You are viewing a plain text version of this content. The canonical link for it is here.
Posted to kerby@directory.apache.org by "Zheng, Kai" <ka...@intel.com> on 2017/05/03 11:28:59 UTC
RE: MIT Kerberos compatibility
Hi Marc,
In case you're not aware of this, please check out the latest fix made by Jiajia. We thought your case may be different, but would be good to have a check before we can repeat/fix your case. Thanks.
https://issues.apache.org/jira/browse/DIRKRB-625
Regards,
Kai
-----Original Message-----
From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
Sent: Sunday, April 30, 2017 7:45 PM
To: kerby@directory.apache.org
Subject: Re: MIT Kerberos compatibility
Hi Kai,
The terminal output below is for the latest MIT Kerberos 1.15.1 (locally built on Ubuntu Xenial). Before that, I also tested with the default Xenial MIT Kerberos packages (1.13.2), with the same result. I did not try earlier MIT Kerberos versions.
Marc
Op 29-04-17 om 21:42 schreef Marc de Lignie:
>
> Hi Kai,
>
> Thanks for the response. I prepared a minimal config that reproduces
> my problem.
>
> You can fetch the branch/commit from:
> https://github.com/vtslab/directory-kerby/commits/MitIssue
>
> This is relative to RC2, but I also tried this on trunk for my actual
> project.
>
> This config produces the debug and error messages below.
>
> 1. For the terminal with the bash + python script $ klist Ticket
> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> Default principal: drankye@TEST.COM
>
> Valid starting Expires Service principal
> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/TEST.COM@TEST.COM
> renew until 29-04-17 21:07:39
>
> $ .
> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/
> server/MitIssueTest.sh [15538] 1493491231.917606: Retrieving
> drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0,
> enctype 0) with result:
> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [15538]
> 1493491231.917827: Retrieving drankye@TEST.COM from
> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> kerberos.authGSSClientInit successful [15538] 1493491231.918185:
> Getting credentials drankye@TEST.COM -> test-service/localhost@ using
> ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
> test-service/localhost@ from
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
> -1765328243/Matching credential not found (filename:
> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
> test-service/localhost@TEST.COM with result: -1765328243/Matching
> credential not found (filename:
> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> [15538] 1493491231.918229: Server has referral realm; starting with
> test-service/localhost@TEST.COM [15538] 1493491231.918278: Retrieving
> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM from
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
> 0/Success
> [15538] 1493491231.918281: Starting with TGT for client realm:
> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
> 1493491231.918301: Requesting tickets for
> test-service/localhost@TEST.COM, referrals on [15538]
> 1493491231.918326: Generated subkey for TGS request:
> aes128-cts/FA30
> [15538] 1493491231.918359: etypes requested in TGS request:
> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1,
> rc4-hmac, camellia128-cts, camellia256-cts [15538] 1493491231.918484:
> Encoding request body and padata into FAST request [15538]
> 1493491231.918541: Sending request (836 bytes) to TEST.COM [15538]
> 1493491231.918597: Resolving hostname localhost [15538]
> 1493491231.918703: Initiating TCP connection to stream
> 127.0.0.1:44292
> [15538] 1493491231.918777: Sending TCP request to stream
> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error receiving from
> stream
> 127.0.0.1:44292: 104/Connection reset by peer [15538]
> 1493491231.922812: Terminating TCP connection to stream
> 127.0.0.1:44292
> [15538] 1493491231.922858: Sending initial UDP request to dgram
> 127.0.0.1:44292
> ('First kerberos.authGSSClientStep not successful',
> GSSError(('Unspecified GSS failure. Minor code may provide more
> information', 851968), ("Cannot contact any KDC for realm 'TEST.COM'",
> -1765328228)))
>
> 2. For the terminal that runs mvn clean test -Dtest=MitIssueTest
> Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> 2017-04-29 21:07:39,182 DEBUG [main] backend.AbstractIdentityBackend:
> initialize called
> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
> getIdentity called, principalName = krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
> getIdentity failed, principalName = krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
> addIdentity successful, principalName = krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
> getIdentity called, principalName = kadmin/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
> getIdentity failed, principalName = kadmin/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,213 DEBUG [main] backend.AbstractIdentityBackend:
> addIdentity successful, principalName = kadmin/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,216 DEBUG [main] backend.AbstractIdentityBackend:
> start called
> 2017-04-29 21:07:39,232 DEBUG [main] backend.AbstractIdentityBackend:
> addIdentity successful, principalName =
> test-service/localhost@TEST.COM
> 2017-04-29 21:07:39,425 DEBUG [main] backend.AbstractIdentityBackend:
> addIdentity successful, principalName = drankye@TEST.COM
> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity called, principalName =
> krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity successful, principalName
> = krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1] request.KdcRequest:
> Client entry is empty.
> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity called, principalName =
> drankye@TEST.COM
> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity successful, principalName
> = drankye@TEST.COM
> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity called, principalName =
> krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity successful, principalName
> = krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
> impl.DefaultKdcHandler: Transport or decoding error occurred,
> disconnecting abnormally java.io.EOFException
> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> at
> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
> at
> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
> at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> at java.lang.Thread.run(Thread.java:748)
> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase: Storing the
> tgt to the credential cache file.
> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
> getIdentity called, principalName = test-service/localhost@TEST.COM
> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
> getIdentity successful, principalName =
> test-service/localhost@TEST.COM
> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity called, principalName =
> krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity successful, principalName
> = krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1] request.KdcRequest:
> Client entry is empty.
> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity called, principalName =
> test-service/localhost@TEST.COM
> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity successful, principalName
> = test-service/localhost@TEST.COM
> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity called, principalName =
> krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity successful, principalName
> = krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1] request.KdcRequest:
> The preauth data is empty.
> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1] server.KdcHandler: KRB
> error occurred while processing request:Additional pre-authentication
> required
> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
> impl.DefaultKdcHandler: Transport or decoding error occurred,
> disconnecting abnormally java.io.EOFException
> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> at
> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
> at
> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
> at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> at java.lang.Thread.run(Thread.java:748)
> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity called, principalName =
> krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity successful, principalName
> = krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1] request.KdcRequest:
> Client entry is empty.
> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity called, principalName =
> test-service/localhost@TEST.COM
> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity successful, principalName
> = test-service/localhost@TEST.COM
> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity called, principalName =
> krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity successful, principalName
> = krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
> impl.DefaultKdcHandler: Transport or decoding error occurred,
> disconnecting abnormally java.io.EOFException
> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> at
> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
> at
> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
> at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> at java.lang.Thread.run(Thread.java:748)
> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity called, principalName =
> krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity successful, principalName
> = krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1] request.KdcRequest:
> Found fast padata and start to process it.
> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
> impl.DefaultKdcHandler: Error occured while processing request:
> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
> at
> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast(KdcRequest.java:208)
> at
> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.process(KdcRequest.java:168)
> at
> org.apache.kerby.kerberos.kerb.server.KdcHandler.handleMessage(KdcHandler.java:115)
> at
> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.handleMessage(DefaultKdcHandler.java:67)
> at
> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:52)
> at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> at java.lang.Thread.run(Thread.java:748)
> Caused by: java.io.IOException: Unexpected item context [0] [tag=0xA0,
> off=0, len=3+207], expecting 0x30
> at
> org.apache.kerby.asn1.type.Asn1Encodeable.decode(Asn1Encodeable.java:210)
> at
> org.apache.kerby.asn1.type.Asn1Encodeable.decode(Asn1Encodeable.java:197)
> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
> ... 9 more
> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
> impl.DefaultKdcHandler: Transport or decoding error occurred,
> disconnecting abnormally
> java.net.SocketException: Socket closed
> at java.net.SocketInputStream.socketRead0(Native Method)
> at java.net.SocketInputStream.socketRead(SocketInputStream.java:116)
> at java.net.SocketInputStream.read(SocketInputStream.java:171)
> at java.net.SocketInputStream.read(SocketInputStream.java:141)
> at java.net.SocketInputStream.read(SocketInputStream.java:224)
> at java.io.DataInputStream.readInt(DataInputStream.java:387)
> at
> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
> at
> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
> at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> at java.lang.Thread.run(Thread.java:748)
>
> In a FreeIPA environment these python lines "just" work.
>
> Any suggestions are welcome!
>
> Marc
>
>
--
Marc de Lignie
Re: MIT Kerberos compatibility
Posted by "Zheng, Kai" <ka...@intel.com>.
I think we can check the tcp problem with our java client and mit client. If both work we still could proceed, otherwise we need fix soon. Note the python client looks like not an easy debug. Anyone familiar?
Sent from iPhone
> 在 2017年5月5日，下午10:09，Colm O hEigeartaigh <co...@apache.org> 写道：
>
> Hi Jiajia,
>
> What are the issues if UDP is disabled and we don't use Netty? I tried
> doing this with my own test-cases and it didn't work, so it would be good
> to get this fixed soon.
>
> Colm.
>
>> On Fri, May 5, 2017 at 2:46 PM, Li, Jiajia <ji...@intel.com> wrote:
>>
>> Hi Marc,
>>>>> - your KRB5 tracing looks quite different. What OS and mit-kerberos
>> version did you use?
>> I use mac os and the python version is 2.7.10
>>
>>>>> - your KRB5 tracing shows UDP comms between kerberos client and KDC,
>> despite the allowUDP = false setting
>>>>> in my test. I did this setting because I get different problems
>> without it, see the additional logs below. So,
>>>>> we must also be aware of networking problems at my side.
>> I enable the UDP and use netty network, there are some issues if UDP
>> disabled, you can create a JIRA for this and we can fix this issue in the
>> next release version.
>>
>> The changes in my side as following:
>>
>> protected boolean allowUdp() {
>> return true;
>> }
>> @Override
>> protected void prepareKdc() throws KrbException {
>> getKdcServer().setInnerKdcImpl(
>> new NettyKdcServerImpl(getKdcServer().getKdcSetting()));
>> super.prepareKdc();
>> }
>>
>> Here is log of MitIssueTest:
>> [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
>> [nioEventLoopGroup-2-1] INFO io.netty.handler.logging.LoggingHandler -
>> [id: 0x2634fe6b] REGISTERED
>> [nioEventLoopGroup-2-1] INFO io.netty.handler.logging.LoggingHandler -
>> [id: 0x2634fe6b] BIND(0.0.0.0/0.0.0.0:53957)
>> [nioEventLoopGroup-2-1] INFO io.netty.handler.logging.LoggingHandler -
>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] ACTIVE
>> [main] INFO org.apache.kerby.kerberos.kdc.impl.NettyKdcServerImpl - Netty
>> kdc server started.
>> [nioEventLoopGroup-2-1] INFO io.netty.handler.logging.LoggingHandler -
>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] RECEIVED: [id: 0xdac7228b, /
>> 127.0.0.1:53961 => /127.0.0.1:53957]
>> [defaultEventExecutorGroup-4-1] INFO org.apache.kerby.kerberos.kerb.server.request.AsRequest
>> - AS_REQ ISSUE: authtime 1493991123792,drankye@TEST.COM for krbtgt/
>> TEST.COM@TEST.COM
>> [main] INFO org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClient
>> - Send to kdc success.
>> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing
>> the tgt to the credential cache file.
>> [nioEventLoopGroup-5-1] INFO org.apache.kerby.kerberos.kerb.server.request.KdcRequest
>> - The preauth data is empty.
>> [nioEventLoopGroup-5-1] INFO org.apache.kerby.kerberos.kerb.server.KdcHandler
>> - KRB error occurred while processing request:Additional pre-authentication
>> required
>> [nioEventLoopGroup-5-1] INFO org.apache.kerby.kerberos.kerb.server.request.AsRequest
>> - AS_REQ ISSUE: authtime 1493991123859,test-service/localhost@TEST.COM
>> for krbtgt/TEST.COM@TEST.COM
>> [nioEventLoopGroup-5-1] INFO org.apache.kerby.kerberos.kerb.server.request.TgsRequest
>> - TGS_REQ ISSUE: authtime 1493991142850,drankye for test-service/
>> localhost@TEST.COM
>>
>> Thanks
>> Jiajia
>>
>> -----Original Message-----
>> From: Zheng, Kai
>> Sent: Friday, May 5, 2017 7:46 PM
>> To: kerby@directory.apache.org; Li, Jiajia <ji...@intel.com>
>> Subject: RE: MIT Kerberos compatibility
>>
>> Hi Marc,
>>
>> Looks like this is quite environment related, could you fire an issue for
>> this? I would suggest we target it to 1.1.0, which can be done in June.
>>
>> Regards,
>> Kai
>>
>> -----Original Message-----
>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
>> Sent: Friday, May 05, 2017 4:44 PM
>> To: Li, Jiajia <ji...@intel.com>
>> Cc: kerby@directory.apache.org
>> Subject: Re: MIT Kerberos compatibility
>>
>> Hi Jiajia,
>>
>> Great to read that you made progress on this issue and to see a working
>> config at your side. Below, I list my progress below (with trunk merged
>> into my MitIssue branch), but I am afraid we are not done yet.
>>
>> Things that stand out:
>>
>> - the kdc decoding error is solved, relative to the logs without your patch
>>
>> - your KRB5 tracing looks quite different. What OS and mit-kerberos
>> version did you use?
>>
>> - your KRB5 tracing shows UDP comms between kerberos client and KDC,
>> despite the allowUDP = false setting in my test. I did this setting because
>> I get different problems without it, see the additional logs below. So, we
>> must also be aware of networking problems at my side.
>>
>> - the "Response was not from master KDC" msg is not relevant; it
>> disappears if you manually add master_kdc to the realms section of the
>> krb5.conf
>>
>> I have no idea how to proceed from here, so that is why I just document
>> the status at my side and ask about your - apparently working - config.
>>
>> Cheers, Marc
>>
>>
>> KDC logging with allowUDP = false:
>>
>> [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
>> [pool-1-thread-1] INFO
>> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
>> authtime 1493970789075,drankye@TEST.COM for krbtgt/TEST.COM@TEST.COM
>> [main] INFO org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClient
>> - Send to kdc success.
>> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing
>> the tgt to the credential cache file.
>> [pool-1-thread-1] INFO
>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The preauth
>> data is empty.
>> [pool-1-thread-1] INFO org.apache.kerby.kerberos.kerb.server.KdcHandler
>> - KRB error occurred while processing request:Additional
>> pre-authentication required [pool-1-thread-1] INFO
>> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
>> authtime 1493970789108,test-service/localhost@TEST.COM for krbtgt/
>> TEST.COM@TEST.COM [pool-1-thread-1] INFO org.apache.kerby.kerberos.kerb.server.request.KdcRequest
>> - Found fast padata and starting to process it.
>> [pool-1-thread-1] INFO
>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found fast
>> padata and starting to process it.
>>
>> Python script KRB5 tracing (MIT Kerberos 1.13.2 of Ubuntu Xenial) with
>> allowUDP = false:
>>
>> $ .
>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/
>> kerberos/kerb/server/MitIssueTest.sh
>> [25281] 1493970797.298753: Retrieving drankye@TEST.COM from
>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281]
>> 1493970797.298952: Retrieving drankye@TEST.COM from
>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281]
>> 1493970797.299106: Retrieving drankye@TEST.COM from
>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281]
>> 1493970797.299213: Retrieving drankye@TEST.COM from
>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281]
>> 1493970797.299323: Retrieving drankye@TEST.COM from
>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281]
>> 1493970797.299436: Retrieving drankye@TEST.COM from
>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281]
>> 1493970797.299545: Retrieving drankye@TEST.COM from
>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281]
>> 1493970797.299654: Retrieving drankye@TEST.COM from
>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>> kerberos.authGSSClientInit successful [25281] 1493970797.299922: Getting
>> credentials drankye@TEST.COM -> test-service/localhost@ using ccache
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> [25281] 1493970797.299945: Retrieving drankye@TEST.COM ->
>> test-service/localhost@ from FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> with result:
>> -1765328243/Matching credential not found [25281] 1493970797.299959:
>> Retrying drankye@TEST.COM -> test-service/localhost@TEST.COM with result:
>> -1765328243/Matching credential not found [25281] 1493970797.299962: Server
>> has referral realm; starting with test-service/localhost@TEST.COM [25281]
>> 1493970797.299975: Retrieving drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM
>> from FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>> 0/Success [25281] 1493970797.299979: Starting with TGT for client realm:
>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [25281] 1493970797.299981:
>> Requesting tickets for test-service/localhost@TEST.COM, referrals on
>> [25281] 1493970797.299994: Generated subkey for TGS request:
>> aes128-cts/1B9B [25281] 1493970797.300009: etypes requested in TGS request:
>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
>> camellia256-cts [25281] 1493970797.300054: Encoding request body and padata
>> into FAST request [25281] 1493970797.300080: Sending request (823 bytes) to
>> TEST.COM [25281] 1493970797.300091: Resolving hostname localhost [25281]
>> 1493970797.300136: Initiating TCP connection to stream
>> 127.0.0.1:34319
>> [25281] 1493970797.300191: Sending TCP request to stream 127.0.0.1:34319
>> [25281] 1493970797.303610: Received answer (125 bytes) from stream
>> 127.0.0.1:34319
>> [25281] 1493970797.303618: Terminating TCP connection to stream
>> 127.0.0.1:34319
>> [25281] 1493970797.553126: Response was not from master KDC [25281]
>> 1493970797.553198: TGS request result: -1765323383/Unknown code krcM 137
>> [25281] 1493970797.553234: Requesting tickets for test-service/
>> localhost@TEST.COM, referrals off [25281] 1493970797.553273: Generated
>> subkey for TGS request: aes128-cts/94C6 [25281] 1493970797.553323: etypes
>> requested in TGS request: aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac,
>> camellia128-cts, camellia256-cts [25281] 1493970797.553436: Encoding
>> request body and padata into FAST request [25281] 1493970797.553532:
>> Sending request (823 bytes) to TEST.COM [25281] 1493970797.553567:
>> Resolving hostname localhost [25281] 1493970797.553745: Initiating TCP
>> connection to stream
>> 127.0.0.1:34319
>> [25281] 1493970797.553889: Sending TCP request to stream 127.0.0.1:34319
>> [25281] 1493970797.558297: Received answer (125 bytes) from stream
>> 127.0.0.1:34319
>> [25281] 1493970797.558318: Terminating TCP connection to stream
>> 127.0.0.1:34319
>> [25281] 1493970797.561189: Response was not from master KDC [25281]
>> 1493970797.561258: TGS request result: -1765323383/Unknown code krcM 137
>> ('First kerberos.authGSSClientStep not successful', GSSError(('Unspecified
>> GSS failure. Minor code may provide more information', 851968), ('Unknown
>> code krcM 137', -1765323383)))
>>
>>
>> KDC logging with allowUDP = true:
>>
>> [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
>> [pool-1-thread-1] INFO
>> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
>> authtime 1493972505784,drankye@TEST.COM for krbtgt/TEST.COM@TEST.COM
>> [main] INFO org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClient
>> - Send to kdc success.
>> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing
>> the tgt to the credential cache file.
>> [pool-1-thread-1] INFO
>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The preauth
>> data is empty.
>> [pool-1-thread-1] INFO org.apache.kerby.kerberos.kerb.server.KdcHandler
>> - KRB error occurred while processing request:Additional
>> pre-authentication required [pool-1-thread-2] INFO
>> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
>> authtime 1493972505948,test-service/localhost@TEST.COM for krbtgt/
>> TEST.COM@TEST.COM Exception in thread "Thread-0"
>> java.lang.RuntimeException: Error occured while checking udp connections
>> at
>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
>> KdcNetwork.java:105)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
>> access$000(KdcNetwork.java:39)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
>> run(KdcNetwork.java:75)
>> at java.lang.Thread.run(Thread.java:748)
>> Caused by: java.nio.channels.ClosedChannelException
>> at
>> sun.nio.ch.DatagramChannelImpl.ensureOpen(DatagramChannelImpl.java:320)
>> at sun.nio.ch.DatagramChannelImpl.receive(
>> DatagramChannelImpl.java:331)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
>> checkUdpMessage(KdcNetwork.java:132)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
>> KdcNetwork.java:101)
>> ... 3 more
>>
>>
>> krb5.conf:
>>
>> [libdefaults]
>> kdc_realm = TEST.COM
>> default_realm = TEST.COM
>> udp_preference_limit = 4096
>> kdc_tcp_port = 37080
>> kdc_udp_port = 36525
>>
>> [realms]
>> TEST.COM = {
>> kdc = localhost:36525
>> }
>>
>> And port 36525 does not show up in `netstat -l` (while 37080 does)
>>
>>
>> Op 04-05-17 om 14:55 schreef Li, Jiajia:
>>> Hi Marc,
>>> I try to run your test(through applying your patch in the trunk) , I
>> think it's success now. Could you take some time to check about it?
>>> Here is the log:
>>>
>>> directory-kerby git:(trunk) ✗ .
>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/
>>> server/MitIssueTest.sh
>>> kerberos.authGSSClientInit successful
>>> 2017-05-04T20:44:06 set-error: -1765328234: entypes not supported
>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>>> for krb5_ccache_conf_data/realm-config@X-CACHECONF: in cache
>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>>> for test-service/localhost@TEST.COM in cache
>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>>> for
>>> krb5_ccache_conf_data/negative-cache/test-service\134/localhost\134@TE
>>> ST.COM@X-CACHECONF: in cache
>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>>> for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF: in cache
>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>>> for krb5_ccache_conf_data/sitename@X-CACHECONF: in cache
>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>>> for test-service/localhost@TEST.COM in cache
>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>> des-cbc-md5-deprecated not supported
>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>> des-cbc-md4-deprecated not supported
>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>> des-cbc-crc-deprecated not supported
>>> 2017-05-04T20:44:06 Trying to find service kdc for realm TEST.COM
>>> flags 0
>>> 2017-05-04T20:44:06 configuration file for realm TEST.COM found
>>> 2017-05-04T20:44:06 submissing new requests to new host
>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
>>> 2017-05-04T20:44:06 connecting to host: udp ::1:52534 (localhost) tid:
>>> 00000001
>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
>>> 2017-05-04T20:44:06 Queuing host in future (in 3s), its the 2 address
>>> on the same name: udp 127.0.0.1:52534 (localhost) tid: 00000002
>>> 2017-05-04T20:44:06 writing packet: udp ::1:52534 (localhost) tid:
>>> 00000001
>>> 2017-05-04T20:44:06 reading packet: udp ::1:52534 (localhost) tid:
>>> 00000001
>>> 2017-05-04T20:44:06 host completed: udp ::1:52534 (localhost) tid:
>>> 00000001
>>> 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0 hosts 1
>>> packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814 tid: 00000002
>>> 2017-05-04T20:44:06 tkt: extract key 17/763641F3
>>> 2017-05-04T20:44:06 set-error: -1765328353: Decrypt integrity check
>>> failed for checksum type hmac-sha1-96-aes128, key type
>>> aes128-cts-hmac-sha1-96
>>> 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
>>> 2017-05-04T20:44:06 krb5_get_credentials_with_flags: TEST.COM wc:
>>> 0.050317
>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>>> for krb5_ccache_conf_data/realm-config@X-CACHECONF: in cache
>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>>> for
>>> krb5_ccache_conf_data/time-offset/test-service\134/localhost\134@TEST.
>>> COM@X-CACHECONF: in cache
>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>> 2017-05-04T20:44:06 Setting up PFS for auth context
>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>> des-cbc-md5-deprecated not supported
>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>> des-cbc-md4-deprecated not supported
>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>> des-cbc-crc-deprecated not supported First kerberos.authGSSClientStep
>>> successful
>>>
>>> Thanks
>>> Jiajia
>>>
>>> -----Original Message-----
>>> From: Zheng, Kai [mailto:kai.zheng@intel.com]
>>> Sent: Wednesday, May 3, 2017 7:29 PM
>>> To: kerby@directory.apache.org
>>> Subject: RE: MIT Kerberos compatibility
>>>
>>> Hi Marc,
>>>
>>> In case you're not aware of this, please check out the latest fix made
>> by Jiajia. We thought your case may be different, but would be good to have
>> a check before we can repeat/fix your case. Thanks.
>>> https://issues.apache.org/jira/browse/DIRKRB-625
>>>
>>> Regards,
>>> Kai
>>>
>>> -----Original Message-----
>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
>>> Sent: Sunday, April 30, 2017 7:45 PM
>>> To: kerby@directory.apache.org
>>> Subject: Re: MIT Kerberos compatibility
>>>
>>> Hi Kai,
>>>
>>> The terminal output below is for the latest MIT Kerberos 1.15.1 (locally
>> built on Ubuntu Xenial). Before that, I also tested with the default Xenial
>> MIT Kerberos packages (1.13.2), with the same result. I did not try earlier
>> MIT Kerberos versions.
>>>
>>> Marc
>>>
>>> Op 29-04-17 om 21:42 schreef Marc de Lignie:
>>>> Hi Kai,
>>>>
>>>> Thanks for the response. I prepared a minimal config that reproduces
>>>> my problem.
>>>>
>>>> You can fetch the branch/commit from:
>>>> https://github.com/vtslab/directory-kerby/commits/MitIssue
>>>>
>>>> This is relative to RC2, but I also tried this on trunk for my actual
>>>> project.
>>>>
>>>> This config produces the debug and error messages below.
>>>>
>>>> 1. For the terminal with the bash + python script $ klist Ticket
>>>> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>> Default principal: drankye@TEST.COM
>>>>
>>>> Valid starting Expires Service principal
>>>> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/TEST.COM@TEST.COM
>>>> renew until 29-04-17 21:07:39
>>>>
>>>> $ .
>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb
>>>> / server/MitIssueTest.sh [15538] 1493491231.917606: Retrieving
>>>> drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0,
>>>> enctype 0) with result:
>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>> [15538]
>>>> 1493491231.917827: Retrieving drankye@TEST.COM from
>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>> kerberos.authGSSClientInit successful [15538] 1493491231.918185:
>>>> Getting credentials drankye@TEST.COM -> test-service/localhost@ using
>>>> ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
>>>> test-service/localhost@ from
>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>>>> -1765328243/Matching credential not found (filename:
>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
>>>> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
>>>> test-service/localhost@TEST.COM with result: -1765328243/Matching
>>>> credential not found (filename:
>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
>>>> [15538] 1493491231.918229: Server has referral realm; starting with
>>>> test-service/localhost@TEST.COM [15538] 1493491231.918278: Retrieving
>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM from
>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>>>> 0/Success
>>>> [15538] 1493491231.918281: Starting with TGT for client realm:
>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
>>>> 1493491231.918301: Requesting tickets for
>>>> test-service/localhost@TEST.COM, referrals on [15538]
>>>> 1493491231.918326: Generated subkey for TGS request:
>>>> aes128-cts/FA30
>>>> [15538] 1493491231.918359: etypes requested in TGS request:
>>>> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1,
>>>> rc4-hmac, camellia128-cts, camellia256-cts [15538] 1493491231.918484:
>>>> Encoding request body and padata into FAST request [15538]
>>>> 1493491231.918541: Sending request (836 bytes) to TEST.COM [15538]
>>>> 1493491231.918597: Resolving hostname localhost [15538]
>>>> 1493491231.918703: Initiating TCP connection to stream
>>>> 127.0.0.1:44292
>>>> [15538] 1493491231.918777: Sending TCP request to stream
>>>> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error receiving from
>>>> stream
>>>> 127.0.0.1:44292: 104/Connection reset by peer [15538]
>>>> 1493491231.922812: Terminating TCP connection to stream
>>>> 127.0.0.1:44292
>>>> [15538] 1493491231.922858: Sending initial UDP request to dgram
>>>> 127.0.0.1:44292
>>>> ('First kerberos.authGSSClientStep not successful',
>>>> GSSError(('Unspecified GSS failure. Minor code may provide more
>>>> information', 851968), ("Cannot contact any KDC for realm
>>>> 'TEST.COM'",
>>>> -1765328228)))
>>>>
>>>> 2. For the terminal that runs mvn clean test -Dtest=MitIssueTest
>>>> Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
>>>> 2017-04-29 21:07:39,182 DEBUG [main] backend.AbstractIdentityBackend:
>>>> initialize called
>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
>>>> getIdentity called, principalName = krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
>>>> getIdentity failed, principalName = krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>>>> addIdentity successful, principalName = krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>>>> getIdentity called, principalName = kadmin/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>>>> getIdentity failed, principalName = kadmin/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,213 DEBUG [main] backend.AbstractIdentityBackend:
>>>> addIdentity successful, principalName = kadmin/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,216 DEBUG [main] backend.AbstractIdentityBackend:
>>>> start called
>>>> 2017-04-29 21:07:39,232 DEBUG [main] backend.AbstractIdentityBackend:
>>>> addIdentity successful, principalName =
>>>> test-service/localhost@TEST.COM
>>>> 2017-04-29 21:07:39,425 DEBUG [main] backend.AbstractIdentityBackend:
>>>> addIdentity successful, principalName = drankye@TEST.COM
>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>>> krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1] request.KdcRequest:
>>>> Client entry is empty.
>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>>> drankye@TEST.COM
>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>> principalName = drankye@TEST.COM
>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>>> krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>>> disconnecting abnormally java.io.EOFException
>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>>>> at
>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
>> receiveMessage(KrbTcpTransport.java:54)
>>>> at
>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
>> DefaultKdcHandler.java:46)
>>>> at
>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>> ThreadPoolExecutor.java:1142)
>>>> at
>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>> ThreadPoolExecutor.java:617)
>>>> at java.lang.Thread.run(Thread.java:748)
>>>> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase: Storing
>>>> the tgt to the credential cache file.
>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
>>>> getIdentity called, principalName = test-service/localhost@TEST.COM
>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
>>>> getIdentity successful, principalName =
>>>> test-service/localhost@TEST.COM
>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>>> krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1] request.KdcRequest:
>>>> Client entry is empty.
>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>>> test-service/localhost@TEST.COM
>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>> principalName = test-service/localhost@TEST.COM
>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>>> krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1] request.KdcRequest:
>>>> The preauth data is empty.
>>>> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1] server.KdcHandler:
>>>> KRB error occurred while processing request:Additional
>>>> pre-authentication required
>>>> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>>> disconnecting abnormally java.io.EOFException
>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>>>> at
>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
>> receiveMessage(KrbTcpTransport.java:54)
>>>> at
>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
>> DefaultKdcHandler.java:46)
>>>> at
>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>> ThreadPoolExecutor.java:1142)
>>>> at
>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>> ThreadPoolExecutor.java:617)
>>>> at java.lang.Thread.run(Thread.java:748)
>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>>> krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1] request.KdcRequest:
>>>> Client entry is empty.
>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>>> test-service/localhost@TEST.COM
>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>> principalName = test-service/localhost@TEST.COM
>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>>> krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>>> disconnecting abnormally java.io.EOFException
>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>>>> at
>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
>> receiveMessage(KrbTcpTransport.java:54)
>>>> at
>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
>> DefaultKdcHandler.java:46)
>>>> at
>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>> ThreadPoolExecutor.java:1142)
>>>> at
>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>> ThreadPoolExecutor.java:617)
>>>> at java.lang.Thread.run(Thread.java:748)
>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>>> krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1] request.KdcRequest:
>>>> Found fast padata and start to process it.
>>>> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
>>>> impl.DefaultKdcHandler: Error occured while processing request:
>>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
>> java:85)
>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
>> java:70)
>>>> at
>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast(
>> KdcRequest.java:208)
>>>> at
>>>> org.apache.kerby.kerberos.kerb.server.request.
>> KdcRequest.process(KdcRequest.java:168)
>>>> at
>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
>> handleMessage(KdcHandler.java:115)
>>>> at
>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
>> handleMessage(DefaultKdcHandler.java:67)
>>>> at
>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
>> DefaultKdcHandler.java:52)
>>>> at
>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>> ThreadPoolExecutor.java:1142)
>>>> at
>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>> ThreadPoolExecutor.java:617)
>>>> at java.lang.Thread.run(Thread.java:748)
>>>> Caused by: java.io.IOException: Unexpected item context [0]
>>>> [tag=0xA0, off=0, len=3+207], expecting 0x30
>>>> at
>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>> Asn1Encodeable.java:210)
>>>> at
>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>> Asn1Encodeable.java:197)
>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
>> java:83)
>>>> ... 9 more
>>>> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>>> disconnecting abnormally
>>>> java.net.SocketException: Socket closed
>>>> at java.net.SocketInputStream.socketRead0(Native Method)
>>>> at java.net.SocketInputStream.socketRead(SocketInputStream.
>> java:116)
>>>> at java.net.SocketInputStream.read(SocketInputStream.java:171)
>>>> at java.net.SocketInputStream.read(SocketInputStream.java:141)
>>>> at java.net.SocketInputStream.read(SocketInputStream.java:224)
>>>> at java.io.DataInputStream.readInt(DataInputStream.java:387)
>>>> at
>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
>> receiveMessage(KrbTcpTransport.java:54)
>>>> at
>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
>> DefaultKdcHandler.java:46)
>>>> at
>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>> ThreadPoolExecutor.java:1142)
>>>> at
>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>> ThreadPoolExecutor.java:617)
>>>> at java.lang.Thread.run(Thread.java:748)
>>>>
>>>> In a FreeIPA environment these python lines "just" work.
>>>>
>>>> Any suggestions are welcome!
>>>>
>>>> Marc
>>>>
>>>>
>>> --
>>> Marc de Lignie
>>>
>>
>> --
>> Marc de Lignie
>>
>>
>
>
> --
> Colm O hEigeartaigh
>
> Talend Community Coder
> http://coders.talend.com
RE: MIT Kerberos compatibility
Posted by "Zheng, Kai" <ka...@intel.com>.
Thanks Colm for the confirm!
Regards,
Kai
From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
Sent: Monday, May 08, 2017 6:36 PM
To: Zheng, Kai <ka...@intel.com>
Cc: kerby@directory.apache.org
Subject: Re: MIT Kerberos compatibility
Hi Kai,
No I think it wasn't caused by recent changes. It's fine to target it for the next release. I will call another vote for 1.0.0 as soon as we get the go ahead from Emmanuel.
Colm.
On Mon, May 8, 2017 at 11:32 AM, Zheng, Kai <ka...@intel.com>> wrote:
Hi Colm,
Did you aware it's caused by any recent changes? It looks to me not. How serve is it? It appears in some case in the WSS4J tests. We have work around, using the Netty one. I'd suggest we target it for next minor release, like 1.1.0 or 1.0.1 so we have enough bandwidth to investigate and improve the default transport. We probably shouldn't introduce more changes to get the release out. Note please prefer to use the TCP transport over the UDP one, in today's world.
Regards,
Kai
-----Original Message-----
From: Colm O hEigeartaigh [mailto:coheigea@apache.org<ma...@apache.org>]
Sent: Monday, May 08, 2017 6:19 PM
To: kerby@directory.apache.org<ma...@directory.apache.org>
Subject: Re: MIT Kerberos compatibility
OK I have created a JIRA and attached a patch that you have to apply to the
Apache WSS4J project to reproduce the error. If you uncomment the line that
uses Netty then the tests all work perfectly. The tests appear to work fine
when run in isolation, it's only when you run a few of them after one
another that you can see the failures.
Please let me know if you have any difficulty in reproducing, thanks!
Colm.
On Mon, May 8, 2017 at 11:08 AM, Zheng, Kai <ka...@intel.com>> wrote:
> Hi Colm,
>
> Sure, please do it. Could you review my change and see how it would cause
> the new failures? Any difference between the failed GSS tests and the Kerby
> GSS tests?
>
> Regards,
> Kai
>
> -----Original Message-----
> From: Colm O hEigeartaigh [mailto:coheigea@apache.org<ma...@apache.org>]
> Sent: Monday, May 08, 2017 5:42 PM
> To: Zheng, Kai <ka...@intel.com>>
> Cc: kerby@directory.apache.org<ma...@directory.apache.org>
> Subject: Re: MIT Kerberos compatibility
>
> Hi Kai,
>
> Your changes fixed the error message I was seeing. However, I now see
> another problem when I run a few GSS client tests in a row:
>
> >>> EType: sun.security.krb5.internal.crypto.Aes128CtsHmacSha1EType
> >>> KrbAsReq creating message
> >>> KrbKdcReq send: kdc=localhost UDP:42665, timeout=30000, number of
> retries =3, #bytes=245
> >>> KDCCommunication: kdc=localhost UDP:42665, timeout=30000,Attempt =1,
> #bytes=245
> SocketTimeOutException with attempt: 1
> >>> KDCCommunication: kdc=localhost UDP:42665, timeout=30000,Attempt =2,
> #bytes=245
> >>> KrbKdcReq send: error trying localhost:42665
> java.net<http://java.net>.PortUnreachableException: ICMP Port Unreachable
>
> Do you want me to create a JIRA + attach a test-case?
>
> Colm.
