Webtop, Kerberos: could not locate credential store

Webtop 6.7 SP2

I'm getting the following error message in a stack trace when I try to authenticate kerberos:

java.lang.RuntimeException: Could not configure Kerberos: com.dstc.security.kerberos.KerberosConfigException: Could not locate credential store.

Further down I get:

08:34:56,213 DEBUG [http-apr-443-exec-5] com.documentum.web.common.Trace - com.documentum.web.formext.session.KerberosSSOLogin:Login fallback = true

08:34:56,213 DEBUG [http-apr-443-exec-5] com.documentum.web.common.Trace - com.documentum.web.formext.session.KerberosSSOLogin:Login Component entryPage = 'repo_selection'

08:34:57,453 DEBUG [http-apr-443-exec-3] com.documentum.web.common.Trace - com.documentum.web.formext.session.KerberosSSOAuthenticationScheme:Browser Supported :true

08:34:57,453 DEBUG [http-apr-443-exec-3] com.documentum.web.common.Trace - com.documentum.web.formext.session.KerberosSSOAuthenticationScheme:Found SPNEGO token in client session

08:34:57,453 DEBUG [http-apr-443-exec-3] com.documentum.web.common.Trace - com.documentum.web.formext.session.KerberosSSOAuthenticationScheme:Token type = SPNEGO

08:34:57,453 DEBUG [http-apr-443-exec-3] com.documentum.web.common.Trace - com.documentum.web.formext.session.KerberosSSOAuthenticationScheme:Obtaining service token from SPNEGO

08:34:57,454 DEBUG [http-apr-443-exec-3] com.documentum.web.common.Trace - com.documentum.web.formext.session.KerberosSSOAuthenticationScheme:Accepting service token for SPN HTTP/mcsdappp1.ndc.nasa.gov@NDC.NASA.GOV

08:34:57,465 DEBUG [http-apr-443-exec-3] com.documentum.web.common.Trace - com.documentum.web.formext.session.KerberosSSOAuthenticationScheme:Failed to accept or delegate service token :com.emc.documentum.kerberos.utility.quest. jdk7provider.JDK7Krb5U2S configured by JDK7OnlyJCSIKrb5 for GSS-API Mechanism Factory cannot be created

08:34:57,467 DEBUG [http-apr-443-exec-3] com.documentum.web.common.Trace - com.documentum.web.formext.session.KerberosSSOAuthenticationScheme:GSSException: com.emc.documentum.kerberos.utility.quest.jdk7provider.JDK7Krb5U2S configured by JDK7OnlyJCSIKrb5 for GSS-API Mechanism Factory cannot be created

If you've seen this before or have any idea what could be the problem please let me know.

Find more posts tagged with

Note:

If there are Accepted Answers, those will be shown by default. You can switch to 'All Replies' by selecting the tab below.

Accepted answers

fainemr

Try changing your Kerberos config file like so:

HTTP-your-principal-name

{

com.sun.security.auth.module.Krb5LoginModule required

…

And then backup and remove both of the jar files that start with vsj- from WEB-INF/lib

Then restart the application server.

-Mark

All comments

Toki

Hi, fainemr

I've got this error too and still struggle with it.

Did you manage to solve this problem?

I really have no idea what is the cause of problem.

Anyway I'm trying to find the way to solve it and hope I find something

Toki

fainemr

Try changing your Kerberos config file like so:

HTTP-your-principal-name

{

com.sun.security.auth.module.Krb5LoginModule required

…

And then backup and remove both of the jar files that start with vsj- from WEB-INF/lib

Then restart the application server.

-Mark

Toki

It works now. Thank you so much

fainemr

No problem. A couple of things though: only consider this as a workaround as this reverts your installation to the way this was handled prior to SP2 before multi-domain kerberos support. If you upgrade the application you'll lose the changes you made. I've got an SR in with EMC over this and they are working on the issue. Also, there was a patch for Webtop 6.7 SP2 that was released yesterday (I think) not sure but it may affect this workaround or maybe even correct the issue, though I don't think so.

VinayHattarki

Hi fainemr,

so, what is the difference between the two, "com.dstc.security.kerberos" and "com.sun.security.auth.module.Krb5LoginModule" ? when and where do we use which?

Thank You,

Vinay

fainemr

The .sun. is the old kerberos library, the new multi-domain capable library is the com.dstc.security.kerberos and uses those specialized jar files that were removed. There seems to be an issue with the new library. As I said above, EMC should be working on it and may have even resolved it by now with a patch. I don't know yet.

VinayHattarki

thanks a lot fainemr, however, i am getting an error as 'Caused by: com.emc.documentum.fs.rt.AuthenticationException: com.emc.documentum.kerberos.utility.quest.jdk7provider.JDK7Krb5U2S configured by JDK7OnlyJCSIKrb5 for GSS-API Mech

anism Factory cannot be created. Could not configure Kerberos: com.dstc.security.kerberos.KerberosConfigException: Could not locate credential store'. could you please tell me whats wrong?

fainemr

Sorry, I missed this reply, did you ever find a solution?

VinayHattarki

yes i did by using only one encryption type while generating keytab. seems that something wrong with Documentum 7 with other encryption types.

Thanks a lot

Thanks,

Vinay

BinayGupta

Hi Vinay,

Can you share a few more details around what you did exactly when you say using only one encryption so which one did you use and if you can share the commands as well.

Thank you.

hendra.liman

thx for the info...really helpful