeAdviceMethod(AbstractAspectJAdvice.java:618) 
     at org.springframework.aop.aspectj.AspectJAroundAdvice.invoke(AspectJAroundAdvice.java:70) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:168) 
     at org.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:92) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) 
     at com.ryantenney.metrics.spring.MeteredMethodInterceptor.invoke(MeteredMethodInterceptor.java:45) 
     at com.ryantenney.metrics.spring.MeteredMethodInterceptor.invoke(MeteredMethodInterceptor.java:32) 
     at com.ryantenney.metrics.spring.AbstractMetricMethodInterceptor.invoke(AbstractMetricMethodInterceptor.java:59) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) 
     at com.ryantenney.metrics.spring.TimedMethodInterceptor.invoke(TimedMethodInterceptor.java:48) 
     at com.ryantenney.metrics.spring.TimedMethodInterceptor.invoke(TimedMethodInterceptor.java:34) 
     at com.ryantenney.metrics.spring.AbstractMetricMethodInterceptor.invoke(AbstractMetricMethodInterceptor.java:59) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) 
     at com.ryantenney.metrics.spring.CountedMethodInterceptor.invoke(CountedMethodInterceptor.java:46) 
     at com.ryantenney.metrics.spring.CountedMethodInterceptor.invoke(CountedMethodInterceptor.java:32) 
     at com.ryantenney.metrics.spring.AbstractMetricMethodInterceptor.invoke(AbstractMetricMethodInterceptor.java:59) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) 
     at com.ryantenney.metrics.spring.MeteredMethodInterceptor.invoke(MeteredMethodInterceptor.java:45) 
     at com.ryantenney.metrics.spring.MeteredMethodInterceptor.invoke(MeteredMethodInterceptor.java:32) 
     at com.ryantenney.metrics.spring.AbstractMetricMethodInterceptor.invoke(AbstractMetricMethodInterceptor.java:59) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) 
     at com.ryantenney.metrics.spring.TimedMethodInterceptor.invoke(TimedMethodInterceptor.java:48) 
     at com.ryantenney.metrics.spring.TimedMethodInterceptor.invoke(TimedMethodInterceptor.java:34) 
     at com.ryantenney.metrics.spring.AbstractMetricMethodInterceptor.invoke(AbstractMetricMethodInterceptor.java:59) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) 
     at com.ryantenney.metrics.spring.CountedMethodInterceptor.invoke(CountedMethodInterceptor.java:46) 
     at com.ryantenney.metrics.spring.CountedMethodInterceptor.invoke(CountedMethodInterceptor.java:32) 
     at com.ryantenney.metrics.spring.AbstractMetricMethodInterceptor.invoke(AbstractMetricMethodInterceptor.java:59) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) 
     at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:673) 
     at org.apereo.cas.authentication.PolicyBasedAuthenticationManager$$EnhancerBySpringCGLIB$$5085e4b0.authenticate(<generated>) 
     at org.apereo.cas.authentication.DefaultAuthenticationTransactionManager.handle(DefaultAuthenticationTransactionManager.java:34) 
     at org.apereo.cas.authentication.DefaultAuthenticationSystemSupport.handleAuthenticationTransaction(DefaultAuthenticationSystemSupport.java:55) 
     at org.apereo.cas.authentication.DefaultAuthenticationSystemSupport.handleInitialAuthenticationTransaction(DefaultAuthenticationSystemSupport.java:41) 
     at org.apereo.cas.web.flow.resolver.impl.InitialAuthenticationAttemptWebflowEventResolver.resolveInternal(InitialAuthenticationAttemptWebflowEventResolver.java:69) 
     at org.apereo.cas.web.flow.resolver.impl.AbstractCasWebflowEventResolver.resolve(AbstractCasWebflowEventResolver.java:475) 
     at org.apereo.cas.web.flow.resolver.impl.AbstractCasWebflowEventResolver.resolveSingle(AbstractCasWebflowEventResolver.java:480) 
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
     at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) 
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) 
     at java.lang.reflect.Method.invoke(Unknown Source) 
     at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:333) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:190) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157) 
     at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:133) 
     at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:121) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) 
     at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:213) 
     at com.sun.proxy.$Proxy164.resolveSingle(Unknown Source) 
     at org.apereo.cas.web.flow.AbstractAuthenticationAction.doExecute(AbstractAuthenticationAction.java:59) 
     at org.springframework.webflow.action.AbstractAction.execute(AbstractAction.java:188) 
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
     at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) 
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) 
     at java.lang.reflect.Method.invoke(Unknown Source) 
     at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:333) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:190) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157) 
     at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:133) 
     at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:121) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) 
     at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:213) 
     at com.sun.proxy.$Proxy160.execute(Unknown Source) 
     at org.springframework.webflow.execution.ActionExecutor.execute(ActionExecutor.java:51) 
     at org.springframework.webflow.action.EvaluateAction.doExecute(EvaluateAction.java:77) 
     at org.springframework.webflow.action.AbstractAction.execute(AbstractAction.java:188) 
     at org.springframework.webflow.execution.ActionExecutor.execute(ActionExecutor.java:51) 