>
> On Sat, May 6, 2017 at 2:01 AM, Zheng, Kai <ka...@intel.com>> wrote:
>
> > I haven't repeated the issue but revisited the codes again and made
> > improvements. Would you check it out? Thanks!
> >
> > Sent from iPhone
> >
> > > 在 2017年5月6日，上午6:28，Zheng, Kai <ka...@intel.com>> 写道：
> > >
> > > Thanks colm for the clarification and it sounds an issue we need to
> > address. I will investigate it soon.
> > >
> > > Sent from iPhone
> > >
> > >> 在 2017年5月6日，上午2:14，Colm O hEigeartaigh <co...@apache.org>> 写道：
> > >>
> > >> Hi Kai,
> > >>
> > >> If I enable UDP with the default Transport, I can get a ticket fine
> > using
> > >> kinit. However then the following error pops up in the window I'm
> > running
> > >> Kerby in (as a test):
> > >>
> > >> Exception in thread "Thread-1" java.lang.RuntimeException: Error
> > >> occured while checking udp connections
> > >> at
> > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > KdcNetwork.java:105)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > access$000(KdcNetwork.java:39)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > run(KdcNetwork.java:75)
> > >> at java.lang.Thread.run(Thread.java:748)
> > >> Caused by: java.nio.channels.ClosedChannelException
> > >> at
> > >> sun.nio.ch<http://sun.nio.ch>.DatagramChannelImpl.ensureOpen(
> DatagramChannelImpl.java:320)
> > >> at sun.nio.ch<http://sun.nio.ch>.DatagramChannelImpl.receive(
> > DatagramChannelImpl.java:331)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > checkUdpMessage(KdcNetwork.java:132)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > KdcNetwork.java:101)
> > >>
> > >> Colm.
> > >>
> > >>
> > >>> On Fri, May 5, 2017 at 5:56 PM, Zheng, Kai <ka...@intel.com>>
> > wrote:
> > >>>
> > >>> Colm, did you see udp problem now instead? I'm a little confused.
> > >>> Udp
> > is
> > >>> sure supported but may not be enabled by default, which should be
> > >>> okay, imo. Thanks.
> > >>>
> > >>> Sent from iPhone
> > >>>
> > >>>> 在 2017年5月6日，上午12:02，Colm O hEigeartaigh <co...@apache.org>> 写道：
> > >>>>
> > >>>> That's probably it. Why does the default transport not support
> > >>>> UDP in
> > >>> Kerby?
> > >>>>
> > >>>> Colm.
> > >>>>
> > >>>>> On Fri, May 5, 2017 at 4:54 PM, Li, Jiajia <ji...@intel.com>>
> > wrote:
> > >>>>>
> > >>>>> Are you sure add kdc_allow_udp = false in kdc.conf?
> > >>>>>
> > >>>>> Thanks
> > >>>>> Jiajia
> > >>>>>
> > >>>>> -----Original Message-----
> > >>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org<ma...@apache.org>]
> > >>>>> Sent: Friday, May 5, 2017 11:41 PM
> > >>>>> To: Li, Jiajia <ji...@intel.com>>
> > >>>>> Cc: kerby@directory.apache.org<ma...@directory.apache.org>; Zheng, Kai
> > >>>>> <ka...@intel.com>>;
> > >>> mailto:
> > >>>>> m.c.delignie@xs4all.nl<ma...@xs4all.nl> <m....@xs4all.nl>>
> > >>>>> Subject: Re: MIT Kerberos compatibility
> > >>>>>
> > >>>>> Sorry, it was my error, UDP was actually enabled there. But why
> > >>>>> am I
> > >>> still
> > >>>>> seeing that error message?
> > >>>>>
> > >>>>> Colm.
> > >>>>>
> > >>>>>> On Fri, May 5, 2017 at 4:39 PM, Li, Jiajia
> > >>>>>> <ji...@intel.com>>
> > >>> wrote:
> > >>>>>>
> > >>>>>> Hi Colm,
> > >>>>>> I also test the Kerby KDC with kerby kint and MIT kinit, and
> > >>>>>> only listen the tcp port(disable udp), both got ticket
> > >>>>>> successfully. But
> > I
> > >>>>>> don't get the error message. Both krb.conf and kdc.conf should
> > >>>>>> set
> > udp
> > >>>>>> to be false, udp is enabled in default.
> > >>>>>>
> > >>>>>> Thanks
> > >>>>>> Jiajia
> > >>>>>>
> > >>>>>> -----Original Message-----
> > >>>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org<ma...@apache.org>]
> > >>>>>> Sent: Friday, May 5, 2017 11:34 PM
> > >>>>>> To: kerby@directory.apache.org<ma...@directory.apache.org>
> > >>>>>> Cc: Zheng, Kai <ka...@intel.com>>;
> > >>>>>> mailto:m.c.delignie@xs4all.nl<ma...@xs4all.nl>
> > <
> > >>>>>> m.c.delignie@xs4all.nl<ma...@xs4all.nl>>
> > >>>>>> Subject: Re: MIT Kerberos compatibility
> > >>>>>>
> > >>>>>> Hi Jiajia,
> > >>>>>>
> > >>>>>> If UDP is disabled and we don't use Netty, I can get a token
> > >>>>>> successfully via kinit. However I then see an error message in
> > >>>>>> the
> > >>> Kerby
> > >>>>> console:
> > >>>>>>
> > >>>>>> Exception in thread "Thread-1" java.lang.RuntimeException:
> > >>>>>> Error occured while checking udp connections at
> > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > >>>>>> KdcNetwork.java:105)
> > >>>>>> at
> > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > >>>>>> access$000(KdcNetwork.java:39)
> > >>>>>> at
> > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > >>>>>> run(KdcNetwork.java:75)
> > >>>>>> at java.lang.Thread.run(Thread.java:748)
> > >>>>>> Caused by: java.nio.channels.ClosedChannelException
> > >>>>>> at
> > >>>>>> sun.nio.ch<http://sun.nio.ch>.DatagramChannelImpl.ensureOpen(
> > >>> DatagramChannelImpl.java:320)
> > >>>>>> at sun.nio.ch<http://sun.nio.ch>.DatagramChannelImpl.receive(
> > >>>>>> DatagramChannelImpl.java:331)
> > >>>>>> at
> > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > >>>>>> checkUdpMessage(KdcNetwork.java:132)
> > >>>>>> at
> > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > >>>>>> KdcNetwork.java:101)
> > >>>>>>
> > >>>>>> I'm not sure why we are seeing UDP errors when it's disabled?
> > >>>>>>
> > >>>>>> Colm.
> > >>>>>>
> > >>>>>>> On Fri, May 5, 2017 at 3:57 PM, Li, Jiajia
> > >>>>>>> <ji...@intel.com>>
> > >>> wrote:
> > >>>>>>>
> > >>>>>>> Hi Colm,
> > >>>>>>> The shell client can't connect to kdc if the UDP is disabled.
> > >>>>>>> We don't use Netty in default.
> > >>>>>>> What's your test-cases? The same as the Marc's?
> > >>>>>>>
> > >>>>>>> Thanks
> > >>>>>>> Jiajia
> > >>>>>>>
> > >>>>>>> -----Original Message-----
> > >>>>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org<ma...@apache.org>]
> > >>>>>>> Sent: Friday, May 5, 2017 10:09 PM
> > >>>>>>> To: kerby@directory.apache.org<ma...@directory.apache.org>
> > >>>>>>> Cc: Zheng, Kai <ka...@intel.com>>; mailto:
> > m.c.delignie@xs4all.nl<ma...@xs4all.nl>
> > >>>>>>> < m.c.delignie@xs4all.nl<ma...@xs4all.nl>>
> > >>>>>>> Subject: Re: MIT Kerberos compatibility
> > >>>>>>>
> > >>>>>>> Hi Jiajia,
> > >>>>>>>
> > >>>>>>> What are the issues if UDP is disabled and we don't use Netty?
> > >>>>>>> I tried doing this with my own test-cases and it didn't work,
> > >>>>>>> so it would be good to get this fixed soon.
> > >>>>>>>
> > >>>>>>> Colm.
> > >>>>>>>
> > >>>>>>> On Fri, May 5, 2017 at 2:46 PM, Li, Jiajia
> > >>>>>>> <ji...@intel.com>>
> > >>>>> wrote:
> > >>>>>>>
> > >>>>>>>> Hi Marc,
> > >>>>>>>>>>> - your KRB5 tracing looks quite different. What OS and
> > >>>>>>>>>>> mit-kerberos
> > >>>>>>>> version did you use?
> > >>>>>>>> I use mac os and the python version is 2.7.10
> > >>>>>>>>
> > >>>>>>>>>>> - your KRB5 tracing shows UDP comms between kerberos
> > >>>>>>>>>>> client and KDC,
> > >>>>>>>> despite the allowUDP = false setting
> > >>>>>>>>>>> in my test. I did this setting because I get different
> > >>>>>>>>>>> problems
> > >>>>>>>> without it, see the additional logs below. So,
> > >>>>>>>>>>> we must also be aware of networking problems at my side.
> > >>>>>>>> I enable the UDP and use netty network, there are some issues
> > >>>>>>>> if UDP disabled, you can create a JIRA for this and we can
> > >>>>>>>> fix this issue in the next release version.
> > >>>>>>>>
> > >>>>>>>> The changes in my side as following:
> > >>>>>>>>
> > >>>>>>>> protected boolean allowUdp() { return true; } @Override
> > >>>>>>>> protected void prepareKdc() throws KrbException {
> > >>>>>>>> getKdcServer().setInnerKdcImpl(
> > >>>>>>>> new
> > >>>>>>>> NettyKdcServerImpl(getKdcServer().getKdcSetting()));
> > >>>>>>>> super.prepareKdc();
> > >>>>>>>> }
> > >>>>>>>>
> > >>>>>>>> Here is log of MitIssueTest:
> > >>>>>>>> [INFO] Running
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > >>>>>>>> io.netty.handler.logging.LoggingHandler
> > >>>>>>>> -
> > >>>>>>>> [id: 0x2634fe6b] REGISTERED
> > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > >>>>>>>> io.netty.handler.logging.LoggingHandler
> > >>>>>>>> -
> > >>>>>>>> [id: 0x2634fe6b] BIND(0.0.0.0/0.0.0.0:53957<http://0.0.0.0/0.0.0.0:53957>)
> > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > >>>>>>>> io.netty.handler.logging.LoggingHandler -
> > >>>>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] ACTIVE [main] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kdc.impl.NettyKdcServerImpl - Netty
> > >>>>>>>> kdc server started.
> > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > >>>>>>>> io.netty.handler.logging.LoggingHandler
> > >>>>>>>> -
> > >>>>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] RECEIVED: [id:
> > >>>>>>>> 0xdac7228b, /
> > >>>>>>>> 127.0.0.1:53961<http://127.0.0.1:53961> => /127.0.0.1:53957<http://127.0.0.1:53957>]
> > >>>>>>>> [defaultEventExecutorGroup-4-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
> > >>>>>>>> - AS_REQ ISSUE: authtime 1493991123792,drankye@TEST.COM<ma...@TEST.COM> for
> > >>>>>>>> krbtgt/ TEST.COM@TEST.COM<ma...@TEST.COM> [main] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> > DefaultInternalKrbClien
> > >>>>>>>> t
> > >>>>>>>> - Send to kdc success.
> > >>>>>>>> [main] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing
> the tgt to the credential cache file.
> > >>>>>>>> [nioEventLoopGroup-5-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> > >>>>>>>> - The preauth data is empty.
> > >>>>>>>> [nioEventLoopGroup-5-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> > >>>>>>>> - KRB error occurred while processing request:Additional
> > >>>>>>>> pre-authentication required [nioEventLoopGroup-5-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
> > >>>>>>>> - AS_REQ ISSUE: authtime
> > >>>>>>>> 1493991123859,test-service/localhost@TEST.COM<ma...@TEST.COM>
> > >>>>>>>> for krbtgt/TEST.COM@TEST.COM<ma...@TEST.COM>
> > >>>>>>>> [nioEventLoopGroup-5-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.TgsRequest
> > >>>>>>>> - TGS_REQ ISSUE: authtime 1493991142850,drankye for
> > >>>>>>>> test-service/ localhost@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>
> > >>>>>>>> Thanks
> > >>>>>>>> Jiajia
> > >>>>>>>>
> > >>>>>>>> -----Original Message-----
> > >>>>>>>> From: Zheng, Kai
> > >>>>>>>> Sent: Friday, May 5, 2017 7:46 PM
> > >>>>>>>> To: kerby@directory.apache.org<ma...@directory.apache.org>; Li, Jiajia
> > >>>>>>>> <ji...@intel.com>>
> > >>>>>>>> Subject: RE: MIT Kerberos compatibility
> > >>>>>>>>
> > >>>>>>>> Hi Marc,
> > >>>>>>>>
> > >>>>>>>> Looks like this is quite environment related, could you fire
> > >>>>>>>> an issue for this? I would suggest we target it to 1.1.0,
> > >>>>>>>> which can be done in
> > >>>>>>> June.
> > >>>>>>>>
> > >>>>>>>> Regards,
> > >>>>>>>> Kai
> > >>>>>>>>
> > >>>>>>>> -----Original Message-----
> > >>>>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl<ma...@xs4all.nl>]
> > >>>>>>>> Sent: Friday, May 05, 2017 4:44 PM
> > >>>>>>>> To: Li, Jiajia <ji...@intel.com>>
> > >>>>>>>> Cc: kerby@directory.apache.org<ma...@directory.apache.org>
> > >>>>>>>> Subject: Re: MIT Kerberos compatibility
> > >>>>>>>>
> > >>>>>>>> Hi Jiajia,
> > >>>>>>>>
> > >>>>>>>> Great to read that you made progress on this issue and to see
> > >>>>>>>> a working config at your side. Below, I list my progress
> > >>>>>>>> below (with trunk merged into my MitIssue branch), but I am
> > >>>>>>>> afraid we are not done
> > >>>>>>> yet.
> > >>>>>>>>
> > >>>>>>>> Things that stand out:
> > >>>>>>>>
> > >>>>>>>> - the kdc decoding error is solved, relative to the logs
> > >>>>>>>> without your patch
> > >>>>>>>>
> > >>>>>>>> - your KRB5 tracing looks quite different. What OS and
> > >>>>>>>> mit-kerberos version did you use?
> > >>>>>>>>
> > >>>>>>>> - your KRB5 tracing shows UDP comms between kerberos client
> > >>>>>>>> and KDC, despite the allowUDP = false setting in my test. I
> > >>>>>>>> did this setting because I get different problems without it,
> > >>>>>>>> see the additional logs below. So, we must also be aware of
> > >>>>>>>> networking
> > >>>>> problems at my side.
> > >>>>>>>>
> > >>>>>>>> - the "Response was not from master KDC" msg is not relevant;
> > >>>>>>>> it disappears if you manually add master_kdc to the realms
> > >>>>>>>> section of the krb5.conf
> > >>>>>>>>
> > >>>>>>>> I have no idea how to proceed from here, so that is why I
> > >>>>>>>> just document the status at my side and ask about your -
> > >>>>>>>> apparently working -
> > >>>>>>> config.
> > >>>>>>>>
> > >>>>>>>> Cheers, Marc
> > >>>>>>>>
> > >>>>>>>>
> > >>>>>>>> KDC logging with allowUDP = false:
> > >>>>>>>>
> > >>>>>>>> [INFO] Running
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > >>>>>>>> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > >>>>>>>> AS_REQ
> > >>>>>> ISSUE:
> > >>>>>>>> authtime 1493970789075,drankye@TEST.COM<ma...@TEST.COM> for
> > >>>>>>>> krbtgt/TEST.COM@TEST.COM<ma...@TEST.COM> [main] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> > DefaultInternalKrbClien
> > >>>>>>>> t
> > >>>>>>>> - Send to kdc success.
> > >>>>>>>> [main] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing
> the tgt to the credential cache file.
> > >>>>>>>> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest -
> > >>>>>>>> The preauth data is empty.
> > >>>>>>>> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> > >>>>>>>> - KRB error occurred while processing request:Additional
> > >>>>>>>> pre-authentication required [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > >>>>>>>> AS_REQ
> > >>>>>> ISSUE:
> > >>>>>>>> authtime 1493970789108,test-service/localhost@TEST.COM<ma...@TEST.COM> for
> > krbtgt/
> > >>>>>>>> TEST.COM@TEST.COM<ma...@TEST.COM> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> > >>>>>>>> - Found fast padata and starting to process it.
> > >>>>>>>> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest -
> > >>>>>>>> Found fast padata and starting to process it.
> > >>>>>>>>
> > >>>>>>>> Python script KRB5 tracing (MIT Kerberos 1.13.2 of Ubuntu
> > >>>>>>>> Xenial) with allowUDP = false:
> > >>>>>>>>
> > >>>>>>>> $ .
> > >>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/
> > >>>>>>>> kerberos/kerb/server/MitIssueTest.sh
> > >>>>>>>> [25281] 1493970797.298753: Retrieving drankye@TEST.COM<ma...@TEST.COM> from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found [25281]
> > >>>>>>>> 1493970797.298952: Retrieving drankye@TEST.COM<ma...@TEST.COM> from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found [25281]
> > >>>>>>>> 1493970797.299106: Retrieving drankye@TEST.COM<ma...@TEST.COM> from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found [25281]
> > >>>>>>>> 1493970797.299213: Retrieving drankye@TEST.COM<ma...@TEST.COM> from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found [25281]
> > >>>>>>>> 1493970797.299323: Retrieving drankye@TEST.COM<ma...@TEST.COM> from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found [25281]
> > >>>>>>>> 1493970797.299436: Retrieving drankye@TEST.COM<ma...@TEST.COM> from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found [25281]
> > >>>>>>>> 1493970797.299545: Retrieving drankye@TEST.COM<ma...@TEST.COM> from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found [25281]
> > >>>>>>>> 1493970797.299654: Retrieving drankye@TEST.COM<ma...@TEST.COM> from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found kerberos.authGSSClientInit successful [25281]
> 1493970797.299922:
> > >>>>>>>> Getting credentials drankye@TEST.COM<ma...@TEST.COM> ->
> > >>>>>>>> test-service/localhost@ using ccache
> > >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>> [25281] 1493970797.299945: Retrieving drankye@TEST.COM<ma...@TEST.COM> ->
> > >>>>>>>> test-service/localhost@ from
> > >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>> with result:
> > >>>>>>>> -1765328243/Matching credential not found [25281]
> > 1493970797.299959:
> > >>>>>>>> Retrying drankye@TEST.COM<ma...@TEST.COM> -> test-service/localhost@TEST.COM<ma...@TEST.COM>
> > >>>>>>>> with
> > >>>>>>> result:
> > >>>>>>>> -1765328243/Matching credential not found [25281]
> > 1493970797.299962:
> > >>>>>>>> Server has referral realm; starting with
> > >>>>>>>> test-service/localhost@TEST.COM<ma...@TEST.COM> [25281]
> > >>>>>>>> 1493970797.299975: Retrieving drankye@TEST.COM<ma...@TEST.COM> ->
> > >>>>>>>> krbtgt/TEST.COM@TEST.COM<ma...@TEST.COM> from
> > >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>> with result:
> > >>>>>>>> 0/Success [25281] 1493970797.299979: Starting with TGT for
> > >>>>>>>> client
> > >>>>>> realm:
> > >>>>>>>> drankye@TEST.COM<ma...@TEST.COM> -> krbtgt/TEST.COM@TEST.COM<ma...@TEST.COM> [25281]
> > >>>>>> 1493970797.299981:
> > >>>>>>>> Requesting tickets for test-service/localhost@TEST.COM<ma...@TEST.COM>,
> > >>>>>>>> referrals on [25281] 1493970797.299994: Generated subkey for
> TGS request:
> > >>>>>>>> aes128-cts/1B9B [25281] 1493970797.300009: etypes requested
> > >>>>>>>> in TGS
> > >>>>>>> request:
> > >>>>>>>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac,
> > >>>>>>>> camellia128-cts, camellia256-cts [25281] 1493970797.300054:
> > >>>>>>>> Encoding request body and padata into FAST request [25281]
> > >>>>>>>> 1493970797.300080: Sending request
> > >>>>>>>> (823 bytes) to TEST.COM<http://TEST.COM> [25281] 1493970797.300091: Resolving
> > >>>>>>>> hostname localhost [25281]
> > >>>>>>>> 1493970797.300136: Initiating TCP connection to stream
> > >>>>>>>> 127.0.0.1:34319<http://127.0.0.1:34319>
> > >>>>>>>> [25281] 1493970797.300191: Sending TCP request to stream
> > >>>>>>>> 127.0.0.1:34319<http://127.0.0.1:34319> [25281] 1493970797.303610: Received answer
> > >>>>>>>> (125
> > >>>>>>>> bytes) from stream
> > >>>>>>>> 127.0.0.1:34319<http://127.0.0.1:34319>
> > >>>>>>>> [25281] 1493970797.303618: Terminating TCP connection to
> > >>>>>>>> stream
> > >>>>>>>> 127.0.0.1:34319<http://127.0.0.1:34319>
> > >>>>>>>> [25281] 1493970797.553126: Response was not from master KDC
> > >>>>>>>> [25281]
> > >>>>>>>> 1493970797.553198: TGS request result: -1765323383/Unknown
> > >>>>>>>> code krcM
> > >>>>>>>> 137 [25281] 1493970797.553234: Requesting tickets for
> > >>>>>>>> test-service/ localhost@TEST.COM<ma...@TEST.COM>, referrals off [25281]
> > >>>>> 1493970797.553273:
> > >>>>>>>> Generated subkey for TGS request: aes128-cts/94C6 [25281]
> > >>>>>> 1493970797.553323:
> > >>>>>>>> etypes requested in TGS request: aes256-cts, aes128-cts,
> > >>>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
> > >>>>>>>> [25281]
> > >>>>>>>> 1493970797.553436: Encoding request body and padata into FAST
> > >>>>>>>> request
> > >>>>>>> [25281] 1493970797.553532:
> > >>>>>>>> Sending request (823 bytes) to TEST.COM<http://TEST.COM> [25281]
> > 1493970797.553567:
> > >>>>>>>> Resolving hostname localhost [25281] 1493970797.553745:
> > >>>>>>>> Initiating TCP connection to stream
> > >>>>>>>> 127.0.0.1:34319<http://127.0.0.1:34319>
> > >>>>>>>> [25281] 1493970797.553889: Sending TCP request to stream
> > >>>>>>>> 127.0.0.1:34319<http://127.0.0.1:34319> [25281] 1493970797.558297: Received answer
> > >>>>>>>> (125
> > >>>>>>>> bytes) from stream
> > >>>>>>>> 127.0.0.1:34319<http://127.0.0.1:34319>
> > >>>>>>>> [25281] 1493970797.558318: Terminating TCP connection to
> > >>>>>>>> stream
> > >>>>>>>> 127.0.0.1:34319<http://127.0.0.1:34319>
> > >>>>>>>> [25281] 1493970797.561189: Response was not from master KDC
> > >>>>>>>> [25281]
> > >>>>>>>> 1493970797.561258: TGS request result: -1765323383/Unknown
> > >>>>>>>> code krcM
> > >>>>>>>> 137 ('First kerberos.authGSSClientStep not successful',
> > >>>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide
> > >>>>>>>> more information', 851968), ('Unknown code krcM 137',
> > >>>>>>>> -1765323383)))
> > >>>>>>>>
> > >>>>>>>>
> > >>>>>>>> KDC logging with allowUDP = true:
> > >>>>>>>>
> > >>>>>>>> [INFO] Running
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > >>>>>>>> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > >>>>>>>> AS_REQ
> > >>>>>> ISSUE:
> > >>>>>>>> authtime 1493972505784,drankye@TEST.COM<ma...@TEST.COM> for
> > >>>>>>>> krbtgt/TEST.COM@TEST.COM<ma...@TEST.COM> [main] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> > DefaultInternalKrbClien
> > >>>>>>>> t
> > >>>>>>>> - Send to kdc success.
> > >>>>>>>> [main] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing
> the tgt to the credential cache file.
> > >>>>>>>> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest -
> > >>>>>>>> The preauth data is empty.
> > >>>>>>>> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> > >>>>>>>> - KRB error occurred while processing request:Additional
> > >>>>>>>> pre-authentication required [pool-1-thread-2] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > >>>>>>>> AS_REQ
> > >>>>>> ISSUE:
> > >>>>>>>> authtime 1493972505948,test-service/localhost@TEST.COM<ma...@TEST.COM> for
> > krbtgt/
> > >>>>>>>> TEST.COM@TEST.COM<ma...@TEST.COM> Exception in thread "Thread-0"
> > >>>>>>>> java.lang.RuntimeException: Error occured while checking udp
> > >>>>>> connections
> > >>>>>>>> at
> > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > >>>>>>>> KdcNetwork.java:105)
> > >>>>>>>> at
> > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > >>>>>>>> access$000(KdcNetwork.java:39)
> > >>>>>>>> at
> > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > >>>>>>>> run(KdcNetwork.java:75)
> > >>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > >>>>>>>> Caused by: java.nio.channels.ClosedChannelException
> > >>>>>>>> at
> > >>>>>>>> sun.nio.ch<http://sun.nio.ch>.DatagramChannelImpl.ensureOpen(
> > >>>>>> DatagramChannelImpl.java:320)
> > >>>>>>>> at sun.nio.ch<http://sun.nio.ch>.DatagramChannelImpl.receive(
> > >>>>>>>> DatagramChannelImpl.java:331)
> > >>>>>>>> at
> > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > >>>>>>>> checkUdpMessage(KdcNetwork.java:132)
> > >>>>>>>> at
> > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > >>>>>>>> KdcNetwork.java:101)
> > >>>>>>>> ... 3 more
> > >>>>>>>>
> > >>>>>>>>
> > >>>>>>>> krb5.conf:
> > >>>>>>>>
> > >>>>>>>> [libdefaults]
> > >>>>>>>> kdc_realm = TEST.COM<http://TEST.COM>
> > >>>>>>>> default_realm = TEST.COM<http://TEST.COM>
> > >>>>>>>> udp_preference_limit = 4096
> > >>>>>>>> kdc_tcp_port = 37080
> > >>>>>>>> kdc_udp_port = 36525
> > >>>>>>>>
> > >>>>>>>> [realms]
> > >>>>>>>> TEST.COM<http://TEST.COM> = {
> > >>>>>>>> kdc = localhost:36525
> > >>>>>>>> }
> > >>>>>>>>
> > >>>>>>>> And port 36525 does not show up in `netstat -l` (while 37080
> > >>>>>>>> does)
> > >>>>>>>>
> > >>>>>>>>
> > >>>>>>>> Op 04-05-17 om 14:55 schreef Li, Jiajia:
> > >>>>>>>>> Hi Marc,
> > >>>>>>>>> I try to run your test(through applying your patch in the
> > >>>>>>>>> trunk) , I
> > >>>>>>>> think it's success now. Could you take some time to check
> > >>>>>>>> about
> > it?
> > >>>>>>>>> Here is the log:
> > >>>>>>>>>
> > >>>>>>>>> directory-kerby git:(trunk) ? .
> > >>>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerb
> > >>>>>>>>> eros
> > >>>>>>>>> /k
> > >>>>>>>>> er
> > >>>>>>>>> b/
> > >>>>>>>>> server/MitIssueTest.sh
> > >>>>>>>>> kerberos.authGSSClientInit successful
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: entypes not
> > >>>>>>>>> supported
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for krb5_ccache_conf_data/realm-config@X-CACHECONF:
> > >>>>>>>>> in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for test-service/localhost@TEST.COM<ma...@TEST.COM> in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for
> > >>>>>>>>> krb5_ccache_conf_data/negative-cache/test-service\134/localh
> > >>>>>>>>> ost\
> > >>>>>>>>> 13
> > >>>>>>>>> 4@
> > >>>>>>>>> TE
> > >>>>>>>>> ST.COM@X-CACHECONF<ma...@X-CACHECONF>: in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF
> :
> > >>>>>>>>> in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for krb5_ccache_conf_data/sitename@X-CACHECONF:
> > >>>>>>>>> in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for test-service/localhost@TEST.COM<ma...@TEST.COM> in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > >>>>>>>>> des-cbc-md5-deprecated not supported
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > >>>>>>>>> des-cbc-md4-deprecated not supported
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > >>>>>>>>> des-cbc-crc-deprecated not supported
> > >>>>>>>>> 2017-05-04T20:44:06 Trying to find service kdc for realm
> > >>>>>>>>> TEST.COM<http://TEST.COM> flags 0
> > >>>>>>>>> 2017-05-04T20:44:06 configuration file for realm TEST.COM<http://TEST.COM>
> > >>>>>>>>> found
> > >>>>>>>>> 2017-05-04T20:44:06 submissing new requests to new host
> > >>>>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
> > >>>>>>>>> 2017-05-04T20:44:06 connecting to host: udp ::1:52534
> > >>>>>>>>> (localhost)
> > >>>>>> tid:
> > >>>>>>>>> 00000001
> > >>>>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
> > >>>>>>>>> 2017-05-04T20:44:06 Queuing host in future (in 3s), its the
> > >>>>>>>>> 2 address on the same name: udp 127.0.0.1:52534<http://127.0.0.1:52534> (localhost)
> tid:
> > >>>>>>>>> 00000002
> > >>>>>>>>> 2017-05-04T20:44:06 writing packet: udp ::1:52534
> > >>>>>>>>> (localhost)
> > tid:
> > >>>>>>>>> 00000001
> > >>>>>>>>> 2017-05-04T20:44:06 reading packet: udp ::1:52534
> > >>>>>>>>> (localhost)
> > tid:
> > >>>>>>>>> 00000001
> > >>>>>>>>> 2017-05-04T20:44:06 host completed: udp ::1:52534
> > >>>>>>>>> (localhost)
> > tid:
> > >>>>>>>>> 00000001
> > >>>>>>>>> 2017-05-04T20:44:06 krb5_sendto_context TEST.COM<http://TEST.COM> done: 0
> > >>>>>>>>> hosts 1 packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814
> > >>>>>>>>> tid: 00000002
> > >>>>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/763641F3
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328353: Decrypt
> > >>>>>>>>> integrity check failed for checksum type
> > >>>>>>>>> hmac-sha1-96-aes128, key type
> > >>>>>>>>> aes128-cts-hmac-sha1-96
> > >>>>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
> > >>>>>>>>> 2017-05-04T20:44:06 krb5_get_credentials_with_flags:
> > >>>>>>>>> TEST.COM<http://TEST.COM>
> > wc:
> > >>>>>>>>> 0.050317
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for krb5_ccache_conf_data/realm-config@X-CACHECONF:
> > >>>>>>>>> in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for
> > >>>>>>>>> krb5_ccache_conf_data/time-offset/test-service\134/
> > >>>>>> localhost\134@TEST.
> > >>>>>>>>> COM@X-CACHECONF: in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 Setting up PFS for auth context
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > >>>>>>>>> des-cbc-md5-deprecated not supported
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > >>>>>>>>> des-cbc-md4-deprecated not supported
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > >>>>>>>>> des-cbc-crc-deprecated not supported First
> > >>>>>>>>> kerberos.authGSSClientStep successful
> > >>>>>>>>>
> > >>>>>>>>> Thanks
> > >>>>>>>>> Jiajia
> > >>>>>>>>>
> > >>>>>>>>> -----Original Message-----
> > >>>>>>>>> From: Zheng, Kai [mailto:kai.zheng@intel.com<ma...@intel.com>]
> > >>>>>>>>> Sent: Wednesday, May 3, 2017 7:29 PM
> > >>>>>>>>> To: kerby@directory.apache.org<ma...@directory.apache.org>
> > >>>>>>>>> Subject: RE: MIT Kerberos compatibility
> > >>>>>>>>>
> > >>>>>>>>> Hi Marc,
> > >>>>>>>>>
> > >>>>>>>>> In case you're not aware of this, please check out the
> > >>>>>>>>> latest fix made
> > >>>>>>>> by Jiajia. We thought your case may be different, but would
> > >>>>>>>> be good to have a check before we can repeat/fix your case.
> Thanks.
> > >>>>>>>>> https://issues.apache.org/jira/browse/DIRKRB-625
> > >>>>>>>>>
> > >>>>>>>>> Regards,
> > >>>>>>>>> Kai
> > >>>>>>>>>
> > >>>>>>>>> -----Original Message-----
> > >>>>>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl<ma...@xs4all.nl>]
> > >>>>>>>>> Sent: Sunday, April 30, 2017 7:45 PM
> > >>>>>>>>> To: kerby@directory.apache.org<ma...@directory.apache.org>
> > >>>>>>>>> Subject: Re: MIT Kerberos compatibility
> > >>>>>>>>>
> > >>>>>>>>> Hi Kai,
> > >>>>>>>>>
> > >>>>>>>>> The terminal output below is for the latest MIT Kerberos
> > >>>>>>>>> 1.15.1 (locally
> > >>>>>>>> built on Ubuntu Xenial). Before that, I also tested with the
> > >>>>>>>> default Xenial MIT Kerberos packages (1.13.2), with the same
> > >>>>>>>> result. I did not try earlier MIT Kerberos versions.
> > >>>>>>>>>
> > >>>>>>>>> Marc
> > >>>>>>>>>
> > >>>>>>>>> Op 29-04-17 om 21:42 schreef Marc de Lignie:
> > >>>>>>>>>> Hi Kai,
> > >>>>>>>>>>
> > >>>>>>>>>> Thanks for the response. I prepared a minimal config that
> > >>>>>>>>>> reproduces my problem.
> > >>>>>>>>>>
> > >>>>>>>>>> You can fetch the branch/commit from:
> > >>>>>>>>>> https://github.com/vtslab/directory-kerby/commits/MitIssue
> > >>>>>>>>>>
> > >>>>>>>>>> This is relative to RC2, but I also tried this on trunk for
> > >>>>>>>>>> my actual project.
> > >>>>>>>>>>
> > >>>>>>>>>> This config produces the debug and error messages below.
> > >>>>>>>>>>
> > >>>>>>>>>> 1. For the terminal with the bash + python script $ klist
> > >>>>>>>>>> Ticket
> > >>>>>>>>>> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>>> Default principal: drankye@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>>
> > >>>>>>>>>> Valid starting Expires Service principal
> > >>>>>>>>>> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/
> TEST.COM@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> renew until 29-04-17 21:07:39
> > >>>>>>>>>>
> > >>>>>>>>>> $ .
