-
Bug
-
Resolution: Done
-
Major
-
None
-
None
Otherwise we can end up with an error like this: -
13:20:41,619 INFO [stdout] (XNIO-1 task-4) [JGSS_DBG_CRED] XNIO-1 task-4 getName found name: HTTP/web.dal.wildfly.org@DAL.WILDFLY.ORG, mech=1.2.840.113554.1.2.2 13:20:41,620 INFO [stdout] (XNIO-1 task-4) [JGSS_DBG_CRED] XNIO-1 task-4 Krb5 name type = 0 13:22:09,371 INFO [stdout] (XNIO-1 task-4) [JGSS_DBG_UNMARSH] XNIO-1 task-4 Real token len 692 13:22:09,372 INFO [stdout] (XNIO-1 task-4) [JGSS_DBG_UNMARSH] XNIO-1 task-4 Token oid 1.3.6.1.5.5.2 13:22:09,373 INFO [stdout] (XNIO-1 task-4) [JGSS_DBG_UNMARSH] XNIO-1 task-4 inner token len 684 13:22:09,374 ERROR [stderr] (XNIO-1 task-4) java.security.PrivilegedActionException: org.ietf.jgss.GSSException, major code: 13, minor code: 0 13:22:09,375 ERROR [stderr] (XNIO-1 task-4) major string: Invalid credentials 13:22:09,375 ERROR [stderr] (XNIO-1 task-4) minor string: Cannot obtain mechanism credential for mechanism 1.3.6.1.5.5.2 13:22:09,376 ERROR [stderr] (XNIO-1 task-4) at java.security.AccessController.doPrivileged(AccessController.java:375) 13:22:09,377 ERROR [stderr] (XNIO-1 task-4) at javax.security.auth.Subject.doAs(Subject.java:572) 13:22:09,378 ERROR [stderr] (XNIO-1 task-4) at io.undertow.security.impl.GSSAPIAuthenticationMechanism.runGSSAPI(GSSAPIAuthenticationMechanism.java:168) 13:22:09,378 ERROR [stderr] (XNIO-1 task-4) at io.undertow.security.impl.GSSAPIAuthenticationMechanism.authenticate(GSSAPIAuthenticationMechanism.java:119) 13:22:09,379 ERROR [stderr] (XNIO-1 task-4) at org.jboss.as.domain.http.server.security.AuthenticationMechanismWrapper.authenticate(AuthenticationMechanismWrapper.java:52) 13:22:09,380 ERROR [stderr] (XNIO-1 task-4) at io.undertow.security.impl.SecurityContextImpl$AuthAttempter.transition(SecurityContextImpl.java:280) 13:22:09,381 ERROR [stderr] (XNIO-1 task-4) at io.undertow.security.impl.SecurityContextImpl$AuthAttempter.transition(SecurityContextImpl.java:297) 13:22:09,382 ERROR [stderr] (XNIO-1 task-4) at io.undertow.security.impl.SecurityContextImpl$AuthAttempter.access$100(SecurityContextImpl.java:267) 13:22:09,383 ERROR [stderr] (XNIO-1 task-4) at io.undertow.security.impl.SecurityContextImpl.attemptAuthentication(SecurityContextImpl.java:130) 13:22:09,384 ERROR [stderr] (XNIO-1 task-4) at io.undertow.security.impl.SecurityContextImpl.authTransition(SecurityContextImpl.java:105) 13:22:09,385 ERROR [stderr] (XNIO-1 task-4) at io.undertow.security.impl.SecurityContextImpl.authenticate(SecurityContextImpl.java:98) 13:22:09,386 ERROR [stderr] (XNIO-1 task-4) at io.undertow.security.handlers.AuthenticationCallHandler.handleRequest(AuthenticationCallHandler.java:50) 13:22:09,386 ERROR [stderr] (XNIO-1 task-4) at io.undertow.server.Connectors.executeRootHandler(Connectors.java:199) 13:22:09,387 ERROR [stderr] (XNIO-1 task-4) at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:767) 13:22:09,387 ERROR [stderr] (XNIO-1 task-4) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1177) 13:22:09,388 ERROR [stderr] (XNIO-1 task-4) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) 13:22:09,388 ERROR [stderr] (XNIO-1 task-4) at java.lang.Thread.run(Thread.java:857) 13:22:09,389 ERROR [stderr] (XNIO-1 task-4) Caused by: org.ietf.jgss.GSSException, major code: 13, minor code: 0 13:22:09,389 ERROR [stderr] (XNIO-1 task-4) major string: Invalid credentials 13:22:09,389 ERROR [stderr] (XNIO-1 task-4) minor string: Cannot obtain mechanism credential for mechanism 1.3.6.1.5.5.2 13:22:09,390 ERROR [stderr] (XNIO-1 task-4) at com.ibm.security.jgss.i18n.I18NException.throwGSSException(I18NException.java:9) 13:22:09,391 ERROR [stderr] (XNIO-1 task-4) at com.ibm.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:33) 13:22:09,391 ERROR [stderr] (XNIO-1 task-4) at com.ibm.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:396) 13:22:09,392 ERROR [stderr] (XNIO-1 task-4) at io.undertow.security.impl.GSSAPIAuthenticationMechanism$AcceptSecurityContext.run(GSSAPIAuthenticationMechanism.java:221) 13:22:09,392 ERROR [stderr] (XNIO-1 task-4) at io.undertow.security.impl.GSSAPIAuthenticationMechanism$AcceptSecurityContext.run(GSSAPIAuthenticationMechanism.java:191) 13:22:09,393 ERROR [stderr] (XNIO-1 task-4) at java.security.AccessController.doPrivileged(AccessController.java:369) 13:22:09,393 ERROR [stderr] (XNIO-1 task-4) ... 16 more
The client is sending a SPNEGO message (1.3.6.1.5.5.2) but the default GSSCredential is for Kerberos (1.2.840.113554.1.2.2) so we need to ensure we are creating a GSSCredential ourselves that is compatible with SPNEGO.