Webtop 6.6 Kerberos

Hi,

I just set up 6.6 environment and enabled kerberos support in ContentServer and Webtop I set up evereythink like it is documented. But something seems to be wrong/missing.

12:08:37,514 DEBUG [http-80-2] com.documentum.web.common.Trace - com.documentum.web.formext.session.KerberosSSOAuthenticationScheme:Failed to get service token from SPNEGO token :null
12:08:37,530 DEBUG [http-80-2] com.documentum.web.common.Trace - com.documentum.web.formext.session.KerberosSSOAuthenticationScheme:java.lang.IndexOutOfBoundsException
    at java.io.ByteArrayInputStream.read(Unknown Source)
    at java.io.FilterInputStream.read(Unknown Source)
    at jcifs.spnego.asn1.DERInputStream.readFully(DERInputStream.java:87)
    at jcifs.spnego.asn1.DERInputStream.readObject(DERInputStream.java:263)
    at jcifs.spnego.NegTokenInit.parse(NegTokenInit.java:148)
    at jcifs.spnego.NegTokenInit.<init>(NegTokenInit.java:74)
    at com.emc.documentum.kerberos.utility.KerberosUtility.getSTFromSpenegoToken(KerberosUtility.java:70)
    at com.documentum.web.formext.session.KerberosSSOAuthenticationScheme.authenticate(KerberosSSOAuthenticationScheme.java:187)
    at com.documentum.web.formext.session.AuthenticationService.authenticate(AuthenticationService.java:142)
    at com.documentum.web.formext.session.KerberosSSOLogin.authenticate(KerberosSSOLogin.java:178)
    at com.documentum.web.formext.session.KerberosSSOLogin.onLogin(KerberosSSOLogin.java:131)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
    at java.lang.reflect.Method.invoke(Unknown Source)
    at com.documentum.web.form.FormProcessor.invokeMethod(FormProcessor.java:1633)
    at com.documentum.web.form.FormProcessor.invokeMethod(FormProcessor.java:1487)
 ...

The question is, is this a browser issue not sending the ST or a windows issue not sending valid Kerberos-Tokens?

Has anyone a working webtop-kerberos-authentication?

Regards

Ralf

Find more posts tagged with

Documentum

Comments

ukdavo

I've not used the Webtop/Kerberos integration but I've set up silent login for other webapps using Java/SPNEGO. I ran into all sorts of problems...

You can check what kind of Negotiate token is being presented (i.e. Kerberos or NTLM) by checking the authenticate header (see http://blogs.technet.com/b/tristank/archive/2006/08/02/negotiate-this.aspx). Bear in mind that IE will send Negotiate NTLM tokens instead of Negotiate Kerberos tokens where 1) the app server and client are one and the same or 2) IE detects that the app server is in the Internet Zone (as opposed to Local Intranet Zone).

Regards

RalfKahrl

Thanks, for your response, this info helped a bit to see what is going on at the http level.

At the moment I've the feeling this whole kerberos stuff evolves into big pain. It seems I'm hitting a lot of possible configuration issues that can come around...

- Duplicate or wrong SPNs within AD

- Different kind of keytab encryption algorithms depending on which java version you use, as well as the used encryption for the ad user password

- Typo is realy important in your login.conf, if it says keyTab= it is not keytab...

- Debugging is quite hard as the implementation seems to ignore the GSSExceptions which are thrown, so I'm debugging the internals of the jdk itself

Now my current problem is that my appServer successfully authenticated against the KDC but the Krb5Context has no delegationTicket... I guess I still have to dig deeper

Regards

Daniel.Gutierrez.Rodriguez

Hello RalfKahrl,

I'm getting exactly the same error:

10:41:54,446 DEBUG [http-8080-2] com.documentum.web.common.Trace - com.documentum.web.formext.session.KerberosSSOAuthenticationScheme:Failed to get service token from SPNEGO token :null

10:41:54,462 DEBUG [http-8080-2] com.documentum.web.common.Trace - com.documentum.web.formext.session.KerberosSSOAuthenticationScheme:java.lang.IndexOutOfBoundsException

Any idea why this is happening?

Thanks in advance.

Best regards,

Daniel.

SuperMAG--6NVI

Same errormessage here.

Is there anybody out there who made this Kerberos stuff work?

Thx