> > >>>>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/ker
> > >>>>>>>>>> bero s/ ke rb / server/MitIssueTest.sh [15538]
> > >>>>>>>>>> 1493491231.917606:
> > >>>>>>>>>> Retrieving drankye@TEST.COM<ma...@TEST.COM> from
> > >>>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>>>> with
> > >>>>>>>>>> result:
> > >>>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>>>> found [15538]
> > >>>>>>>>>> 1493491231.917827: Retrieving drankye@TEST.COM<ma...@TEST.COM> from
> > >>>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>>>> with
> > >>>>>>> result:
> > >>>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>>>> found kerberos.authGSSClientInit successful [15538]
> 1493491231.918185:
> > >>>>>>>>>> Getting credentials drankye@TEST.COM<ma...@TEST.COM> ->
> > >>>>>>>>>> test-service/localhost@ using ccache
> > >>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>>> [15538] 1493491231.918210: Retrieving drankye@TEST.COM<ma...@TEST.COM> ->
> > >>>>>>>>>> test-service/localhost@ from
> > >>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with
> > result:
> > >>>>>>>>>> -1765328243/Matching credential not found (filename:
> > >>>>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> > >>>>>>>>>> [15538] 1493491231.918226: Retrying drankye@TEST.COM<ma...@TEST.COM> ->
> > >>>>>>>>>> test-service/localhost@TEST.COM<ma...@TEST.COM> with result:
> > >>>>>>>>>> -1765328243/Matching credential not found (filename:
> > >>>>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> > >>>>>>>>>> [15538] 1493491231.918229: Server has referral realm;
> > >>>>>>>>>> starting with test-service/localhost@TEST.COM<ma...@TEST.COM> [15538]
> 1493491231.918278:
> > >>>>>>>>>> Retrieving drankye@TEST.COM<ma...@TEST.COM> -> krbtgt/TEST.COM@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> from FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>>> with
> > result:
> > >>>>>>>>>> 0/Success
> > >>>>>>>>>> [15538] 1493491231.918281: Starting with TGT for client realm:
> > >>>>>>>>>> drankye@TEST.COM<ma...@TEST.COM> -> krbtgt/TEST.COM@TEST.COM<ma...@TEST.COM> [15538]
> > >>>>>>>>>> 1493491231.918301: Requesting tickets for
> > >>>>>>>>>> test-service/localhost@TEST.COM<ma...@TEST.COM>, referrals on [15538]
> > >>>>>>>>>> 1493491231.918326: Generated subkey for TGS request:
> > >>>>>>>>>> aes128-cts/FA30
> > >>>>>>>>>> [15538] 1493491231.918359: etypes requested in TGS request:
> > >>>>>>>>>> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2,
> > >>>>>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
> > >>>>>>>>>> [15538]
> > >>>>>> 1493491231.918484:
> > >>>>>>>>>> Encoding request body and padata into FAST request [15538]
> > >>>>>>>>>> 1493491231.918541: Sending request (836 bytes) to TEST.COM<http://TEST.COM>
> > >>>>>>>>>> [15538]
> > >>>>>>>>>> 1493491231.918597: Resolving hostname localhost [15538]
> > >>>>>>>>>> 1493491231.918703: Initiating TCP connection to stream
> > >>>>>>>>>> 127.0.0.1:44292<http://127.0.0.1:44292>
> > >>>>>>>>>> [15538] 1493491231.918777: Sending TCP request to stream
> > >>>>>>>>>> 127.0.0.1:44292<http://127.0.0.1:44292> [15538] 1493491231.922803: TCP error
> > >>>>>>>>>> receiving from stream
> > >>>>>>>>>> 127.0.0.1:44292<http://127.0.0.1:44292>: 104/Connection reset by peer [15538]
> > >>>>>>>>>> 1493491231.922812: Terminating TCP connection to stream
> > >>>>>>>>>> 127.0.0.1:44292<http://127.0.0.1:44292>
> > >>>>>>>>>> [15538] 1493491231.922858: Sending initial UDP request to
> > >>>>>>>>>> dgram
> > >>>>>>>>>> 127.0.0.1:44292<http://127.0.0.1:44292>
> > >>>>>>>>>> ('First kerberos.authGSSClientStep not successful',
> > >>>>>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide
> > >>>>>>>>>> more information', 851968), ("Cannot contact any KDC for
> > >>>>>>>>>> realm 'TEST.COM<http://TEST.COM>'",
> > >>>>>>>>>> -1765328228)))
> > >>>>>>>>>>
> > >>>>>>>>>> 2. For the terminal that runs mvn clean test
> > >>>>>>>>>> -Dtest=MitIssueTest Running
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > >>>>>>>>>> 2017-04-29 21:07:39,182 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> initialize called
> > >>>>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> getIdentity called, principalName =
> > >>>>>>>>>> krbtgt/TEST.COM@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> getIdentity failed, principalName =
> > >>>>>>>>>> krbtgt/TEST.COM@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> addIdentity successful, principalName =
> > >>>>>>>>>> krbtgt/TEST.COM@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> getIdentity called, principalName =
> > >>>>>>>>>> kadmin/TEST.COM@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> getIdentity failed, principalName =
> > >>>>>>>>>> kadmin/TEST.COM@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:39,213 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> addIdentity successful, principalName =
> > >>>>>>>>>> kadmin/TEST.COM@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:39,216 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> start called
> > >>>>>>>>>> 2017-04-29 21:07:39,232 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> addIdentity successful, principalName =
> > >>>>>>>>>> test-service/localhost@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:39,425 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> addIdentity successful, principalName = drankye@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1]
> > >>>>> request.KdcRequest:
> > >>>>>>>>>> Client entry is empty.
> > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = drankye@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = drankye@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > >>>>>>>>>> occurred, disconnecting abnormally java.io.EOFException
> > >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:
> 392)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > >>>>>>>>>> r.ru<http://r.ru>
> > >>>>>>>>>> n(
> > >>>>>>>> DefaultKdcHandler.java:46)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > >>>>>>>> ThreadPoolExecutor.java:1142)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > >>>>>>>> ThreadPoolExecutor.java:617)
> > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > >>>>>>>>>> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase:
> > >>>>>>>>>> Storing the tgt to the credential cache file.
> > >>>>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> getIdentity called, principalName =
> > >>>>>>>>>> test-service/localhost@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> getIdentity successful, principalName =
> > >>>>>>>>>> test-service/localhost@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1]
> > >>>>> request.KdcRequest:
> > >>>>>>>>>> Client entry is empty.
> > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = test-service/localhost@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = test-service/localhost@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1]
> > >>>>> request.KdcRequest:
> > >>>>>>>>>> The preauth data is empty.
> > >>>>>>>>>> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1]
> > server.KdcHandler:
> > >>>>>>>>>> KRB error occurred while processing request:Additional
> > >>>>>>>>>> pre-authentication required
> > >>>>>>>>>> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > >>>>>>>>>> occurred, disconnecting abnormally java.io.EOFException
> > >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:
> 392)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > >>>>>>>>>> r.ru<http://r.ru>
> > >>>>>>>>>> n(
> > >>>>>>>> DefaultKdcHandler.java:46)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > >>>>>>>> ThreadPoolExecutor.java:1142)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > >>>>>>>> ThreadPoolExecutor.java:617)
> > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > >>>>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1]
> > >>>>> request.KdcRequest:
> > >>>>>>>>>> Client entry is empty.
> > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = test-service/localhost@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = test-service/localhost@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > >>>>>>>>>> occurred, disconnecting abnormally java.io.EOFException
> > >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:
> 392)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > >>>>>>>>>> r.ru<http://r.ru>
> > >>>>>>>>>> n(
> > >>>>>>>> DefaultKdcHandler.java:46)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > >>>>>>>> ThreadPoolExecutor.java:1142)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > >>>>>>>> ThreadPoolExecutor.java:617)
> > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > >>>>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM<ma...@TEST.COM>
> > >>>>>>>>>> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1]
> > >>>>> request.KdcRequest:
> > >>>>>>>>>> Found fast padata and start to process it.
> > >>>>>>>>>> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
> > >>>>>>>>>> impl.DefaultKdcHandler: Error occured while processing
> request:
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
> > >>>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> > >>>>>>>> java:85)
> > >>>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> > >>>>>>>> java:70)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kd
> > >>>>>>>>>> cFin
> > >>>>>>>>>> dF
> > >>>>>>>>>> as
> > >>>>>>>>>> t(
> > >>>>>>>> KdcRequest.java:208)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.
> > >>>>>>>> KdcRequest.process(KdcRequest.java:168)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
> > >>>>>>>> handleMessage(KdcHandler.java:115)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
> > >>>>>>>> handleMessage(DefaultKdcHandler.java:67)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > >>>>>>>>>> r.ru<http://r.ru>
> > >>>>>>>>>> n(
> > >>>>>>>> DefaultKdcHandler.java:52)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > >>>>>>>> ThreadPoolExecutor.java:1142)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > >>>>>>>> ThreadPoolExecutor.java:617)
> > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > >>>>>>>>>> Caused by: java.io.IOException: Unexpected item context [0]
> > >>>>>>>>>> [tag=0xA0, off=0, len=3+207], expecting 0x30
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > >>>>>>>> Asn1Encodeable.java:210)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > >>>>>>>> Asn1Encodeable.java:197)
> > >>>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> > >>>>>>>> java:83)
> > >>>>>>>>>> ... 9 more
> > >>>>>>>>>> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > >>>>>>>>>> occurred, disconnecting abnormally
> > >>>>>>>>>> java.net.SocketException: Socket closed
> > >>>>>>>>>> at java.net.SocketInputStream.socketRead0(Native Method)
> > >>>>>>>>>> at java.net.SocketInputStream.socketRead(SocketInputStream.
> > >>>>>>>> java:116)
> > >>>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
> > >>>>> 171)
> > >>>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
> > >>>>> 141)
> > >>>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
> > >>>>> 224)
> > >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:
> 387)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > >>>>>>>>>> r.ru<http://r.ru>
> > >>>>>>>>>> n(
> > >>>>>>>> DefaultKdcHandler.java:46)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > >>>>>>>> ThreadPoolExecutor.java:1142)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > >>>>>>>> ThreadPoolExecutor.java:617)
> > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > >>>>>>>>>>
> > >>>>>>>>>> In a FreeIPA environment these python lines "just" work.
> > >>>>>>>>>>
> > >>>>>>>>>> Any suggestions are welcome!
> > >>>>>>>>>>
> > >>>>>>>>>> Marc
> > >>>>>>>>>>
> > >>>>>>>>>>
> > >>>>>>>>> --
> > >>>>>>>>> Marc de Lignie
> > >>>>>>>>>
> > >>>>>>>>
> > >>>>>>>> --
> > >>>>>>>> Marc de Lignie
> > >>>>>>>>
> > >>>>>>>>
> > >>>>>>>
> > >>>>>>>
> > >>>>>>> --
> > >>>>>>> Colm O hEigeartaigh
> > >>>>>>>
> > >>>>>>> Talend Community Coder
> > >>>>>>> http://coders.talend.com
> > >>>>>>>
> > >>>>>>
> > >>>>>>
> > >>>>>>
> > >>>>>> --
> > >>>>>> Colm O hEigeartaigh
> > >>>>>>
> > >>>>>> Talend Community Coder
> > >>>>>> http://coders.talend.com
> > >>>>>>
> > >>>>>
> > >>>>>
> > >>>>>
> > >>>>> --
> > >>>>> Colm O hEigeartaigh
> > >>>>>
> > >>>>> Talend Community Coder
> > >>>>> http://coders.talend.com
> > >>>>>
> > >>>>
> > >>>>
> > >>>>
> > >>>> --
> > >>>> Colm O hEigeartaigh
> > >>>>
> > >>>> Talend Community Coder
> > >>>> http://coders.talend.com
> > >>>
> > >>>
> > >>
> > >>
> > >> --
> > >> Colm O hEigeartaigh
> > >>
> > >> Talend Community Coder
> > >> http://coders.talend.com
> >
>
>
>
> --
> Colm O hEigeartaigh
>
> Talend Community Coder
> http://coders.talend.com
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
Re: MIT Kerberos compatibility
Posted by Colm O hEigeartaigh <co...@apache.org>.
Hi Kai,
No I think it wasn't caused by recent changes. It's fine to target it for
the next release. I will call another vote for 1.0.0 as soon as we get the
go ahead from Emmanuel.
Colm.
On Mon, May 8, 2017 at 11:32 AM, Zheng, Kai <ka...@intel.com> wrote:
> Hi Colm,
>
> Did you aware it's caused by any recent changes? It looks to me not. How
> serve is it? It appears in some case in the WSS4J tests. We have work
> around, using the Netty one. I'd suggest we target it for next minor
> release, like 1.1.0 or 1.0.1 so we have enough bandwidth to investigate and
> improve the default transport. We probably shouldn't introduce more changes
> to get the release out. Note please prefer to use the TCP transport over
> the UDP one, in today's world.
>
> Regards,
> Kai
>
> -----Original Message-----
> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> Sent: Monday, May 08, 2017 6:19 PM
> To: kerby@directory.apache.org
> Subject: Re: MIT Kerberos compatibility
>
> OK I have created a JIRA and attached a patch that you have to apply to the
> Apache WSS4J project to reproduce the error. If you uncomment the line that
> uses Netty then the tests all work perfectly. The tests appear to work fine
> when run in isolation, it's only when you run a few of them after one
> another that you can see the failures.
>
> Please let me know if you have any difficulty in reproducing, thanks!
>
> Colm.
>
> On Mon, May 8, 2017 at 11:08 AM, Zheng, Kai <ka...@intel.com> wrote:
>
> > Hi Colm,
> >
> > Sure, please do it. Could you review my change and see how it would cause
> > the new failures? Any difference between the failed GSS tests and the
> Kerby
> > GSS tests?
> >
> > Regards,
> > Kai
> >
> > -----Original Message-----
> > From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > Sent: Monday, May 08, 2017 5:42 PM
> > To: Zheng, Kai <ka...@intel.com>
> > Cc: kerby@directory.apache.org
> > Subject: Re: MIT Kerberos compatibility
> >
> > Hi Kai,
> >
> > Your changes fixed the error message I was seeing. However, I now see
> > another problem when I run a few GSS client tests in a row:
> >
> > >>> EType: sun.security.krb5.internal.crypto.Aes128CtsHmacSha1EType
> > >>> KrbAsReq creating message
> > >>> KrbKdcReq send: kdc=localhost UDP:42665, timeout=30000, number of
> > retries =3, #bytes=245
> > >>> KDCCommunication: kdc=localhost UDP:42665, timeout=30000,Attempt =1,
> > #bytes=245
> > SocketTimeOutException with attempt: 1
> > >>> KDCCommunication: kdc=localhost UDP:42665, timeout=30000,Attempt =2,
> > #bytes=245
> > >>> KrbKdcReq send: error trying localhost:42665
> > java.net.PortUnreachableException: ICMP Port Unreachable
> >
> > Do you want me to create a JIRA + attach a test-case?
> >
> > Colm.
> >
> > On Sat, May 6, 2017 at 2:01 AM, Zheng, Kai <ka...@intel.com> wrote:
> >
> > > I haven't repeated the issue but revisited the codes again and made
> > > improvements. Would you check it out? Thanks!
> > >
> > > Sent from iPhone
> > >
> > > > 在 2017年5月6日，上午6:28，Zheng, Kai <ka...@intel.com> 写道：
> > > >
> > > > Thanks colm for the clarification and it sounds an issue we need to
> > > address. I will investigate it soon.
> > > >
> > > > Sent from iPhone
> > > >
> > > >> 在 2017年5月6日，上午2:14，Colm O hEigeartaigh <co...@apache.org> 写道：
> > > >>
> > > >> Hi Kai,
> > > >>
> > > >> If I enable UDP with the default Transport, I can get a ticket fine
> > > using
> > > >> kinit. However then the following error pops up in the window I'm
> > > running
> > > >> Kerby in (as a test):
> > > >>
> > > >> Exception in thread "Thread-1" java.lang.RuntimeException: Error
> > > >> occured while checking udp connections
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > KdcNetwork.java:105)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > access$000(KdcNetwork.java:39)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > > run(KdcNetwork.java:75)
> > > >> at java.lang.Thread.run(Thread.java:748)
> > > >> Caused by: java.nio.channels.ClosedChannelException
> > > >> at
> > > >> sun.nio.ch.DatagramChannelImpl.ensureOpen(
> > DatagramChannelImpl.java:320)
> > > >> at sun.nio.ch.DatagramChannelImpl.receive(
> > > DatagramChannelImpl.java:331)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > checkUdpMessage(KdcNetwork.java:132)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > KdcNetwork.java:101)
> > > >>
> > > >> Colm.
> > > >>
> > > >>
> > > >>> On Fri, May 5, 2017 at 5:56 PM, Zheng, Kai <ka...@intel.com>
> > > wrote:
> > > >>>
> > > >>> Colm, did you see udp problem now instead? I'm a little confused.
> > > >>> Udp
> > > is
> > > >>> sure supported but may not be enabled by default, which should be
> > > >>> okay, imo. Thanks.
> > > >>>
> > > >>> Sent from iPhone
> > > >>>
> > > >>>> 在 2017年5月6日，上午12:02，Colm O hEigeartaigh <co...@apache.org> 写道：
> > > >>>>
> > > >>>> That's probably it. Why does the default transport not support
> > > >>>> UDP in
> > > >>> Kerby?
> > > >>>>
> > > >>>> Colm.
> > > >>>>
> > > >>>>> On Fri, May 5, 2017 at 4:54 PM, Li, Jiajia <ji...@intel.com>
> > > wrote:
> > > >>>>>
> > > >>>>> Are you sure add kdc_allow_udp = false in kdc.conf?
> > > >>>>>
> > > >>>>> Thanks
> > > >>>>> Jiajia
> > > >>>>>
> > > >>>>> -----Original Message-----
> > > >>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > > >>>>> Sent: Friday, May 5, 2017 11:41 PM
> > > >>>>> To: Li, Jiajia <ji...@intel.com>
> > > >>>>> Cc: kerby@directory.apache.org; Zheng, Kai
> > > >>>>> <ka...@intel.com>;
> > > >>> mailto:
> > > >>>>> m.c.delignie@xs4all.nl <m....@xs4all.nl>
> > > >>>>> Subject: Re: MIT Kerberos compatibility
> > > >>>>>
> > > >>>>> Sorry, it was my error, UDP was actually enabled there. But why
> > > >>>>> am I
> > > >>> still
> > > >>>>> seeing that error message?
> > > >>>>>
> > > >>>>> Colm.
> > > >>>>>
> > > >>>>>> On Fri, May 5, 2017 at 4:39 PM, Li, Jiajia
> > > >>>>>> <ji...@intel.com>
> > > >>> wrote:
> > > >>>>>>
> > > >>>>>> Hi Colm,
> > > >>>>>> I also test the Kerby KDC with kerby kint and MIT kinit, and
> > > >>>>>> only listen the tcp port(disable udp), both got ticket
> > > >>>>>> successfully. But
> > > I
> > > >>>>>> don't get the error message. Both krb.conf and kdc.conf should
> > > >>>>>> set
> > > udp
> > > >>>>>> to be false, udp is enabled in default.
> > > >>>>>>
> > > >>>>>> Thanks
> > > >>>>>> Jiajia
> > > >>>>>>
> > > >>>>>> -----Original Message-----
> > > >>>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > > >>>>>> Sent: Friday, May 5, 2017 11:34 PM
> > > >>>>>> To: kerby@directory.apache.org
> > > >>>>>> Cc: Zheng, Kai <ka...@intel.com>;
> > > >>>>>> mailto:m.c.delignie@xs4all.nl
> > > <
> > > >>>>>> m.c.delignie@xs4all.nl>
> > > >>>>>> Subject: Re: MIT Kerberos compatibility
> > > >>>>>>
> > > >>>>>> Hi Jiajia,
> > > >>>>>>
> > > >>>>>> If UDP is disabled and we don't use Netty, I can get a token
> > > >>>>>> successfully via kinit. However I then see an error message in
> > > >>>>>> the
> > > >>> Kerby
> > > >>>>> console:
> > > >>>>>>
> > > >>>>>> Exception in thread "Thread-1" java.lang.RuntimeException:
> > > >>>>>> Error occured while checking udp connections at
> > > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > >>>>>> KdcNetwork.java:105)
> > > >>>>>> at
> > > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > >>>>>> access$000(KdcNetwork.java:39)
> > > >>>>>> at
> > > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > > >>>>>> run(KdcNetwork.java:75)
> > > >>>>>> at java.lang.Thread.run(Thread.java:748)
> > > >>>>>> Caused by: java.nio.channels.ClosedChannelException
> > > >>>>>> at
> > > >>>>>> sun.nio.ch.DatagramChannelImpl.ensureOpen(
> > > >>> DatagramChannelImpl.java:320)
> > > >>>>>> at sun.nio.ch.DatagramChannelImpl.receive(
> > > >>>>>> DatagramChannelImpl.java:331)
> > > >>>>>> at
> > > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > >>>>>> checkUdpMessage(KdcNetwork.java:132)
> > > >>>>>> at
> > > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > >>>>>> KdcNetwork.java:101)
> > > >>>>>>
> > > >>>>>> I'm not sure why we are seeing UDP errors when it's disabled?
> > > >>>>>>
> > > >>>>>> Colm.
> > > >>>>>>
> > > >>>>>>> On Fri, May 5, 2017 at 3:57 PM, Li, Jiajia
> > > >>>>>>> <ji...@intel.com>
> > > >>> wrote:
> > > >>>>>>>
> > > >>>>>>> Hi Colm,
> > > >>>>>>> The shell client can't connect to kdc if the UDP is disabled.
> > > >>>>>>> We don't use Netty in default.
> > > >>>>>>> What's your test-cases? The same as the Marc's?
> > > >>>>>>>
> > > >>>>>>> Thanks
> > > >>>>>>> Jiajia
> > > >>>>>>>
> > > >>>>>>> -----Original Message-----
> > > >>>>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > > >>>>>>> Sent: Friday, May 5, 2017 10:09 PM
> > > >>>>>>> To: kerby@directory.apache.org
> > > >>>>>>> Cc: Zheng, Kai <ka...@intel.com>; mailto:
> > > m.c.delignie@xs4all.nl
> > > >>>>>>> < m.c.delignie@xs4all.nl>
> > > >>>>>>> Subject: Re: MIT Kerberos compatibility
> > > >>>>>>>
> > > >>>>>>> Hi Jiajia,
> > > >>>>>>>
> > > >>>>>>> What are the issues if UDP is disabled and we don't use Netty?
> > > >>>>>>> I tried doing this with my own test-cases and it didn't work,
> > > >>>>>>> so it would be good to get this fixed soon.
> > > >>>>>>>
> > > >>>>>>> Colm.
> > > >>>>>>>
> > > >>>>>>> On Fri, May 5, 2017 at 2:46 PM, Li, Jiajia
> > > >>>>>>> <ji...@intel.com>
> > > >>>>> wrote:
> > > >>>>>>>
> > > >>>>>>>> Hi Marc,
> > > >>>>>>>>>>> - your KRB5 tracing looks quite different. What OS and
> > > >>>>>>>>>>> mit-kerberos
> > > >>>>>>>> version did you use?
> > > >>>>>>>> I use mac os and the python version is 2.7.10
> > > >>>>>>>>
> > > >>>>>>>>>>> - your KRB5 tracing shows UDP comms between kerberos
> > > >>>>>>>>>>> client and KDC,
> > > >>>>>>>> despite the allowUDP = false setting
> > > >>>>>>>>>>> in my test. I did this setting because I get different
> > > >>>>>>>>>>> problems
> > > >>>>>>>> without it, see the additional logs below. So,
> > > >>>>>>>>>>> we must also be aware of networking problems at my side.
> > > >>>>>>>> I enable the UDP and use netty network, there are some issues
> > > >>>>>>>> if UDP disabled, you can create a JIRA for this and we can
> > > >>>>>>>> fix this issue in the next release version.
> > > >>>>>>>>
> > > >>>>>>>> The changes in my side as following:
> > > >>>>>>>>
> > > >>>>>>>> protected boolean allowUdp() { return true; } @Override
> > > >>>>>>>> protected void prepareKdc() throws KrbException {
> > > >>>>>>>> getKdcServer().setInnerKdcImpl(
> > > >>>>>>>> new
> > > >>>>>>>> NettyKdcServerImpl(getKdcServer().getKdcSetting()));
> > > >>>>>>>> super.prepareKdc();
> > > >>>>>>>> }
> > > >>>>>>>>
> > > >>>>>>>> Here is log of MitIssueTest:
> > > >>>>>>>> [INFO] Running
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > > >>>>>>>> io.netty.handler.logging.LoggingHandler
> > > >>>>>>>> -
> > > >>>>>>>> [id: 0x2634fe6b] REGISTERED
> > > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > > >>>>>>>> io.netty.handler.logging.LoggingHandler
> > > >>>>>>>> -
> > > >>>>>>>> [id: 0x2634fe6b] BIND(0.0.0.0/0.0.0.0:53957)
> > > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > > >>>>>>>> io.netty.handler.logging.LoggingHandler -
> > > >>>>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] ACTIVE [main] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kdc.impl.NettyKdcServerImpl - Netty
> > > >>>>>>>> kdc server started.
> > > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > > >>>>>>>> io.netty.handler.logging.LoggingHandler
> > > >>>>>>>> -
> > > >>>>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] RECEIVED: [id:
> > > >>>>>>>> 0xdac7228b, /
> > > >>>>>>>> 127.0.0.1:53961 => /127.0.0.1:53957]
> > > >>>>>>>> [defaultEventExecutorGroup-4-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
> > > >>>>>>>> - AS_REQ ISSUE: authtime 1493991123792,drankye@TEST.COM for
> > > >>>>>>>> krbtgt/ TEST.COM@TEST.COM [main] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> > > DefaultInternalKrbClien
> > > >>>>>>>> t
> > > >>>>>>>> - Send to kdc success.
> > > >>>>>>>> [main] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing
> > the tgt to the credential cache file.
> > > >>>>>>>> [nioEventLoopGroup-5-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> > > >>>>>>>> - The preauth data is empty.
> > > >>>>>>>> [nioEventLoopGroup-5-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> > > >>>>>>>> - KRB error occurred while processing request:Additional
> > > >>>>>>>> pre-authentication required [nioEventLoopGroup-5-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
> > > >>>>>>>> - AS_REQ ISSUE: authtime
> > > >>>>>>>> 1493991123859,test-service/localhost@TEST.COM
> > > >>>>>>>> for krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>> [nioEventLoopGroup-5-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.TgsRequest
> > > >>>>>>>> - TGS_REQ ISSUE: authtime 1493991142850,drankye for
> > > >>>>>>>> test-service/ localhost@TEST.COM
> > > >>>>>>>>
> > > >>>>>>>> Thanks
> > > >>>>>>>> Jiajia
> > > >>>>>>>>
> > > >>>>>>>> -----Original Message-----
> > > >>>>>>>> From: Zheng, Kai
> > > >>>>>>>> Sent: Friday, May 5, 2017 7:46 PM
> > > >>>>>>>> To: kerby@directory.apache.org; Li, Jiajia
> > > >>>>>>>> <ji...@intel.com>
> > > >>>>>>>> Subject: RE: MIT Kerberos compatibility
> > > >>>>>>>>
> > > >>>>>>>> Hi Marc,
> > > >>>>>>>>
> > > >>>>>>>> Looks like this is quite environment related, could you fire
> > > >>>>>>>> an issue for this? I would suggest we target it to 1.1.0,
> > > >>>>>>>> which can be done in
> > > >>>>>>> June.
> > > >>>>>>>>
> > > >>>>>>>> Regards,
> > > >>>>>>>> Kai
> > > >>>>>>>>
> > > >>>>>>>> -----Original Message-----
> > > >>>>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> > > >>>>>>>> Sent: Friday, May 05, 2017 4:44 PM
> > > >>>>>>>> To: Li, Jiajia <ji...@intel.com>
> > > >>>>>>>> Cc: kerby@directory.apache.org
> > > >>>>>>>> Subject: Re: MIT Kerberos compatibility
> > > >>>>>>>>
> > > >>>>>>>> Hi Jiajia,
> > > >>>>>>>>
> > > >>>>>>>> Great to read that you made progress on this issue and to see
> > > >>>>>>>> a working config at your side. Below, I list my progress
> > > >>>>>>>> below (with trunk merged into my MitIssue branch), but I am
> > > >>>>>>>> afraid we are not done
> > > >>>>>>> yet.
> > > >>>>>>>>
> > > >>>>>>>> Things that stand out:
> > > >>>>>>>>
> > > >>>>>>>> - the kdc decoding error is solved, relative to the logs
> > > >>>>>>>> without your patch
> > > >>>>>>>>
> > > >>>>>>>> - your KRB5 tracing looks quite different. What OS and
> > > >>>>>>>> mit-kerberos version did you use?
> > > >>>>>>>>
> > > >>>>>>>> - your KRB5 tracing shows UDP comms between kerberos client
> > > >>>>>>>> and KDC, despite the allowUDP = false setting in my test. I
> > > >>>>>>>> did this setting because I get different problems without it,
> > > >>>>>>>> see the additional logs below. So, we must also be aware of
> > > >>>>>>>> networking
> > > >>>>> problems at my side.
> > > >>>>>>>>
> > > >>>>>>>> - the "Response was not from master KDC" msg is not relevant;
> > > >>>>>>>> it disappears if you manually add master_kdc to the realms
> > > >>>>>>>> section of the krb5.conf
> > > >>>>>>>>
> > > >>>>>>>> I have no idea how to proceed from here, so that is why I
> > > >>>>>>>> just document the status at my side and ask about your -
> > > >>>>>>>> apparently working -
> > > >>>>>>> config.
> > > >>>>>>>>
> > > >>>>>>>> Cheers, Marc
> > > >>>>>>>>
> > > >>>>>>>>
> > > >>>>>>>> KDC logging with allowUDP = false:
> > > >>>>>>>>
> > > >>>>>>>> [INFO] Running
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > > >>>>>>>> [pool-1-thread-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > > >>>>>>>> AS_REQ
> > > >>>>>> ISSUE:
> > > >>>>>>>> authtime 1493970789075,drankye@TEST.COM for
> > > >>>>>>>> krbtgt/TEST.COM@TEST.COM [main] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> > > DefaultInternalKrbClien
> > > >>>>>>>> t
> > > >>>>>>>> - Send to kdc success.
> > > >>>>>>>> [main] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing
> > the tgt to the credential cache file.
> > > >>>>>>>> [pool-1-thread-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest -
> > > >>>>>>>> The preauth data is empty.
> > > >>>>>>>> [pool-1-thread-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> > > >>>>>>>> - KRB error occurred while processing request:Additional
> > > >>>>>>>> pre-authentication required [pool-1-thread-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > > >>>>>>>> AS_REQ
> > > >>>>>> ISSUE:
> > > >>>>>>>> authtime 1493970789108,test-service/localhost@TEST.COM for
> > > krbtgt/
> > > >>>>>>>> TEST.COM@TEST.COM [pool-1-thread-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> > > >>>>>>>> - Found fast padata and starting to process it.
> > > >>>>>>>> [pool-1-thread-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest -
> > > >>>>>>>> Found fast padata and starting to process it.
> > > >>>>>>>>
> > > >>>>>>>> Python script KRB5 tracing (MIT Kerberos 1.13.2 of Ubuntu
> > > >>>>>>>> Xenial) with allowUDP = false:
> > > >>>>>>>>
> > > >>>>>>>> $ .
> > > >>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/
> > > >>>>>>>> kerberos/kerb/server/MitIssueTest.sh
> > > >>>>>>>> [25281] 1493970797.298753: Retrieving drankye@TEST.COM from
> > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>> with
> > > >>>>> result:
> > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>> found [25281]
> > > >>>>>>>> 1493970797.298952: Retrieving drankye@TEST.COM from
> > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>> with
> > > >>>>> result:
> > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>> found [25281]
> > > >>>>>>>> 1493970797.299106: Retrieving drankye@TEST.COM from
> > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>> with
> > > >>>>> result:
> > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>> found [25281]
> > > >>>>>>>> 1493970797.299213: Retrieving drankye@TEST.COM from
> > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>> with
> > > >>>>> result:
> > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>> found [25281]
> > > >>>>>>>> 1493970797.299323: Retrieving drankye@TEST.COM from
> > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>> with
> > > >>>>> result:
> > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>> found [25281]
> > > >>>>>>>> 1493970797.299436: Retrieving drankye@TEST.COM from
> > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>> with
> > > >>>>> result:
> > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>> found [25281]
> > > >>>>>>>> 1493970797.299545: Retrieving drankye@TEST.COM from
> > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>> with
> > > >>>>> result:
> > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>> found [25281]
> > > >>>>>>>> 1493970797.299654: Retrieving drankye@TEST.COM from
> > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>> with
> > > >>>>> result:
> > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>> found kerberos.authGSSClientInit successful [25281]
> > 1493970797.299922:
> > > >>>>>>>> Getting credentials drankye@TEST.COM ->
> > > >>>>>>>> test-service/localhost@ using ccache
> > > >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>> [25281] 1493970797.299945: Retrieving drankye@TEST.COM ->
> > > >>>>>>>> test-service/localhost@ from
> > > >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>> with result:
> > > >>>>>>>> -1765328243/Matching credential not found [25281]
> > > 1493970797.299959:
> > > >>>>>>>> Retrying drankye@TEST.COM -> test-service/localhost@TEST.COM
> > > >>>>>>>> with
> > > >>>>>>> result:
> > > >>>>>>>> -1765328243/Matching credential not found [25281]
> > > 1493970797.299962:
> > > >>>>>>>> Server has referral realm; starting with
> > > >>>>>>>> test-service/localhost@TEST.COM [25281]
> > > >>>>>>>> 1493970797.299975: Retrieving drankye@TEST.COM ->
> > > >>>>>>>> krbtgt/TEST.COM@TEST.COM from
> > > >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>> with result:
> > > >>>>>>>> 0/Success [25281] 1493970797.299979: Starting with TGT for
> > > >>>>>>>> client
> > > >>>>>> realm:
> > > >>>>>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [25281]
> > > >>>>>> 1493970797.299981:
> > > >>>>>>>> Requesting tickets for test-service/localhost@TEST.COM,
> > > >>>>>>>> referrals on [25281] 1493970797.299994: Generated subkey for
> > TGS request:
> > > >>>>>>>> aes128-cts/1B9B [25281] 1493970797.300009: etypes requested
> > > >>>>>>>> in TGS
> > > >>>>>>> request:
> > > >>>>>>>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac,
> > > >>>>>>>> camellia128-cts, camellia256-cts [25281] 1493970797.300054:
> > > >>>>>>>> Encoding request body and padata into FAST request [25281]
> > > >>>>>>>> 1493970797.300080: Sending request
> > > >>>>>>>> (823 bytes) to TEST.COM [25281] 1493970797.300091: Resolving
> > > >>>>>>>> hostname localhost [25281]
> > > >>>>>>>> 1493970797.300136: Initiating TCP connection to stream
> > > >>>>>>>> 127.0.0.1:34319
> > > >>>>>>>> [25281] 1493970797.300191: Sending TCP request to stream
> > > >>>>>>>> 127.0.0.1:34319 [25281] 1493970797.303610: Received answer
> > > >>>>>>>> (125
> > > >>>>>>>> bytes) from stream
> > > >>>>>>>> 127.0.0.1:34319
> > > >>>>>>>> [25281] 1493970797.303618: Terminating TCP connection to
> > > >>>>>>>> stream
> > > >>>>>>>> 127.0.0.1:34319
> > > >>>>>>>> [25281] 1493970797.553126: Response was not from master KDC
> > > >>>>>>>> [25281]
> > > >>>>>>>> 1493970797.553198: TGS request result: -1765323383/Unknown
> > > >>>>>>>> code krcM
> > > >>>>>>>> 137 [25281] 1493970797.553234: Requesting tickets for
> > > >>>>>>>> test-service/ localhost@TEST.COM, referrals off [25281]
> > > >>>>> 1493970797.553273:
> > > >>>>>>>> Generated subkey for TGS request: aes128-cts/94C6 [25281]
> > > >>>>>> 1493970797.553323:
> > > >>>>>>>> etypes requested in TGS request: aes256-cts, aes128-cts,
> > > >>>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
> > > >>>>>>>> [25281]
> > > >>>>>>>> 1493970797.553436: Encoding request body and padata into FAST
> > > >>>>>>>> request
> > > >>>>>>> [25281] 1493970797.553532:
> > > >>>>>>>> Sending request (823 bytes) to TEST.COM [25281]
> > > 1493970797.553567:
> > > >>>>>>>> Resolving hostname localhost [25281] 1493970797.553745:
> > > >>>>>>>> Initiating TCP connection to stream
> > > >>>>>>>> 127.0.0.1:34319
> > > >>>>>>>> [25281] 1493970797.553889: Sending TCP request to stream
> > > >>>>>>>> 127.0.0.1:34319 [25281] 1493970797.558297: Received answer
> > > >>>>>>>> (125
> > > >>>>>>>> bytes) from stream
> > > >>>>>>>> 127.0.0.1:34319
> > > >>>>>>>> [25281] 1493970797.558318: Terminating TCP connection to
> > > >>>>>>>> stream
> > > >>>>>>>> 127.0.0.1:34319
> > > >>>>>>>> [25281] 1493970797.561189: Response was not from master KDC
> > > >>>>>>>> [25281]
> > > >>>>>>>> 1493970797.561258: TGS request result: -1765323383/Unknown
> > > >>>>>>>> code krcM
> > > >>>>>>>> 137 ('First kerberos.authGSSClientStep not successful',
> > > >>>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide
> > > >>>>>>>> more information', 851968), ('Unknown code krcM 137',
> > > >>>>>>>> -1765323383)))
> > > >>>>>>>>
> > > >>>>>>>>
> > > >>>>>>>> KDC logging with allowUDP = true:
> > > >>>>>>>>
> > > >>>>>>>> [INFO] Running
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > > >>>>>>>> [pool-1-thread-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > > >>>>>>>> AS_REQ
> > > >>>>>> ISSUE:
> > > >>>>>>>> authtime 1493972505784,drankye@TEST.COM for
> > > >>>>>>>> krbtgt/TEST.COM@TEST.COM [main] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> > > DefaultInternalKrbClien
> > > >>>>>>>> t
> > > >>>>>>>> - Send to kdc success.
> > > >>>>>>>> [main] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing
> > the tgt to the credential cache file.
> > > >>>>>>>> [pool-1-thread-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest -
> > > >>>>>>>> The preauth data is empty.
