Loading...

XML

Word

Printable

Type: Bug
Resolution: Done
Priority: Blocker
Fix Version/s: 7.1.0.DR19
Affects Version/s: 7.1.0.DR13
Component/s: Security
Labels:

CDW devel_ack:
CDW docs_ack:
CDW pm_ack:
CDW qa_ack:
CDW release:
Target Release:

7.1.0.GA
Git Pull Request:
https://github.com/wildfly-security/wildfly-elytron/pull/823
Steps to Reproduce:
Hide

On IBM java

Follow https://doc-stage.usersys.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.1.alpha/html-single/how_to_set_up_sso_with_kerberos/#configure_the_elytron_subsystem

In step 2.4.1.1 during adding kerberos-security-factory add obtain-kerberos-ticket = true option

/subsystem=elytron/kerberos-security-factory=krbSF:add( \ principal="HTTP/host@REALM", \ path="/path/to/http.keytab", \ obtain-kerberos-ticket="true", \ mechanism-oids=[ \ 1.2.840.113554.1.2.2, \ 1.3.6.1.5.5.2 \ ] \ )
Show
On IBM java Follow https://doc-stage.usersys.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.1.alpha/html-single/how_to_set_up_sso_with_kerberos/#configure_the_elytron_subsystem In step 2.4.1.1 during adding kerberos-security-factory add obtain-kerberos-ticket = true option /subsystem=elytron/kerberos-security-factory=krbSF:add( \ principal= "HTTP/host@REALM" , \ path= "/path/to/http.keytab" , \ obtain-kerberos-ticket= " true " , \ mechanism-oids=[ \ 1.2.840.113554.1.2.2, \ 1.3.6.1.5.5.2 \ ] \ )

SFDC Cases Counter:
SFDC Cases Open:
SFDC Cases Links:

On IBM java when obtain-kerberos-ticket is set to true user always get

javax.security.auth.login.LoginException: Bad JAAS configuration: credsType and keytab values are not compatible

According to ibm documentation [1] credsType=initiator and useKeytab are really incompatible.

This constraint can't be avoided once obtain-kerberos-ticket = true, because keytab path is required in model.

       "path" => {
	    "type" => STRING,
	    "description" => "The path of the KeyTab to load to obtain the credential.",
	    "attribute-group" => "file",
	    "expressions-allowed" => true,
	    "required" => true,
	    "nillable" => false,
	    "min-length" => 1L,
	    "max-length" => 2147483647L,
	    "access-type" => "read-write",
	    "storage" => "configuration",
	    "restart-required" => "resource-services"
	},

And keytab is always set into Kerberos login module options

GSSCredentialSecurityFactory.java

            if (IS_IBM) {
                options.put("noAddress", "true");
                options.put("credsType", (isServer && !obtainKerberosTicket) ? "acceptor" : "initiator");
                options.put("useKeytab", keyTab.toURI().toURL().toString());
            }

[1] https://www.ibm.com/support/knowledgecenter/SSYKE2_8.0.0/com.ibm.java.security.component.80.doc/security-component/jgssDocs/jaas_login_user.html

I am not setting to blocker just because I am not sure about importance of obtain-kerberos-ticket. See my question ~~JBEAP-9292~~.

is cloned by

ELY-1181 Elytron, Unable to authenticate with SPNEGO on IBM java if obtain-kerberos-ticket = true

Resolved

is incorporated by

JBEAP-11068 Upgrade WildFly Elytron to 1.1.0.Beta45

Closed

Assignee:: Darran Lofthouse

Reporter:: Martin Choma

Tester:: Martin Choma

QA Contact:: Martin Choma

Votes:: 0 Vote for this issue

Watchers:: 4 Start watching this issue

Created:: 2017/03/06 3:42 AM

Updated:: 2024/09/02 4:42 PM

Resolved:: 2017/05/22 2:07 PM

Details

Description

Attachments

Issue Links

Easy Agile Planning Poker

Activity

People

Dates