KDC 不支持加密类型 (14) [英] KDC has no support for encryption type (14)

问题描述

我正在尝试使用 spring-security-kerberos 扩展通过 kerberos 实现 SSO.

I'm trying to implement SSO with kerberos using spring-security-kerberos extension.

我创建了一个密钥表文件，但在尝试访问我的 web 应用程序时出现以下错误:

I've created a keytab file and I get the following error when trying to access my webapp:

GSSException: Failure unspecified at GSS-API level (Mechanism level: Checksum failed)

我尝试根据这篇文章测试我的密钥表.

I tried to test my keytab according to this post.

使用以下命令创建密钥表:

The keytab was created with the following command:

ktpass /out http-web.keytab /mapuser [e-mail] /princ HTTP/[e-mail] /pass myPass /ptype KRB5_NT_PRINCIPAL -crypto RC4-HMAC-NT /kvno 0

我的krb5.conf如下

My krb5.conf is as follow

[libdefaults]
default_realm = MYDOMAIN.COM
permitted_enctypes =  aes256-cts arcfour-hmac-md5 aes128-cts rc4-hmac des3-cbc-sha1 des-cbc-md5 des-cbc-crc
default_tgs_enctypes = aes256-cts arcfour-hmac-md5 aes128-cts rc4-hmac des3-cbc-sha1 des-cbc-md5 des-cbc-crc
default_tkt_enctypes = aes256-cts arcfour-hmac-md5 aes128-cts rc4-hmac des3-cbc-sha1 des-cbc-md5 des-cbc-crc
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true

[realms]
MYDOMAIN.COM = {
kdc = controller1.mydomain.com:88
kdc = controler2.mydomain.com:88
kdc = controller3.mydomain.com:88
admin_server = controller3.mydomain.com
default_domain = MYDOMAIN.COM
}

[domain_realm]
.mydomain.com = MYDOMAIN.COM
mydomain.com = MYDOMAIN.COM

[login]
krb4_convert = true
krb4_get_tickets = false

我收到以下错误:

 KDC has no support for encryption type (14)

我已经尝试为 SPN 的帐户启用 DES、AES-128 和 AES-256，但没有解决问题.

I've tried enabling DES, AES-128 and AES-256 for the account of the SPN but it didn't solve the problem.

我在这里遗漏了什么?

谢谢，利奥

推荐答案

我在连续几天内一直对 KrbException KDC 不支持加密类型 (14)"感到头疼.我访问过很多地方，包括一些深入的 MSDN 博客文章(来自 Hongwei Sun，Sebastian Canevari)，由于缺乏声誉，我无法参考.

just bashed my head against the KrbException "KDC has no support for enryption type (14)" for several days in sequence. I have visited many places including some indepth MSDN blog posts (from Hongwei Sun, Sebastian Canevari) I cannot reference for lack of reputation.

谢谢，您提到 kvno 0 和 DES，它现在也适用于我.

Thanks, for your mention of kvno 0 and dsiabling DES it now also works on my side.

最后归结为我使用

userAccountControl: 0d66048 或 0x10200 匹配 0b10000001000000000或 ADS_UF_DONT_EXPIRE_PASSWD (0x00010000) 和 ADS_UF_NORMAL_ACCOUNT (0x00000200) 但没有设置 UF_USE_DES_KEY_ONLY (0x200000)

userAccountControl: 0d66048 or 0x10200 which matches 0b10000001000000000 or ADS_UF_DONT_EXPIRE_PASSWD (0x00010000) and ADS_UF_NORMAL_ACCOUNT (0x00000200) but no UF_USE_DES_KEY_ONLY (0x200000) being set

和

msDS-SupportedEncryptionTypes:0d16 或 0x10 匹配 0b10000 或 AES256-CTS-HMAC-SHA1-96 (0x10) 但未设置 RC4-HMAC (0x04).

msDS-SupportedEncryptionTypes: 0d16 or 0x10 which matches 0b10000 or AES256-CTS-HMAC-SHA1-96 (0x10) but no RC4-HMAC (0x04) being set.

ldapsearch -h masterdc.localnet.org -D 'spn_hostname' -w '*password*' -b 'ou=Accounts,dc=localnet,dc=org' -s sub 'userPrincipalName=HTTP/[e-mail]' distinguishedName servicePrincipalName userPrincipalName msDS-SupportedEncryptionTypes userAccountControl
# extended LDIF
#
# LDAPv3
# base <ou=Accounts,dc=localnet,dc=org> with scope subtree
# filter: userPrincipalName=HTTP/[e-mail]
# requesting: distinguishedName servicePrincipalName userPrincipalName msDS-SupportedEncryptionTypes userAccountControl
#