> > > >>>>>>>> [pool-1-thread-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> > > >>>>>>>> - KRB error occurred while processing request:Additional
> > > >>>>>>>> pre-authentication required [pool-1-thread-2] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > > >>>>>>>> AS_REQ
> > > >>>>>> ISSUE:
> > > >>>>>>>> authtime 1493972505948,test-service/localhost@TEST.COM for
> > > krbtgt/
> > > >>>>>>>> TEST.COM@TEST.COM Exception in thread "Thread-0"
> > > >>>>>>>> java.lang.RuntimeException: Error occured while checking udp
> > > >>>>>> connections
> > > >>>>>>>> at
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > >>>>>>>> KdcNetwork.java:105)
> > > >>>>>>>> at
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > >>>>>>>> access$000(KdcNetwork.java:39)
> > > >>>>>>>> at
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > > >>>>>>>> run(KdcNetwork.java:75)
> > > >>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > > >>>>>>>> Caused by: java.nio.channels.ClosedChannelException
> > > >>>>>>>> at
> > > >>>>>>>> sun.nio.ch.DatagramChannelImpl.ensureOpen(
> > > >>>>>> DatagramChannelImpl.java:320)
> > > >>>>>>>> at sun.nio.ch.DatagramChannelImpl.receive(
> > > >>>>>>>> DatagramChannelImpl.java:331)
> > > >>>>>>>> at
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > >>>>>>>> checkUdpMessage(KdcNetwork.java:132)
> > > >>>>>>>> at
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > >>>>>>>> KdcNetwork.java:101)
> > > >>>>>>>> ... 3 more
> > > >>>>>>>>
> > > >>>>>>>>
> > > >>>>>>>> krb5.conf:
> > > >>>>>>>>
> > > >>>>>>>> [libdefaults]
> > > >>>>>>>> kdc_realm = TEST.COM
> > > >>>>>>>> default_realm = TEST.COM
> > > >>>>>>>> udp_preference_limit = 4096
> > > >>>>>>>> kdc_tcp_port = 37080
> > > >>>>>>>> kdc_udp_port = 36525
> > > >>>>>>>>
> > > >>>>>>>> [realms]
> > > >>>>>>>> TEST.COM = {
> > > >>>>>>>> kdc = localhost:36525
> > > >>>>>>>> }
> > > >>>>>>>>
> > > >>>>>>>> And port 36525 does not show up in `netstat -l` (while 37080
> > > >>>>>>>> does)
> > > >>>>>>>>
> > > >>>>>>>>
> > > >>>>>>>> Op 04-05-17 om 14:55 schreef Li, Jiajia:
> > > >>>>>>>>> Hi Marc,
> > > >>>>>>>>> I try to run your test(through applying your patch in the
> > > >>>>>>>>> trunk) , I
> > > >>>>>>>> think it's success now. Could you take some time to check
> > > >>>>>>>> about
> > > it?
> > > >>>>>>>>> Here is the log:
> > > >>>>>>>>>
> > > >>>>>>>>> directory-kerby git:(trunk) ? .
> > > >>>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerb
> > > >>>>>>>>> eros
> > > >>>>>>>>> /k
> > > >>>>>>>>> er
> > > >>>>>>>>> b/
> > > >>>>>>>>> server/MitIssueTest.sh
> > > >>>>>>>>> kerberos.authGSSClientInit successful
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: entypes not
> > > >>>>>>>>> supported
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > >>>>>>>>> credential for krb5_ccache_conf_data/realm-
> config@X-CACHECONF:
> > > >>>>>>>>> in cache
> > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > >>>>>>>>> credential for test-service/localhost@TEST.COM in cache
> > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > >>>>>>>>> credential for
> > > >>>>>>>>> krb5_ccache_conf_data/negative-cache/test-service\134/localh
> > > >>>>>>>>> ost\
> > > >>>>>>>>> 13
> > > >>>>>>>>> 4@
> > > >>>>>>>>> TE
> > > >>>>>>>>> ST.COM@X-CACHECONF: in cache
> > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > >>>>>>>>> credential for krb5_ccache_conf_data/lkdc-
> hostname@X-CACHECONF
> > :
> > > >>>>>>>>> in cache
> > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > >>>>>>>>> credential for krb5_ccache_conf_data/sitename@X-CACHECONF:
> > > >>>>>>>>> in cache
> > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > >>>>>>>>> credential for test-service/localhost@TEST.COM in cache
> > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > >>>>>>>>> des-cbc-md5-deprecated not supported
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > >>>>>>>>> des-cbc-md4-deprecated not supported
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > >>>>>>>>> des-cbc-crc-deprecated not supported
> > > >>>>>>>>> 2017-05-04T20:44:06 Trying to find service kdc for realm
> > > >>>>>>>>> TEST.COM flags 0
> > > >>>>>>>>> 2017-05-04T20:44:06 configuration file for realm TEST.COM
> > > >>>>>>>>> found
> > > >>>>>>>>> 2017-05-04T20:44:06 submissing new requests to new host
> > > >>>>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
> > > >>>>>>>>> 2017-05-04T20:44:06 connecting to host: udp ::1:52534
> > > >>>>>>>>> (localhost)
> > > >>>>>> tid:
> > > >>>>>>>>> 00000001
> > > >>>>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
> > > >>>>>>>>> 2017-05-04T20:44:06 Queuing host in future (in 3s), its the
> > > >>>>>>>>> 2 address on the same name: udp 127.0.0.1:52534 (localhost)
> > tid:
> > > >>>>>>>>> 00000002
> > > >>>>>>>>> 2017-05-04T20:44:06 writing packet: udp ::1:52534
> > > >>>>>>>>> (localhost)
> > > tid:
> > > >>>>>>>>> 00000001
> > > >>>>>>>>> 2017-05-04T20:44:06 reading packet: udp ::1:52534
> > > >>>>>>>>> (localhost)
> > > tid:
> > > >>>>>>>>> 00000001
> > > >>>>>>>>> 2017-05-04T20:44:06 host completed: udp ::1:52534
> > > >>>>>>>>> (localhost)
> > > tid:
> > > >>>>>>>>> 00000001
> > > >>>>>>>>> 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0
> > > >>>>>>>>> hosts 1 packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814
> > > >>>>>>>>> tid: 00000002
> > > >>>>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/763641F3
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328353: Decrypt
> > > >>>>>>>>> integrity check failed for checksum type
> > > >>>>>>>>> hmac-sha1-96-aes128, key type
> > > >>>>>>>>> aes128-cts-hmac-sha1-96
> > > >>>>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
> > > >>>>>>>>> 2017-05-04T20:44:06 krb5_get_credentials_with_flags:
> > > >>>>>>>>> TEST.COM
> > > wc:
> > > >>>>>>>>> 0.050317
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > >>>>>>>>> credential for krb5_ccache_conf_data/realm-
> config@X-CACHECONF:
> > > >>>>>>>>> in cache
> > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > >>>>>>>>> credential for
> > > >>>>>>>>> krb5_ccache_conf_data/time-offset/test-service\134/
> > > >>>>>> localhost\134@TEST.
> > > >>>>>>>>> COM@X-CACHECONF: in cache
> > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>> 2017-05-04T20:44:06 Setting up PFS for auth context
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > >>>>>>>>> des-cbc-md5-deprecated not supported
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > >>>>>>>>> des-cbc-md4-deprecated not supported
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > >>>>>>>>> des-cbc-crc-deprecated not supported First
> > > >>>>>>>>> kerberos.authGSSClientStep successful
> > > >>>>>>>>>
> > > >>>>>>>>> Thanks
> > > >>>>>>>>> Jiajia
> > > >>>>>>>>>
> > > >>>>>>>>> -----Original Message-----
> > > >>>>>>>>> From: Zheng, Kai [mailto:kai.zheng@intel.com]
> > > >>>>>>>>> Sent: Wednesday, May 3, 2017 7:29 PM
> > > >>>>>>>>> To: kerby@directory.apache.org
> > > >>>>>>>>> Subject: RE: MIT Kerberos compatibility
> > > >>>>>>>>>
> > > >>>>>>>>> Hi Marc,
> > > >>>>>>>>>
> > > >>>>>>>>> In case you're not aware of this, please check out the
> > > >>>>>>>>> latest fix made
> > > >>>>>>>> by Jiajia. We thought your case may be different, but would
> > > >>>>>>>> be good to have a check before we can repeat/fix your case.
> > Thanks.
> > > >>>>>>>>> https://issues.apache.org/jira/browse/DIRKRB-625
> > > >>>>>>>>>
> > > >>>>>>>>> Regards,
> > > >>>>>>>>> Kai
> > > >>>>>>>>>
> > > >>>>>>>>> -----Original Message-----
> > > >>>>>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> > > >>>>>>>>> Sent: Sunday, April 30, 2017 7:45 PM
> > > >>>>>>>>> To: kerby@directory.apache.org
> > > >>>>>>>>> Subject: Re: MIT Kerberos compatibility
> > > >>>>>>>>>
> > > >>>>>>>>> Hi Kai,
> > > >>>>>>>>>
> > > >>>>>>>>> The terminal output below is for the latest MIT Kerberos
> > > >>>>>>>>> 1.15.1 (locally
> > > >>>>>>>> built on Ubuntu Xenial). Before that, I also tested with the
> > > >>>>>>>> default Xenial MIT Kerberos packages (1.13.2), with the same
> > > >>>>>>>> result. I did not try earlier MIT Kerberos versions.
> > > >>>>>>>>>
> > > >>>>>>>>> Marc
> > > >>>>>>>>>
> > > >>>>>>>>> Op 29-04-17 om 21:42 schreef Marc de Lignie:
> > > >>>>>>>>>> Hi Kai,
> > > >>>>>>>>>>
> > > >>>>>>>>>> Thanks for the response. I prepared a minimal config that
> > > >>>>>>>>>> reproduces my problem.
> > > >>>>>>>>>>
> > > >>>>>>>>>> You can fetch the branch/commit from:
> > > >>>>>>>>>> https://github.com/vtslab/directory-kerby/commits/MitIssue
> > > >>>>>>>>>>
> > > >>>>>>>>>> This is relative to RC2, but I also tried this on trunk for
> > > >>>>>>>>>> my actual project.
> > > >>>>>>>>>>
> > > >>>>>>>>>> This config produces the debug and error messages below.
> > > >>>>>>>>>>
> > > >>>>>>>>>> 1. For the terminal with the bash + python script $ klist
> > > >>>>>>>>>> Ticket
> > > >>>>>>>>>> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>>> Default principal: drankye@TEST.COM
> > > >>>>>>>>>>
> > > >>>>>>>>>> Valid starting Expires Service principal
> > > >>>>>>>>>> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/
> > TEST.COM@TEST.COM
> > > >>>>>>>>>> renew until 29-04-17 21:07:39
> > > >>>>>>>>>>
> > > >>>>>>>>>> $ .
> > > >>>>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/ker
> > > >>>>>>>>>> bero s/ ke rb / server/MitIssueTest.sh [15538]
> > > >>>>>>>>>> 1493491231.917606:
> > > >>>>>>>>>> Retrieving drankye@TEST.COM from
> > > >>>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>>>> with
> > > >>>>>>>>>> result:
> > > >>>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>>>> found [15538]
> > > >>>>>>>>>> 1493491231.917827: Retrieving drankye@TEST.COM from
> > > >>>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>>>> with
> > > >>>>>>> result:
> > > >>>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>>>> found kerberos.authGSSClientInit successful [15538]
> > 1493491231.918185:
> > > >>>>>>>>>> Getting credentials drankye@TEST.COM ->
> > > >>>>>>>>>> test-service/localhost@ using ccache
> > > >>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>>> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
> > > >>>>>>>>>> test-service/localhost@ from
> > > >>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with
> > > result:
> > > >>>>>>>>>> -1765328243/Matching credential not found (filename:
> > > >>>>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> > > >>>>>>>>>> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
> > > >>>>>>>>>> test-service/localhost@TEST.COM with result:
> > > >>>>>>>>>> -1765328243/Matching credential not found (filename:
> > > >>>>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> > > >>>>>>>>>> [15538] 1493491231.918229: Server has referral realm;
> > > >>>>>>>>>> starting with test-service/localhost@TEST.COM [15538]
> > 1493491231.918278:
> > > >>>>>>>>>> Retrieving drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> from FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>>> with
> > > result:
> > > >>>>>>>>>> 0/Success
> > > >>>>>>>>>> [15538] 1493491231.918281: Starting with TGT for client
> realm:
> > > >>>>>>>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
> > > >>>>>>>>>> 1493491231.918301: Requesting tickets for
> > > >>>>>>>>>> test-service/localhost@TEST.COM, referrals on [15538]
> > > >>>>>>>>>> 1493491231.918326: Generated subkey for TGS request:
> > > >>>>>>>>>> aes128-cts/FA30
> > > >>>>>>>>>> [15538] 1493491231.918359: etypes requested in TGS request:
> > > >>>>>>>>>> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2,
> > > >>>>>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
> > > >>>>>>>>>> [15538]
> > > >>>>>> 1493491231.918484:
> > > >>>>>>>>>> Encoding request body and padata into FAST request [15538]
> > > >>>>>>>>>> 1493491231.918541: Sending request (836 bytes) to TEST.COM
> > > >>>>>>>>>> [15538]
> > > >>>>>>>>>> 1493491231.918597: Resolving hostname localhost [15538]
> > > >>>>>>>>>> 1493491231.918703: Initiating TCP connection to stream
> > > >>>>>>>>>> 127.0.0.1:44292
> > > >>>>>>>>>> [15538] 1493491231.918777: Sending TCP request to stream
> > > >>>>>>>>>> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error
> > > >>>>>>>>>> receiving from stream
> > > >>>>>>>>>> 127.0.0.1:44292: 104/Connection reset by peer [15538]
> > > >>>>>>>>>> 1493491231.922812: Terminating TCP connection to stream
> > > >>>>>>>>>> 127.0.0.1:44292
> > > >>>>>>>>>> [15538] 1493491231.922858: Sending initial UDP request to
> > > >>>>>>>>>> dgram
> > > >>>>>>>>>> 127.0.0.1:44292
> > > >>>>>>>>>> ('First kerberos.authGSSClientStep not successful',
> > > >>>>>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide
> > > >>>>>>>>>> more information', 851968), ("Cannot contact any KDC for
> > > >>>>>>>>>> realm 'TEST.COM'",
> > > >>>>>>>>>> -1765328228)))
> > > >>>>>>>>>>
> > > >>>>>>>>>> 2. For the terminal that runs mvn clean test
> > > >>>>>>>>>> -Dtest=MitIssueTest Running
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > > >>>>>>>>>> 2017-04-29 21:07:39,182 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> initialize called
> > > >>>>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> getIdentity called, principalName =
> > > >>>>>>>>>> krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> getIdentity failed, principalName =
> > > >>>>>>>>>> krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> addIdentity successful, principalName =
> > > >>>>>>>>>> krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> getIdentity called, principalName =
> > > >>>>>>>>>> kadmin/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> getIdentity failed, principalName =
> > > >>>>>>>>>> kadmin/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,213 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> addIdentity successful, principalName =
> > > >>>>>>>>>> kadmin/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,216 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> start called
> > > >>>>>>>>>> 2017-04-29 21:07:39,232 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> addIdentity successful, principalName =
> > > >>>>>>>>>> test-service/localhost@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,425 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> addIdentity successful, principalName = drankye@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1]
> > > >>>>> request.KdcRequest:
> > > >>>>>>>>>> Client entry is empty.
> > > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = drankye@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = drankye@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > > >>>>>>>>>> occurred, disconnecting abnormally java.io.EOFException
> > > >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:
> > 392)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > > >>>>>>>>>> r.ru
> > > >>>>>>>>>> n(
> > > >>>>>>>> DefaultKdcHandler.java:46)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > >>>>>>>> ThreadPoolExecutor.java:1142)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > >>>>>>>> ThreadPoolExecutor.java:617)
> > > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > > >>>>>>>>>> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase:
> > > >>>>>>>>>> Storing the tgt to the credential cache file.
> > > >>>>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> getIdentity called, principalName =
> > > >>>>>>>>>> test-service/localhost@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> getIdentity successful, principalName =
> > > >>>>>>>>>> test-service/localhost@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1]
> > > >>>>> request.KdcRequest:
> > > >>>>>>>>>> Client entry is empty.
> > > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1]
> > > >>>>> request.KdcRequest:
> > > >>>>>>>>>> The preauth data is empty.
> > > >>>>>>>>>> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1]
> > > server.KdcHandler:
> > > >>>>>>>>>> KRB error occurred while processing request:Additional
> > > >>>>>>>>>> pre-authentication required
> > > >>>>>>>>>> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > > >>>>>>>>>> occurred, disconnecting abnormally java.io.EOFException
> > > >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:
> > 392)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > > >>>>>>>>>> r.ru
> > > >>>>>>>>>> n(
> > > >>>>>>>> DefaultKdcHandler.java:46)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > >>>>>>>> ThreadPoolExecutor.java:1142)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > >>>>>>>> ThreadPoolExecutor.java:617)
> > > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > > >>>>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1]
> > > >>>>> request.KdcRequest:
> > > >>>>>>>>>> Client entry is empty.
> > > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > > >>>>>>>>>> occurred, disconnecting abnormally java.io.EOFException
> > > >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:
> > 392)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > > >>>>>>>>>> r.ru
> > > >>>>>>>>>> n(
> > > >>>>>>>> DefaultKdcHandler.java:46)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > >>>>>>>> ThreadPoolExecutor.java:1142)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > >>>>>>>> ThreadPoolExecutor.java:617)
> > > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > > >>>>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1]
> > > >>>>> request.KdcRequest:
> > > >>>>>>>>>> Found fast padata and start to process it.
> > > >>>>>>>>>> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
> > > >>>>>>>>>> impl.DefaultKdcHandler: Error occured while processing
> > request:
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding
> failed
> > > >>>>>>>>>> at org.apache.kerby.kerberos.
> kerb.KrbCodec.decode(KrbCodec.
> > > >>>>>>>> java:85)
> > > >>>>>>>>>> at org.apache.kerby.kerberos.
> kerb.KrbCodec.decode(KrbCodec.
> > > >>>>>>>> java:70)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kd
> > > >>>>>>>>>> cFin
> > > >>>>>>>>>> dF
> > > >>>>>>>>>> as
> > > >>>>>>>>>> t(
> > > >>>>>>>> KdcRequest.java:208)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.
> > > >>>>>>>> KdcRequest.process(KdcRequest.java:168)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
> > > >>>>>>>> handleMessage(KdcHandler.java:115)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.
> DefaultKdcHandler.
> > > >>>>>>>> handleMessage(DefaultKdcHandler.java:67)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > > >>>>>>>>>> r.ru
> > > >>>>>>>>>> n(
> > > >>>>>>>> DefaultKdcHandler.java:52)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > >>>>>>>> ThreadPoolExecutor.java:1142)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > >>>>>>>> ThreadPoolExecutor.java:617)
> > > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > > >>>>>>>>>> Caused by: java.io.IOException: Unexpected item context [0]
> > > >>>>>>>>>> [tag=0xA0, off=0, len=3+207], expecting 0x30
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > > >>>>>>>> Asn1Encodeable.java:210)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > > >>>>>>>> Asn1Encodeable.java:197)
> > > >>>>>>>>>> at org.apache.kerby.kerberos.
> kerb.KrbCodec.decode(KrbCodec.
> > > >>>>>>>> java:83)
> > > >>>>>>>>>> ... 9 more
> > > >>>>>>>>>> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > > >>>>>>>>>> occurred, disconnecting abnormally
> > > >>>>>>>>>> java.net.SocketException: Socket closed
> > > >>>>>>>>>> at java.net.SocketInputStream.socketRead0(Native Method)
> > > >>>>>>>>>> at java.net.SocketInputStream.
> socketRead(SocketInputStream.
> > > >>>>>>>> java:116)
> > > >>>>>>>>>> at java.net.SocketInputStream.
> read(SocketInputStream.java:
> > > >>>>> 171)
> > > >>>>>>>>>> at java.net.SocketInputStream.
> read(SocketInputStream.java:
> > > >>>>> 141)
> > > >>>>>>>>>> at java.net.SocketInputStream.
> read(SocketInputStream.java:
> > > >>>>> 224)
> > > >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:
> > 387)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > > >>>>>>>>>> r.ru
> > > >>>>>>>>>> n(
> > > >>>>>>>> DefaultKdcHandler.java:46)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > >>>>>>>> ThreadPoolExecutor.java:1142)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > >>>>>>>> ThreadPoolExecutor.java:617)
> > > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > > >>>>>>>>>>
> > > >>>>>>>>>> In a FreeIPA environment these python lines "just" work.
> > > >>>>>>>>>>
> > > >>>>>>>>>> Any suggestions are welcome!
> > > >>>>>>>>>>
> > > >>>>>>>>>> Marc
> > > >>>>>>>>>>
> > > >>>>>>>>>>
> > > >>>>>>>>> --
> > > >>>>>>>>> Marc de Lignie
> > > >>>>>>>>>
> > > >>>>>>>>
> > > >>>>>>>> --
> > > >>>>>>>> Marc de Lignie
> > > >>>>>>>>
> > > >>>>>>>>
> > > >>>>>>>
> > > >>>>>>>
> > > >>>>>>> --
> > > >>>>>>> Colm O hEigeartaigh
> > > >>>>>>>
> > > >>>>>>> Talend Community Coder
> > > >>>>>>> http://coders.talend.com
> > > >>>>>>>
> > > >>>>>>
> > > >>>>>>
> > > >>>>>>
> > > >>>>>> --
> > > >>>>>> Colm O hEigeartaigh
> > > >>>>>>
> > > >>>>>> Talend Community Coder
> > > >>>>>> http://coders.talend.com
> > > >>>>>>
> > > >>>>>
> > > >>>>>
> > > >>>>>
> > > >>>>> --
> > > >>>>> Colm O hEigeartaigh
> > > >>>>>
> > > >>>>> Talend Community Coder
> > > >>>>> http://coders.talend.com
> > > >>>>>
> > > >>>>
> > > >>>>
> > > >>>>
> > > >>>> --
> > > >>>> Colm O hEigeartaigh
> > > >>>>
> > > >>>> Talend Community Coder
> > > >>>> http://coders.talend.com
> > > >>>
> > > >>>
> > > >>
> > > >>
> > > >> --
> > > >> Colm O hEigeartaigh
> > > >>
> > > >> Talend Community Coder
> > > >> http://coders.talend.com
> > >
> >
> >
> >
> > --
> > Colm O hEigeartaigh
> >
> > Talend Community Coder
> > http://coders.talend.com
> >
>
>
>
> --
> Colm O hEigeartaigh
>
> Talend Community Coder
> http://coders.talend.com
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
RE: MIT Kerberos compatibility
Posted by "Zheng, Kai" <ka...@intel.com>.
Hi Colm,
Did you aware it's caused by any recent changes? It looks to me not. How serve is it? It appears in some case in the WSS4J tests. We have work around, using the Netty one. I'd suggest we target it for next minor release, like 1.1.0 or 1.0.1 so we have enough bandwidth to investigate and improve the default transport. We probably shouldn't introduce more changes to get the release out. Note please prefer to use the TCP transport over the UDP one, in today's world.
Regards,
Kai
-----Original Message-----
From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
Sent: Monday, May 08, 2017 6:19 PM
To: kerby@directory.apache.org
Subject: Re: MIT Kerberos compatibility
OK I have created a JIRA and attached a patch that you have to apply to the
Apache WSS4J project to reproduce the error. If you uncomment the line that
uses Netty then the tests all work perfectly. The tests appear to work fine
when run in isolation, it's only when you run a few of them after one
another that you can see the failures.
Please let me know if you have any difficulty in reproducing, thanks!
Colm.
On Mon, May 8, 2017 at 11:08 AM, Zheng, Kai <ka...@intel.com> wrote:
> Hi Colm,
>
> Sure, please do it. Could you review my change and see how it would cause
> the new failures? Any difference between the failed GSS tests and the Kerby
> GSS tests?
>
> Regards,
> Kai
>
> -----Original Message-----
> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> Sent: Monday, May 08, 2017 5:42 PM
> To: Zheng, Kai <ka...@intel.com>
> Cc: kerby@directory.apache.org
> Subject: Re: MIT Kerberos compatibility
>
> Hi Kai,
>
> Your changes fixed the error message I was seeing. However, I now see
> another problem when I run a few GSS client tests in a row:
>
> >>> EType: sun.security.krb5.internal.crypto.Aes128CtsHmacSha1EType
> >>> KrbAsReq creating message
> >>> KrbKdcReq send: kdc=localhost UDP:42665, timeout=30000, number of
> retries =3, #bytes=245
> >>> KDCCommunication: kdc=localhost UDP:42665, timeout=30000,Attempt =1,
> #bytes=245
> SocketTimeOutException with attempt: 1
> >>> KDCCommunication: kdc=localhost UDP:42665, timeout=30000,Attempt =2,
> #bytes=245
> >>> KrbKdcReq send: error trying localhost:42665
> java.net.PortUnreachableException: ICMP Port Unreachable
>
> Do you want me to create a JIRA + attach a test-case?
>
> Colm.
>
> On Sat, May 6, 2017 at 2:01 AM, Zheng, Kai <ka...@intel.com> wrote:
>
> > I haven't repeated the issue but revisited the codes again and made
> > improvements. Would you check it out? Thanks!
> >
> > Sent from iPhone
> >
> > > 在 2017年5月6日，上午6:28，Zheng, Kai <ka...@intel.com> 写道：
> > >
> > > Thanks colm for the clarification and it sounds an issue we need to
> > address. I will investigate it soon.
> > >
> > > Sent from iPhone
> > >
> > >> 在 2017年5月6日，上午2:14，Colm O hEigeartaigh <co...@apache.org> 写道：
> > >>
> > >> Hi Kai,
> > >>
> > >> If I enable UDP with the default Transport, I can get a ticket fine
> > using
> > >> kinit. However then the following error pops up in the window I'm
> > running
> > >> Kerby in (as a test):
> > >>
> > >> Exception in thread "Thread-1" java.lang.RuntimeException: Error
> > >> occured while checking udp connections
> > >> at
> > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > KdcNetwork.java:105)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > access$000(KdcNetwork.java:39)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > run(KdcNetwork.java:75)
> > >> at java.lang.Thread.run(Thread.java:748)
> > >> Caused by: java.nio.channels.ClosedChannelException
> > >> at
> > >> sun.nio.ch.DatagramChannelImpl.ensureOpen(
> DatagramChannelImpl.java:320)
> > >> at sun.nio.ch.DatagramChannelImpl.receive(
> > DatagramChannelImpl.java:331)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > checkUdpMessage(KdcNetwork.java:132)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > KdcNetwork.java:101)
> > >>
> > >> Colm.
> > >>
> > >>
> > >>> On Fri, May 5, 2017 at 5:56 PM, Zheng, Kai <ka...@intel.com>
> > wrote:
> > >>>
> > >>> Colm, did you see udp problem now instead? I'm a little confused.
> > >>> Udp
> > is
> > >>> sure supported but may not be enabled by default, which should be
> > >>> okay, imo. Thanks.
> > >>>
> > >>> Sent from iPhone
> > >>>
> > >>>> 在 2017年5月6日，上午12:02，Colm O hEigeartaigh <co...@apache.org> 写道：
> > >>>>
> > >>>> That's probably it. Why does the default transport not support
> > >>>> UDP in
> > >>> Kerby?
> > >>>>
> > >>>> Colm.
> > >>>>
> > >>>>> On Fri, May 5, 2017 at 4:54 PM, Li, Jiajia <ji...@intel.com>
> > wrote:
> > >>>>>
> > >>>>> Are you sure add kdc_allow_udp = false in kdc.conf?
> > >>>>>
> > >>>>> Thanks
> > >>>>> Jiajia
> > >>>>>
> > >>>>> -----Original Message-----
> > >>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > >>>>> Sent: Friday, May 5, 2017 11:41 PM
> > >>>>> To: Li, Jiajia <ji...@intel.com>
> > >>>>> Cc: kerby@directory.apache.org; Zheng, Kai
> > >>>>> <ka...@intel.com>;
> > >>> mailto:
> > >>>>> m.c.delignie@xs4all.nl <m....@xs4all.nl>
> > >>>>> Subject: Re: MIT Kerberos compatibility
> > >>>>>
> > >>>>> Sorry, it was my error, UDP was actually enabled there. But why
> > >>>>> am I
> > >>> still
> > >>>>> seeing that error message?
> > >>>>>
> > >>>>> Colm.
> > >>>>>
> > >>>>>> On Fri, May 5, 2017 at 4:39 PM, Li, Jiajia
> > >>>>>> <ji...@intel.com>
> > >>> wrote:
> > >>>>>>
> > >>>>>> Hi Colm,
> > >>>>>> I also test the Kerby KDC with kerby kint and MIT kinit, and
> > >>>>>> only listen the tcp port(disable udp), both got ticket
> > >>>>>> successfully. But
> > I
> > >>>>>> don't get the error message. Both krb.conf and kdc.conf should
> > >>>>>> set
> > udp
> > >>>>>> to be false, udp is enabled in default.
> > >>>>>>
> > >>>>>> Thanks
> > >>>>>> Jiajia
> > >>>>>>
> > >>>>>> -----Original Message-----
> > >>>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > >>>>>> Sent: Friday, May 5, 2017 11:34 PM
> > >>>>>> To: kerby@directory.apache.org
> > >>>>>> Cc: Zheng, Kai <ka...@intel.com>;
> > >>>>>> mailto:m.c.delignie@xs4all.nl
> > <
> > >>>>>> m.c.delignie@xs4all.nl>
> > >>>>>> Subject: Re: MIT Kerberos compatibility
> > >>>>>>
> > >>>>>> Hi Jiajia,
> > >>>>>>
> > >>>>>> If UDP is disabled and we don't use Netty, I can get a token
> > >>>>>> successfully via kinit. However I then see an error message in
> > >>>>>> the
> > >>> Kerby
> > >>>>> console:
> > >>>>>>
> > >>>>>> Exception in thread "Thread-1" java.lang.RuntimeException:
> > >>>>>> Error occured while checking udp connections at
> > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > >>>>>> KdcNetwork.java:105)
> > >>>>>> at
> > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > >>>>>> access$000(KdcNetwork.java:39)
> > >>>>>> at
> > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > >>>>>> run(KdcNetwork.java:75)
> > >>>>>> at java.lang.Thread.run(Thread.java:748)
> > >>>>>> Caused by: java.nio.channels.ClosedChannelException
> > >>>>>> at
> > >>>>>> sun.nio.ch.DatagramChannelImpl.ensureOpen(
> > >>> DatagramChannelImpl.java:320)
> > >>>>>> at sun.nio.ch.DatagramChannelImpl.receive(
> > >>>>>> DatagramChannelImpl.java:331)
> > >>>>>> at
> > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > >>>>>> checkUdpMessage(KdcNetwork.java:132)
> > >>>>>> at
> > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > >>>>>> KdcNetwork.java:101)
> > >>>>>>
> > >>>>>> I'm not sure why we are seeing UDP errors when it's disabled?
> > >>>>>>
> > >>>>>> Colm.
> > >>>>>>
> > >>>>>>> On Fri, May 5, 2017 at 3:57 PM, Li, Jiajia
> > >>>>>>> <ji...@intel.com>
> > >>> wrote:
> > >>>>>>>
> > >>>>>>> Hi Colm,
> > >>>>>>> The shell client can't connect to kdc if the UDP is disabled.
> > >>>>>>> We don't use Netty in default.
> > >>>>>>> What's your test-cases? The same as the Marc's?
> > >>>>>>>
> > >>>>>>> Thanks
> > >>>>>>> Jiajia
> > >>>>>>>
> > >>>>>>> -----Original Message-----
> > >>>>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > >>>>>>> Sent: Friday, May 5, 2017 10:09 PM
> > >>>>>>> To: kerby@directory.apache.org
> > >>>>>>> Cc: Zheng, Kai <ka...@intel.com>; mailto:
> > m.c.delignie@xs4all.nl
> > >>>>>>> < m.c.delignie@xs4all.nl>
> > >>>>>>> Subject: Re: MIT Kerberos compatibility
> > >>>>>>>
> > >>>>>>> Hi Jiajia,
> > >>>>>>>
> > >>>>>>> What are the issues if UDP is disabled and we don't use Netty?
> > >>>>>>> I tried doing this with my own test-cases and it didn't work,
> > >>>>>>> so it would be good to get this fixed soon.
> > >>>>>>>
> > >>>>>>> Colm.
> > >>>>>>>
> > >>>>>>> On Fri, May 5, 2017 at 2:46 PM, Li, Jiajia
> > >>>>>>> <ji...@intel.com>
> > >>>>> wrote:
> > >>>>>>>
> > >>>>>>>> Hi Marc,
> > >>>>>>>>>>> - your KRB5 tracing looks quite different. What OS and
> > >>>>>>>>>>> mit-kerberos
> > >>>>>>>> version did you use?
> > >>>>>>>> I use mac os and the python version is 2.7.10
> > >>>>>>>>
> > >>>>>>>>>>> - your KRB5 tracing shows UDP comms between kerberos
> > >>>>>>>>>>> client and KDC,
> > >>>>>>>> despite the allowUDP = false setting
> > >>>>>>>>>>> in my test. I did this setting because I get different
> > >>>>>>>>>>> problems
> > >>>>>>>> without it, see the additional logs below. So,
> > >>>>>>>>>>> we must also be aware of networking problems at my side.
> > >>>>>>>> I enable the UDP and use netty network, there are some issues
> > >>>>>>>> if UDP disabled, you can create a JIRA for this and we can
> > >>>>>>>> fix this issue in the next release version.
> > >>>>>>>>
> > >>>>>>>> The changes in my side as following:
> > >>>>>>>>
> > >>>>>>>> protected boolean allowUdp() { return true; } @Override
> > >>>>>>>> protected void prepareKdc() throws KrbException {
> > >>>>>>>> getKdcServer().setInnerKdcImpl(
> > >>>>>>>> new
> > >>>>>>>> NettyKdcServerImpl(getKdcServer().getKdcSetting()));
> > >>>>>>>> super.prepareKdc();
> > >>>>>>>> }
> > >>>>>>>>
> > >>>>>>>> Here is log of MitIssueTest:
> > >>>>>>>> [INFO] Running
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > >>>>>>>> io.netty.handler.logging.LoggingHandler
> > >>>>>>>> -
> > >>>>>>>> [id: 0x2634fe6b] REGISTERED
> > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > >>>>>>>> io.netty.handler.logging.LoggingHandler
> > >>>>>>>> -
> > >>>>>>>> [id: 0x2634fe6b] BIND(0.0.0.0/0.0.0.0:53957)
> > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > >>>>>>>> io.netty.handler.logging.LoggingHandler -
> > >>>>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] ACTIVE [main] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kdc.impl.NettyKdcServerImpl - Netty
> > >>>>>>>> kdc server started.
> > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > >>>>>>>> io.netty.handler.logging.LoggingHandler
> > >>>>>>>> -
> > >>>>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] RECEIVED: [id:
> > >>>>>>>> 0xdac7228b, /
> > >>>>>>>> 127.0.0.1:53961 => /127.0.0.1:53957]
> > >>>>>>>> [defaultEventExecutorGroup-4-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
> > >>>>>>>> - AS_REQ ISSUE: authtime 1493991123792,drankye@TEST.COM for
> > >>>>>>>> krbtgt/ TEST.COM@TEST.COM [main] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> > DefaultInternalKrbClien
> > >>>>>>>> t
> > >>>>>>>> - Send to kdc success.
> > >>>>>>>> [main] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing
> the tgt to the credential cache file.
> > >>>>>>>> [nioEventLoopGroup-5-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> > >>>>>>>> - The preauth data is empty.
> > >>>>>>>> [nioEventLoopGroup-5-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> > >>>>>>>> - KRB error occurred while processing request:Additional
> > >>>>>>>> pre-authentication required [nioEventLoopGroup-5-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
> > >>>>>>>> - AS_REQ ISSUE: authtime
> > >>>>>>>> 1493991123859,test-service/localhost@TEST.COM
> > >>>>>>>> for krbtgt/TEST.COM@TEST.COM
> > >>>>>>>> [nioEventLoopGroup-5-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.TgsRequest
> > >>>>>>>> - TGS_REQ ISSUE: authtime 1493991142850,drankye for
> > >>>>>>>> test-service/ localhost@TEST.COM
> > >>>>>>>>
> > >>>>>>>> Thanks
> > >>>>>>>> Jiajia
> > >>>>>>>>
> > >>>>>>>> -----Original Message-----
> > >>>>>>>> From: Zheng, Kai
> > >>>>>>>> Sent: Friday, May 5, 2017 7:46 PM
> > >>>>>>>> To: kerby@directory.apache.org; Li, Jiajia
> > >>>>>>>> <ji...@intel.com>
> > >>>>>>>> Subject: RE: MIT Kerberos compatibility
> > >>>>>>>>
> > >>>>>>>> Hi Marc,
> > >>>>>>>>
> > >>>>>>>> Looks like this is quite environment related, could you fire
> > >>>>>>>> an issue for this? I would suggest we target it to 1.1.0,
> > >>>>>>>> which can be done in
> > >>>>>>> June.
> > >>>>>>>>
> > >>>>>>>> Regards,
> > >>>>>>>> Kai
> > >>>>>>>>
> > >>>>>>>> -----Original Message-----
> > >>>>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> > >>>>>>>> Sent: Friday, May 05, 2017 4:44 PM
> > >>>>>>>> To: Li, Jiajia <ji...@intel.com>
> > >>>>>>>> Cc: kerby@directory.apache.org
> > >>>>>>>> Subject: Re: MIT Kerberos compatibility
> > >>>>>>>>
> > >>>>>>>> Hi Jiajia,
> > >>>>>>>>
> > >>>>>>>> Great to read that you made progress on this issue and to see
> > >>>>>>>> a working config at your side. Below, I list my progress
> > >>>>>>>> below (with trunk merged into my MitIssue branch), but I am
> > >>>>>>>> afraid we are not done
> > >>>>>>> yet.