     at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:101) 
     at org.springframework.webflow.engine.State.enter(State.java:194) 
     at org.springframework.webflow.engine.Transition.execute(Transition.java:228) 
     at org.springframework.webflow.engine.impl.FlowExecutionImpl.execute(FlowExecutionImpl.java:395) 
     at org.springframework.webflow.engine.impl.RequestControlContextImpl.execute(RequestControlContextImpl.java:214) 
     at org.springframework.webflow.engine.TransitionableState.handleEvent(TransitionableState.java:116) 
     at org.springframework.webflow.engine.Flow.handleEvent(Flow.java:547) 
     at org.springframework.webflow.engine.impl.FlowExecutionImpl.handleEvent(FlowExecutionImpl.java:390) 
     at org.springframework.webflow.engine.impl.RequestControlContextImpl.handleEvent(RequestControlContextImpl.java:210) 
     at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:105) 
     at org.springframework.webflow.engine.State.enter(State.java:194) 
     at org.springframework.webflow.engine.Transition.execute(Transition.java:228) 
     at org.springframework.webflow.engine.impl.FlowExecutionImpl.execute(FlowExecutionImpl.java:395) 
     at org.springframework.webflow.engine.impl.RequestControlContextImpl.execute(RequestControlContextImpl.java:214) 
     at org.springframework.webflow.engine.TransitionableState.handleEvent(TransitionableState.java:116) 
     at org.springframework.webflow.engine.Flow.handleEvent(Flow.java:547) 
     at org.springframework.webflow.engine.impl.FlowExecutionImpl.handleEvent(FlowExecutionImpl.java:390) 
     at org.springframework.webflow.engine.impl.RequestControlContextImpl.handleEvent(RequestControlContextImpl.java:210) 
     at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:105) 
     at org.springframework.webflow.engine.State.enter(State.java:194) 
     at org.springframework.webflow.engine.Transition.execute(Transition.java:228) 
     at org.springframework.webflow.engine.impl.FlowExecutionImpl.execute(FlowExecutionImpl.java:395) 
     at org.springframework.webflow.engine.impl.RequestControlContextImpl.execute(RequestControlContextImpl.java:214) 
     at org.springframework.webflow.engine.TransitionableState.handleEvent(TransitionableState.java:116) 
     at org.springframework.webflow.engine.Flow.handleEvent(Flow.java:547) 
     at org.springframework.webflow.engine.impl.FlowExecutionImpl.handleEvent(FlowExecutionImpl.java:390) 
     at org.springframework.webflow.engine.impl.RequestControlContextImpl.handleEvent(RequestControlContextImpl.java:210) 
     at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:105) 
     at org.springframework.webflow.engine.State.enter(State.java:194) 
     at org.springframework.webflow.engine.Transition.execute(Transition.java:228) 
     at org.springframework.webflow.engine.DecisionState.doEnter(DecisionState.java:51) 
     at org.springframework.webflow.engine.State.enter(State.java:194) 
     at org.springframework.webflow.engine.Transition.execute(Transition.java:228) 
     at org.springframework.webflow.engine.impl.FlowExecutionImpl.execute(FlowExecutionImpl.java:395) 
     at org.springframework.webflow.engine.impl.RequestControlContextImpl.execute(RequestControlContextImpl.java:214) 
     at org.springframework.webflow.engine.TransitionableState.handleEvent(TransitionableState.java:116) 
     at org.springframework.webflow.engine.Flow.handleEvent(Flow.java:547) 
     at org.springframework.webflow.engine.impl.FlowExecutionImpl.handleEvent(FlowExecutionImpl.java:390) 
     at org.springframework.webflow.engine.impl.RequestControlContextImpl.handleEvent(RequestControlContextImpl.java:210) 
     at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:105) 
     at org.springframework.webflow.engine.State.enter(State.java:194) 
     at org.springframework.webflow.engine.Transition.execute(Transition.java:228) 
     at org.springframework.webflow.engine.impl.FlowExecutionImpl.execute(FlowExecutionImpl.java:395) 
     at org.springframework.webflow.engine.impl.RequestControlContextImpl.execute(RequestControlContextImpl.java:214) 
     at org.springframework.webflow.engine.TransitionableState.handleEvent(TransitionableState.java:116) 
     at org.springframework.webflow.engine.Flow.handleEvent(Flow.java:547) 
     at org.springframework.webflow.engine.impl.FlowExecutionImpl.handleEvent(FlowExecutionImpl.java:390) 
     at org.springframework.webflow.engine.impl.RequestControlContextImpl.handleEvent(RequestControlContextImpl.java:210) 
     at org.springframework.webflow.engine.ActionState.doEnter(ActionState.java:105) 
     at org.springframework.webflow.engine.State.enter(State.java:194) 
     at org.springframework.webflow.engine.Flow.start(Flow.java:527) 
     at org.springframework.webflow.engine.impl.FlowExecutionImpl.start(FlowExecutionImpl.java:368) 
     at org.springframework.webflow.engine.impl.FlowExecutionImpl.start(FlowExecutionImpl.java:223) 
     at org.springframework.webflow.executor.FlowExecutorImpl.launchExecution(FlowExecutorImpl.java:140) 
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
     at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) 
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) 
     at java.lang.reflect.Method.invoke(Unknown Source) 
     at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:333) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:190) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157) 
     at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:133) 
     at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:121) 