# spn_hostname, DokSvc, Services, Accounts, localnet.org
dn: CN=spn_hostname,OU=DokSvc,OU=Services,OU=Accounts,DC=localnet,DC=org
distinguishedName: CN=spn_hostname,OU=DokSvc,OU=Services,OU=Accounts,DC=localnet,DC=org
userAccountControl: 66048
userPrincipalName: HTTP/[e-mail]
servicePrincipalName: HTTP/hostname.localnet.org
servicePrincipalName: HTTP/[e-mail]
msDS-SupportedEncryptionTypes: 16

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

在我的/etc/krb5.conf 中使用此内容和以下内容，当从 default_tkt_enctypes 中删除 rc4-hmac 时，我可以重现地引发KrbException KDC 不支持加密类型 (14)".

With this and the following in my /etc/krb5.conf I can reproducably provoke "KrbException KDC has no support for enryption type (14)" when removing rc4-hmac from the default_tkt_enctypes.

/etc/krb5.conf:

/etc/krb5.conf:

[logging]
  default = FILE:/var/log/krb5libs.log
  kdc = FILE:/var/log/krb5kdc.log
  admin_server = FILE:/var/log/kadmind.log
[libdefaults]
  default_realm = LOCALNET.DE
  default_tkt_enctypes = aes256-cts
  default_tgs_enctypes = aes256-cts
  permitted_enctypes = aes256-cts
[realms]
LOCALNET.ORG = {
  kdc = masterdc.localnet.org:88
  admin_server = masterdc.localnet.org
  default_domain = LOCALNET.ORG
}
[domain_realm]
  .localnet.org = LOCALNET.ORG
  localnet.org = LOCALNET.ORG
[appdefaults]
  autologin = true
  forward = true
  forwardable = true
  encrypt = true

但是，如果您将其更改为 default_tkt_enctypes = aes256-cts rc4-hmac 它将成功.

However if you change it to default_tkt_enctypes = aes256-cts rc4-hmac it will succeed.

请注意，您也可以省略在/etc/krb5.conf 中指定 default_tkt_enctypes 指令，以使其工作.

Note that you can also leave out specifying the default_tkt_enctypes directive in /etc/krb5.conf, in order to make it work.

Using builtin default etypes for default_tkt_enctypes
default etypes for default_tkt_enctypes: 18 17 16 23.

因此看起来 Windows Server 2008 SP2 Active Directory 在预认证阶段明确要求 RC4-HMAC:

It therefor looks like Windows Server 2008 SP2 Active Directory does explicitly require RC4-HMAC in the Pre-Authentication phase:

         PA-ETYPE-INFO2 etype = 23, salt = null, s2kparams = null

为了支持 AES256，我已经更新了 JDK 的 jre/lib/security 文件夹中的 JCE 1.8.0 策略文件.

I have updated JCE 1.8.0 policy files within my JDK's jre/lib/security folder in order for AES256 to be supported.

亲切的问候，斯蒂芬

加密类型在

Kerberos 参数http://www.iana.org/assignments/kerberos-parameters/kerberos-parameters.xhtml

Kerberos Parameters http://www.iana.org/assignments/kerberos-parameters/kerberos-parameters.xhtml

etype   encryption type     Reference
1   des-cbc-crc     [RFC3961]
3   des-cbc-md5     [RFC3961]
17  aes128-cts-hmac-sha1-96     [RFC3962]
18  aes256-cts-hmac-sha1-96     [RFC3962]
23  rc4-hmac    [RFC4757]

<小时>

失败:

java -cp /somepath/krb5.jar -Dsun.security.krb5.debug=true sun.security.krb5.internal.tools.Kinit -k -t /somepath/spn_hostname.keytab HTTP/[e-mail]
>>>KinitOptions cache name is /tmp/krb5cc_723
Principal is HTTP/[e-mail]
>>> Kinit using keytab
>>> Kinit keytab file name: /somepath/spn_hostname.keytab
Java config name: null
LSA: Found Ticket
LSA: Made NewWeakGlobalRef
LSA: Found PrincipalName
LSA: Made NewWeakGlobalRef
LSA: Found DerValue
LSA: Made NewWeakGlobalRef
LSA: Found EncryptionKey
LSA: Made NewWeakGlobalRef
LSA: Found TicketFlags
LSA: Made NewWeakGlobalRef
LSA: Found KerberosTime
LSA: Made NewWeakGlobalRef
LSA: Found String
LSA: Made NewWeakGlobalRef
LSA: Found DerValue constructor
LSA: Found Ticket constructor
LSA: Found PrincipalName constructor
LSA: Found EncryptionKey constructor
LSA: Found TicketFlags constructor
LSA: Found KerberosTime constructor
LSA: Finished OnLoad processing
Native config name: C:Windowskrb5.ini
Loaded from native config
>>> Kinit realm name is LOCALNET.ORG
>>> Creating KrbAsReq
>>> KrbKdcReq local addresses for hostname.localnet.org are:

        hostname.localnet.org/192.168.1.2
IPv4 address
>>> KdcAccessibility: reset
>>> KeyTabInputStream, readName(): LOCALNET.ORG
>>> KeyTabInputStream, readName(): HTTP
>>> KeyTabInputStream, readName(): hostname.localnet.org
>>> KeyTab: load() entry length: 64; type: 1
>>> KeyTabInputStream, readName(): LOCALNET.ORG
>>> KeyTabInputStream, readName(): HTTP
>>> KeyTabInputStream, readName(): hostname.localnet.org
>>> KeyTab: load() entry length: 64; type: 3
>>> KeyTabInputStream, readName(): LOCALNET.ORG
>>> KeyTabInputStream, readName(): HTTP
>>> KeyTabInputStream, readName(): hostname.localnet.org
>>> KeyTab: load() entry length: 72; type: 23
>>> KeyTabInputStream, readName(): LOCALNET.ORG
>>> KeyTabInputStream, readName(): HTTP
>>> KeyTabInputStream, readName(): hostname.localnet.org
>>> KeyTab: load() entry length: 88; type: 18
>>> KeyTabInputStream, readName(): LOCALNET.ORG
>>> KeyTabInputStream, readName(): HTTP
>>> KeyTabInputStream, readName(): hostname.localnet.org
>>> KeyTab: load() entry length: 72; type: 17
Looking for keys for: HTTP/[e-mail]
Added key: 17version: 0
Added key: 18version: 0
Added key: 23version: 0
Found unsupported keytype (3) for HTTP/[e-mail]
Found unsupported keytype (1) for HTTP/[e-mail]
default etypes for default_tkt_enctypes: 18.
>>> KrbAsReq creating message
>>> KrbKdcReq send: kdc=masterdc.localnet.org UDP:88, timeout=30000, number of retries =3, #bytes=216
>>> KDCCommunication: kdc=masterdc.localnet.org UDP:88, timeout=30000,Attempt =1, #bytes=216
>>> KrbKdcReq send: #bytes read=194
>>>Pre-Authentication Data:
         PA-DATA type = 19
         PA-ETYPE-INFO2 etype = 18, salt = LOCALNET.ORGHTTPhostname.localnet.org, s2kparams = null

>>>Pre-Authentication Data:
         PA-DATA type = 2
         PA-ENC-TIMESTAMP
>>>Pre-Authentication Data:
         PA-DATA type = 16

>>>Pre-Authentication Data:
         PA-DATA type = 15

>>> KdcAccessibility: remove masterdc.localnet.org:88
>>> KDCRep: init() encoding tag is 126 req type is 11
>>>KRBError:
         sTime is Tue Jan 17 18:49:14 CET 2017 1484675354000
         suSec is 822386
         error code is 25
         error Message is Additional pre-authentication required
         sname is krbtgt/[e-mail]
         eData provided.
         msgType is 30
>>>Pre-Authentication Data:
         PA-DATA type = 19
         PA-ETYPE-INFO2 etype = 18, salt = LOCALNET.ORGHTTPhostname.localnet.org, s2kparams = null

>>>Pre-Authentication Data:
         PA-DATA type = 2
         PA-ENC-TIMESTAMP
>>>Pre-Authentication Data:
         PA-DATA type = 16