> > >>>>>>>>
> > >>>>>>>> Things that stand out:
> > >>>>>>>>
> > >>>>>>>> - the kdc decoding error is solved, relative to the logs
> > >>>>>>>> without your patch
> > >>>>>>>>
> > >>>>>>>> - your KRB5 tracing looks quite different. What OS and
> > >>>>>>>> mit-kerberos version did you use?
> > >>>>>>>>
> > >>>>>>>> - your KRB5 tracing shows UDP comms between kerberos client
> > >>>>>>>> and KDC, despite the allowUDP = false setting in my test. I
> > >>>>>>>> did this setting because I get different problems without it,
> > >>>>>>>> see the additional logs below. So, we must also be aware of
> > >>>>>>>> networking
> > >>>>> problems at my side.
> > >>>>>>>>
> > >>>>>>>> - the "Response was not from master KDC" msg is not relevant;
> > >>>>>>>> it disappears if you manually add master_kdc to the realms
> > >>>>>>>> section of the krb5.conf
> > >>>>>>>>
> > >>>>>>>> I have no idea how to proceed from here, so that is why I
> > >>>>>>>> just document the status at my side and ask about your -
> > >>>>>>>> apparently working -
> > >>>>>>> config.
> > >>>>>>>>
> > >>>>>>>> Cheers, Marc
> > >>>>>>>>
> > >>>>>>>>
> > >>>>>>>> KDC logging with allowUDP = false:
> > >>>>>>>>
> > >>>>>>>> [INFO] Running
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > >>>>>>>> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > >>>>>>>> AS_REQ
> > >>>>>> ISSUE:
> > >>>>>>>> authtime 1493970789075,drankye@TEST.COM for
> > >>>>>>>> krbtgt/TEST.COM@TEST.COM [main] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> > DefaultInternalKrbClien
> > >>>>>>>> t
> > >>>>>>>> - Send to kdc success.
> > >>>>>>>> [main] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing
> the tgt to the credential cache file.
> > >>>>>>>> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest -
> > >>>>>>>> The preauth data is empty.
> > >>>>>>>> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> > >>>>>>>> - KRB error occurred while processing request:Additional
> > >>>>>>>> pre-authentication required [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > >>>>>>>> AS_REQ
> > >>>>>> ISSUE:
> > >>>>>>>> authtime 1493970789108,test-service/localhost@TEST.COM for
> > krbtgt/
> > >>>>>>>> TEST.COM@TEST.COM [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> > >>>>>>>> - Found fast padata and starting to process it.
> > >>>>>>>> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest -
> > >>>>>>>> Found fast padata and starting to process it.
> > >>>>>>>>
> > >>>>>>>> Python script KRB5 tracing (MIT Kerberos 1.13.2 of Ubuntu
> > >>>>>>>> Xenial) with allowUDP = false:
> > >>>>>>>>
> > >>>>>>>> $ .
> > >>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/
> > >>>>>>>> kerberos/kerb/server/MitIssueTest.sh
> > >>>>>>>> [25281] 1493970797.298753: Retrieving drankye@TEST.COM from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found [25281]
> > >>>>>>>> 1493970797.298952: Retrieving drankye@TEST.COM from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found [25281]
> > >>>>>>>> 1493970797.299106: Retrieving drankye@TEST.COM from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found [25281]
> > >>>>>>>> 1493970797.299213: Retrieving drankye@TEST.COM from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found [25281]
> > >>>>>>>> 1493970797.299323: Retrieving drankye@TEST.COM from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found [25281]
> > >>>>>>>> 1493970797.299436: Retrieving drankye@TEST.COM from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found [25281]
> > >>>>>>>> 1493970797.299545: Retrieving drankye@TEST.COM from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found [25281]
> > >>>>>>>> 1493970797.299654: Retrieving drankye@TEST.COM from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found kerberos.authGSSClientInit successful [25281]
> 1493970797.299922:
> > >>>>>>>> Getting credentials drankye@TEST.COM ->
> > >>>>>>>> test-service/localhost@ using ccache
> > >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>> [25281] 1493970797.299945: Retrieving drankye@TEST.COM ->
> > >>>>>>>> test-service/localhost@ from
> > >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>> with result:
> > >>>>>>>> -1765328243/Matching credential not found [25281]
> > 1493970797.299959:
> > >>>>>>>> Retrying drankye@TEST.COM -> test-service/localhost@TEST.COM
> > >>>>>>>> with
> > >>>>>>> result:
> > >>>>>>>> -1765328243/Matching credential not found [25281]
> > 1493970797.299962:
> > >>>>>>>> Server has referral realm; starting with
> > >>>>>>>> test-service/localhost@TEST.COM [25281]
> > >>>>>>>> 1493970797.299975: Retrieving drankye@TEST.COM ->
> > >>>>>>>> krbtgt/TEST.COM@TEST.COM from
> > >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>> with result:
> > >>>>>>>> 0/Success [25281] 1493970797.299979: Starting with TGT for
> > >>>>>>>> client
> > >>>>>> realm:
> > >>>>>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [25281]
> > >>>>>> 1493970797.299981:
> > >>>>>>>> Requesting tickets for test-service/localhost@TEST.COM,
> > >>>>>>>> referrals on [25281] 1493970797.299994: Generated subkey for
> TGS request:
> > >>>>>>>> aes128-cts/1B9B [25281] 1493970797.300009: etypes requested
> > >>>>>>>> in TGS
> > >>>>>>> request:
> > >>>>>>>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac,
> > >>>>>>>> camellia128-cts, camellia256-cts [25281] 1493970797.300054:
> > >>>>>>>> Encoding request body and padata into FAST request [25281]
> > >>>>>>>> 1493970797.300080: Sending request
> > >>>>>>>> (823 bytes) to TEST.COM [25281] 1493970797.300091: Resolving
> > >>>>>>>> hostname localhost [25281]
> > >>>>>>>> 1493970797.300136: Initiating TCP connection to stream
> > >>>>>>>> 127.0.0.1:34319
> > >>>>>>>> [25281] 1493970797.300191: Sending TCP request to stream
> > >>>>>>>> 127.0.0.1:34319 [25281] 1493970797.303610: Received answer
> > >>>>>>>> (125
> > >>>>>>>> bytes) from stream
> > >>>>>>>> 127.0.0.1:34319
> > >>>>>>>> [25281] 1493970797.303618: Terminating TCP connection to
> > >>>>>>>> stream
> > >>>>>>>> 127.0.0.1:34319
> > >>>>>>>> [25281] 1493970797.553126: Response was not from master KDC
> > >>>>>>>> [25281]
> > >>>>>>>> 1493970797.553198: TGS request result: -1765323383/Unknown
> > >>>>>>>> code krcM
> > >>>>>>>> 137 [25281] 1493970797.553234: Requesting tickets for
> > >>>>>>>> test-service/ localhost@TEST.COM, referrals off [25281]
> > >>>>> 1493970797.553273:
> > >>>>>>>> Generated subkey for TGS request: aes128-cts/94C6 [25281]
> > >>>>>> 1493970797.553323:
> > >>>>>>>> etypes requested in TGS request: aes256-cts, aes128-cts,
> > >>>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
> > >>>>>>>> [25281]
> > >>>>>>>> 1493970797.553436: Encoding request body and padata into FAST
> > >>>>>>>> request
> > >>>>>>> [25281] 1493970797.553532:
> > >>>>>>>> Sending request (823 bytes) to TEST.COM [25281]
> > 1493970797.553567:
> > >>>>>>>> Resolving hostname localhost [25281] 1493970797.553745:
> > >>>>>>>> Initiating TCP connection to stream
> > >>>>>>>> 127.0.0.1:34319
> > >>>>>>>> [25281] 1493970797.553889: Sending TCP request to stream
> > >>>>>>>> 127.0.0.1:34319 [25281] 1493970797.558297: Received answer
> > >>>>>>>> (125
> > >>>>>>>> bytes) from stream
> > >>>>>>>> 127.0.0.1:34319
> > >>>>>>>> [25281] 1493970797.558318: Terminating TCP connection to
> > >>>>>>>> stream
> > >>>>>>>> 127.0.0.1:34319
> > >>>>>>>> [25281] 1493970797.561189: Response was not from master KDC
> > >>>>>>>> [25281]
> > >>>>>>>> 1493970797.561258: TGS request result: -1765323383/Unknown
> > >>>>>>>> code krcM
> > >>>>>>>> 137 ('First kerberos.authGSSClientStep not successful',
> > >>>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide
> > >>>>>>>> more information', 851968), ('Unknown code krcM 137',
> > >>>>>>>> -1765323383)))
> > >>>>>>>>
> > >>>>>>>>
> > >>>>>>>> KDC logging with allowUDP = true:
> > >>>>>>>>
> > >>>>>>>> [INFO] Running
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > >>>>>>>> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > >>>>>>>> AS_REQ
> > >>>>>> ISSUE:
> > >>>>>>>> authtime 1493972505784,drankye@TEST.COM for
> > >>>>>>>> krbtgt/TEST.COM@TEST.COM [main] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> > DefaultInternalKrbClien
> > >>>>>>>> t
> > >>>>>>>> - Send to kdc success.
> > >>>>>>>> [main] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing
> the tgt to the credential cache file.
> > >>>>>>>> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest -
> > >>>>>>>> The preauth data is empty.
> > >>>>>>>> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> > >>>>>>>> - KRB error occurred while processing request:Additional
> > >>>>>>>> pre-authentication required [pool-1-thread-2] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > >>>>>>>> AS_REQ
> > >>>>>> ISSUE:
> > >>>>>>>> authtime 1493972505948,test-service/localhost@TEST.COM for
> > krbtgt/
> > >>>>>>>> TEST.COM@TEST.COM Exception in thread "Thread-0"
> > >>>>>>>> java.lang.RuntimeException: Error occured while checking udp
> > >>>>>> connections
> > >>>>>>>> at
> > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > >>>>>>>> KdcNetwork.java:105)
> > >>>>>>>> at
> > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > >>>>>>>> access$000(KdcNetwork.java:39)
> > >>>>>>>> at
> > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > >>>>>>>> run(KdcNetwork.java:75)
> > >>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > >>>>>>>> Caused by: java.nio.channels.ClosedChannelException
> > >>>>>>>> at
> > >>>>>>>> sun.nio.ch.DatagramChannelImpl.ensureOpen(
> > >>>>>> DatagramChannelImpl.java:320)
> > >>>>>>>> at sun.nio.ch.DatagramChannelImpl.receive(
> > >>>>>>>> DatagramChannelImpl.java:331)
> > >>>>>>>> at
> > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > >>>>>>>> checkUdpMessage(KdcNetwork.java:132)
> > >>>>>>>> at
> > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > >>>>>>>> KdcNetwork.java:101)
> > >>>>>>>> ... 3 more
> > >>>>>>>>
> > >>>>>>>>
> > >>>>>>>> krb5.conf:
> > >>>>>>>>
> > >>>>>>>> [libdefaults]
> > >>>>>>>> kdc_realm = TEST.COM
> > >>>>>>>> default_realm = TEST.COM
> > >>>>>>>> udp_preference_limit = 4096
> > >>>>>>>> kdc_tcp_port = 37080
> > >>>>>>>> kdc_udp_port = 36525
> > >>>>>>>>
> > >>>>>>>> [realms]
> > >>>>>>>> TEST.COM = {
> > >>>>>>>> kdc = localhost:36525
> > >>>>>>>> }
> > >>>>>>>>
> > >>>>>>>> And port 36525 does not show up in `netstat -l` (while 37080
> > >>>>>>>> does)
> > >>>>>>>>
> > >>>>>>>>
> > >>>>>>>> Op 04-05-17 om 14:55 schreef Li, Jiajia:
> > >>>>>>>>> Hi Marc,
> > >>>>>>>>> I try to run your test(through applying your patch in the
> > >>>>>>>>> trunk) , I
> > >>>>>>>> think it's success now. Could you take some time to check
> > >>>>>>>> about
> > it?
> > >>>>>>>>> Here is the log:
> > >>>>>>>>>
> > >>>>>>>>> directory-kerby git:(trunk) ? .
> > >>>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerb
> > >>>>>>>>> eros
> > >>>>>>>>> /k
> > >>>>>>>>> er
> > >>>>>>>>> b/
> > >>>>>>>>> server/MitIssueTest.sh
> > >>>>>>>>> kerberos.authGSSClientInit successful
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: entypes not
> > >>>>>>>>> supported
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for krb5_ccache_conf_data/realm-config@X-CACHECONF:
> > >>>>>>>>> in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for test-service/localhost@TEST.COM in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for
> > >>>>>>>>> krb5_ccache_conf_data/negative-cache/test-service\134/localh
> > >>>>>>>>> ost\
> > >>>>>>>>> 13
> > >>>>>>>>> 4@
> > >>>>>>>>> TE
> > >>>>>>>>> ST.COM@X-CACHECONF: in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF
> :
> > >>>>>>>>> in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for krb5_ccache_conf_data/sitename@X-CACHECONF:
> > >>>>>>>>> in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for test-service/localhost@TEST.COM in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > >>>>>>>>> des-cbc-md5-deprecated not supported
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > >>>>>>>>> des-cbc-md4-deprecated not supported
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > >>>>>>>>> des-cbc-crc-deprecated not supported
> > >>>>>>>>> 2017-05-04T20:44:06 Trying to find service kdc for realm
> > >>>>>>>>> TEST.COM flags 0
> > >>>>>>>>> 2017-05-04T20:44:06 configuration file for realm TEST.COM
> > >>>>>>>>> found
> > >>>>>>>>> 2017-05-04T20:44:06 submissing new requests to new host
> > >>>>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
> > >>>>>>>>> 2017-05-04T20:44:06 connecting to host: udp ::1:52534
> > >>>>>>>>> (localhost)
> > >>>>>> tid:
> > >>>>>>>>> 00000001
> > >>>>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
> > >>>>>>>>> 2017-05-04T20:44:06 Queuing host in future (in 3s), its the
> > >>>>>>>>> 2 address on the same name: udp 127.0.0.1:52534 (localhost)
> tid:
> > >>>>>>>>> 00000002
> > >>>>>>>>> 2017-05-04T20:44:06 writing packet: udp ::1:52534
> > >>>>>>>>> (localhost)
> > tid:
> > >>>>>>>>> 00000001
> > >>>>>>>>> 2017-05-04T20:44:06 reading packet: udp ::1:52534
> > >>>>>>>>> (localhost)
> > tid:
> > >>>>>>>>> 00000001
> > >>>>>>>>> 2017-05-04T20:44:06 host completed: udp ::1:52534
> > >>>>>>>>> (localhost)
> > tid:
> > >>>>>>>>> 00000001
> > >>>>>>>>> 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0
> > >>>>>>>>> hosts 1 packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814
> > >>>>>>>>> tid: 00000002
> > >>>>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/763641F3
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328353: Decrypt
> > >>>>>>>>> integrity check failed for checksum type
> > >>>>>>>>> hmac-sha1-96-aes128, key type
> > >>>>>>>>> aes128-cts-hmac-sha1-96
> > >>>>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
> > >>>>>>>>> 2017-05-04T20:44:06 krb5_get_credentials_with_flags:
> > >>>>>>>>> TEST.COM
> > wc:
> > >>>>>>>>> 0.050317
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for krb5_ccache_conf_data/realm-config@X-CACHECONF:
> > >>>>>>>>> in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for
> > >>>>>>>>> krb5_ccache_conf_data/time-offset/test-service\134/
> > >>>>>> localhost\134@TEST.
> > >>>>>>>>> COM@X-CACHECONF: in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 Setting up PFS for auth context
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > >>>>>>>>> des-cbc-md5-deprecated not supported
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > >>>>>>>>> des-cbc-md4-deprecated not supported
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > >>>>>>>>> des-cbc-crc-deprecated not supported First
> > >>>>>>>>> kerberos.authGSSClientStep successful
> > >>>>>>>>>
> > >>>>>>>>> Thanks
> > >>>>>>>>> Jiajia
> > >>>>>>>>>
> > >>>>>>>>> -----Original Message-----
> > >>>>>>>>> From: Zheng, Kai [mailto:kai.zheng@intel.com]
> > >>>>>>>>> Sent: Wednesday, May 3, 2017 7:29 PM
> > >>>>>>>>> To: kerby@directory.apache.org
> > >>>>>>>>> Subject: RE: MIT Kerberos compatibility
> > >>>>>>>>>
> > >>>>>>>>> Hi Marc,
> > >>>>>>>>>
> > >>>>>>>>> In case you're not aware of this, please check out the
> > >>>>>>>>> latest fix made
> > >>>>>>>> by Jiajia. We thought your case may be different, but would
> > >>>>>>>> be good to have a check before we can repeat/fix your case.
> Thanks.
> > >>>>>>>>> https://issues.apache.org/jira/browse/DIRKRB-625
> > >>>>>>>>>
> > >>>>>>>>> Regards,
> > >>>>>>>>> Kai
> > >>>>>>>>>
> > >>>>>>>>> -----Original Message-----
> > >>>>>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> > >>>>>>>>> Sent: Sunday, April 30, 2017 7:45 PM
> > >>>>>>>>> To: kerby@directory.apache.org
> > >>>>>>>>> Subject: Re: MIT Kerberos compatibility
> > >>>>>>>>>
> > >>>>>>>>> Hi Kai,
> > >>>>>>>>>
> > >>>>>>>>> The terminal output below is for the latest MIT Kerberos
> > >>>>>>>>> 1.15.1 (locally
> > >>>>>>>> built on Ubuntu Xenial). Before that, I also tested with the
> > >>>>>>>> default Xenial MIT Kerberos packages (1.13.2), with the same
> > >>>>>>>> result. I did not try earlier MIT Kerberos versions.
> > >>>>>>>>>
> > >>>>>>>>> Marc
> > >>>>>>>>>
> > >>>>>>>>> Op 29-04-17 om 21:42 schreef Marc de Lignie:
> > >>>>>>>>>> Hi Kai,
> > >>>>>>>>>>
> > >>>>>>>>>> Thanks for the response. I prepared a minimal config that
> > >>>>>>>>>> reproduces my problem.
> > >>>>>>>>>>
> > >>>>>>>>>> You can fetch the branch/commit from:
> > >>>>>>>>>> https://github.com/vtslab/directory-kerby/commits/MitIssue
> > >>>>>>>>>>
> > >>>>>>>>>> This is relative to RC2, but I also tried this on trunk for
> > >>>>>>>>>> my actual project.
> > >>>>>>>>>>
> > >>>>>>>>>> This config produces the debug and error messages below.
> > >>>>>>>>>>
> > >>>>>>>>>> 1. For the terminal with the bash + python script $ klist
> > >>>>>>>>>> Ticket
> > >>>>>>>>>> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>>> Default principal: drankye@TEST.COM
> > >>>>>>>>>>
> > >>>>>>>>>> Valid starting Expires Service principal
> > >>>>>>>>>> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/
> TEST.COM@TEST.COM
> > >>>>>>>>>> renew until 29-04-17 21:07:39
> > >>>>>>>>>>
> > >>>>>>>>>> $ .
> > >>>>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/ker
> > >>>>>>>>>> bero s/ ke rb / server/MitIssueTest.sh [15538]
> > >>>>>>>>>> 1493491231.917606:
> > >>>>>>>>>> Retrieving drankye@TEST.COM from
> > >>>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>>>> with
> > >>>>>>>>>> result:
> > >>>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>>>> found [15538]
> > >>>>>>>>>> 1493491231.917827: Retrieving drankye@TEST.COM from
> > >>>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>>>> with
> > >>>>>>> result:
> > >>>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>>>> found kerberos.authGSSClientInit successful [15538]
> 1493491231.918185:
> > >>>>>>>>>> Getting credentials drankye@TEST.COM ->
> > >>>>>>>>>> test-service/localhost@ using ccache
> > >>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>>> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
> > >>>>>>>>>> test-service/localhost@ from
> > >>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with
> > result:
> > >>>>>>>>>> -1765328243/Matching credential not found (filename:
> > >>>>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> > >>>>>>>>>> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
> > >>>>>>>>>> test-service/localhost@TEST.COM with result:
> > >>>>>>>>>> -1765328243/Matching credential not found (filename:
> > >>>>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> > >>>>>>>>>> [15538] 1493491231.918229: Server has referral realm;
> > >>>>>>>>>> starting with test-service/localhost@TEST.COM [15538]
> 1493491231.918278:
> > >>>>>>>>>> Retrieving drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> from FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>>> with
> > result:
> > >>>>>>>>>> 0/Success
> > >>>>>>>>>> [15538] 1493491231.918281: Starting with TGT for client realm:
> > >>>>>>>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
> > >>>>>>>>>> 1493491231.918301: Requesting tickets for
> > >>>>>>>>>> test-service/localhost@TEST.COM, referrals on [15538]
> > >>>>>>>>>> 1493491231.918326: Generated subkey for TGS request:
> > >>>>>>>>>> aes128-cts/FA30
> > >>>>>>>>>> [15538] 1493491231.918359: etypes requested in TGS request:
> > >>>>>>>>>> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2,
> > >>>>>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
> > >>>>>>>>>> [15538]
> > >>>>>> 1493491231.918484:
> > >>>>>>>>>> Encoding request body and padata into FAST request [15538]
> > >>>>>>>>>> 1493491231.918541: Sending request (836 bytes) to TEST.COM
> > >>>>>>>>>> [15538]
> > >>>>>>>>>> 1493491231.918597: Resolving hostname localhost [15538]
> > >>>>>>>>>> 1493491231.918703: Initiating TCP connection to stream
> > >>>>>>>>>> 127.0.0.1:44292
> > >>>>>>>>>> [15538] 1493491231.918777: Sending TCP request to stream
> > >>>>>>>>>> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error
> > >>>>>>>>>> receiving from stream
> > >>>>>>>>>> 127.0.0.1:44292: 104/Connection reset by peer [15538]
> > >>>>>>>>>> 1493491231.922812: Terminating TCP connection to stream
> > >>>>>>>>>> 127.0.0.1:44292
> > >>>>>>>>>> [15538] 1493491231.922858: Sending initial UDP request to
> > >>>>>>>>>> dgram
> > >>>>>>>>>> 127.0.0.1:44292
> > >>>>>>>>>> ('First kerberos.authGSSClientStep not successful',
> > >>>>>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide
> > >>>>>>>>>> more information', 851968), ("Cannot contact any KDC for
> > >>>>>>>>>> realm 'TEST.COM'",
> > >>>>>>>>>> -1765328228)))
> > >>>>>>>>>>
> > >>>>>>>>>> 2. For the terminal that runs mvn clean test
> > >>>>>>>>>> -Dtest=MitIssueTest Running
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > >>>>>>>>>> 2017-04-29 21:07:39,182 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> initialize called
> > >>>>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> getIdentity called, principalName =
> > >>>>>>>>>> krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> getIdentity failed, principalName =
> > >>>>>>>>>> krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> addIdentity successful, principalName =
> > >>>>>>>>>> krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> getIdentity called, principalName =
> > >>>>>>>>>> kadmin/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> getIdentity failed, principalName =
> > >>>>>>>>>> kadmin/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,213 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> addIdentity successful, principalName =
> > >>>>>>>>>> kadmin/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,216 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> start called
> > >>>>>>>>>> 2017-04-29 21:07:39,232 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> addIdentity successful, principalName =
> > >>>>>>>>>> test-service/localhost@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,425 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> addIdentity successful, principalName = drankye@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1]
> > >>>>> request.KdcRequest:
> > >>>>>>>>>> Client entry is empty.
> > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = drankye@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = drankye@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > >>>>>>>>>> occurred, disconnecting abnormally java.io.EOFException
> > >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:
> 392)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > >>>>>>>>>> r.ru
> > >>>>>>>>>> n(
> > >>>>>>>> DefaultKdcHandler.java:46)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > >>>>>>>> ThreadPoolExecutor.java:1142)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > >>>>>>>> ThreadPoolExecutor.java:617)
> > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > >>>>>>>>>> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase:
> > >>>>>>>>>> Storing the tgt to the credential cache file.
> > >>>>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> getIdentity called, principalName =
> > >>>>>>>>>> test-service/localhost@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> getIdentity successful, principalName =
> > >>>>>>>>>> test-service/localhost@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1]
> > >>>>> request.KdcRequest:
> > >>>>>>>>>> Client entry is empty.
> > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1]
> > >>>>> request.KdcRequest:
> > >>>>>>>>>> The preauth data is empty.
> > >>>>>>>>>> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1]
> > server.KdcHandler:
> > >>>>>>>>>> KRB error occurred while processing request:Additional
> > >>>>>>>>>> pre-authentication required
> > >>>>>>>>>> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > >>>>>>>>>> occurred, disconnecting abnormally java.io.EOFException
> > >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:
> 392)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > >>>>>>>>>> r.ru
> > >>>>>>>>>> n(
> > >>>>>>>> DefaultKdcHandler.java:46)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > >>>>>>>> ThreadPoolExecutor.java:1142)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > >>>>>>>> ThreadPoolExecutor.java:617)
> > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > >>>>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1]
> > >>>>> request.KdcRequest:
> > >>>>>>>>>> Client entry is empty.
> > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > >>>>>>>>>> occurred, disconnecting abnormally java.io.EOFException
> > >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:
> 392)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > >>>>>>>>>> r.ru
> > >>>>>>>>>> n(
> > >>>>>>>> DefaultKdcHandler.java:46)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > >>>>>>>> ThreadPoolExecutor.java:1142)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > >>>>>>>> ThreadPoolExecutor.java:617)
> > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > >>>>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1]
> > >>>>> request.KdcRequest:
> > >>>>>>>>>> Found fast padata and start to process it.
> > >>>>>>>>>> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
> > >>>>>>>>>> impl.DefaultKdcHandler: Error occured while processing
> request:
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
> > >>>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> > >>>>>>>> java:85)
> > >>>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> > >>>>>>>> java:70)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kd
> > >>>>>>>>>> cFin
> > >>>>>>>>>> dF
> > >>>>>>>>>> as
> > >>>>>>>>>> t(
> > >>>>>>>> KdcRequest.java:208)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.
> > >>>>>>>> KdcRequest.process(KdcRequest.java:168)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
> > >>>>>>>> handleMessage(KdcHandler.java:115)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
> > >>>>>>>> handleMessage(DefaultKdcHandler.java:67)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > >>>>>>>>>> r.ru
> > >>>>>>>>>> n(
> > >>>>>>>> DefaultKdcHandler.java:52)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > >>>>>>>> ThreadPoolExecutor.java:1142)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > >>>>>>>> ThreadPoolExecutor.java:617)
> > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > >>>>>>>>>> Caused by: java.io.IOException: Unexpected item context [0]
> > >>>>>>>>>> [tag=0xA0, off=0, len=3+207], expecting 0x30
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > >>>>>>>> Asn1Encodeable.java:210)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > >>>>>>>> Asn1Encodeable.java:197)
> > >>>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> > >>>>>>>> java:83)
> > >>>>>>>>>> ... 9 more
> > >>>>>>>>>> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > >>>>>>>>>> occurred, disconnecting abnormally
> > >>>>>>>>>> java.net.SocketException: Socket closed
> > >>>>>>>>>> at java.net.SocketInputStream.socketRead0(Native Method)
> > >>>>>>>>>> at java.net.SocketInputStream.socketRead(SocketInputStream.
> > >>>>>>>> java:116)
> > >>>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
> > >>>>> 171)
> > >>>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
> > >>>>> 141)
> > >>>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
> > >>>>> 224)
> > >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:
> 387)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > >>>>>>>>>> r.ru
> > >>>>>>>>>> n(
> > >>>>>>>> DefaultKdcHandler.java:46)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > >>>>>>>> ThreadPoolExecutor.java:1142)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > >>>>>>>> ThreadPoolExecutor.java:617)
> > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > >>>>>>>>>>
> > >>>>>>>>>> In a FreeIPA environment these python lines "just" work.
> > >>>>>>>>>>
> > >>>>>>>>>> Any suggestions are welcome!
> > >>>>>>>>>>
> > >>>>>>>>>> Marc
> > >>>>>>>>>>
> > >>>>>>>>>>
> > >>>>>>>>> --
> > >>>>>>>>> Marc de Lignie
> > >>>>>>>>>
> > >>>>>>>>
> > >>>>>>>> --
> > >>>>>>>> Marc de Lignie
> > >>>>>>>>
> > >>>>>>>>
> > >>>>>>>
> > >>>>>>>
> > >>>>>>> --
> > >>>>>>> Colm O hEigeartaigh
> > >>>>>>>
> > >>>>>>> Talend Community Coder
> > >>>>>>> http://coders.talend.com
> > >>>>>>>
> > >>>>>>
> > >>>>>>
> > >>>>>>
> > >>>>>> --
> > >>>>>> Colm O hEigeartaigh
> > >>>>>>
> > >>>>>> Talend Community Coder
> > >>>>>> http://coders.talend.com
> > >>>>>>
> > >>>>>
> > >>>>>
> > >>>>>
> > >>>>> --
> > >>>>> Colm O hEigeartaigh
> > >>>>>
> > >>>>> Talend Community Coder
> > >>>>> http://coders.talend.com
> > >>>>>
> > >>>>
> > >>>>
> > >>>>
> > >>>> --
> > >>>> Colm O hEigeartaigh
> > >>>>
> > >>>> Talend Community Coder
> > >>>> http://coders.talend.com
> > >>>
> > >>>
> > >>
> > >>
> > >> --
> > >> Colm O hEigeartaigh
> > >>
> > >> Talend Community Coder
> > >> http://coders.talend.com
> >
>
>
>
> --
> Colm O hEigeartaigh
>
> Talend Community Coder
> http://coders.talend.com
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
Re: MIT Kerberos compatibility
Posted by Colm O hEigeartaigh <co...@apache.org>.
Hi Kai,
No I don't think so, that was the last networking issue that I had iirc.
Colm.
On Mon, Jun 19, 2017 at 10:25 AM, Zheng, Kai <ka...@intel.com> wrote:
> This sounds great. IIRC, you have another TCP/UDP network related issue to
> be fixed yet? Maybe we fix it as well to justify a new minor release.
>
> Regards,
> Kai
>
> -----Original Message-----
> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> Sent: Monday, June 19, 2017 4:45 PM
> To: kerby@directory.apache.org
> Subject: Re: MIT Kerberos compatibility
>
> Yes, it works perfectly, thanks Jiajia for the fix! I'll resolve the JIRA.
>
> Colm.
>
> On Mon, Jun 19, 2017 at 6:09 AM, Li, Jiajia <ji...@intel.com> wrote:
>
> > Hi Colm,
> > Thanks for providing the way to reproduce the error, and I have the fix
> in
> > trunk code, can you take some time to check it?
> >
> > Commit log:
> > commit 106299efb7aa3001da89ae821eb43285c544bab7
> > Author: plusplusjiajia <ji...@intel.com>
> > Date: Mon Jun 19 13:07:04 2017 +0800
> >
> > Fix DIRKRB-629:ICMP Port Unreachable error message with GSS + default
> > transport.
> >
> >
> > Thanks
> > Jiajia
> >
> > -----Original Message-----
> > From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > Sent: Monday, May 8, 2017 6:19 PM
> > To: kerby@directory.apache.org
> > Subject: Re: MIT Kerberos compatibility
> >
> > OK I have created a JIRA and attached a patch that you have to apply to
> the
> > Apache WSS4J project to reproduce the error. If you uncomment the line
> that
> > uses Netty then the tests all work perfectly. The tests appear to work
> fine
> > when run in isolation, it's only when you run a few of them after one
> > another that you can see the failures.
> >
> > Please let me know if you have any difficulty in reproducing, thanks!
> >
> > Colm.
> >
> > On Mon, May 8, 2017 at 11:08 AM, Zheng, Kai <ka...@intel.com> wrote:
> >
> > > Hi Colm,
> > >
> > > Sure, please do it. Could you review my change and see how it would
> cause
> > > the new failures? Any difference between the failed GSS tests and the
> > Kerby
> > > GSS tests?
> > >
> > > Regards,
> > > Kai
> > >
> > > -----Original Message-----
> > > From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > > Sent: Monday, May 08, 2017 5:42 PM
> > > To: Zheng, Kai <ka...@intel.com>
> > > Cc: kerby@directory.apache.org
> > > Subject: Re: MIT Kerberos compatibility
> > >
> > > Hi Kai,
> > >
> > > Your changes fixed the error message I was seeing. However, I now see
> > > another problem when I run a few GSS client tests in a row:
> > >
> > > >>> EType: sun.security.krb5.internal.crypto.Aes128CtsHmacSha1EType
> > > >>> KrbAsReq creating message
> > > >>> KrbKdcReq send: kdc=localhost UDP:42665, timeout=30000, number of
> > > retries =3, #bytes=245
> > > >>> KDCCommunication: kdc=localhost UDP:42665, timeout=30000,Attempt
> =1,
> > > #bytes=245
> > > SocketTimeOutException with attempt: 1
> > > >>> KDCCommunication: kdc=localhost UDP:42665, timeout=30000,Attempt
> =2,
> > > #bytes=245
> > > >>> KrbKdcReq send: error trying localhost:42665
> > > java.net.PortUnreachableException: ICMP Port Unreachable
> > >
> > > Do you want me to create a JIRA + attach a test-case?
> > >
> > > Colm.
> > >
> > > On Sat, May 6, 2017 at 2:01 AM, Zheng, Kai <ka...@intel.com>
> wrote:
> > >
> > > > I haven't repeated the issue but revisited the codes again and made
> > > > improvements. Would you check it out? Thanks!
> > > >
> > > > Sent from iPhone
> > > >
> > > > > 在 2017年5月6日，上午6:28，Zheng, Kai <ka...@intel.com> 写道：
> > > > >
> > > > > Thanks colm for the clarification and it sounds an issue we need to
> > > > address. I will investigate it soon.
> > > > >
> > > > > Sent from iPhone
> > > > >
> > > > >> 在 2017年5月6日，上午2:14，Colm O hEigeartaigh <co...@apache.org> 写道：
> > > > >>
> > > > >> Hi Kai,
> > > > >>
> > > > >> If I enable UDP with the default Transport, I can get a ticket
> fine
> > > > using
> > > > >> kinit. However then the following error pops up in the window I'm
> > > > running
> > > > >> Kerby in (as a test):
> > > > >>
> > > > >> Exception in thread "Thread-1" java.lang.RuntimeException: Error
> > > > >> occured while checking udp connections
> > > > >> at
> > > > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > > KdcNetwork.java:105)
> > > > >> at
> > > > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > > access$000(KdcNetwork.java:39)
> > > > >> at
> > > > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > > > run(KdcNetwork.java:75)
> > > > >> at java.lang.Thread.run(Thread.java:748)
> > > > >> Caused by: java.nio.channels.ClosedChannelException
> > > > >> at
> > > > >> sun.nio.ch.DatagramChannelImpl.ensureOpen(
> > > DatagramChannelImpl.java:320)
> > > > >> at sun.nio.ch.DatagramChannelImpl.receive(
> > > > DatagramChannelImpl.java:331)
> > > > >> at
> > > > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > > checkUdpMessage(KdcNetwork.java:132)
> > > > >> at
> > > > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > > KdcNetwork.java:101)
> > > > >>
> > > > >> Colm.
> > > > >>
> > > > >>
> > > > >>> On Fri, May 5, 2017 at 5:56 PM, Zheng, Kai <ka...@intel.com>
> > > > wrote:
> > > > >>>
> > > > >>> Colm, did you see udp problem now instead? I'm a little confused.
> > > > >>> Udp
> > > > is
> > > > >>> sure supported but may not be enabled by default, which should be
> > > > >>> okay, imo. Thanks.
> > > > >>>
> > > > >>> Sent from iPhone
> > > > >>>
> > > > >>>> 在 2017年5月6日，上午12:02，Colm O hEigeartaigh <co...@apache.org>
> 写道：
> > > > >>>>
> > > > >>>> That's probably it. Why does the default transport not support
> > > > >>>> UDP in
> > > > >>> Kerby?
> > > > >>>>
> > > > >>>> Colm.
> > > > >>>>
> > > > >>>>> On Fri, May 5, 2017 at 4:54 PM, Li, Jiajia <
> jiajia.li@intel.com>
> > > > wrote:
> > > > >>>>>
> > > > >>>>> Are you sure add kdc_allow_udp = false in kdc.conf?
> > > > >>>>>
> > > > >>>>> Thanks
> > > > >>>>> Jiajia
> > > > >>>>>
> > > > >>>>> -----Original Message-----
> > > > >>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > > > >>>>> Sent: Friday, May 5, 2017 11:41 PM
> > > > >>>>> To: Li, Jiajia <ji...@intel.com>
> > > > >>>>> Cc: kerby@directory.apache.org; Zheng, Kai
> > > > >>>>> <ka...@intel.com>;
> > > > >>> mailto:
> > > > >>>>> m.c.delignie@xs4all.nl <m....@xs4all.nl>
> > > > >>>>> Subject: Re: MIT Kerberos compatibility
> > > > >>>>>
> > > > >>>>> Sorry, it was my error, UDP was actually enabled there. But why
> > > > >>>>> am I
> > > > >>> still
> > > > >>>>> seeing that error message?
