Hi, What you want to do for debugging is enable debug=true in the JAAS configuration for the Krb5 authenticators. That gives you a lot of information about what’s going on in the kerberos negotiation itself.
/Fredrik > 15 mars 2016 kl. 11:04 skrev Andrea Prandini <[email protected]>: > > RESOLVED > > Redoing all the process from the beginning with some changes: > - disabling DES encryption on user (AD2008) > - changing casspnego's password, avoiding special chars > - using -crypto ALL and -mapuser with the full qualified name in the KTPASS > command > > I don't know which of these resolve the problem. Every time this process it's > a kind of alchemy. > > “Everything is going to be fine in the end. If it's not fine it's not the > end.” [O.Wilde] > > > > > > Il giorno lunedì 14 marzo 2016 13:25:13 UTC+1, Andrea Prandini ha scritto: > Hi > > I'm configuring a CAS server (3.2.1) installed on a Windows Server 2012 (jvm > oracle 1.7) and I need to implement the Intergated Windows Authentication > with the AD domain. > I've created a casspnego user on AD and I've used the ktpass command to map > the service and create the keytab file. > I've used these parameters: -crypto RC4-HMAC-NT -ptype KRB5_NT_PRINCIPAL > > These are the CAS configurations > <property name="jcifsServicePrincipal" > value="HTTP/[email protected]" /> > <property name="jcifsServicePassword" value="xxxxx" /> > <property name="jcifsUsername" value="casspnego" /> > <property name="jcifsPassword" value="xxxxxx" /> > <property name="kerberosDebug" value="true" /> > <property name="kerberosRealm" value="DOMAIN.AD" /> > <property name="kerberosKdc" value="xxx.xxx.xxx.xxx" /> > <property name="loginConf" > value="................../webapps/cas/WEB-INF/login.conf" /> > > Testing the automatic login with the IE on the local server the process > fails. Here the CAS server log > > SPNEGO Authorization header found with 164 bytes > Obtained token: `y + �o0m�00. > + �7 > *�H�� *�H�� > + �7 �9 7NTLMSSP �� � 1 > > But this is not a problem. I need that it works on the users workstations. > Testing from a user workstation in the domain I can see in the log a longer > token that looks like a kerberos token, but the CAS server can't obtains the > principal name. I tried to change the DES encryption flag and resetting the > password but nothing change > Can someone help me to understand where the problem is. > Thanks > Andrea > > -- > You received this message because you are subscribed to the Google Groups > "CAS Community" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/. > > -- > You received this message because you are subscribed to the Google Groups > "CAS Community" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/. -- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. Visit this group at https://groups.google.com/a/apereo.org/group/cas-user/.