>>>Pre-Authentication Data:
         PA-DATA type = 15

KrbAsReqBuilder: PREAUTH FAILED/REQ, re-send AS-REQ
default etypes for default_tkt_enctypes: 18.
Looking for keys for: HTTP/[e-mail]
Added key: 17version: 0
Added key: 18version: 0
Added key: 23version: 0
Found unsupported keytype (3) for HTTP/[e-mail]
Found unsupported keytype (1) for HTTP/[e-mail]
Looking for keys for: HTTP/[e-mail]
Added key: 17version: 0
Added key: 18version: 0
Added key: 23version: 0
Found unsupported keytype (3) for HTTP/[e-mail]
Found unsupported keytype (1) for HTTP/[e-mail]
default etypes for default_tkt_enctypes: 18.
>>> EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType
>>> KrbAsReq creating message
>>> KrbKdcReq send: kdc=masterdc.localnet.org UDP:88, timeout=30000, number of retries =3, #bytes=305
>>> KDCCommunication: kdc=masterdc.localnet.org UDP:88, timeout=30000,Attempt =1, #bytes=305
>>> KrbKdcReq send: #bytes read=93
>>> KdcAccessibility: remove masterdc.localnet.org:88
>>> KDCRep: init() encoding tag is 126 req type is 11
>>>KRBError:
         sTime is Tue Jan 17 18:49:14 CET 2017 1484675354000
         suSec is 25186
         error code is 14
         error Message is KDC has no support for encryption type
         sname is krbtgt/[e-mail]
         msgType is 30
Exception: krb_error 14 KDC has no support for encryption type (14) KDC has no support for encryption type
KrbException: KDC has no support for encryption type (14)
        at sun.security.krb5.KrbAsRep.<init>(Unknown Source)
        at sun.security.krb5.KrbAsReqBuilder.send(Unknown Source)
        at sun.security.krb5.KrbAsReqBuilder.action(Unknown Source)
        at sun.security.krb5.internal.tools.Kinit.<init>(Unknown Source)
        at sun.security.krb5.internal.tools.Kinit.main(Unknown Source)
Caused by: KrbException: Identifier doesn't match expected value (906)
        at sun.security.krb5.internal.KDCRep.init(Unknown Source)
        at sun.security.krb5.internal.ASRep.init(Unknown Source)
        at sun.security.krb5.internal.ASRep.<init>(Unknown Source)
        ... 5 more

成功:

java -cp /home/wls0/webdav/krb5.jar -Dsun.security.krb5.debug=true sun.security.krb5.internal.tools.Kinit -k -t /somepath/spn_hostname.keytab HTTP/[e-mail]
>>>KinitOptions cache name is /tmp/krb5cc_723
Principal is HTTP/[e-mail]
>>> Kinit using keytab
>>> Kinit keytab file name: /somepath/spn_hostname.keytab
Java config name: null
Native config name: /etc/krb5.conf
Loaded from native config
>>> Kinit realm name is LOCALNET.ORG
>>> Creating KrbAsReq
>>> KrbKdcReq local addresses for hostname.localnet.org are:

        hostname.localnet.org/192.168.1.2
IPv4 address
>>> KdcAccessibility: reset
>>> KeyTabInputStream, readName(): LOCALNET.ORG
>>> KeyTabInputStream, readName(): HTTP
>>> KeyTabInputStream, readName(): hostname.localnet.org
>>> KeyTab: load() entry length: 64; type: 1
>>> KeyTabInputStream, readName(): LOCALNET.ORG
>>> KeyTabInputStream, readName(): HTTP
>>> KeyTabInputStream, readName(): hostname.localnet.org
>>> KeyTab: load() entry length: 64; type: 3
>>> KeyTabInputStream, readName(): LOCALNET.ORG
>>> KeyTabInputStream, readName(): HTTP
>>> KeyTabInputStream, readName(): hostname.localnet.org
>>> KeyTab: load() entry length: 72; type: 23
>>> KeyTabInputStream, readName(): LOCALNET.ORG
>>> KeyTabInputStream, readName(): HTTP
>>> KeyTabInputStream, readName(): hostname.localnet.org
>>> KeyTab: load() entry length: 88; type: 18
>>> KeyTabInputStream, readName(): LOCALNET.ORG
>>> KeyTabInputStream, readName(): HTTP
>>> KeyTabInputStream, readName(): hostname.localnet.org
>>> KeyTab: load() entry length: 72; type: 17
Looking for keys for: HTTP/[e-mail]
Added key: 17version: 0
Added key: 18version: 0
Added key: 23version: 0
Found unsupported keytype (3) for HTTP/[e-mail]
Found unsupported keytype (1) for HTTP/[e-mail]
default etypes for default_tkt_enctypes: 23 18.
>>> KrbAsReq creating message
>>> KrbKdcReq send: kdc=masterdc.localnet.org UDP:88, timeout=30000, number of retries =3, #bytes=180
>>> KDCCommunication: kdc=masterdc.localnet.org UDP:88, timeout=30000,Attempt =1, #bytes=180
>>> KrbKdcReq send: #bytes read=201
>>>Pre-Authentication Data:
         PA-DATA type = 19
         PA-ETYPE-INFO2 etype = 18, salt = LOCALNET.ORGHTTPhostname.localnet.org, s2kparams = null
         PA-ETYPE-INFO2 etype = 23, salt = null, s2kparams = null