> > > > >>>>>
> > > > >>>>> Colm.
> > > > >>>>>
> > > > >>>>>> On Fri, May 5, 2017 at 4:39 PM, Li, Jiajia
> > > > >>>>>> <ji...@intel.com>
> > > > >>> wrote:
> > > > >>>>>>
> > > > >>>>>> Hi Colm,
> > > > >>>>>> I also test the Kerby KDC with kerby kint and MIT kinit, and
> > > > >>>>>> only listen the tcp port(disable udp), both got ticket
> > > > >>>>>> successfully. But
> > > > I
> > > > >>>>>> don't get the error message. Both krb.conf and kdc.conf should
> > > > >>>>>> set
> > > > udp
> > > > >>>>>> to be false, udp is enabled in default.
> > > > >>>>>>
> > > > >>>>>> Thanks
> > > > >>>>>> Jiajia
> > > > >>>>>>
> > > > >>>>>> -----Original Message-----
> > > > >>>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > > > >>>>>> Sent: Friday, May 5, 2017 11:34 PM
> > > > >>>>>> To: kerby@directory.apache.org
> > > > >>>>>> Cc: Zheng, Kai <ka...@intel.com>;
> > > > >>>>>> mailto:m.c.delignie@xs4all.nl
> > > > <
> > > > >>>>>> m.c.delignie@xs4all.nl>
> > > > >>>>>> Subject: Re: MIT Kerberos compatibility
> > > > >>>>>>
> > > > >>>>>> Hi Jiajia,
> > > > >>>>>>
> > > > >>>>>> If UDP is disabled and we don't use Netty, I can get a token
> > > > >>>>>> successfully via kinit. However I then see an error message in
> > > > >>>>>> the
> > > > >>> Kerby
> > > > >>>>> console:
> > > > >>>>>>
> > > > >>>>>> Exception in thread "Thread-1" java.lang.RuntimeException:
> > > > >>>>>> Error occured while checking udp connections at
> > > > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > > >>>>>> KdcNetwork.java:105)
> > > > >>>>>> at
> > > > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > > >>>>>> access$000(KdcNetwork.java:39)
> > > > >>>>>> at
> > > > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > > > >>>>>> run(KdcNetwork.java:75)
> > > > >>>>>> at java.lang.Thread.run(Thread.java:748)
> > > > >>>>>> Caused by: java.nio.channels.ClosedChannelException
> > > > >>>>>> at
> > > > >>>>>> sun.nio.ch.DatagramChannelImpl.ensureOpen(
> > > > >>> DatagramChannelImpl.java:320)
> > > > >>>>>> at sun.nio.ch.DatagramChannelImpl.receive(
> > > > >>>>>> DatagramChannelImpl.java:331)
> > > > >>>>>> at
> > > > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > > >>>>>> checkUdpMessage(KdcNetwork.java:132)
> > > > >>>>>> at
> > > > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > > >>>>>> KdcNetwork.java:101)
> > > > >>>>>>
> > > > >>>>>> I'm not sure why we are seeing UDP errors when it's disabled?
> > > > >>>>>>
> > > > >>>>>> Colm.
> > > > >>>>>>
> > > > >>>>>>> On Fri, May 5, 2017 at 3:57 PM, Li, Jiajia
> > > > >>>>>>> <ji...@intel.com>
> > > > >>> wrote:
> > > > >>>>>>>
> > > > >>>>>>> Hi Colm,
> > > > >>>>>>> The shell client can't connect to kdc if the UDP is disabled.
> > > > >>>>>>> We don't use Netty in default.
> > > > >>>>>>> What's your test-cases? The same as the Marc's?
> > > > >>>>>>>
> > > > >>>>>>> Thanks
> > > > >>>>>>> Jiajia
> > > > >>>>>>>
> > > > >>>>>>> -----Original Message-----
> > > > >>>>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > > > >>>>>>> Sent: Friday, May 5, 2017 10:09 PM
> > > > >>>>>>> To: kerby@directory.apache.org
> > > > >>>>>>> Cc: Zheng, Kai <ka...@intel.com>; mailto:
> > > > m.c.delignie@xs4all.nl
> > > > >>>>>>> < m.c.delignie@xs4all.nl>
> > > > >>>>>>> Subject: Re: MIT Kerberos compatibility
> > > > >>>>>>>
> > > > >>>>>>> Hi Jiajia,
> > > > >>>>>>>
> > > > >>>>>>> What are the issues if UDP is disabled and we don't use
> Netty?
> > > > >>>>>>> I tried doing this with my own test-cases and it didn't work,
> > > > >>>>>>> so it would be good to get this fixed soon.
> > > > >>>>>>>
> > > > >>>>>>> Colm.
> > > > >>>>>>>
> > > > >>>>>>> On Fri, May 5, 2017 at 2:46 PM, Li, Jiajia
> > > > >>>>>>> <ji...@intel.com>
> > > > >>>>> wrote:
> > > > >>>>>>>
> > > > >>>>>>>> Hi Marc,
> > > > >>>>>>>>>>> - your KRB5 tracing looks quite different. What OS and
> > > > >>>>>>>>>>> mit-kerberos
> > > > >>>>>>>> version did you use?
> > > > >>>>>>>> I use mac os and the python version is 2.7.10
> > > > >>>>>>>>
> > > > >>>>>>>>>>> - your KRB5 tracing shows UDP comms between kerberos
> > > > >>>>>>>>>>> client and KDC,
> > > > >>>>>>>> despite the allowUDP = false setting
> > > > >>>>>>>>>>> in my test. I did this setting because I get different
> > > > >>>>>>>>>>> problems
> > > > >>>>>>>> without it, see the additional logs below. So,
> > > > >>>>>>>>>>> we must also be aware of networking problems at my side.
> > > > >>>>>>>> I enable the UDP and use netty network, there are some
> issues
> > > > >>>>>>>> if UDP disabled, you can create a JIRA for this and we can
> > > > >>>>>>>> fix this issue in the next release version.
> > > > >>>>>>>>
> > > > >>>>>>>> The changes in my side as following:
> > > > >>>>>>>>
> > > > >>>>>>>> protected boolean allowUdp() { return true; } @Override
> > > > >>>>>>>> protected void prepareKdc() throws KrbException {
> > > > >>>>>>>> getKdcServer().setInnerKdcImpl(
> > > > >>>>>>>> new
> > > > >>>>>>>> NettyKdcServerImpl(getKdcServer().getKdcSetting()));
> > > > >>>>>>>> super.prepareKdc();
> > > > >>>>>>>> }
> > > > >>>>>>>>
> > > > >>>>>>>> Here is log of MitIssueTest:
> > > > >>>>>>>> [INFO] Running
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > > > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > > > >>>>>>>> io.netty.handler.logging.LoggingHandler
> > > > >>>>>>>> -
> > > > >>>>>>>> [id: 0x2634fe6b] REGISTERED
> > > > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > > > >>>>>>>> io.netty.handler.logging.LoggingHandler
> > > > >>>>>>>> -
> > > > >>>>>>>> [id: 0x2634fe6b] BIND(0.0.0.0/0.0.0.0:53957)
> > > > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > > > >>>>>>>> io.netty.handler.logging.LoggingHandler -
> > > > >>>>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] ACTIVE [main] INFO
> > > > >>>>>>>> org.apache.kerby.kerberos.kdc.impl.NettyKdcServerImpl -
> Netty
> > > > >>>>>>>> kdc server started.
> > > > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > > > >>>>>>>> io.netty.handler.logging.LoggingHandler
> > > > >>>>>>>> -
> > > > >>>>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] RECEIVED: [id:
> > > > >>>>>>>> 0xdac7228b, /
> > > > >>>>>>>> 127.0.0.1:53961 => /127.0.0.1:53957]
> > > > >>>>>>>> [defaultEventExecutorGroup-4-1] INFO
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
> > > > >>>>>>>> - AS_REQ ISSUE: authtime 1493991123792,drankye@TEST.COM for
> > > > >>>>>>>> krbtgt/ TEST.COM@TEST.COM [main] INFO
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> > > > DefaultInternalKrbClien
> > > > >>>>>>>> t
> > > > >>>>>>>> - Send to kdc success.
> > > > >>>>>>>> [main] INFO
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.client.KrbClientBase -
> Storing
> > > the tgt to the credential cache file.
> > > > >>>>>>>> [nioEventLoopGroup-5-1] INFO
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> > > > >>>>>>>> - The preauth data is empty.
> > > > >>>>>>>> [nioEventLoopGroup-5-1] INFO
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> > > > >>>>>>>> - KRB error occurred while processing request:Additional
> > > > >>>>>>>> pre-authentication required [nioEventLoopGroup-5-1] INFO
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
> > > > >>>>>>>> - AS_REQ ISSUE: authtime
> > > > >>>>>>>> 1493991123859,test-service/localhost@TEST.COM
> > > > >>>>>>>> for krbtgt/TEST.COM@TEST.COM
> > > > >>>>>>>> [nioEventLoopGroup-5-1] INFO
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.TgsRequest
> > > > >>>>>>>> - TGS_REQ ISSUE: authtime 1493991142850,drankye for
> > > > >>>>>>>> test-service/ localhost@TEST.COM
> > > > >>>>>>>>
> > > > >>>>>>>> Thanks
> > > > >>>>>>>> Jiajia
> > > > >>>>>>>>
> > > > >>>>>>>> -----Original Message-----
> > > > >>>>>>>> From: Zheng, Kai
> > > > >>>>>>>> Sent: Friday, May 5, 2017 7:46 PM
> > > > >>>>>>>> To: kerby@directory.apache.org; Li, Jiajia
> > > > >>>>>>>> <ji...@intel.com>
> > > > >>>>>>>> Subject: RE: MIT Kerberos compatibility
> > > > >>>>>>>>
> > > > >>>>>>>> Hi Marc,
> > > > >>>>>>>>
> > > > >>>>>>>> Looks like this is quite environment related, could you fire
> > > > >>>>>>>> an issue for this? I would suggest we target it to 1.1.0,
> > > > >>>>>>>> which can be done in
> > > > >>>>>>> June.
> > > > >>>>>>>>
> > > > >>>>>>>> Regards,
> > > > >>>>>>>> Kai
> > > > >>>>>>>>
> > > > >>>>>>>> -----Original Message-----
> > > > >>>>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> > > > >>>>>>>> Sent: Friday, May 05, 2017 4:44 PM
> > > > >>>>>>>> To: Li, Jiajia <ji...@intel.com>
> > > > >>>>>>>> Cc: kerby@directory.apache.org
> > > > >>>>>>>> Subject: Re: MIT Kerberos compatibility
> > > > >>>>>>>>
> > > > >>>>>>>> Hi Jiajia,
> > > > >>>>>>>>
> > > > >>>>>>>> Great to read that you made progress on this issue and to
> see
> > > > >>>>>>>> a working config at your side. Below, I list my progress
> > > > >>>>>>>> below (with trunk merged into my MitIssue branch), but I am
> > > > >>>>>>>> afraid we are not done
> > > > >>>>>>> yet.
> > > > >>>>>>>>
> > > > >>>>>>>> Things that stand out:
> > > > >>>>>>>>
> > > > >>>>>>>> - the kdc decoding error is solved, relative to the logs
> > > > >>>>>>>> without your patch
> > > > >>>>>>>>
> > > > >>>>>>>> - your KRB5 tracing looks quite different. What OS and
> > > > >>>>>>>> mit-kerberos version did you use?
> > > > >>>>>>>>
> > > > >>>>>>>> - your KRB5 tracing shows UDP comms between kerberos client
> > > > >>>>>>>> and KDC, despite the allowUDP = false setting in my test. I
> > > > >>>>>>>> did this setting because I get different problems without
> it,
> > > > >>>>>>>> see the additional logs below. So, we must also be aware of
> > > > >>>>>>>> networking
> > > > >>>>> problems at my side.
> > > > >>>>>>>>
> > > > >>>>>>>> - the "Response was not from master KDC" msg is not
> relevant;
> > > > >>>>>>>> it disappears if you manually add master_kdc to the realms
> > > > >>>>>>>> section of the krb5.conf
> > > > >>>>>>>>
> > > > >>>>>>>> I have no idea how to proceed from here, so that is why I
> > > > >>>>>>>> just document the status at my side and ask about your -
> > > > >>>>>>>> apparently working -
> > > > >>>>>>> config.
> > > > >>>>>>>>
> > > > >>>>>>>> Cheers, Marc
> > > > >>>>>>>>
> > > > >>>>>>>>
> > > > >>>>>>>> KDC logging with allowUDP = false:
> > > > >>>>>>>>
> > > > >>>>>>>> [INFO] Running
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > > > >>>>>>>> [pool-1-thread-1] INFO
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > > > >>>>>>>> AS_REQ
> > > > >>>>>> ISSUE:
> > > > >>>>>>>> authtime 1493970789075,drankye@TEST.COM for
> > > > >>>>>>>> krbtgt/TEST.COM@TEST.COM [main] INFO
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> > > > DefaultInternalKrbClien
> > > > >>>>>>>> t
> > > > >>>>>>>> - Send to kdc success.
> > > > >>>>>>>> [main] INFO
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.client.KrbClientBase -
> Storing
> > > the tgt to the credential cache file.
> > > > >>>>>>>> [pool-1-thread-1] INFO
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest -
> > > > >>>>>>>> The preauth data is empty.
> > > > >>>>>>>> [pool-1-thread-1] INFO
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> > > > >>>>>>>> - KRB error occurred while processing request:Additional
> > > > >>>>>>>> pre-authentication required [pool-1-thread-1] INFO
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > > > >>>>>>>> AS_REQ
> > > > >>>>>> ISSUE:
> > > > >>>>>>>> authtime 1493970789108,test-service/localhost@TEST.COM for
> > > > krbtgt/
> > > > >>>>>>>> TEST.COM@TEST.COM [pool-1-thread-1] INFO
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> > > > >>>>>>>> - Found fast padata and starting to process it.
> > > > >>>>>>>> [pool-1-thread-1] INFO
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest -
> > > > >>>>>>>> Found fast padata and starting to process it.
> > > > >>>>>>>>
> > > > >>>>>>>> Python script KRB5 tracing (MIT Kerberos 1.13.2 of Ubuntu
> > > > >>>>>>>> Xenial) with allowUDP = false:
> > > > >>>>>>>>
> > > > >>>>>>>> $ .
> > > > >>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/
> > > > >>>>>>>> kerberos/kerb/server/MitIssueTest.sh
> > > > >>>>>>>> [25281] 1493970797.298753: Retrieving drankye@TEST.COM from
> > > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > > >>>>>>>> with
> > > > >>>>> result:
> > > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > > >>>>>>>> found [25281]
> > > > >>>>>>>> 1493970797.298952: Retrieving drankye@TEST.COM from
> > > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > > >>>>>>>> with
> > > > >>>>> result:
> > > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > > >>>>>>>> found [25281]
> > > > >>>>>>>> 1493970797.299106: Retrieving drankye@TEST.COM from
> > > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > > >>>>>>>> with
> > > > >>>>> result:
> > > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > > >>>>>>>> found [25281]
> > > > >>>>>>>> 1493970797.299213: Retrieving drankye@TEST.COM from
> > > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > > >>>>>>>> with
> > > > >>>>> result:
> > > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > > >>>>>>>> found [25281]
> > > > >>>>>>>> 1493970797.299323: Retrieving drankye@TEST.COM from
> > > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > > >>>>>>>> with
> > > > >>>>> result:
> > > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > > >>>>>>>> found [25281]
> > > > >>>>>>>> 1493970797.299436: Retrieving drankye@TEST.COM from
> > > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > > >>>>>>>> with
> > > > >>>>> result:
> > > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > > >>>>>>>> found [25281]
> > > > >>>>>>>> 1493970797.299545: Retrieving drankye@TEST.COM from
> > > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > > >>>>>>>> with
> > > > >>>>> result:
> > > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > > >>>>>>>> found [25281]
> > > > >>>>>>>> 1493970797.299654: Retrieving drankye@TEST.COM from
> > > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > > >>>>>>>> with
> > > > >>>>> result:
> > > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > > >>>>>>>> found kerberos.authGSSClientInit successful [25281]
> > > 1493970797.299922:
> > > > >>>>>>>> Getting credentials drankye@TEST.COM ->
> > > > >>>>>>>> test-service/localhost@ using ccache
> > > > >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > >>>>>>>> [25281] 1493970797.299945: Retrieving drankye@TEST.COM ->
> > > > >>>>>>>> test-service/localhost@ from
> > > > >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > >>>>>>>> with result:
> > > > >>>>>>>> -1765328243/Matching credential not found [25281]
> > > > 1493970797.299959:
> > > > >>>>>>>> Retrying drankye@TEST.COM -> test-service/localhost@TEST.
> COM
> > > > >>>>>>>> with
> > > > >>>>>>> result:
> > > > >>>>>>>> -1765328243/Matching credential not found [25281]
> > > > 1493970797.299962:
> > > > >>>>>>>> Server has referral realm; starting with
> > > > >>>>>>>> test-service/localhost@TEST.COM [25281]
> > > > >>>>>>>> 1493970797.299975: Retrieving drankye@TEST.COM ->
> > > > >>>>>>>> krbtgt/TEST.COM@TEST.COM from
> > > > >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > >>>>>>> with result:
> > > > >>>>>>>> 0/Success [25281] 1493970797.299979: Starting with TGT for
> > > > >>>>>>>> client
> > > > >>>>>> realm:
> > > > >>>>>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [25281]
> > > > >>>>>> 1493970797.299981:
> > > > >>>>>>>> Requesting tickets for test-service/localhost@TEST.COM,
> > > > >>>>>>>> referrals on [25281] 1493970797.299994: Generated subkey for
> > > TGS request:
> > > > >>>>>>>> aes128-cts/1B9B [25281] 1493970797.300009: etypes requested
> > > > >>>>>>>> in TGS
> > > > >>>>>>> request:
> > > > >>>>>>>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac,
> > > > >>>>>>>> camellia128-cts, camellia256-cts [25281] 1493970797.300054:
> > > > >>>>>>>> Encoding request body and padata into FAST request [25281]
> > > > >>>>>>>> 1493970797.300080: Sending request
> > > > >>>>>>>> (823 bytes) to TEST.COM [25281] 1493970797.300091:
> Resolving
> > > > >>>>>>>> hostname localhost [25281]
> > > > >>>>>>>> 1493970797.300136: Initiating TCP connection to stream
> > > > >>>>>>>> 127.0.0.1:34319
> > > > >>>>>>>> [25281] 1493970797.300191: Sending TCP request to stream
> > > > >>>>>>>> 127.0.0.1:34319 [25281] 1493970797.303610: Received answer
> > > > >>>>>>>> (125
> > > > >>>>>>>> bytes) from stream
> > > > >>>>>>>> 127.0.0.1:34319
> > > > >>>>>>>> [25281] 1493970797.303618: Terminating TCP connection to
> > > > >>>>>>>> stream
> > > > >>>>>>>> 127.0.0.1:34319
> > > > >>>>>>>> [25281] 1493970797.553126: Response was not from master KDC
> > > > >>>>>>>> [25281]
> > > > >>>>>>>> 1493970797.553198: TGS request result: -1765323383/Unknown
> > > > >>>>>>>> code krcM
> > > > >>>>>>>> 137 [25281] 1493970797.553234: Requesting tickets for
> > > > >>>>>>>> test-service/ localhost@TEST.COM, referrals off [25281]
> > > > >>>>> 1493970797.553273:
> > > > >>>>>>>> Generated subkey for TGS request: aes128-cts/94C6 [25281]
> > > > >>>>>> 1493970797.553323:
> > > > >>>>>>>> etypes requested in TGS request: aes256-cts, aes128-cts,
> > > > >>>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
> > > > >>>>>>>> [25281]
> > > > >>>>>>>> 1493970797.553436: Encoding request body and padata into
> FAST
> > > > >>>>>>>> request
> > > > >>>>>>> [25281] 1493970797.553532:
> > > > >>>>>>>> Sending request (823 bytes) to TEST.COM [25281]
> > > > 1493970797.553567:
> > > > >>>>>>>> Resolving hostname localhost [25281] 1493970797.553745:
> > > > >>>>>>>> Initiating TCP connection to stream
> > > > >>>>>>>> 127.0.0.1:34319
> > > > >>>>>>>> [25281] 1493970797.553889: Sending TCP request to stream
> > > > >>>>>>>> 127.0.0.1:34319 [25281] 1493970797.558297: Received answer
> > > > >>>>>>>> (125
> > > > >>>>>>>> bytes) from stream
> > > > >>>>>>>> 127.0.0.1:34319
> > > > >>>>>>>> [25281] 1493970797.558318: Terminating TCP connection to
> > > > >>>>>>>> stream
> > > > >>>>>>>> 127.0.0.1:34319
> > > > >>>>>>>> [25281] 1493970797.561189: Response was not from master KDC
> > > > >>>>>>>> [25281]
> > > > >>>>>>>> 1493970797.561258: TGS request result: -1765323383/Unknown
> > > > >>>>>>>> code krcM
> > > > >>>>>>>> 137 ('First kerberos.authGSSClientStep not successful',
> > > > >>>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide
> > > > >>>>>>>> more information', 851968), ('Unknown code krcM 137',
> > > > >>>>>>>> -1765323383)))
> > > > >>>>>>>>
> > > > >>>>>>>>
> > > > >>>>>>>> KDC logging with allowUDP = true:
> > > > >>>>>>>>
> > > > >>>>>>>> [INFO] Running
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > > > >>>>>>>> [pool-1-thread-1] INFO
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > > > >>>>>>>> AS_REQ
> > > > >>>>>> ISSUE:
> > > > >>>>>>>> authtime 1493972505784,drankye@TEST.COM for
> > > > >>>>>>>> krbtgt/TEST.COM@TEST.COM [main] INFO
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> > > > DefaultInternalKrbClien
> > > > >>>>>>>> t
> > > > >>>>>>>> - Send to kdc success.
> > > > >>>>>>>> [main] INFO
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.client.KrbClientBase -
> Storing
> > > the tgt to the credential cache file.
> > > > >>>>>>>> [pool-1-thread-1] INFO
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest -
> > > > >>>>>>>> The preauth data is empty.
> > > > >>>>>>>> [pool-1-thread-1] INFO
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> > > > >>>>>>>> - KRB error occurred while processing request:Additional
> > > > >>>>>>>> pre-authentication required [pool-1-thread-2] INFO
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > > > >>>>>>>> AS_REQ
> > > > >>>>>> ISSUE:
> > > > >>>>>>>> authtime 1493972505948,test-service/localhost@TEST.COM for
> > > > krbtgt/
> > > > >>>>>>>> TEST.COM@TEST.COM Exception in thread "Thread-0"
> > > > >>>>>>>> java.lang.RuntimeException: Error occured while checking udp
> > > > >>>>>> connections
> > > > >>>>>>>> at
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > > >>>>>>>> KdcNetwork.java:105)
> > > > >>>>>>>> at
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > > >>>>>>>> access$000(KdcNetwork.java:39)
> > > > >>>>>>>> at
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > > > >>>>>>>> run(KdcNetwork.java:75)
> > > > >>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > > > >>>>>>>> Caused by: java.nio.channels.ClosedChannelException
> > > > >>>>>>>> at
> > > > >>>>>>>> sun.nio.ch.DatagramChannelImpl.ensureOpen(
> > > > >>>>>> DatagramChannelImpl.java:320)
> > > > >>>>>>>> at sun.nio.ch.DatagramChannelImpl.receive(
> > > > >>>>>>>> DatagramChannelImpl.java:331)
> > > > >>>>>>>> at
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > > >>>>>>>> checkUdpMessage(KdcNetwork.java:132)
> > > > >>>>>>>> at
> > > > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > > >>>>>>>> KdcNetwork.java:101)
> > > > >>>>>>>> ... 3 more
> > > > >>>>>>>>
> > > > >>>>>>>>
> > > > >>>>>>>> krb5.conf:
> > > > >>>>>>>>
> > > > >>>>>>>> [libdefaults]
> > > > >>>>>>>> kdc_realm = TEST.COM
> > > > >>>>>>>> default_realm = TEST.COM
> > > > >>>>>>>> udp_preference_limit = 4096
> > > > >>>>>>>> kdc_tcp_port = 37080
> > > > >>>>>>>> kdc_udp_port = 36525
> > > > >>>>>>>>
> > > > >>>>>>>> [realms]
> > > > >>>>>>>> TEST.COM = {
> > > > >>>>>>>> kdc = localhost:36525
> > > > >>>>>>>> }
> > > > >>>>>>>>
> > > > >>>>>>>> And port 36525 does not show up in `netstat -l` (while 37080
> > > > >>>>>>>> does)
> > > > >>>>>>>>
> > > > >>>>>>>>
> > > > >>>>>>>> Op 04-05-17 om 14:55 schreef Li, Jiajia:
> > > > >>>>>>>>> Hi Marc,
> > > > >>>>>>>>> I try to run your test(through applying your patch in the
> > > > >>>>>>>>> trunk) , I
> > > > >>>>>>>> think it's success now. Could you take some time to check
> > > > >>>>>>>> about
> > > > it?
> > > > >>>>>>>>> Here is the log:
> > > > >>>>>>>>>
> > > > >>>>>>>>> directory-kerby git:(trunk) ? .
> > > > >>>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/
> kerb
> > > > >>>>>>>>> eros
> > > > >>>>>>>>> /k
> > > > >>>>>>>>> er
> > > > >>>>>>>>> b/
> > > > >>>>>>>>> server/MitIssueTest.sh
> > > > >>>>>>>>> kerberos.authGSSClientInit successful
> > > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: entypes not
> > > > >>>>>>>>> supported
> > > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > >>>>>>>>> credential for krb5_ccache_conf_data/realm-
> > config@X-CACHECONF:
> > > > >>>>>>>>> in cache
> > > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > >>>>>>>>> credential for test-service/localhost@TEST.COM in cache
> > > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > >>>>>>>>> credential for
> > > > >>>>>>>>> krb5_ccache_conf_data/negative-cache/test-service\
> 134/localh
> > > > >>>>>>>>> ost\
> > > > >>>>>>>>> 13
> > > > >>>>>>>>> 4@
> > > > >>>>>>>>> TE
> > > > >>>>>>>>> ST.COM@X-CACHECONF: in cache
> > > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > >>>>>>>>> credential for krb5_ccache_conf_data/lkdc-
> > hostname@X-CACHECONF
> > > :
> > > > >>>>>>>>> in cache
> > > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > >>>>>>>>> credential for krb5_ccache_conf_data/sitename@X-CACHECONF:
> > > > >>>>>>>>> in cache
> > > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > >>>>>>>>> credential for test-service/localhost@TEST.COM in cache
> > > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > > >>>>>>>>> des-cbc-md5-deprecated not supported
> > > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > > >>>>>>>>> des-cbc-md4-deprecated not supported
> > > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > > >>>>>>>>> des-cbc-crc-deprecated not supported
> > > > >>>>>>>>> 2017-05-04T20:44:06 Trying to find service kdc for realm
> > > > >>>>>>>>> TEST.COM flags 0
> > > > >>>>>>>>> 2017-05-04T20:44:06 configuration file for realm TEST.COM
> > > > >>>>>>>>> found
> > > > >>>>>>>>> 2017-05-04T20:44:06 submissing new requests to new host
> > > > >>>>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
> > > > >>>>>>>>> 2017-05-04T20:44:06 connecting to host: udp ::1:52534
> > > > >>>>>>>>> (localhost)
> > > > >>>>>> tid:
> > > > >>>>>>>>> 00000001
> > > > >>>>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
> > > > >>>>>>>>> 2017-05-04T20:44:06 Queuing host in future (in 3s), its the
> > > > >>>>>>>>> 2 address on the same name: udp 127.0.0.1:52534
> (localhost)
> > > tid:
> > > > >>>>>>>>> 00000002
> > > > >>>>>>>>> 2017-05-04T20:44:06 writing packet: udp ::1:52534
> > > > >>>>>>>>> (localhost)
> > > > tid:
> > > > >>>>>>>>> 00000001
> > > > >>>>>>>>> 2017-05-04T20:44:06 reading packet: udp ::1:52534
> > > > >>>>>>>>> (localhost)
> > > > tid:
> > > > >>>>>>>>> 00000001
> > > > >>>>>>>>> 2017-05-04T20:44:06 host completed: udp ::1:52534
> > > > >>>>>>>>> (localhost)
> > > > tid:
> > > > >>>>>>>>> 00000001
> > > > >>>>>>>>> 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0
> > > > >>>>>>>>> hosts 1 packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814
> > > > >>>>>>>>> tid: 00000002
> > > > >>>>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/763641F3
> > > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328353: Decrypt
> > > > >>>>>>>>> integrity check failed for checksum type
> > > > >>>>>>>>> hmac-sha1-96-aes128, key type
> > > > >>>>>>>>> aes128-cts-hmac-sha1-96
> > > > >>>>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
> > > > >>>>>>>>> 2017-05-04T20:44:06 krb5_get_credentials_with_flags:
> > > > >>>>>>>>> TEST.COM
> > > > wc:
> > > > >>>>>>>>> 0.050317
> > > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > >>>>>>>>> credential for krb5_ccache_conf_data/realm-
> > config@X-CACHECONF:
> > > > >>>>>>>>> in cache
> > > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > >>>>>>>>> credential for
> > > > >>>>>>>>> krb5_ccache_conf_data/time-offset/test-service\134/
> > > > >>>>>> localhost\134@TEST.
> > > > >>>>>>>>> COM@X-CACHECONF: in cache
> > > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > >>>>>>>>> 2017-05-04T20:44:06 Setting up PFS for auth context
> > > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > > >>>>>>>>> des-cbc-md5-deprecated not supported
> > > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > > >>>>>>>>> des-cbc-md4-deprecated not supported
> > > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > > >>>>>>>>> des-cbc-crc-deprecated not supported First
> > > > >>>>>>>>> kerberos.authGSSClientStep successful
> > > > >>>>>>>>>
> > > > >>>>>>>>> Thanks
> > > > >>>>>>>>> Jiajia
> > > > >>>>>>>>>
> > > > >>>>>>>>> -----Original Message-----
> > > > >>>>>>>>> From: Zheng, Kai [mailto:kai.zheng@intel.com]
> > > > >>>>>>>>> Sent: Wednesday, May 3, 2017 7:29 PM
> > > > >>>>>>>>> To: kerby@directory.apache.org
> > > > >>>>>>>>> Subject: RE: MIT Kerberos compatibility
> > > > >>>>>>>>>
> > > > >>>>>>>>> Hi Marc,
> > > > >>>>>>>>>
> > > > >>>>>>>>> In case you're not aware of this, please check out the
> > > > >>>>>>>>> latest fix made
> > > > >>>>>>>> by Jiajia. We thought your case may be different, but would
> > > > >>>>>>>> be good to have a check before we can repeat/fix your case.
> > > Thanks.
> > > > >>>>>>>>> https://issues.apache.org/jira/browse/DIRKRB-625
> > > > >>>>>>>>>
> > > > >>>>>>>>> Regards,
> > > > >>>>>>>>> Kai
> > > > >>>>>>>>>
> > > > >>>>>>>>> -----Original Message-----
> > > > >>>>>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> > > > >>>>>>>>> Sent: Sunday, April 30, 2017 7:45 PM
> > > > >>>>>>>>> To: kerby@directory.apache.org
> > > > >>>>>>>>> Subject: Re: MIT Kerberos compatibility
> > > > >>>>>>>>>
> > > > >>>>>>>>> Hi Kai,
> > > > >>>>>>>>>
> > > > >>>>>>>>> The terminal output below is for the latest MIT Kerberos
> > > > >>>>>>>>> 1.15.1 (locally
> > > > >>>>>>>> built on Ubuntu Xenial). Before that, I also tested with the
> > > > >>>>>>>> default Xenial MIT Kerberos packages (1.13.2), with the same
> > > > >>>>>>>> result. I did not try earlier MIT Kerberos versions.
> > > > >>>>>>>>>
> > > > >>>>>>>>> Marc
> > > > >>>>>>>>>
> > > > >>>>>>>>> Op 29-04-17 om 21:42 schreef Marc de Lignie:
> > > > >>>>>>>>>> Hi Kai,
> > > > >>>>>>>>>>
> > > > >>>>>>>>>> Thanks for the response. I prepared a minimal config that
> > > > >>>>>>>>>> reproduces my problem.
> > > > >>>>>>>>>>
> > > > >>>>>>>>>> You can fetch the branch/commit from:
> > > > >>>>>>>>>> https://github.com/vtslab/directory-kerby/commits/
> MitIssue
> > > > >>>>>>>>>>
> > > > >>>>>>>>>> This is relative to RC2, but I also tried this on trunk
> for
> > > > >>>>>>>>>> my actual project.
> > > > >>>>>>>>>>
> > > > >>>>>>>>>> This config produces the debug and error messages below.
> > > > >>>>>>>>>>
> > > > >>>>>>>>>> 1. For the terminal with the bash + python script $ klist
> > > > >>>>>>>>>> Ticket
> > > > >>>>>>>>>> cache: FILE:kerby-kerb/kerb-kdc-test/
> target/tmp/test-tkt.cc
> > > > >>>>>>>>>> Default principal: drankye@TEST.COM
> > > > >>>>>>>>>>
> > > > >>>>>>>>>> Valid starting Expires Service principal
> > > > >>>>>>>>>> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/
> > > TEST.COM@TEST.COM
> > > > >>>>>>>>>> renew until 29-04-17 21:07:39
> > > > >>>>>>>>>>
> > > > >>>>>>>>>> $ .
> > > > >>>>>>>>>> kerby-kerb/kerb-kdc-test/src/
> test/java/org/apache/kerby/ker
> > > > >>>>>>>>>> bero s/ ke rb / server/MitIssueTest.sh [15538]
> > > > >>>>>>>>>> 1493491231.917606:
> > > > >>>>>>>>>> Retrieving drankye@TEST.COM from
> > > > >>>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > > >>>>>>>>>> with
> > > > >>>>>>>>>> result:
> > > > >>>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > > >>>>>>>>>> found [15538]
> > > > >>>>>>>>>> 1493491231.917827: Retrieving drankye@TEST.COM from
> > > > >>>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > > >>>>>>>>>> with
> > > > >>>>>>> result:
> > > > >>>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > > >>>>>>>>>> found kerberos.authGSSClientInit successful [15538]
> > > 1493491231.918185:
> > > > >>>>>>>>>> Getting credentials drankye@TEST.COM ->
> > > > >>>>>>>>>> test-service/localhost@ using ccache
> > > > >>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > >>>>>>>>>> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
> > > > >>>>>>>>>> test-service/localhost@ from
> > > > >>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with
> > > > result:
> > > > >>>>>>>>>> -1765328243/Matching credential not found (filename:
> > > > >>>>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> > > > >>>>>>>>>> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
> > > > >>>>>>>>>> test-service/localhost@TEST.COM with result:
> > > > >>>>>>>>>> -1765328243/Matching credential not found (filename:
> > > > >>>>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> > > > >>>>>>>>>> [15538] 1493491231.918229: Server has referral realm;
> > > > >>>>>>>>>> starting with test-service/localhost@TEST.COM [15538]
> > > 1493491231.918278:
> > > > >>>>>>>>>> Retrieving drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM
> > > > >>>>>>>>>> from FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > >>>>>>>>>> with
> > > > result:
> > > > >>>>>>>>>> 0/Success
> > > > >>>>>>>>>> [15538] 1493491231.918281: Starting with TGT for client
> > realm:
> > > > >>>>>>>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
> > > > >>>>>>>>>> 1493491231.918301: Requesting tickets for
> > > > >>>>>>>>>> test-service/localhost@TEST.COM, referrals on [15538]
> > > > >>>>>>>>>> 1493491231.918326: Generated subkey for TGS request:
> > > > >>>>>>>>>> aes128-cts/FA30
> > > > >>>>>>>>>> [15538] 1493491231.918359: etypes requested in TGS
> request:
> > > > >>>>>>>>>> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2,
> > > > >>>>>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
> > > > >>>>>>>>>> [15538]
> > > > >>>>>> 1493491231.918484:
> > > > >>>>>>>>>> Encoding request body and padata into FAST request [15538]
> > > > >>>>>>>>>> 1493491231.918541: Sending request (836 bytes) to
> TEST.COM
> > > > >>>>>>>>>> [15538]
> > > > >>>>>>>>>> 1493491231.918597: Resolving hostname localhost [15538]
> > > > >>>>>>>>>> 1493491231.918703: Initiating TCP connection to stream
> > > > >>>>>>>>>> 127.0.0.1:44292
> > > > >>>>>>>>>> [15538] 1493491231.918777: Sending TCP request to stream
> > > > >>>>>>>>>> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error
> > > > >>>>>>>>>> receiving from stream
> > > > >>>>>>>>>> 127.0.0.1:44292: 104/Connection reset by peer [15538]
> > > > >>>>>>>>>> 1493491231.922812: Terminating TCP connection to stream
> > > > >>>>>>>>>> 127.0.0.1:44292
> > > > >>>>>>>>>> [15538] 1493491231.922858: Sending initial UDP request to
> > > > >>>>>>>>>> dgram
> > > > >>>>>>>>>> 127.0.0.1:44292
> > > > >>>>>>>>>> ('First kerberos.authGSSClientStep not successful',
> > > > >>>>>>>>>> GSSError(('Unspecified GSS failure. Minor code may
> provide
> > > > >>>>>>>>>> more information', 851968), ("Cannot contact any KDC for
> > > > >>>>>>>>>> realm 'TEST.COM'",
> > > > >>>>>>>>>> -1765328228)))
> > > > >>>>>>>>>>
> > > > >>>>>>>>>> 2. For the terminal that runs mvn clean test
> > > > >>>>>>>>>> -Dtest=MitIssueTest Running
> > > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > > > >>>>>>>>>> 2017-04-29 21:07:39,182 DEBUG [main] backend.
