Kerberos Authentication in DFS Dctm

Hi All,

I am developing a DFS application which user kerberos SSO to create dctm session.

Environment details:

Content Server version : 6.6

DFS version : 6.6

Its a remote dfs client and when I set the token in the BinarySecurityToken object following exception is thrown in server side..

com.emc.documentum.fs.rt.AuthenticationException: No valid credentials provided
(Mechanism level: Failed to find any Kerberos Key)
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)

        at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstruct
orAccessorImpl.java:39)
        at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingC
onstructorAccessorImpl.java:27)
        at java.lang.reflect.Constructor.newInstance(Constructor.java:513)
        at com.emc.documentum.fs.rt.context.impl.compat.ClientReflectionServiceI
nvokerCompat60.getExceptionInstance(ClientReflectionServiceInvokerCompat60.java:
176)
        at com.emc.documentum.fs.rt.context.impl.compat.ClientReflectionServiceI
nvokerCompat60.invoke(ClientReflectionServiceInvokerCompat60.java:78)
        at com.emc.documentum.fs.rt.context.impl.UcfClientInvocationHandler.invo
ke(UcfClientInvocationHandler.java:47)
        at com.emc.documentum.fs.rt.context.impl.SoapClientInvocationHandler.inv
oke(SoapClientInvocationHandler.java:66)
        at com.emc.documentum.fs.rt.context.impl.MtomCompatHandler60SP1.invoke(M
tomCompatHandler60SP1.java:57)
        at com.emc.documentum.fs.rt.context.impl.HttpSessionInvocationHandler.in
voke(HttpSessionInvocationHandler.java:89)
        at com.emc.documentum.fs.rt.context.impl.RemoteServiceInterfaceInvocatio
nHandler.invoke(RemoteServiceInterfaceInvocationHandler.java:30)
        at com.emc.documentum.fs.rt.context.impl.ReturnedContentTransformationHa
ndler.invoke(ReturnedContentTransformationHandler.java:45)
        at com.emc.documentum.fs.rt.context.impl.OperationOptionsHandler.invoke(
OperationOptionsHandler.java:71)
        at com.emc.documentum.fs.rt.context.impl.ContextThreadLocalInvocationHan
dler.invoke(ContextThreadLocalInvocationHandler.java:51)
        at com.emc.documentum.fs.rt.context.impl.ServiceContextInvocationHandler
.invoke(ServiceContextInvocationHandler.java:30)
        at $Proxy18.execute(Unknown Source)
        at com.cosi.kerberos.service.DfsServiceCreation.testDfs(DfsServiceCreati
on.java:46)
        at com.cosi.kerberos.service.ServiceAccount.main(ServiceAccount.java:37)

Caused by: java.lang.Exception: No valid credentials provided (Mechanism level:
Failed to find any Kerberos Key)
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)

Thanks,

Rafi

Find more posts tagged with

Comments

mszurap

Hi,

How did you get the kerberos token?

Here is how I got it:

I made a jsp file (which is deployed to the same application server, which hosts the kerberized DFS services), which returns 401 HTTP response with WWW-Authenticate: Negotiate header when Authorization header is not present. If the browser sends the Authorization header, then you can use the com.emc.documentum.kerberos.utility.KerberosUtility class to get a Service token from the SPNEGO token:

String serviceToken = KerberosUtility.getSTFromSpenegoToken(spnegoToken)

This can be used for authorization. An example QueryService SOAP request:

<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">   <s:Header>      <ns3:Security xmlns:ns1="http://www.w3.org/2003/05/soap-envelope" xmlns:ns2="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:ns3="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">         <ns3:BinarySecurityToken ValueType="http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5_AP_REQ" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary">YIIJnAY...</ns3:BinarySecurityToken>      </ns3:Security>   </s:Header>   <s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">      <execute xmlns="http://core.services.fs.documentum.emc.com/">         <query xsi:type="q1:PassthroughQuery" queryString="select r_object_id, object_name from dm_document where folder('/Temp')" xmlns="" xmlns:q1="http://query.core.datamodel.fs.documentum.emc.com/">            <q1:repositories>myrepository</q1:repositories>         </query>         <execution startingIndex="0" maxResultCount="100" maxResultPerSource="100" cacheStrategyType="DEFAULT_CACHE_STRATEGY" xmlns=""/>      </execute>   </s:Body></s:Envelope>

Hi Miclos,

My client is just a remote DFS call. I am getting the kerberos token and encoding the token to BASE64, setting the token in tokenHandler.setBinarySecurityToken(new KerberosBinarySecurityToken(byteToken, KerberosValueType.KERBEROSV5_AP_REQ));

