Java Web应用程序上的SSO-SPNEGO + Kerberos keytab

如何解决Java Web应用程序上的SSO-SPNEGO + Kerberos keytab

我已经在不计其数的帖子中查找了这个问题，但是无法继续前进。这是当前面临的问题，将尝试并提供所有必要的详细信息

我在Tomcat 8上部署了一个Java Web应用程序，我需要为其启用SSO，目前它具有一种形式，该形式可获取用户ID传递并针对LDAP验证Intranet用户。

对于SSO，请执行以下操作

创建的服务帐户
创建了spn并为其注册了服务帐户
创建密钥表和映射的服务帐户用户
设置jaas.conf
设置krb5.ini
tomcat conf文件夹中已复制keytab及2个以上文件

Web应用已部署在a.domain.org上Windows Server 2012中的tomcat上

正在通过B.DOMAIN.COM从Windows访问Web应用

jaas.conf

com.sun.security.jgss.krb5.initiate {
      com.sun.security.auth.module.Krb5LoginModule required
    doNotPrompt=true
    principal="HTTP/<winserver>.A.domain.org@B.DOMAIN.COM"
    useKeyTab=true
    keyTab="C:\\apache-tomcat-8.5.57-windows-x64\\apache-tomcat-8.5.57\\conf\\spn_winserver.skrb"
    storeKey=true
refreshKrb5Config=true
    debug=true;
};

com.sun.security.jgss.krb5.accept {
   com.sun.security.auth.module.Krb5LoginModule required
    doNotPrompt=true
    principal="HTTP/<winserver>.a.domain.org@B.DOMAIN.COM"
    useKeyTab=true
    keyTab="C:\\apache-tomcat-8.5.57-windows-x64\\apache-tomcat-8.5.57\\conf\\spn_winserver.skrb"
    storeKey=true
    refreshKrb5Config=true
    useTicketCache=false
isInitiator=false
    debug=true;
};

krb5.ini

[libdefaults]
default_realm = B.DOMAIN.COM
default_keytab_name = "C:\apache-tomcat-8.5.57-windows-x64\apache-tomcat-8.5.57\conf\spn_winserver.skrb"
default_tkt_enctypes = aes256-cts-hmac-sha1-96 aes256-cts aes128-cts-hmac-sha1-96 aes128-cts rc4-hmac
default_tgs_enctypes = aes256-cts-hmac-sha1-96 aes256-cts aes128-cts-hmac-sha1-96 aes128-cts rc4-hmac
permitted_enctypes = aes256-cts-hmac-sha1-96 aes256-cts aes128-cts-hmac-sha1-96 caes128-cts rc4-hmac
forwardable = true
dns_lookup_realm = false
dns_lookup_kdc = false

 
[realms]
B.DOMAIN.COM = {

kdc = pgs-it-1xx.b.domain.com
kdc = pgs-it-2xx.b.domain.com
kdc = pn4-it-3xx.b.domain.com

admin_server = pgi-it-3xx.b.domain.com
default_domain = B.DOMAIN.COM
}

[domain_realm]
b.domain.com = B.DOMAIN.COM
.b.domain.com = B.DOMAIN.COM

[logging]
debug = true

Keytab是使用以下命令创建的

ktpass / princ HTTP / winserver.a.domain.org。@ B.DOMAIN.COM / mapuser / mapOp设置-pass xxxxxxx / crypto RC4-HMAC-NT / out spn_winserver.skrb

Web应用程序服务器上的

klist给了我2张缓存的票我在票中观察到以下内容 KerbTicket加密类型： AES-256-CTS-HMAC-SHA1-96

还带有keytab和主体的kinit给出以下错误

Exception: krb_error 6 Client not found in Kerberos database (6) Client not found in Kerberos database
KrbException: Client not found in Kerberos database (6)
        at sun.security.krb5.KrbAsRep.<init>(KrbAsRep.java:76)
        at sun.security.krb5.KrbAsReqBuilder.send(KrbAsReqBuilder.java:316)
        at sun.security.krb5.KrbAsReqBuilder.action(KrbAsReqBuilder.java:361)
        at sun.security.krb5.internal.tools.Kinit.<init>(Kinit.java:219)
        at sun.security.krb5.internal.tools.Kinit.main(Kinit.java:113)
Caused by: KrbException: Identifier doesn't match expected value (906)
        at sun.security.krb5.internal.KDCRep.init(KDCRep.java:140)
        at sun.security.krb5.internal.ASRep.init(ASRep.java:64)
        at sun.security.krb5.internal.ASRep.<init>(ASRep.java:59)
        at sun.security.krb5.KrbAsRep.<init>(KrbAsRep.java:60)
        ... 4 more

tomcat日志指示了一些SPNEGO令牌，index.jsp也显示了登录用户

index.jsp

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>AUTH test</title>
</head>
<body>
<h1>Hello World!</h1>
<p>auth type: <%=request.getAuthType()%> </p>
<p>remote user: <%=request.getRemoteUser() %> </p>
<p>principal: <%=request.getUserPrincipal() %></p>
<p>name: <%= (request.getUserPrincipal()!=null)?request.getUserPrincipal().getName():"NO PRINCIPAL" %></p>
</body>
</html>

这显示Auth类型为SPNEGO和正确的用户，因此它的某些内容正在起作用我不了解的是如何使该用户自动登录或执行SSO。

AM怀疑keytab加密可能是错误的，将r4-hmac替换为AES

请告知

Java Web应用程序上的SSO-SPNEGO + Kerberos keytab

如何解决Java Web应用程序上的SSO-SPNEGO + Kerberos keytab

相关推荐