> > > > >>>>>> AbstractIdentityBackend:
> > > > >>>>>>>>>> initialize called
> > > > >>>>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
> > > > >>>>>> AbstractIdentityBackend:
> > > > >>>>>>>>>> getIdentity called, principalName =
> > > > >>>>>>>>>> krbtgt/TEST.COM@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
> > > > >>>>>> AbstractIdentityBackend:
> > > > >>>>>>>>>> getIdentity failed, principalName =
> > > > >>>>>>>>>> krbtgt/TEST.COM@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> > > > >>>>>> AbstractIdentityBackend:
> > > > >>>>>>>>>> addIdentity successful, principalName =
> > > > >>>>>>>>>> krbtgt/TEST.COM@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> > > > >>>>>> AbstractIdentityBackend:
> > > > >>>>>>>>>> getIdentity called, principalName =
> > > > >>>>>>>>>> kadmin/TEST.COM@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> > > > >>>>>> AbstractIdentityBackend:
> > > > >>>>>>>>>> getIdentity failed, principalName =
> > > > >>>>>>>>>> kadmin/TEST.COM@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:39,213 DEBUG [main] backend.
> > > > >>>>>> AbstractIdentityBackend:
> > > > >>>>>>>>>> addIdentity successful, principalName =
> > > > >>>>>>>>>> kadmin/TEST.COM@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:39,216 DEBUG [main] backend.
> > > > >>>>>> AbstractIdentityBackend:
> > > > >>>>>>>>>> start called
> > > > >>>>>>>>>> 2017-04-29 21:07:39,232 DEBUG [main] backend.
> > > > >>>>>> AbstractIdentityBackend:
> > > > >>>>>>>>>> addIdentity successful, principalName =
> > > > >>>>>>>>>> test-service/localhost@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:39,425 DEBUG [main] backend.
> > > > >>>>>> AbstractIdentityBackend:
> > > > >>>>>>>>>> addIdentity successful, principalName = drankye@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1]
> > > > >>>>> request.KdcRequest:
> > > > >>>>>>>>>> Client entry is empty.
> > > > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > > >>>>>>>>>> principalName = drankye@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > > >>>>>>>>>> principalName = drankye@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
> > > > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > > > >>>>>>>>>> occurred, disconnecting abnormally java.io.EOFException
> > > > >>>>>>>>>> at java.io.DataInputStream.
> readInt(DataInputStream.java:
> > > 392)
> > > > >>>>>>>>>> at
> > > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > > > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > > > >>>>>>>>>> at
> > > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.
> DefaultKdcHandle
> > > > >>>>>>>>>> r.ru
> > > > >>>>>>>>>> n(
> > > > >>>>>>>> DefaultKdcHandler.java:46)
> > > > >>>>>>>>>> at
> > > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > > >>>>>>>> ThreadPoolExecutor.java:1142)
> > > > >>>>>>>>>> at
> > > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > > >>>>>>>> ThreadPoolExecutor.java:617)
> > > > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > > > >>>>>>>>>> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase:
> > > > >>>>>>>>>> Storing the tgt to the credential cache file.
> > > > >>>>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
> > > > >>>>>> AbstractIdentityBackend:
> > > > >>>>>>>>>> getIdentity called, principalName =
> > > > >>>>>>>>>> test-service/localhost@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
> > > > >>>>>> AbstractIdentityBackend:
> > > > >>>>>>>>>> getIdentity successful, principalName =
> > > > >>>>>>>>>> test-service/localhost@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> > > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> > > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1]
> > > > >>>>> request.KdcRequest:
> > > > >>>>>>>>>> Client entry is empty.
> > > > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > > >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > > >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1]
> > > > >>>>> request.KdcRequest:
> > > > >>>>>>>>>> The preauth data is empty.
> > > > >>>>>>>>>> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1]
> > > > server.KdcHandler:
> > > > >>>>>>>>>> KRB error occurred while processing request:Additional
> > > > >>>>>>>>>> pre-authentication required
> > > > >>>>>>>>>> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
> > > > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > > > >>>>>>>>>> occurred, disconnecting abnormally java.io.EOFException
> > > > >>>>>>>>>> at java.io.DataInputStream.
> readInt(DataInputStream.java:
> > > 392)
> > > > >>>>>>>>>> at
> > > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > > > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > > > >>>>>>>>>> at
> > > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.
> DefaultKdcHandle
> > > > >>>>>>>>>> r.ru
> > > > >>>>>>>>>> n(
> > > > >>>>>>>> DefaultKdcHandler.java:46)
> > > > >>>>>>>>>> at
> > > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > > >>>>>>>> ThreadPoolExecutor.java:1142)
> > > > >>>>>>>>>> at
> > > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > > >>>>>>>> ThreadPoolExecutor.java:617)
> > > > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > > > >>>>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> > > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> > > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1]
> > > > >>>>> request.KdcRequest:
> > > > >>>>>>>>>> Client entry is empty.
> > > > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > > >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > > >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
> > > > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > > > >>>>>>>>>> occurred, disconnecting abnormally java.io.EOFException
> > > > >>>>>>>>>> at java.io.DataInputStream.
> readInt(DataInputStream.java:
> > > 392)
> > > > >>>>>>>>>> at
> > > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > > > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > > > >>>>>>>>>> at
> > > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.
> DefaultKdcHandle
> > > > >>>>>>>>>> r.ru
> > > > >>>>>>>>>> n(
> > > > >>>>>>>> DefaultKdcHandler.java:46)
> > > > >>>>>>>>>> at
> > > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > > >>>>>>>> ThreadPoolExecutor.java:1142)
> > > > >>>>>>>>>> at
> > > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > > >>>>>>>> ThreadPoolExecutor.java:617)
> > > > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > > > >>>>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> > > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> > > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > > >>>>>>>>>> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1]
> > > > >>>>> request.KdcRequest:
> > > > >>>>>>>>>> Found fast padata and start to process it.
> > > > >>>>>>>>>> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
> > > > >>>>>>>>>> impl.DefaultKdcHandler: Error occured while processing
> > > request:
> > > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding
> > failed
> > > > >>>>>>>>>> at org.apache.kerby.kerberos.
> > kerb.KrbCodec.decode(KrbCodec.
> > > > >>>>>>>> java:85)
> > > > >>>>>>>>>> at org.apache.kerby.kerberos.
> > kerb.KrbCodec.decode(KrbCodec.
> > > > >>>>>>>> java:70)
> > > > >>>>>>>>>> at
> > > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.
> KdcRequest.kd
> > > > >>>>>>>>>> cFin
> > > > >>>>>>>>>> dF
> > > > >>>>>>>>>> as
> > > > >>>>>>>>>> t(
> > > > >>>>>>>> KdcRequest.java:208)
> > > > >>>>>>>>>> at
> > > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.
> > > > >>>>>>>> KdcRequest.process(KdcRequest.java:168)
> > > > >>>>>>>>>> at
> > > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
> > > > >>>>>>>> handleMessage(KdcHandler.java:115)
> > > > >>>>>>>>>> at
> > > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.
> > DefaultKdcHandler.
> > > > >>>>>>>> handleMessage(DefaultKdcHandler.java:67)
> > > > >>>>>>>>>> at
> > > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.
> DefaultKdcHandle
> > > > >>>>>>>>>> r.ru
> > > > >>>>>>>>>> n(
> > > > >>>>>>>> DefaultKdcHandler.java:52)
> > > > >>>>>>>>>> at
> > > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > > >>>>>>>> ThreadPoolExecutor.java:1142)
> > > > >>>>>>>>>> at
> > > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > > >>>>>>>> ThreadPoolExecutor.java:617)
> > > > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > > > >>>>>>>>>> Caused by: java.io.IOException: Unexpected item context
> [0]
> > > > >>>>>>>>>> [tag=0xA0, off=0, len=3+207], expecting 0x30
> > > > >>>>>>>>>> at
> > > > >>>>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > > > >>>>>>>> Asn1Encodeable.java:210)
> > > > >>>>>>>>>> at
> > > > >>>>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > > > >>>>>>>> Asn1Encodeable.java:197)
> > > > >>>>>>>>>> at org.apache.kerby.kerberos.
> > kerb.KrbCodec.decode(KrbCodec.
> > > > >>>>>>>> java:83)
> > > > >>>>>>>>>> ... 9 more
> > > > >>>>>>>>>> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
> > > > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > > > >>>>>>>>>> occurred, disconnecting abnormally
> > > > >>>>>>>>>> java.net.SocketException: Socket closed
> > > > >>>>>>>>>> at java.net.SocketInputStream.socketRead0(Native
> Method)
> > > > >>>>>>>>>> at java.net.SocketInputStream.
> > socketRead(SocketInputStream.
> > > > >>>>>>>> java:116)
> > > > >>>>>>>>>> at java.net.SocketInputStream.
> > read(SocketInputStream.java:
> > > > >>>>> 171)
> > > > >>>>>>>>>> at java.net.SocketInputStream.
> > read(SocketInputStream.java:
> > > > >>>>> 141)
> > > > >>>>>>>>>> at java.net.SocketInputStream.
> > read(SocketInputStream.java:
> > > > >>>>> 224)
> > > > >>>>>>>>>> at java.io.DataInputStream.
> readInt(DataInputStream.java:
> > > 387)
> > > > >>>>>>>>>> at
> > > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > > > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > > > >>>>>>>>>> at
> > > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.
> DefaultKdcHandle
> > > > >>>>>>>>>> r.ru
> > > > >>>>>>>>>> n(
> > > > >>>>>>>> DefaultKdcHandler.java:46)
> > > > >>>>>>>>>> at
> > > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > > >>>>>>>> ThreadPoolExecutor.java:1142)
> > > > >>>>>>>>>> at
> > > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > > >>>>>>>> ThreadPoolExecutor.java:617)
> > > > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > > > >>>>>>>>>>
> > > > >>>>>>>>>> In a FreeIPA environment these python lines "just" work.
> > > > >>>>>>>>>>
> > > > >>>>>>>>>> Any suggestions are welcome!
> > > > >>>>>>>>>>
> > > > >>>>>>>>>> Marc
> > > > >>>>>>>>>>
> > > > >>>>>>>>>>
> > > > >>>>>>>>> --
> > > > >>>>>>>>> Marc de Lignie
> > > > >>>>>>>>>
> > > > >>>>>>>>
> > > > >>>>>>>> --
> > > > >>>>>>>> Marc de Lignie
> > > > >>>>>>>>
> > > > >>>>>>>>
> > > > >>>>>>>
> > > > >>>>>>>
> > > > >>>>>>> --
> > > > >>>>>>> Colm O hEigeartaigh
> > > > >>>>>>>
> > > > >>>>>>> Talend Community Coder
> > > > >>>>>>> http://coders.talend.com
> > > > >>>>>>>
> > > > >>>>>>
> > > > >>>>>>
> > > > >>>>>>
> > > > >>>>>> --
> > > > >>>>>> Colm O hEigeartaigh
> > > > >>>>>>
> > > > >>>>>> Talend Community Coder
> > > > >>>>>> http://coders.talend.com
> > > > >>>>>>
> > > > >>>>>
> > > > >>>>>
> > > > >>>>>
> > > > >>>>> --
> > > > >>>>> Colm O hEigeartaigh
> > > > >>>>>
> > > > >>>>> Talend Community Coder
> > > > >>>>> http://coders.talend.com
> > > > >>>>>
> > > > >>>>
> > > > >>>>
> > > > >>>>
> > > > >>>> --
> > > > >>>> Colm O hEigeartaigh
> > > > >>>>
> > > > >>>> Talend Community Coder
> > > > >>>> http://coders.talend.com
> > > > >>>
> > > > >>>
> > > > >>
> > > > >>
> > > > >> --
> > > > >> Colm O hEigeartaigh
> > > > >>
> > > > >> Talend Community Coder
> > > > >> http://coders.talend.com
> > > >
> > >
> > >
> > >
> > > --
> > > Colm O hEigeartaigh
> > >
> > > Talend Community Coder
> > > http://coders.talend.com
> > >
> >
> >
> >
> > --
> > Colm O hEigeartaigh
> >
> > Talend Community Coder
> > http://coders.talend.com
> >
>
>
>
> --
> Colm O hEigeartaigh
>
> Talend Community Coder
> http://coders.talend.com
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
RE: MIT Kerberos compatibility
Posted by "Zheng, Kai" <ka...@intel.com>.
This sounds great. IIRC, you have another TCP/UDP network related issue to be fixed yet? Maybe we fix it as well to justify a new minor release.
Regards,
Kai
-----Original Message-----
From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
Sent: Monday, June 19, 2017 4:45 PM
To: kerby@directory.apache.org
Subject: Re: MIT Kerberos compatibility
Yes, it works perfectly, thanks Jiajia for the fix! I'll resolve the JIRA.
Colm.
On Mon, Jun 19, 2017 at 6:09 AM, Li, Jiajia <ji...@intel.com> wrote:
> Hi Colm,
> Thanks for providing the way to reproduce the error, and I have the fix in
> trunk code, can you take some time to check it?
>
> Commit log:
> commit 106299efb7aa3001da89ae821eb43285c544bab7
> Author: plusplusjiajia <ji...@intel.com>
> Date: Mon Jun 19 13:07:04 2017 +0800
>
> Fix DIRKRB-629:ICMP Port Unreachable error message with GSS + default
> transport.
>
>
> Thanks
> Jiajia
>
> -----Original Message-----
> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> Sent: Monday, May 8, 2017 6:19 PM
> To: kerby@directory.apache.org
> Subject: Re: MIT Kerberos compatibility
>
> OK I have created a JIRA and attached a patch that you have to apply to the
> Apache WSS4J project to reproduce the error. If you uncomment the line that
> uses Netty then the tests all work perfectly. The tests appear to work fine
> when run in isolation, it's only when you run a few of them after one
> another that you can see the failures.
>
> Please let me know if you have any difficulty in reproducing, thanks!
>
> Colm.
>
> On Mon, May 8, 2017 at 11:08 AM, Zheng, Kai <ka...@intel.com> wrote:
>
> > Hi Colm,
> >
> > Sure, please do it. Could you review my change and see how it would cause
> > the new failures? Any difference between the failed GSS tests and the
> Kerby
> > GSS tests?
> >
> > Regards,
> > Kai
> >
> > -----Original Message-----
> > From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > Sent: Monday, May 08, 2017 5:42 PM
> > To: Zheng, Kai <ka...@intel.com>
> > Cc: kerby@directory.apache.org
> > Subject: Re: MIT Kerberos compatibility
> >
> > Hi Kai,
> >
> > Your changes fixed the error message I was seeing. However, I now see
> > another problem when I run a few GSS client tests in a row:
> >
> > >>> EType: sun.security.krb5.internal.crypto.Aes128CtsHmacSha1EType
> > >>> KrbAsReq creating message
> > >>> KrbKdcReq send: kdc=localhost UDP:42665, timeout=30000, number of
> > retries =3, #bytes=245
> > >>> KDCCommunication: kdc=localhost UDP:42665, timeout=30000,Attempt =1,
> > #bytes=245
> > SocketTimeOutException with attempt: 1
> > >>> KDCCommunication: kdc=localhost UDP:42665, timeout=30000,Attempt =2,
> > #bytes=245
> > >>> KrbKdcReq send: error trying localhost:42665
> > java.net.PortUnreachableException: ICMP Port Unreachable
> >
> > Do you want me to create a JIRA + attach a test-case?
> >
> > Colm.
> >
> > On Sat, May 6, 2017 at 2:01 AM, Zheng, Kai <ka...@intel.com> wrote:
> >
> > > I haven't repeated the issue but revisited the codes again and made
> > > improvements. Would you check it out? Thanks!
> > >
> > > Sent from iPhone
> > >
> > > > 在 2017年5月6日，上午6:28，Zheng, Kai <ka...@intel.com> 写道：
> > > >
> > > > Thanks colm for the clarification and it sounds an issue we need to
> > > address. I will investigate it soon.
> > > >
> > > > Sent from iPhone
> > > >
> > > >> 在 2017年5月6日，上午2:14，Colm O hEigeartaigh <co...@apache.org> 写道：
> > > >>
> > > >> Hi Kai,
> > > >>
> > > >> If I enable UDP with the default Transport, I can get a ticket fine
> > > using
> > > >> kinit. However then the following error pops up in the window I'm
> > > running
> > > >> Kerby in (as a test):
> > > >>
> > > >> Exception in thread "Thread-1" java.lang.RuntimeException: Error
> > > >> occured while checking udp connections
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > KdcNetwork.java:105)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > access$000(KdcNetwork.java:39)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > > run(KdcNetwork.java:75)
> > > >> at java.lang.Thread.run(Thread.java:748)
> > > >> Caused by: java.nio.channels.ClosedChannelException
> > > >> at
> > > >> sun.nio.ch.DatagramChannelImpl.ensureOpen(
> > DatagramChannelImpl.java:320)
> > > >> at sun.nio.ch.DatagramChannelImpl.receive(
> > > DatagramChannelImpl.java:331)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > checkUdpMessage(KdcNetwork.java:132)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > KdcNetwork.java:101)
> > > >>
> > > >> Colm.
> > > >>
> > > >>
> > > >>> On Fri, May 5, 2017 at 5:56 PM, Zheng, Kai <ka...@intel.com>
> > > wrote:
> > > >>>
> > > >>> Colm, did you see udp problem now instead? I'm a little confused.
> > > >>> Udp
> > > is
> > > >>> sure supported but may not be enabled by default, which should be
> > > >>> okay, imo. Thanks.
> > > >>>
> > > >>> Sent from iPhone
> > > >>>
> > > >>>> 在 2017年5月6日，上午12:02，Colm O hEigeartaigh <co...@apache.org> 写道：
> > > >>>>
> > > >>>> That's probably it. Why does the default transport not support
> > > >>>> UDP in
> > > >>> Kerby?
> > > >>>>
> > > >>>> Colm.
> > > >>>>
> > > >>>>> On Fri, May 5, 2017 at 4:54 PM, Li, Jiajia <ji...@intel.com>
> > > wrote:
> > > >>>>>
> > > >>>>> Are you sure add kdc_allow_udp = false in kdc.conf?
> > > >>>>>
> > > >>>>> Thanks
> > > >>>>> Jiajia
> > > >>>>>
> > > >>>>> -----Original Message-----
> > > >>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > > >>>>> Sent: Friday, May 5, 2017 11:41 PM
> > > >>>>> To: Li, Jiajia <ji...@intel.com>
> > > >>>>> Cc: kerby@directory.apache.org; Zheng, Kai
> > > >>>>> <ka...@intel.com>;
> > > >>> mailto:
> > > >>>>> m.c.delignie@xs4all.nl <m....@xs4all.nl>
> > > >>>>> Subject: Re: MIT Kerberos compatibility
> > > >>>>>
> > > >>>>> Sorry, it was my error, UDP was actually enabled there. But why
> > > >>>>> am I
> > > >>> still
> > > >>>>> seeing that error message?
> > > >>>>>
> > > >>>>> Colm.
> > > >>>>>
> > > >>>>>> On Fri, May 5, 2017 at 4:39 PM, Li, Jiajia
> > > >>>>>> <ji...@intel.com>
> > > >>> wrote:
> > > >>>>>>
> > > >>>>>> Hi Colm,
> > > >>>>>> I also test the Kerby KDC with kerby kint and MIT kinit, and
> > > >>>>>> only listen the tcp port(disable udp), both got ticket
> > > >>>>>> successfully. But
> > > I
> > > >>>>>> don't get the error message. Both krb.conf and kdc.conf should
> > > >>>>>> set
> > > udp
> > > >>>>>> to be false, udp is enabled in default.
> > > >>>>>>
> > > >>>>>> Thanks
> > > >>>>>> Jiajia
> > > >>>>>>
> > > >>>>>> -----Original Message-----
> > > >>>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > > >>>>>> Sent: Friday, May 5, 2017 11:34 PM
> > > >>>>>> To: kerby@directory.apache.org
> > > >>>>>> Cc: Zheng, Kai <ka...@intel.com>;
> > > >>>>>> mailto:m.c.delignie@xs4all.nl
> > > <
> > > >>>>>> m.c.delignie@xs4all.nl>
> > > >>>>>> Subject: Re: MIT Kerberos compatibility
> > > >>>>>>
> > > >>>>>> Hi Jiajia,
> > > >>>>>>
> > > >>>>>> If UDP is disabled and we don't use Netty, I can get a token
> > > >>>>>> successfully via kinit. However I then see an error message in
> > > >>>>>> the
> > > >>> Kerby
> > > >>>>> console:
> > > >>>>>>
> > > >>>>>> Exception in thread "Thread-1" java.lang.RuntimeException:
> > > >>>>>> Error occured while checking udp connections at
> > > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > >>>>>> KdcNetwork.java:105)
> > > >>>>>> at
> > > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > >>>>>> access$000(KdcNetwork.java:39)
> > > >>>>>> at
> > > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > > >>>>>> run(KdcNetwork.java:75)
> > > >>>>>> at java.lang.Thread.run(Thread.java:748)
> > > >>>>>> Caused by: java.nio.channels.ClosedChannelException
> > > >>>>>> at
> > > >>>>>> sun.nio.ch.DatagramChannelImpl.ensureOpen(
> > > >>> DatagramChannelImpl.java:320)
> > > >>>>>> at sun.nio.ch.DatagramChannelImpl.receive(
> > > >>>>>> DatagramChannelImpl.java:331)
> > > >>>>>> at
> > > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > >>>>>> checkUdpMessage(KdcNetwork.java:132)
> > > >>>>>> at
> > > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > >>>>>> KdcNetwork.java:101)
> > > >>>>>>
> > > >>>>>> I'm not sure why we are seeing UDP errors when it's disabled?
> > > >>>>>>
> > > >>>>>> Colm.
> > > >>>>>>
> > > >>>>>>> On Fri, May 5, 2017 at 3:57 PM, Li, Jiajia
> > > >>>>>>> <ji...@intel.com>
> > > >>> wrote:
> > > >>>>>>>
> > > >>>>>>> Hi Colm,
> > > >>>>>>> The shell client can't connect to kdc if the UDP is disabled.
> > > >>>>>>> We don't use Netty in default.
> > > >>>>>>> What's your test-cases? The same as the Marc's?
> > > >>>>>>>
> > > >>>>>>> Thanks
> > > >>>>>>> Jiajia
> > > >>>>>>>
> > > >>>>>>> -----Original Message-----
> > > >>>>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > > >>>>>>> Sent: Friday, May 5, 2017 10:09 PM
> > > >>>>>>> To: kerby@directory.apache.org
> > > >>>>>>> Cc: Zheng, Kai <ka...@intel.com>; mailto:
> > > m.c.delignie@xs4all.nl
> > > >>>>>>> < m.c.delignie@xs4all.nl>
> > > >>>>>>> Subject: Re: MIT Kerberos compatibility
> > > >>>>>>>
> > > >>>>>>> Hi Jiajia,
> > > >>>>>>>
> > > >>>>>>> What are the issues if UDP is disabled and we don't use Netty?
> > > >>>>>>> I tried doing this with my own test-cases and it didn't work,
> > > >>>>>>> so it would be good to get this fixed soon.
> > > >>>>>>>
> > > >>>>>>> Colm.
> > > >>>>>>>
> > > >>>>>>> On Fri, May 5, 2017 at 2:46 PM, Li, Jiajia
> > > >>>>>>> <ji...@intel.com>
> > > >>>>> wrote:
> > > >>>>>>>
> > > >>>>>>>> Hi Marc,
> > > >>>>>>>>>>> - your KRB5 tracing looks quite different. What OS and
> > > >>>>>>>>>>> mit-kerberos
> > > >>>>>>>> version did you use?
> > > >>>>>>>> I use mac os and the python version is 2.7.10
> > > >>>>>>>>
> > > >>>>>>>>>>> - your KRB5 tracing shows UDP comms between kerberos
> > > >>>>>>>>>>> client and KDC,
> > > >>>>>>>> despite the allowUDP = false setting
> > > >>>>>>>>>>> in my test. I did this setting because I get different
> > > >>>>>>>>>>> problems
> > > >>>>>>>> without it, see the additional logs below. So,
> > > >>>>>>>>>>> we must also be aware of networking problems at my side.
> > > >>>>>>>> I enable the UDP and use netty network, there are some issues
> > > >>>>>>>> if UDP disabled, you can create a JIRA for this and we can
> > > >>>>>>>> fix this issue in the next release version.
> > > >>>>>>>>
> > > >>>>>>>> The changes in my side as following:
> > > >>>>>>>>
> > > >>>>>>>> protected boolean allowUdp() { return true; } @Override
> > > >>>>>>>> protected void prepareKdc() throws KrbException {
> > > >>>>>>>> getKdcServer().setInnerKdcImpl(
> > > >>>>>>>> new
> > > >>>>>>>> NettyKdcServerImpl(getKdcServer().getKdcSetting()));
> > > >>>>>>>> super.prepareKdc();
> > > >>>>>>>> }
> > > >>>>>>>>
> > > >>>>>>>> Here is log of MitIssueTest:
> > > >>>>>>>> [INFO] Running
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > > >>>>>>>> io.netty.handler.logging.LoggingHandler
> > > >>>>>>>> -
> > > >>>>>>>> [id: 0x2634fe6b] REGISTERED
> > > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > > >>>>>>>> io.netty.handler.logging.LoggingHandler
> > > >>>>>>>> -
> > > >>>>>>>> [id: 0x2634fe6b] BIND(0.0.0.0/0.0.0.0:53957)
> > > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > > >>>>>>>> io.netty.handler.logging.LoggingHandler -
> > > >>>>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] ACTIVE [main] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kdc.impl.NettyKdcServerImpl - Netty
> > > >>>>>>>> kdc server started.
> > > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > > >>>>>>>> io.netty.handler.logging.LoggingHandler
> > > >>>>>>>> -
> > > >>>>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] RECEIVED: [id:
> > > >>>>>>>> 0xdac7228b, /
> > > >>>>>>>> 127.0.0.1:53961 => /127.0.0.1:53957]
> > > >>>>>>>> [defaultEventExecutorGroup-4-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
> > > >>>>>>>> - AS_REQ ISSUE: authtime 1493991123792,drankye@TEST.COM for
> > > >>>>>>>> krbtgt/ TEST.COM@TEST.COM [main] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> > > DefaultInternalKrbClien
> > > >>>>>>>> t
> > > >>>>>>>> - Send to kdc success.
> > > >>>>>>>> [main] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing
> > the tgt to the credential cache file.
> > > >>>>>>>> [nioEventLoopGroup-5-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> > > >>>>>>>> - The preauth data is empty.
> > > >>>>>>>> [nioEventLoopGroup-5-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> > > >>>>>>>> - KRB error occurred while processing request:Additional
> > > >>>>>>>> pre-authentication required [nioEventLoopGroup-5-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
> > > >>>>>>>> - AS_REQ ISSUE: authtime
> > > >>>>>>>> 1493991123859,test-service/localhost@TEST.COM
> > > >>>>>>>> for krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>> [nioEventLoopGroup-5-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.TgsRequest
> > > >>>>>>>> - TGS_REQ ISSUE: authtime 1493991142850,drankye for
> > > >>>>>>>> test-service/ localhost@TEST.COM
> > > >>>>>>>>
> > > >>>>>>>> Thanks
> > > >>>>>>>> Jiajia
> > > >>>>>>>>
> > > >>>>>>>> -----Original Message-----
> > > >>>>>>>> From: Zheng, Kai
> > > >>>>>>>> Sent: Friday, May 5, 2017 7:46 PM
> > > >>>>>>>> To: kerby@directory.apache.org; Li, Jiajia
> > > >>>>>>>> <ji...@intel.com>
> > > >>>>>>>> Subject: RE: MIT Kerberos compatibility
> > > >>>>>>>>
> > > >>>>>>>> Hi Marc,
> > > >>>>>>>>
> > > >>>>>>>> Looks like this is quite environment related, could you fire
> > > >>>>>>>> an issue for this? I would suggest we target it to 1.1.0,
> > > >>>>>>>> which can be done in
> > > >>>>>>> June.
> > > >>>>>>>>
> > > >>>>>>>> Regards,
> > > >>>>>>>> Kai
> > > >>>>>>>>
> > > >>>>>>>> -----Original Message-----
> > > >>>>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> > > >>>>>>>> Sent: Friday, May 05, 2017 4:44 PM
> > > >>>>>>>> To: Li, Jiajia <ji...@intel.com>
> > > >>>>>>>> Cc: kerby@directory.apache.org
> > > >>>>>>>> Subject: Re: MIT Kerberos compatibility
> > > >>>>>>>>
> > > >>>>>>>> Hi Jiajia,
> > > >>>>>>>>
> > > >>>>>>>> Great to read that you made progress on this issue and to see
> > > >>>>>>>> a working config at your side. Below, I list my progress
> > > >>>>>>>> below (with trunk merged into my MitIssue branch), but I am
> > > >>>>>>>> afraid we are not done
> > > >>>>>>> yet.
> > > >>>>>>>>
> > > >>>>>>>> Things that stand out:
> > > >>>>>>>>
> > > >>>>>>>> - the kdc decoding error is solved, relative to the logs
> > > >>>>>>>> without your patch
> > > >>>>>>>>
> > > >>>>>>>> - your KRB5 tracing looks quite different. What OS and
> > > >>>>>>>> mit-kerberos version did you use?
> > > >>>>>>>>
> > > >>>>>>>> - your KRB5 tracing shows UDP comms between kerberos client
> > > >>>>>>>> and KDC, despite the allowUDP = false setting in my test. I
> > > >>>>>>>> did this setting because I get different problems without it,
> > > >>>>>>>> see the additional logs below. So, we must also be aware of
> > > >>>>>>>> networking
> > > >>>>> problems at my side.
> > > >>>>>>>>
> > > >>>>>>>> - the "Response was not from master KDC" msg is not relevant;
> > > >>>>>>>> it disappears if you manually add master_kdc to the realms
> > > >>>>>>>> section of the krb5.conf
> > > >>>>>>>>
> > > >>>>>>>> I have no idea how to proceed from here, so that is why I
> > > >>>>>>>> just document the status at my side and ask about your -
> > > >>>>>>>> apparently working -
> > > >>>>>>> config.
> > > >>>>>>>>
> > > >>>>>>>> Cheers, Marc
> > > >>>>>>>>
> > > >>>>>>>>
> > > >>>>>>>> KDC logging with allowUDP = false:
> > > >>>>>>>>
> > > >>>>>>>> [INFO] Running
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > > >>>>>>>> [pool-1-thread-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > > >>>>>>>> AS_REQ
> > > >>>>>> ISSUE:
> > > >>>>>>>> authtime 1493970789075,drankye@TEST.COM for
> > > >>>>>>>> krbtgt/TEST.COM@TEST.COM [main] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> > > DefaultInternalKrbClien
> > > >>>>>>>> t
> > > >>>>>>>> - Send to kdc success.
> > > >>>>>>>> [main] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing
> > the tgt to the credential cache file.
> > > >>>>>>>> [pool-1-thread-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest -
> > > >>>>>>>> The preauth data is empty.
> > > >>>>>>>> [pool-1-thread-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> > > >>>>>>>> - KRB error occurred while processing request:Additional
> > > >>>>>>>> pre-authentication required [pool-1-thread-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > > >>>>>>>> AS_REQ
> > > >>>>>> ISSUE:
> > > >>>>>>>> authtime 1493970789108,test-service/localhost@TEST.COM for
> > > krbtgt/
> > > >>>>>>>> TEST.COM@TEST.COM [pool-1-thread-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> > > >>>>>>>> - Found fast padata and starting to process it.
> > > >>>>>>>> [pool-1-thread-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest -
> > > >>>>>>>> Found fast padata and starting to process it.
> > > >>>>>>>>
> > > >>>>>>>> Python script KRB5 tracing (MIT Kerberos 1.13.2 of Ubuntu
> > > >>>>>>>> Xenial) with allowUDP = false:
> > > >>>>>>>>
> > > >>>>>>>> $ .
> > > >>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/
> > > >>>>>>>> kerberos/kerb/server/MitIssueTest.sh
> > > >>>>>>>> [25281] 1493970797.298753: Retrieving drankye@TEST.COM from
> > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>> with
> > > >>>>> result:
> > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>> found [25281]
> > > >>>>>>>> 1493970797.298952: Retrieving drankye@TEST.COM from
> > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>> with
> > > >>>>> result:
> > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>> found [25281]
> > > >>>>>>>> 1493970797.299106: Retrieving drankye@TEST.COM from
> > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>> with
> > > >>>>> result:
> > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>> found [25281]
> > > >>>>>>>> 1493970797.299213: Retrieving drankye@TEST.COM from
> > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>> with
> > > >>>>> result:
> > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>> found [25281]
> > > >>>>>>>> 1493970797.299323: Retrieving drankye@TEST.COM from
> > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>> with
> > > >>>>> result:
> > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>> found [25281]
> > > >>>>>>>> 1493970797.299436: Retrieving drankye@TEST.COM from
> > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>> with
> > > >>>>> result:
> > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>> found [25281]
> > > >>>>>>>> 1493970797.299545: Retrieving drankye@TEST.COM from
> > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>> with
> > > >>>>> result:
> > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>> found [25281]
> > > >>>>>>>> 1493970797.299654: Retrieving drankye@TEST.COM from
> > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>> with
> > > >>>>> result:
> > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>> found kerberos.authGSSClientInit successful [25281]
> > 1493970797.299922:
> > > >>>>>>>> Getting credentials drankye@TEST.COM ->
> > > >>>>>>>> test-service/localhost@ using ccache
> > > >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>> [25281] 1493970797.299945: Retrieving drankye@TEST.COM ->
> > > >>>>>>>> test-service/localhost@ from
> > > >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>> with result:
> > > >>>>>>>> -1765328243/Matching credential not found [25281]
> > > 1493970797.299959:
> > > >>>>>>>> Retrying drankye@TEST.COM -> test-service/localhost@TEST.COM
> > > >>>>>>>> with
> > > >>>>>>> result:
> > > >>>>>>>> -1765328243/Matching credential not found [25281]
> > > 1493970797.299962:
> > > >>>>>>>> Server has referral realm; starting with
> > > >>>>>>>> test-service/localhost@TEST.COM [25281]
> > > >>>>>>>> 1493970797.299975: Retrieving drankye@TEST.COM ->
> > > >>>>>>>> krbtgt/TEST.COM@TEST.COM from
> > > >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>> with result:
> > > >>>>>>>> 0/Success [25281] 1493970797.299979: Starting with TGT for
> > > >>>>>>>> client
> > > >>>>>> realm:
> > > >>>>>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [25281]
> > > >>>>>> 1493970797.299981:
> > > >>>>>>>> Requesting tickets for test-service/localhost@TEST.COM,
> > > >>>>>>>> referrals on [25281] 1493970797.299994: Generated subkey for
> > TGS request:
> > > >>>>>>>> aes128-cts/1B9B [25281] 1493970797.300009: etypes requested
> > > >>>>>>>> in TGS
> > > >>>>>>> request:
> > > >>>>>>>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac,
> > > >>>>>>>> camellia128-cts, camellia256-cts [25281] 1493970797.300054:
> > > >>>>>>>> Encoding request body and padata into FAST request [25281]
> > > >>>>>>>> 1493970797.300080: Sending request
> > > >>>>>>>> (823 bytes) to TEST.COM [25281] 1493970797.300091: Resolving
> > > >>>>>>>> hostname localhost [25281]
> > > >>>>>>>> 1493970797.300136: Initiating TCP connection to stream
> > > >>>>>>>> 127.0.0.1:34319
> > > >>>>>>>> [25281] 1493970797.300191: Sending TCP request to stream
> > > >>>>>>>> 127.0.0.1:34319 [25281] 1493970797.303610: Received answer
> > > >>>>>>>> (125
> > > >>>>>>>> bytes) from stream
> > > >>>>>>>> 127.0.0.1:34319
> > > >>>>>>>> [25281] 1493970797.303618: Terminating TCP connection to
> > > >>>>>>>> stream
> > > >>>>>>>> 127.0.0.1:34319
> > > >>>>>>>> [25281] 1493970797.553126: Response was not from master KDC
> > > >>>>>>>> [25281]
> > > >>>>>>>> 1493970797.553198: TGS request result: -1765323383/Unknown
> > > >>>>>>>> code krcM
> > > >>>>>>>> 137 [25281] 1493970797.553234: Requesting tickets for
> > > >>>>>>>> test-service/ localhost@TEST.COM, referrals off [25281]
> > > >>>>> 1493970797.553273:
> > > >>>>>>>> Generated subkey for TGS request: aes128-cts/94C6 [25281]
> > > >>>>>> 1493970797.553323:
> > > >>>>>>>> etypes requested in TGS request: aes256-cts, aes128-cts,
> > > >>>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
> > > >>>>>>>> [25281]
> > > >>>>>>>> 1493970797.553436: Encoding request body and padata into FAST
> > > >>>>>>>> request
> > > >>>>>>> [25281] 1493970797.553532:
> > > >>>>>>>> Sending request (823 bytes) to TEST.COM [25281]
> > > 1493970797.553567:
> > > >>>>>>>> Resolving hostname localhost [25281] 1493970797.553745:
> > > >>>>>>>> Initiating TCP connection to stream
> > > >>>>>>>> 127.0.0.1:34319
> > > >>>>>>>> [25281] 1493970797.553889: Sending TCP request to stream
> > > >>>>>>>> 127.0.0.1:34319 [25281] 1493970797.558297: Received answer
> > > >>>>>>>> (125
> > > >>>>>>>> bytes) from stream
> > > >>>>>>>> 127.0.0.1:34319
> > > >>>>>>>> [25281] 1493970797.558318: Terminating TCP connection to
> > > >>>>>>>> stream
> > > >>>>>>>> 127.0.0.1:34319
> > > >>>>>>>> [25281] 1493970797.561189: Response was not from master KDC
> > > >>>>>>>> [25281]
> > > >>>>>>>> 1493970797.561258: TGS request result: -1765323383/Unknown
> > > >>>>>>>> code krcM
> > > >>>>>>>> 137 ('First kerberos.authGSSClientStep not successful',
> > > >>>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide
> > > >>>>>>>> more information', 851968), ('Unknown code krcM 137',
> > > >>>>>>>> -1765323383)))
> > > >>>>>>>>
> > > >>>>>>>>
> > > >>>>>>>> KDC logging with allowUDP = true:
> > > >>>>>>>>
> > > >>>>>>>> [INFO] Running
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > > >>>>>>>> [pool-1-thread-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > > >>>>>>>> AS_REQ
> > > >>>>>> ISSUE:
> > > >>>>>>>> authtime 1493972505784,drankye@TEST.COM for
> > > >>>>>>>> krbtgt/TEST.COM@TEST.COM [main] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> > > DefaultInternalKrbClien
> > > >>>>>>>> t
> > > >>>>>>>> - Send to kdc success.