          PassthroughQuery query = new PassthroughQuery();
               query.setQueryString("select r_object_id, "
                                 + "object_name from dm_cabinet");
            query.addRepository(<repositoryname>);
            QueryExecution queryEx = new QueryExecution();
            queryEx.setCacheStrategyType(CacheStrategyType.DEFAULT_CACHE_STRATEGY);
            OperationOptions operationOptions = null;

            KerberosTokenHandler tokenHandler = new KerberosTokenHandler();

            IServiceContext serviceContext = ContextFactory.getInstance().getContext();

            IQueryService queryService = ServiceFactory.getInstance().getRemoteService(IQueryService.class,
                    serviceContext, "core", <serverurl>, Arrays.asList((Handler) tokenHandler));


            tokenHandler.setBinarySecurityToken(new KerberosBinarySecurityToken(byteToken, KerberosValueType.KERBEROSV5_AP_REQ));;

            QueryResult queryResult = queryService.execute(query, queryEx, operationOptions);

Thanks,
Rafi

Hi All,

I managed to fix the previous issue. But now I am facing new issue with same program. Following is the exception message

com.emc.documentum.fs.rt.AuthenticationException: Defective token detected (Mech
anism level: GSSHeader did not find the right tag)
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)

        at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstruct
orAccessorImpl.java:39)
        at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingC
onstructorAccessorImpl.java:27)
        at java.lang.reflect.Constructor.newInstance(Constructor.java:513)
        at com.emc.documentum.fs.rt.context.impl.compat.ClientReflectionServiceI
nvokerCompat60.getExceptionInstance(ClientReflectionServiceInvokerCompat60.java:
176)
        at com.emc.documentum.fs.rt.context.impl.compat.ClientReflectionServiceI
nvokerCompat60.invoke(ClientReflectionServiceInvokerCompat60.java:78)
        at com.emc.documentum.fs.rt.context.impl.UcfClientInvocationHandler.invo
ke(UcfClientInvocationHandler.java:47)
        at com.emc.documentum.fs.rt.context.impl.SoapClientInvocationHandler.inv
oke(SoapClientInvocationHandler.java:66)
        at com.emc.documentum.fs.rt.context.impl.MtomCompatHandler60SP1.invoke(M
tomCompatHandler60SP1.java:57)
        at com.emc.documentum.fs.rt.context.impl.HttpSessionInvocationHandler.in
voke(HttpSessionInvocationHandler.java:89)
        at com.emc.documentum.fs.rt.context.impl.RemoteServiceInterfaceInvocatio
nHandler.invoke(RemoteServiceInterfaceInvocationHandler.java:30)
        at com.emc.documentum.fs.rt.context.impl.ReturnedContentTransformationHa
ndler.invoke(ReturnedContentTransformationHandler.java:45)
        at com.emc.documentum.fs.rt.context.impl.OperationOptionsHandler.invoke(
OperationOptionsHandler.java:71)
        at com.emc.documentum.fs.rt.context.impl.ContextThreadLocalInvocationHan
dler.invoke(ContextThreadLocalInvocationHandler.java:51)
        at com.emc.documentum.fs.rt.context.impl.ServiceContextInvocationHandler
.invoke(ServiceContextInvocationHandler.java:30)
        at $Proxy18.execute(Unknown Source)
        at com.cosi.kerberos.service.DfsServiceCreation.testDfs(DfsServiceCreati
on.java:61)
        at com.cosi.dfs.kerberos.sample.TokenCreation.main(TokenCreation.java:20
1)
Caused by: java.lang.Exception: Defective token detected (Mechanism level: GSSHe
ader did not find the right tag)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)

I had looked into several forums and the exception messge corresponds to NTLM. But in my case its Kerberos only as byte array starts with YII.......

Thanks in advance,

Rafi

mszurap

Hi Rafi,

I could not make it work with the EMC DFS client libraries (maybe my mistake, I tried to follow the documentations and if I remember well, I got the same error message), but it was ok for me with an Axis generated client.

Kerberos token starting with YII... is ok, that's a BASE64 encoded value, if you decode it, then you get a value with the "NTLMSSP..." beginning.

Miklos

Hi Miklos,

Thanks for your reply.

I am getting below string when I decode the token ..