>>>Pre-Authentication Data:
         PA-DATA type = 2
         PA-ENC-TIMESTAMP
>>>Pre-Authentication Data:
         PA-DATA type = 16

>>>Pre-Authentication Data:
         PA-DATA type = 15

>>> KdcAccessibility: remove masterdc.localnet.org
>>> KDCRep: init() encoding tag is 126 req type is 11
>>>KRBError:
         sTime is Tue Jan 17 19:11:56 CET 2017 1484676716000
         suSec is 116308
         error code is 25
         error Message is Additional pre-authentication required
         sname is krbtgt/[e-mail]
         eData provided.
         msgType is 30
>>>Pre-Authentication Data:
         PA-DATA type = 19
         PA-ETYPE-INFO2 etype = 18, salt = LOCALNET.ORGHTTPhostname.localnet.org, s2kparams = null
         PA-ETYPE-INFO2 etype = 23, salt = null, s2kparams = null

>>>Pre-Authentication Data:
         PA-DATA type = 2
         PA-ENC-TIMESTAMP
>>>Pre-Authentication Data:
         PA-DATA type = 16

>>>Pre-Authentication Data:
         PA-DATA type = 15

KrbAsReqBuilder: PREAUTH FAILED/REQ, re-send AS-REQ
default etypes for default_tkt_enctypes: 23 18.
Looking for keys for: HTTP/[e-mail]
Added key: 17version: 0
Added key: 18version: 0
Added key: 23version: 0
Found unsupported keytype (3) for HTTP/[e-mail]
Found unsupported keytype (1) for HTTP/[e-mail]
Looking for keys for: HTTP/[e-mail]
Added key: 17version: 0
Added key: 18version: 0
Added key: 23version: 0
Found unsupported keytype (3) for HTTP/[e-mail]
Found unsupported keytype (1) for HTTP/[e-mail]
default etypes for default_tkt_enctypes: 23 18.
>>> EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType
>>> KrbAsReq creating message
>>> KrbKdcReq send: kdc=masterdc.localnet.org UDP:88, timeout=30000, number of retries =3, #bytes=269
>>> KDCCommunication: kdc=masterdc.localnet.org UDP:88, timeout=30000,Attempt =1, #bytes=269
>>> KrbKdcReq send: #bytes read=94
>>> KrbKdcReq send: kdc=masterdc.localnet.org TCP:88, timeout=30000, number of retries =3, #bytes=269
>>> KDCCommunication: kdc=masterdc.localnet.org TCP:88, timeout=30000,Attempt =1, #bytes=269
>>>DEBUG: TCPClient reading 1615 bytes
>>> KrbKdcReq send: #bytes read=1615
>>> KdcAccessibility: remove masterdc.localnet.org
Looking for keys for: HTTP/[e-mail]
Added key: 17version: 0
Added key: 18version: 0
Added key: 23version: 0
Found unsupported keytype (3) for HTTP/[e-mail]
Found unsupported keytype (1) for HTTP/[e-mail]
>>> EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType
>>> KrbAsRep cons in KrbAsReq.getReply HTTP/hostname.localnet.org
New ticket is stored in cache file /tmp/krb5cc_723

<小时>

PS:您可能希望从 Windows JDK 中提取 Kerberos 5 工具，因为 Oracle 已将其从 JDK 1.6 中删除.这为您提供了带有参数 (-Dsun.security.krb5.debug=true) 的 Linux 平台上的额外调试输出.

---

PS: You might want to extract the Kerberos 5 Tools from a Windows JDK because Oracle have removed it from the JDK 1.6 onwards. This gives you additional debug output on Linux platform with the Parameter (-Dsun.security.krb5.debug=true).

mkdir sun.security.krb5
cd sun.security.krb5
"C:OracleJavajdk1.8.0_112injar.exe" -xf C:OracleJavajre1.8.0_112lib
t.jar sunsecuritykrb5
"C:OracleJavajdk1.8.0_112injar.exe" -cf krb5.jar sunsecuritykrb5
dir

这适用于 JDK-6910497:缺少 Kinit 类http://bugs.java.com/bugdatabase/view_bug.do?bug_id=6910497

This works around JDK-6910497 : Kinit class missing http://bugs.java.com/bugdatabase/view_bug.do?bug_id=6910497

这篇关于KDC 不支持加密类型 (14)的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！