     at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) 
     at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:213) 
     at com.sun.proxy.$Proxy158.launchExecution(Unknown Source) 
     at org.springframework.webflow.mvc.servlet.FlowHandlerAdapter.handle(FlowHandlerAdapter.java:263) 
     at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:963) 
     at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:897) 
     at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:970) 
     at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:861) 
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:635) 
     at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846) 
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:742) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.apereo.cas.web.support.AuthenticationCredentialsLocalBinderClearingFilter.doFilter(AuthenticationCredentialsLocalBinderClearingFilter.java:28) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.apereo.cas.security.RequestParameterPolicyEnforcementFilter.doFilter(RequestParameterPolicyEnforcementFilter.java:261) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.apereo.cas.security.ResponseHeadersEnforcementFilter.doFilter(ResponseHeadersEnforcementFilter.java:238) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.springframework.boot.actuate.trace.WebRequestTraceFilter.doFilterInternal(WebRequestTraceFilter.java:110) 
     at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99) 
     at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.springframework.web.filter.HttpPutFormContentFilter.doFilterInternal(HttpPutFormContentFilter.java:105) 
     at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:81) 
     at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.apereo.cas.logging.web.ThreadContextMDCServletFilter.doFilter(ThreadContextMDCServletFilter.java:90) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.springframework.boot.actuate.autoconfigure.MetricsFilter.doFilterInternal(MetricsFilter.java:106) 
     at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:197) 
     at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.springframework.boot.web.support.ErrorPageFilter.doFilter(ErrorPageFilter.java:115) 
     at org.springframework.boot.web.support.ErrorPageFilter.access$000(ErrorPageFilter.java:59) 
     at org.springframework.boot.web.support.ErrorPageFilter$1.doFilterInternal(ErrorPageFilter.java:90) 
     at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
     at org.springframework.boot.web.support.ErrorPageFilter.doFilter(ErrorPageFilter.java:108) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.apereo.inspektr.common.web.ClientInfoThreadLocalFilter.doFilter(ClientInfoThreadLocalFilter.java:64) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.apache.logging.log4j.web.Log4jServletFilter.doFilter(Log4jServletFilter.java:71) 
     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
     at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198) 
     at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) 
     at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:478) 
     at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140) 
     at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:80) 
     at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:624) 
     at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) 
     at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342) 
     at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:799) 
     at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) 
     at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:861) 
     at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1455) 
     at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) 
     at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) 
     at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) 
     at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) 
     at java.lang.Thread.run(Unknown Source) 
Caused by: java.lang.reflect.InvocationTargetException 
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
     at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) 
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) 
     at java.lang.reflect.Method.invoke(Unknown Source) 
     at jcifs.spnego.Authentication$ServerAction.run(Authentication.java:517) 
     at jcifs.spnego.Authentication.processKerberos(Authentication.java:430) 
     ... 274 more 
Caused by: GSSException: Failure unspecified at GSS-API level (Mechanism level: Checksum failed) 
     at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Unknown Source) 
     at sun.security.jgss.GSSContextImpl.acceptSecContext(Unknown Source) 
     at sun.security.jgss.GSSContextImpl.acceptSecContext(Unknown Source) 
     ... 280 more 
Caused by: KrbException: Checksum failed 
     at sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType.decrypt(Unknown Source) 
     at sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType.decrypt(Unknown Source) 
     at sun.security.krb5.EncryptedData.decrypt(Unknown Source) 
     at sun.security.krb5.KrbApReq.authenticate(Unknown Source) 
     at sun.security.krb5.KrbApReq.<init>(Unknown Source) 
     at sun.security.jgss.krb5.InitSecContextToken.<init>(Unknown Source) 
     ... 283 more 
Caused by: java.security.GeneralSecurityException: Checksum failed 
     at sun.security.krb5.internal.crypto.dk.AesDkCrypto.decryptCTS(Unknown Source) 
     at sun.security.krb5.internal.crypto.dk.AesDkCrypto.decrypt(Unknown Source) 
     at sun.security.krb5.internal.crypto.Aes256.decrypt(Unknown Source) 
     ... 289 more