`é♦}♠ *åHå≈↕☺☻☻☺ né♦l0é♦há♥☻☺♣í♥☻☺♫ó♥♣ úé♥ÿaé♥ö0é♥
?á♥☻☺←♠DMNCSIó-0+á♥☻☺ í$0"←♥DFS←←avtivedi-89dfe0.DMNCSI:8080úé♥N0é♥Já♥☻☺♥í♥☻☺♦óé
♥<♦é♥87?òδµ┴1└Θ¡}▄♠∩7│J┬Tª`Cu⌠╘;D■w╙╦Hτ)╙{u#ƒµ╢:Eïï]Fδ☼⌠U²☻┴┘NΦδ|m£UCâ╣[τp16≤Ü╗◄
ö:▐!┌P┴ëV ┌▒▓♀∩Oö_Σ·KΣ╙↕ñππ£(e²╔åNα▲┬♠0╝Ñ{²C╠Ü☻z¡╕SªE: èÜ²x⌂ó⌠╔↨<C╞‼]5╘òR├S┼┤⌡Ü
C¶╕G.Γ½DJ☻τD²╦╘Ω⌐⌐<µε♣féµ÷╠o¢┐╫Æcd‼₧|¡¢`ÿ‼╛ë`|∙╛☻╗_═èÇ▓τ:²N#►*·ir╖0╖░½ëσGX*─╝╡▒«
LΩ ∩Ñ8Æ►?δ⌡╜∟↨?%╬H xnó╡╔á dn,εc²¿ƒPÿ^HD↓☺■òV░≥Ä6N╪êà♥▼║&U¿╢╪∙ Jj?♫▬yföö╒σ¡√ho↓Ωn
?ΩXv┤t▲)ç@▲╣#╬½1╣gî??j↨♀←>πmFµ╗öq'▬Ç┬→≥Æα\<J▬Dù╡Θ<₧:_./&Γ9÷2.<%q░ƒ_²@┐▒\ûêcΘL┌╨
↔↕░╦ ≥◄1[¼░w@≡5↑.▓L↨Ü2`lö²¢Θ♦lôφ_┤(ó╬─è╓Lt╕σ=∟Cφ'%îC┴↓▬>┴*oÿ}Üw♠ö▓▼δAOâê┘¡☺\┐╫q2
▒Φ}?¢4º═îxα_kûH]Ωx╩eGëô↔Çòù╫í:♣oA╞?├ ♥·φ'┐^·?↕æ+┐81RòO┴Φ7∞Fqe'LæûA╖îEz♠Ü@j%╓¢ÿè╙
[╬ú♀PªwΣ+*♦♦╨\ε ‼a╧`╛√a|&┴¼?╦↨L?└╕░bm☻█┴S2R¡ ╜Çφ>σ╫+▒╙Ä▌
;╪╓L♀ßßLÜ╗Câ╝½╔?↓╙pCç¿oö╤╧wⁿ╨┼∞"εÄ╝╖▌±\1▒.·kε
k☺GºJ┼▌^φ‼↑è╡Rtσv@g:☼ú5♣L[2╨r}á▀Ç)↕╪Ü║Yd◄▒┘┼╢?§²"#6o║☻╤♂╘²►▲╢╩b◄ßÖnHªæq∞¢?P ╣ ÿε
!▀ε±)Üp⌠≈╟ù '≥¡╓E║÷ :$☻¿:æ}?FoÇç±τ?îB≥<q¢Jâ ☼!▼äñ?╢0?│á♥☻☺♥ó?½♦?¿ÑZ☺←╘3F_?┬■
ÿεë╤?/¬ªY╟LD\3╕2CR$*g☻∙f↑╟¢J±ñA╪☼?f☺( ╘#Θ²9?Jö2»g╪5ê}╙/☼¬τQ╩c→å≈╦6 §U≡F╥↨j♂ô<^f
P╦└&▒╩Xúlu⌂r`∩╘♣6╞FI‼Q7xO▌→ñ#▄ÇÇΘ<I╛U■"ⁿ▒.√↓¡X╟└û r▼╛¢╦α├MpU0Je

I deployed the application in Tomcat and JBoss. And this is the exact exception I am getting in both the servers. Is it an issue with DFS apps.

-- Rafi

mszurap

Hi,

Are you using krbutil.jar provided with EMC DFS libraries (KerberosUtility class)?

In client side there is no involement of this jar file. But it is used in server side internally..

-- Rafi

mszurap

I used to call KerberosUtility.getSTFromSpenegoToken() method to get Service Token from the SPNEGO token. That is injected in the SOAP header, and it should be accepted (and consumed) on the DFS server side.

Hi,

I am still facing the same issue even after using getSTFromSpnegoToken() method. I haven't tried with axis or jax-ws based client applications.

-- Rafi

mszurap

I have no more clues, as I have no successful experience with DFS client libraries and Kerberos.

There is a troubleshooting guide for Kerberos, but only for Webtop. Search on "h8209-documentum-kerberos-wp.pdf" on powerlink.

Cheers, Mike