问：这是什么意思？哪个配置元素可能会导致此问题？

答

我找到了解决方案。总之：我在cas.properties的cas.authn.spnego.jcifsServicePrincipal有问题。

详情：

的Active Directory
JDK 1.8 + JCE
Apereo CAS 5.1
的Tomcat 8.5.15在Windows Server 2012 R2

CAS documentation建议这样的配置：

cas.authn.spnego.jcifsServicePrincipal=HTTP/[email protected]

但要知道，这是jcifsServicePrincipal主要名 - 在Active Directory用户，这SPN分配的名称。我有用户cn=service_xxx其中servicePrincipalName属性分配给HTTP/machine1.domain.com和HTTP/machine1（但我认为，只有第一个需要）。

值得关注本教程：Kerberos/SPNEGO based SSO (Single Sign-On) in Weblogic。

如何做我的CAS的工作原理：

使用上面的教程中，我创建SPN为现有用户service_xxx（用户可登录到MACHINE1）：

setspn -s HTTP/machine1.domain.com service_xxx

用户service_xxx在Active Directory中具有此类属性：AES 128位加密和AES 256位加密。

这两个操作都是由Active Directory管理员完成的（他有足够的权限）。

所以service_xxx是主体名称（用户名）和HTTP/machine1.domain.com是只分配给主体的SPN属性。据我了解 - 现在运行在机器machine1.domain.com（这是机器URL）上的CAS服务器可以从用户service_xxx从AD（LDAP）获得任何信息。所以CAS服务器也可以使用Kerberos协议来认证任何用户。在我看来，这就是为什么CAS属性jcifsServicePrincipal应该指向主体[email protected]（完整主体名称@ domain.com），而不是它的SPN属性名称（除非它们是相同的字符串）。

我的配置细节：

首席，AES属性和SPN属性设置
与Java Java加密扩展（JCE）安装

密钥表无限强度使用从JDK ktab.exe工具创建
login.conf file - 与CAS documentation相同
cas.properties和krb5.conf如下图所示

密钥表

密钥选项卡创建过程（无任何特殊权限要求）：

"C:\Program Files\Java\jre1.8.0_131\bin\ktab.exe" -a service_xxx -n 0 -k cas.keytab

-k指定TAB键输出文件名。 -n 0指定KNVO编号。免责声明：对于我的用户cn = service_xxx在Active Directory中没有属性msDS-KeyVersionNumber（KNVO），所以我用0.但我认为Windows忽略KNVO号码 - 请参阅this comment。

One的详细信息有关密钥表：

很多教程，甚至官方documentation建议，使密钥表使用ktpass.exe。不幸的是，这需要AD管理员权限，所以这不是一个好主意。更好地使用JDK的ktab.exe（如上所述）。您只需要记住在service_xxx密码更改后始终生成新的密钥表。

在那里测试TAB键几个选项：

使用kinit命令来收集Kerberos票据（为service_xxx本金）。这也是由JDK提供的工具。
从SO试试这个由@Ivan维谢洛夫斯基写小程序：https://stackoverflow.com/a/13859217/5162026

cas.properties这对我的作品：

cas.authn.spnego.kerberosConf=/etc/cas/config/krb5.conf 
cas.authn.spnego.jcifsServicePrincipal=service_[email protected] 
cas.authn.spnego.loginConf=file:/etc/cas/config/login.conf 
cas.authn.spnego.kerberosRealm=DOMAIN.COM 

cas.authn.spnego.principal.principalAttribute=sAMAccountName 

cas.authn.spnego.ldap.ldapUrl=ldap://path.to.ldap.domain.com 
cas.authn.spnego.ldap.baseDn=DC=domain,DC=com #this is base dn where LDAP starts searching for users 
cas.authn.spnego.ldap.bindDn=cn=SERVICE_XXX,DC=domain,DC=com #it's a kind of login to LDAP 
cas.authn.spnego.ldap.failFast=false 
cas.authn.spnego.ldap.subtreeSearch=true 
cas.authn.spnego.ldap.useSsl=false 
cas.authn.spnego.ldap.searchFilter=cn={host}

很有趣的是路径像/etc/cas/config作品也可以在Windows和点到C:驱动器根 - 所以C:\etc\cas\config。请注意，此处（和所有Java文件）路径中的所有配置都使用正斜杠。

我也提供krb5.conf。该文件特定于您的组织。通常您可以在连接到域的任何工作站中的C:\Windows文件夹中找到它。所以你可以复制它，并根据需要进行编辑。您也可以手动编写它（样本位于CAS文档中）。

最重要的是添加有路径密钥表：

[libdefaults] 
    default_keytab_name = C:/Users/SERVICE_XXX/my_keytab/cas.keytab

正如你所看到的 - default_keytab_name参数[libdefaults]下。 login.conf文件中也有相同的路径（请参阅Apereo CAS文档）。

如果您在CAS中启用调试（cas.authn.spnego.kerberosDebug=true并更改log4j2.xml中的调试级别）。那么你应该在CAS正在使用您的密钥表，像看到：

2017-07-04 19:56:29,613 DEBUG [org.apereo.cas.support.spnego.authentication.handler.support.JcifsSpnegoAuthenticationHandler] - <Processing SPNEGO authentication> 
Java config name: /etc/cas/config/krb5.conf 
Loaded from Java config 
Found KeyTab Default keytab 
Entered Krb5Context.acceptSecContext with state=STATE_NEW 
>>> KeyTabInputStream, readName(): DOMAIN.COM 
>>> KeyTabInputStream, readName(): SERVICE_XXX 
>>> KeyTab: load() entry length: 79; type: 18 

// ... edited 

Added key: 23version: 0 
Added key: 16version: 0 
Added key: 17version: 0 
Added key: 18version: 0

否则，你会看到，CAS Looking for keys for: [email protected]，然后抛出类似下面的例外。

故障1：

如果你看到类似这样的例外：

Caused by: GSSException: Failure unspecified at GSS-API level (Mechanism level: Invalid argument (400) - Cannot find key of appropriate type to decrypt AP REP - AES256 CTS mode with HMAC SHA1-96) 
     at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Unknown Source) 
     at sun.security.jgss.GSSContextImpl.acceptSecContext(Unknown Source) 
     at sun.security.jgss.GSSContextImpl.acceptSecContext(Unknown Source) 
     ... 280 more 
Caused by: KrbException: Invalid argument (400) - Cannot find key of appropriate type to decrypt AP REP - AES256 CTS mode with HMAC SHA1-96 
     at sun.security.krb5.KrbApReq.authenticate(Unknown Source) 
     at sun.security.krb5.KrbApReq.<init>(Unknown Source) 
     at sun.security.jgss.krb5.InitSecContextToken.<init>(Unknown Source) 
     ... 283 more

它很可能，你已经走错了路，以.keytab文件（如指出也here）。

故障2：

如果抱怨不支持CAS加密：

Encryption type AES256 CTS mode with HMAC SHA1-96 is not supported/enabled

很可能是Java的JCE未安装或Java进行了更新，并在结果JCE支持由覆盖更新（再次安装JCE）。

你可以接受你自己的答案在这一个。 –

CAS Spnego - KrbException：校验和失败

相关推荐