> > > >>>>>>>> [main] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing
> > the tgt to the credential cache file.
> > > >>>>>>>> [pool-1-thread-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest -
> > > >>>>>>>> The preauth data is empty.
> > > >>>>>>>> [pool-1-thread-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> > > >>>>>>>> - KRB error occurred while processing request:Additional
> > > >>>>>>>> pre-authentication required [pool-1-thread-2] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > > >>>>>>>> AS_REQ
> > > >>>>>> ISSUE:
> > > >>>>>>>> authtime 1493972505948,test-service/localhost@TEST.COM for
> > > krbtgt/
> > > >>>>>>>> TEST.COM@TEST.COM Exception in thread "Thread-0"
> > > >>>>>>>> java.lang.RuntimeException: Error occured while checking udp
> > > >>>>>> connections
> > > >>>>>>>> at
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > >>>>>>>> KdcNetwork.java:105)
> > > >>>>>>>> at
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > >>>>>>>> access$000(KdcNetwork.java:39)
> > > >>>>>>>> at
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > > >>>>>>>> run(KdcNetwork.java:75)
> > > >>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > > >>>>>>>> Caused by: java.nio.channels.ClosedChannelException
> > > >>>>>>>> at
> > > >>>>>>>> sun.nio.ch.DatagramChannelImpl.ensureOpen(
> > > >>>>>> DatagramChannelImpl.java:320)
> > > >>>>>>>> at sun.nio.ch.DatagramChannelImpl.receive(
> > > >>>>>>>> DatagramChannelImpl.java:331)
> > > >>>>>>>> at
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > >>>>>>>> checkUdpMessage(KdcNetwork.java:132)
> > > >>>>>>>> at
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > >>>>>>>> KdcNetwork.java:101)
> > > >>>>>>>> ... 3 more
> > > >>>>>>>>
> > > >>>>>>>>
> > > >>>>>>>> krb5.conf:
> > > >>>>>>>>
> > > >>>>>>>> [libdefaults]
> > > >>>>>>>> kdc_realm = TEST.COM
> > > >>>>>>>> default_realm = TEST.COM
> > > >>>>>>>> udp_preference_limit = 4096
> > > >>>>>>>> kdc_tcp_port = 37080
> > > >>>>>>>> kdc_udp_port = 36525
> > > >>>>>>>>
> > > >>>>>>>> [realms]
> > > >>>>>>>> TEST.COM = {
> > > >>>>>>>> kdc = localhost:36525
> > > >>>>>>>> }
> > > >>>>>>>>
> > > >>>>>>>> And port 36525 does not show up in `netstat -l` (while 37080
> > > >>>>>>>> does)
> > > >>>>>>>>
> > > >>>>>>>>
> > > >>>>>>>> Op 04-05-17 om 14:55 schreef Li, Jiajia:
> > > >>>>>>>>> Hi Marc,
> > > >>>>>>>>> I try to run your test(through applying your patch in the
> > > >>>>>>>>> trunk) , I
> > > >>>>>>>> think it's success now. Could you take some time to check
> > > >>>>>>>> about
> > > it?
> > > >>>>>>>>> Here is the log:
> > > >>>>>>>>>
> > > >>>>>>>>> directory-kerby git:(trunk) ? .
> > > >>>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerb
> > > >>>>>>>>> eros
> > > >>>>>>>>> /k
> > > >>>>>>>>> er
> > > >>>>>>>>> b/
> > > >>>>>>>>> server/MitIssueTest.sh
> > > >>>>>>>>> kerberos.authGSSClientInit successful
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: entypes not
> > > >>>>>>>>> supported
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > >>>>>>>>> credential for krb5_ccache_conf_data/realm-
> config@X-CACHECONF:
> > > >>>>>>>>> in cache
> > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > >>>>>>>>> credential for test-service/localhost@TEST.COM in cache
> > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > >>>>>>>>> credential for
> > > >>>>>>>>> krb5_ccache_conf_data/negative-cache/test-service\134/localh
> > > >>>>>>>>> ost\
> > > >>>>>>>>> 13
> > > >>>>>>>>> 4@
> > > >>>>>>>>> TE
> > > >>>>>>>>> ST.COM@X-CACHECONF: in cache
> > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > >>>>>>>>> credential for krb5_ccache_conf_data/lkdc-
> hostname@X-CACHECONF
> > :
> > > >>>>>>>>> in cache
> > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > >>>>>>>>> credential for krb5_ccache_conf_data/sitename@X-CACHECONF:
> > > >>>>>>>>> in cache
> > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > >>>>>>>>> credential for test-service/localhost@TEST.COM in cache
> > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > >>>>>>>>> des-cbc-md5-deprecated not supported
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > >>>>>>>>> des-cbc-md4-deprecated not supported
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > >>>>>>>>> des-cbc-crc-deprecated not supported
> > > >>>>>>>>> 2017-05-04T20:44:06 Trying to find service kdc for realm
> > > >>>>>>>>> TEST.COM flags 0
> > > >>>>>>>>> 2017-05-04T20:44:06 configuration file for realm TEST.COM
> > > >>>>>>>>> found
> > > >>>>>>>>> 2017-05-04T20:44:06 submissing new requests to new host
> > > >>>>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
> > > >>>>>>>>> 2017-05-04T20:44:06 connecting to host: udp ::1:52534
> > > >>>>>>>>> (localhost)
> > > >>>>>> tid:
> > > >>>>>>>>> 00000001
> > > >>>>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
> > > >>>>>>>>> 2017-05-04T20:44:06 Queuing host in future (in 3s), its the
> > > >>>>>>>>> 2 address on the same name: udp 127.0.0.1:52534 (localhost)
> > tid:
> > > >>>>>>>>> 00000002
> > > >>>>>>>>> 2017-05-04T20:44:06 writing packet: udp ::1:52534
> > > >>>>>>>>> (localhost)
> > > tid:
> > > >>>>>>>>> 00000001
> > > >>>>>>>>> 2017-05-04T20:44:06 reading packet: udp ::1:52534
> > > >>>>>>>>> (localhost)
> > > tid:
> > > >>>>>>>>> 00000001
> > > >>>>>>>>> 2017-05-04T20:44:06 host completed: udp ::1:52534
> > > >>>>>>>>> (localhost)
> > > tid:
> > > >>>>>>>>> 00000001
> > > >>>>>>>>> 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0
> > > >>>>>>>>> hosts 1 packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814
> > > >>>>>>>>> tid: 00000002
> > > >>>>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/763641F3
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328353: Decrypt
> > > >>>>>>>>> integrity check failed for checksum type
> > > >>>>>>>>> hmac-sha1-96-aes128, key type
> > > >>>>>>>>> aes128-cts-hmac-sha1-96
> > > >>>>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
> > > >>>>>>>>> 2017-05-04T20:44:06 krb5_get_credentials_with_flags:
> > > >>>>>>>>> TEST.COM
> > > wc:
> > > >>>>>>>>> 0.050317
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > >>>>>>>>> credential for krb5_ccache_conf_data/realm-
> config@X-CACHECONF:
> > > >>>>>>>>> in cache
> > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > >>>>>>>>> credential for
> > > >>>>>>>>> krb5_ccache_conf_data/time-offset/test-service\134/
> > > >>>>>> localhost\134@TEST.
> > > >>>>>>>>> COM@X-CACHECONF: in cache
> > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>> 2017-05-04T20:44:06 Setting up PFS for auth context
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > >>>>>>>>> des-cbc-md5-deprecated not supported
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > >>>>>>>>> des-cbc-md4-deprecated not supported
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > >>>>>>>>> des-cbc-crc-deprecated not supported First
> > > >>>>>>>>> kerberos.authGSSClientStep successful
> > > >>>>>>>>>
> > > >>>>>>>>> Thanks
> > > >>>>>>>>> Jiajia
> > > >>>>>>>>>
> > > >>>>>>>>> -----Original Message-----
> > > >>>>>>>>> From: Zheng, Kai [mailto:kai.zheng@intel.com]
> > > >>>>>>>>> Sent: Wednesday, May 3, 2017 7:29 PM
> > > >>>>>>>>> To: kerby@directory.apache.org
> > > >>>>>>>>> Subject: RE: MIT Kerberos compatibility
> > > >>>>>>>>>
> > > >>>>>>>>> Hi Marc,
> > > >>>>>>>>>
> > > >>>>>>>>> In case you're not aware of this, please check out the
> > > >>>>>>>>> latest fix made
> > > >>>>>>>> by Jiajia. We thought your case may be different, but would
> > > >>>>>>>> be good to have a check before we can repeat/fix your case.
> > Thanks.
> > > >>>>>>>>> https://issues.apache.org/jira/browse/DIRKRB-625
> > > >>>>>>>>>
> > > >>>>>>>>> Regards,
> > > >>>>>>>>> Kai
> > > >>>>>>>>>
> > > >>>>>>>>> -----Original Message-----
> > > >>>>>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> > > >>>>>>>>> Sent: Sunday, April 30, 2017 7:45 PM
> > > >>>>>>>>> To: kerby@directory.apache.org
> > > >>>>>>>>> Subject: Re: MIT Kerberos compatibility
> > > >>>>>>>>>
> > > >>>>>>>>> Hi Kai,
> > > >>>>>>>>>
> > > >>>>>>>>> The terminal output below is for the latest MIT Kerberos
> > > >>>>>>>>> 1.15.1 (locally
> > > >>>>>>>> built on Ubuntu Xenial). Before that, I also tested with the
> > > >>>>>>>> default Xenial MIT Kerberos packages (1.13.2), with the same
> > > >>>>>>>> result. I did not try earlier MIT Kerberos versions.
> > > >>>>>>>>>
> > > >>>>>>>>> Marc
> > > >>>>>>>>>
> > > >>>>>>>>> Op 29-04-17 om 21:42 schreef Marc de Lignie:
> > > >>>>>>>>>> Hi Kai,
> > > >>>>>>>>>>
> > > >>>>>>>>>> Thanks for the response. I prepared a minimal config that
> > > >>>>>>>>>> reproduces my problem.
> > > >>>>>>>>>>
> > > >>>>>>>>>> You can fetch the branch/commit from:
> > > >>>>>>>>>> https://github.com/vtslab/directory-kerby/commits/MitIssue
> > > >>>>>>>>>>
> > > >>>>>>>>>> This is relative to RC2, but I also tried this on trunk for
> > > >>>>>>>>>> my actual project.
> > > >>>>>>>>>>
> > > >>>>>>>>>> This config produces the debug and error messages below.
> > > >>>>>>>>>>
> > > >>>>>>>>>> 1. For the terminal with the bash + python script $ klist
> > > >>>>>>>>>> Ticket
> > > >>>>>>>>>> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>>> Default principal: drankye@TEST.COM
> > > >>>>>>>>>>
> > > >>>>>>>>>> Valid starting Expires Service principal
> > > >>>>>>>>>> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/
> > TEST.COM@TEST.COM
> > > >>>>>>>>>> renew until 29-04-17 21:07:39
> > > >>>>>>>>>>
> > > >>>>>>>>>> $ .
> > > >>>>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/ker
> > > >>>>>>>>>> bero s/ ke rb / server/MitIssueTest.sh [15538]
> > > >>>>>>>>>> 1493491231.917606:
> > > >>>>>>>>>> Retrieving drankye@TEST.COM from
> > > >>>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>>>> with
> > > >>>>>>>>>> result:
> > > >>>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>>>> found [15538]
> > > >>>>>>>>>> 1493491231.917827: Retrieving drankye@TEST.COM from
> > > >>>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>>>> with
> > > >>>>>>> result:
> > > >>>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>>>> found kerberos.authGSSClientInit successful [15538]
> > 1493491231.918185:
> > > >>>>>>>>>> Getting credentials drankye@TEST.COM ->
> > > >>>>>>>>>> test-service/localhost@ using ccache
> > > >>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>>> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
> > > >>>>>>>>>> test-service/localhost@ from
> > > >>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with
> > > result:
> > > >>>>>>>>>> -1765328243/Matching credential not found (filename:
> > > >>>>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> > > >>>>>>>>>> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
> > > >>>>>>>>>> test-service/localhost@TEST.COM with result:
> > > >>>>>>>>>> -1765328243/Matching credential not found (filename:
> > > >>>>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> > > >>>>>>>>>> [15538] 1493491231.918229: Server has referral realm;
> > > >>>>>>>>>> starting with test-service/localhost@TEST.COM [15538]
> > 1493491231.918278:
> > > >>>>>>>>>> Retrieving drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> from FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>>> with
> > > result:
> > > >>>>>>>>>> 0/Success
> > > >>>>>>>>>> [15538] 1493491231.918281: Starting with TGT for client
> realm:
> > > >>>>>>>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
> > > >>>>>>>>>> 1493491231.918301: Requesting tickets for
> > > >>>>>>>>>> test-service/localhost@TEST.COM, referrals on [15538]
> > > >>>>>>>>>> 1493491231.918326: Generated subkey for TGS request:
> > > >>>>>>>>>> aes128-cts/FA30
> > > >>>>>>>>>> [15538] 1493491231.918359: etypes requested in TGS request:
> > > >>>>>>>>>> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2,
> > > >>>>>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
> > > >>>>>>>>>> [15538]
> > > >>>>>> 1493491231.918484:
> > > >>>>>>>>>> Encoding request body and padata into FAST request [15538]
> > > >>>>>>>>>> 1493491231.918541: Sending request (836 bytes) to TEST.COM
> > > >>>>>>>>>> [15538]
> > > >>>>>>>>>> 1493491231.918597: Resolving hostname localhost [15538]
> > > >>>>>>>>>> 1493491231.918703: Initiating TCP connection to stream
> > > >>>>>>>>>> 127.0.0.1:44292
> > > >>>>>>>>>> [15538] 1493491231.918777: Sending TCP request to stream
> > > >>>>>>>>>> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error
> > > >>>>>>>>>> receiving from stream
> > > >>>>>>>>>> 127.0.0.1:44292: 104/Connection reset by peer [15538]
> > > >>>>>>>>>> 1493491231.922812: Terminating TCP connection to stream
> > > >>>>>>>>>> 127.0.0.1:44292
> > > >>>>>>>>>> [15538] 1493491231.922858: Sending initial UDP request to
> > > >>>>>>>>>> dgram
> > > >>>>>>>>>> 127.0.0.1:44292
> > > >>>>>>>>>> ('First kerberos.authGSSClientStep not successful',
> > > >>>>>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide
> > > >>>>>>>>>> more information', 851968), ("Cannot contact any KDC for
> > > >>>>>>>>>> realm 'TEST.COM'",
> > > >>>>>>>>>> -1765328228)))
> > > >>>>>>>>>>
> > > >>>>>>>>>> 2. For the terminal that runs mvn clean test
> > > >>>>>>>>>> -Dtest=MitIssueTest Running
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > > >>>>>>>>>> 2017-04-29 21:07:39,182 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> initialize called
> > > >>>>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> getIdentity called, principalName =
> > > >>>>>>>>>> krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> getIdentity failed, principalName =
> > > >>>>>>>>>> krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> addIdentity successful, principalName =
> > > >>>>>>>>>> krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> getIdentity called, principalName =
> > > >>>>>>>>>> kadmin/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> getIdentity failed, principalName =
> > > >>>>>>>>>> kadmin/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,213 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> addIdentity successful, principalName =
> > > >>>>>>>>>> kadmin/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,216 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> start called
> > > >>>>>>>>>> 2017-04-29 21:07:39,232 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> addIdentity successful, principalName =
> > > >>>>>>>>>> test-service/localhost@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,425 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> addIdentity successful, principalName = drankye@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1]
> > > >>>>> request.KdcRequest:
> > > >>>>>>>>>> Client entry is empty.
> > > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = drankye@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = drankye@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > > >>>>>>>>>> occurred, disconnecting abnormally java.io.EOFException
> > > >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:
> > 392)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > > >>>>>>>>>> r.ru
> > > >>>>>>>>>> n(
> > > >>>>>>>> DefaultKdcHandler.java:46)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > >>>>>>>> ThreadPoolExecutor.java:1142)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > >>>>>>>> ThreadPoolExecutor.java:617)
> > > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > > >>>>>>>>>> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase:
> > > >>>>>>>>>> Storing the tgt to the credential cache file.
> > > >>>>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> getIdentity called, principalName =
> > > >>>>>>>>>> test-service/localhost@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> getIdentity successful, principalName =
> > > >>>>>>>>>> test-service/localhost@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1]
> > > >>>>> request.KdcRequest:
> > > >>>>>>>>>> Client entry is empty.
> > > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1]
> > > >>>>> request.KdcRequest:
> > > >>>>>>>>>> The preauth data is empty.
> > > >>>>>>>>>> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1]
> > > server.KdcHandler:
> > > >>>>>>>>>> KRB error occurred while processing request:Additional
> > > >>>>>>>>>> pre-authentication required
> > > >>>>>>>>>> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > > >>>>>>>>>> occurred, disconnecting abnormally java.io.EOFException
> > > >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:
> > 392)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > > >>>>>>>>>> r.ru
> > > >>>>>>>>>> n(
> > > >>>>>>>> DefaultKdcHandler.java:46)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > >>>>>>>> ThreadPoolExecutor.java:1142)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > >>>>>>>> ThreadPoolExecutor.java:617)
> > > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > > >>>>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1]
> > > >>>>> request.KdcRequest:
> > > >>>>>>>>>> Client entry is empty.
> > > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > > >>>>>>>>>> occurred, disconnecting abnormally java.io.EOFException
> > > >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:
> > 392)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > > >>>>>>>>>> r.ru
> > > >>>>>>>>>> n(
> > > >>>>>>>> DefaultKdcHandler.java:46)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > >>>>>>>> ThreadPoolExecutor.java:1142)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > >>>>>>>> ThreadPoolExecutor.java:617)
> > > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > > >>>>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1]
> > > >>>>> request.KdcRequest:
> > > >>>>>>>>>> Found fast padata and start to process it.
> > > >>>>>>>>>> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
> > > >>>>>>>>>> impl.DefaultKdcHandler: Error occured while processing
> > request:
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding
> failed
> > > >>>>>>>>>> at org.apache.kerby.kerberos.
> kerb.KrbCodec.decode(KrbCodec.
> > > >>>>>>>> java:85)
> > > >>>>>>>>>> at org.apache.kerby.kerberos.
> kerb.KrbCodec.decode(KrbCodec.
> > > >>>>>>>> java:70)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kd
> > > >>>>>>>>>> cFin
> > > >>>>>>>>>> dF
> > > >>>>>>>>>> as
> > > >>>>>>>>>> t(
> > > >>>>>>>> KdcRequest.java:208)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.
> > > >>>>>>>> KdcRequest.process(KdcRequest.java:168)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
> > > >>>>>>>> handleMessage(KdcHandler.java:115)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.
> DefaultKdcHandler.
> > > >>>>>>>> handleMessage(DefaultKdcHandler.java:67)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > > >>>>>>>>>> r.ru
> > > >>>>>>>>>> n(
> > > >>>>>>>> DefaultKdcHandler.java:52)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > >>>>>>>> ThreadPoolExecutor.java:1142)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > >>>>>>>> ThreadPoolExecutor.java:617)
> > > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > > >>>>>>>>>> Caused by: java.io.IOException: Unexpected item context [0]
> > > >>>>>>>>>> [tag=0xA0, off=0, len=3+207], expecting 0x30
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > > >>>>>>>> Asn1Encodeable.java:210)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > > >>>>>>>> Asn1Encodeable.java:197)
> > > >>>>>>>>>> at org.apache.kerby.kerberos.
> kerb.KrbCodec.decode(KrbCodec.
> > > >>>>>>>> java:83)
> > > >>>>>>>>>> ... 9 more
> > > >>>>>>>>>> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > > >>>>>>>>>> occurred, disconnecting abnormally
> > > >>>>>>>>>> java.net.SocketException: Socket closed
> > > >>>>>>>>>> at java.net.SocketInputStream.socketRead0(Native Method)
> > > >>>>>>>>>> at java.net.SocketInputStream.
> socketRead(SocketInputStream.
> > > >>>>>>>> java:116)
> > > >>>>>>>>>> at java.net.SocketInputStream.
> read(SocketInputStream.java:
> > > >>>>> 171)
> > > >>>>>>>>>> at java.net.SocketInputStream.
> read(SocketInputStream.java:
> > > >>>>> 141)
> > > >>>>>>>>>> at java.net.SocketInputStream.
> read(SocketInputStream.java:
> > > >>>>> 224)
> > > >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:
> > 387)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > > >>>>>>>>>> r.ru
> > > >>>>>>>>>> n(
> > > >>>>>>>> DefaultKdcHandler.java:46)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > >>>>>>>> ThreadPoolExecutor.java:1142)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > >>>>>>>> ThreadPoolExecutor.java:617)
> > > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > > >>>>>>>>>>
> > > >>>>>>>>>> In a FreeIPA environment these python lines "just" work.
> > > >>>>>>>>>>
> > > >>>>>>>>>> Any suggestions are welcome!
> > > >>>>>>>>>>
> > > >>>>>>>>>> Marc
> > > >>>>>>>>>>
> > > >>>>>>>>>>
> > > >>>>>>>>> --
> > > >>>>>>>>> Marc de Lignie
> > > >>>>>>>>>
> > > >>>>>>>>
> > > >>>>>>>> --
> > > >>>>>>>> Marc de Lignie
> > > >>>>>>>>
> > > >>>>>>>>
> > > >>>>>>>
> > > >>>>>>>
> > > >>>>>>> --
> > > >>>>>>> Colm O hEigeartaigh
> > > >>>>>>>
> > > >>>>>>> Talend Community Coder
> > > >>>>>>> http://coders.talend.com
> > > >>>>>>>
> > > >>>>>>
> > > >>>>>>
> > > >>>>>>
> > > >>>>>> --
> > > >>>>>> Colm O hEigeartaigh
> > > >>>>>>
> > > >>>>>> Talend Community Coder
> > > >>>>>> http://coders.talend.com
> > > >>>>>>
> > > >>>>>
> > > >>>>>
> > > >>>>>
> > > >>>>> --
> > > >>>>> Colm O hEigeartaigh
> > > >>>>>
> > > >>>>> Talend Community Coder
> > > >>>>> http://coders.talend.com
> > > >>>>>
> > > >>>>
> > > >>>>
> > > >>>>
> > > >>>> --
> > > >>>> Colm O hEigeartaigh
> > > >>>>
> > > >>>> Talend Community Coder
> > > >>>> http://coders.talend.com
> > > >>>
> > > >>>
> > > >>
> > > >>
> > > >> --
> > > >> Colm O hEigeartaigh
> > > >>
> > > >> Talend Community Coder
> > > >> http://coders.talend.com
> > >
> >
> >
> >
> > --
> > Colm O hEigeartaigh
> >
> > Talend Community Coder
> > http://coders.talend.com
> >
>
>
>
> --
> Colm O hEigeartaigh
>
> Talend Community Coder
> http://coders.talend.com
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
Re: MIT Kerberos compatibility
Posted by Colm O hEigeartaigh <co...@apache.org>.
Yes, it works perfectly, thanks Jiajia for the fix! I'll resolve the JIRA.
Colm.
On Mon, Jun 19, 2017 at 6:09 AM, Li, Jiajia <ji...@intel.com> wrote:
> Hi Colm,
> Thanks for providing the way to reproduce the error, and I have the fix in
> trunk code, can you take some time to check it?
>
> Commit log:
> commit 106299efb7aa3001da89ae821eb43285c544bab7
> Author: plusplusjiajia <ji...@intel.com>
> Date: Mon Jun 19 13:07:04 2017 +0800
>
> Fix DIRKRB-629:ICMP Port Unreachable error message with GSS + default
> transport.
>
>
> Thanks
> Jiajia
>
> -----Original Message-----
> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> Sent: Monday, May 8, 2017 6:19 PM
> To: kerby@directory.apache.org
> Subject: Re: MIT Kerberos compatibility
>
> OK I have created a JIRA and attached a patch that you have to apply to the
> Apache WSS4J project to reproduce the error. If you uncomment the line that
> uses Netty then the tests all work perfectly. The tests appear to work fine
> when run in isolation, it's only when you run a few of them after one
> another that you can see the failures.
>
> Please let me know if you have any difficulty in reproducing, thanks!
>
> Colm.
>
> On Mon, May 8, 2017 at 11:08 AM, Zheng, Kai <ka...@intel.com> wrote:
>
> > Hi Colm,
> >
> > Sure, please do it. Could you review my change and see how it would cause
> > the new failures? Any difference between the failed GSS tests and the
> Kerby
> > GSS tests?
> >
> > Regards,
> > Kai
> >
> > -----Original Message-----
> > From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > Sent: Monday, May 08, 2017 5:42 PM
> > To: Zheng, Kai <ka...@intel.com>
> > Cc: kerby@directory.apache.org
> > Subject: Re: MIT Kerberos compatibility
> >
> > Hi Kai,
> >
> > Your changes fixed the error message I was seeing. However, I now see
> > another problem when I run a few GSS client tests in a row:
> >
> > >>> EType: sun.security.krb5.internal.crypto.Aes128CtsHmacSha1EType
> > >>> KrbAsReq creating message
> > >>> KrbKdcReq send: kdc=localhost UDP:42665, timeout=30000, number of
> > retries =3, #bytes=245
> > >>> KDCCommunication: kdc=localhost UDP:42665, timeout=30000,Attempt =1,
> > #bytes=245
> > SocketTimeOutException with attempt: 1
> > >>> KDCCommunication: kdc=localhost UDP:42665, timeout=30000,Attempt =2,
> > #bytes=245
> > >>> KrbKdcReq send: error trying localhost:42665
> > java.net.PortUnreachableException: ICMP Port Unreachable
> >
> > Do you want me to create a JIRA + attach a test-case?
> >
> > Colm.
> >
> > On Sat, May 6, 2017 at 2:01 AM, Zheng, Kai <ka...@intel.com> wrote:
> >
> > > I haven't repeated the issue but revisited the codes again and made
> > > improvements. Would you check it out? Thanks!
> > >
> > > Sent from iPhone
> > >
> > > > 在 2017年5月6日，上午6:28，Zheng, Kai <ka...@intel.com> 写道：
> > > >
> > > > Thanks colm for the clarification and it sounds an issue we need to
> > > address. I will investigate it soon.
> > > >
> > > > Sent from iPhone
> > > >
> > > >> 在 2017年5月6日，上午2:14，Colm O hEigeartaigh <co...@apache.org> 写道：
> > > >>
> > > >> Hi Kai,
> > > >>
> > > >> If I enable UDP with the default Transport, I can get a ticket fine
> > > using
> > > >> kinit. However then the following error pops up in the window I'm
> > > running
> > > >> Kerby in (as a test):
> > > >>
> > > >> Exception in thread "Thread-1" java.lang.RuntimeException: Error
> > > >> occured while checking udp connections
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > KdcNetwork.java:105)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > access$000(KdcNetwork.java:39)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > > run(KdcNetwork.java:75)
> > > >> at java.lang.Thread.run(Thread.java:748)
> > > >> Caused by: java.nio.channels.ClosedChannelException
> > > >> at
> > > >> sun.nio.ch.DatagramChannelImpl.ensureOpen(
> > DatagramChannelImpl.java:320)
> > > >> at sun.nio.ch.DatagramChannelImpl.receive(
> > > DatagramChannelImpl.java:331)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > checkUdpMessage(KdcNetwork.java:132)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > KdcNetwork.java:101)
> > > >>
> > > >> Colm.
> > > >>
> > > >>
> > > >>> On Fri, May 5, 2017 at 5:56 PM, Zheng, Kai <ka...@intel.com>
> > > wrote:
> > > >>>
> > > >>> Colm, did you see udp problem now instead? I'm a little confused.
> > > >>> Udp
> > > is
> > > >>> sure supported but may not be enabled by default, which should be
> > > >>> okay, imo. Thanks.
> > > >>>
> > > >>> Sent from iPhone
> > > >>>
> > > >>>> 在 2017年5月6日，上午12:02，Colm O hEigeartaigh <co...@apache.org> 写道：
> > > >>>>
> > > >>>> That's probably it. Why does the default transport not support
> > > >>>> UDP in
> > > >>> Kerby?
> > > >>>>
> > > >>>> Colm.
> > > >>>>
> > > >>>>> On Fri, May 5, 2017 at 4:54 PM, Li, Jiajia <ji...@intel.com>
> > > wrote:
> > > >>>>>
> > > >>>>> Are you sure add kdc_allow_udp = false in kdc.conf?
> > > >>>>>
> > > >>>>> Thanks
> > > >>>>> Jiajia
> > > >>>>>
> > > >>>>> -----Original Message-----
> > > >>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > > >>>>> Sent: Friday, May 5, 2017 11:41 PM
> > > >>>>> To: Li, Jiajia <ji...@intel.com>
> > > >>>>> Cc: kerby@directory.apache.org; Zheng, Kai
> > > >>>>> <ka...@intel.com>;
> > > >>> mailto:
> > > >>>>> m.c.delignie@xs4all.nl <m....@xs4all.nl>
> > > >>>>> Subject: Re: MIT Kerberos compatibility
> > > >>>>>
> > > >>>>> Sorry, it was my error, UDP was actually enabled there. But why
> > > >>>>> am I
> > > >>> still
> > > >>>>> seeing that error message?
> > > >>>>>
> > > >>>>> Colm.
> > > >>>>>
> > > >>>>>> On Fri, May 5, 2017 at 4:39 PM, Li, Jiajia
> > > >>>>>> <ji...@intel.com>
> > > >>> wrote:
> > > >>>>>>
> > > >>>>>> Hi Colm,
> > > >>>>>> I also test the Kerby KDC with kerby kint and MIT kinit, and
> > > >>>>>> only listen the tcp port(disable udp), both got ticket
> > > >>>>>> successfully. But
> > > I
> > > >>>>>> don't get the error message. Both krb.conf and kdc.conf should
> > > >>>>>> set
> > > udp
> > > >>>>>> to be false, udp is enabled in default.
> > > >>>>>>
> > > >>>>>> Thanks
> > > >>>>>> Jiajia
> > > >>>>>>
> > > >>>>>> -----Original Message-----
> > > >>>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > > >>>>>> Sent: Friday, May 5, 2017 11:34 PM
> > > >>>>>> To: kerby@directory.apache.org
> > > >>>>>> Cc: Zheng, Kai <ka...@intel.com>;
> > > >>>>>> mailto:m.c.delignie@xs4all.nl
> > > <
> > > >>>>>> m.c.delignie@xs4all.nl>
> > > >>>>>> Subject: Re: MIT Kerberos compatibility
> > > >>>>>>
> > > >>>>>> Hi Jiajia,
> > > >>>>>>
> > > >>>>>> If UDP is disabled and we don't use Netty, I can get a token
> > > >>>>>> successfully via kinit. However I then see an error message in
> > > >>>>>> the
> > > >>> Kerby
> > > >>>>> console:
> > > >>>>>>
> > > >>>>>> Exception in thread "Thread-1" java.lang.RuntimeException:
> > > >>>>>> Error occured while checking udp connections at
> > > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > >>>>>> KdcNetwork.java:105)
> > > >>>>>> at
> > > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > >>>>>> access$000(KdcNetwork.java:39)
> > > >>>>>> at
> > > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > > >>>>>> run(KdcNetwork.java:75)
> > > >>>>>> at java.lang.Thread.run(Thread.java:748)
> > > >>>>>> Caused by: java.nio.channels.ClosedChannelException
> > > >>>>>> at
> > > >>>>>> sun.nio.ch.DatagramChannelImpl.ensureOpen(
> > > >>> DatagramChannelImpl.java:320)
> > > >>>>>> at sun.nio.ch.DatagramChannelImpl.receive(
> > > >>>>>> DatagramChannelImpl.java:331)
> > > >>>>>> at
> > > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > >>>>>> checkUdpMessage(KdcNetwork.java:132)
> > > >>>>>> at
> > > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > >>>>>> KdcNetwork.java:101)
> > > >>>>>>
> > > >>>>>> I'm not sure why we are seeing UDP errors when it's disabled?
> > > >>>>>>
> > > >>>>>> Colm.
> > > >>>>>>
> > > >>>>>>> On Fri, May 5, 2017 at 3:57 PM, Li, Jiajia
> > > >>>>>>> <ji...@intel.com>
> > > >>> wrote:
> > > >>>>>>>
> > > >>>>>>> Hi Colm,
> > > >>>>>>> The shell client can't connect to kdc if the UDP is disabled.
> > > >>>>>>> We don't use Netty in default.
> > > >>>>>>> What's your test-cases? The same as the Marc's?
> > > >>>>>>>
> > > >>>>>>> Thanks
> > > >>>>>>> Jiajia
> > > >>>>>>>
> > > >>>>>>> -----Original Message-----
> > > >>>>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > > >>>>>>> Sent: Friday, May 5, 2017 10:09 PM
> > > >>>>>>> To: kerby@directory.apache.org
> > > >>>>>>> Cc: Zheng, Kai <ka...@intel.com>; mailto:
> > > m.c.delignie@xs4all.nl
> > > >>>>>>> < m.c.delignie@xs4all.nl>
> > > >>>>>>> Subject: Re: MIT Kerberos compatibility
> > > >>>>>>>
> > > >>>>>>> Hi Jiajia,
> > > >>>>>>>
> > > >>>>>>> What are the issues if UDP is disabled and we don't use Netty?
> > > >>>>>>> I tried doing this with my own test-cases and it didn't work,
> > > >>>>>>> so it would be good to get this fixed soon.
> > > >>>>>>>
> > > >>>>>>> Colm.
> > > >>>>>>>
> > > >>>>>>> On Fri, May 5, 2017 at 2:46 PM, Li, Jiajia
> > > >>>>>>> <ji...@intel.com>
> > > >>>>> wrote:
> > > >>>>>>>
> > > >>>>>>>> Hi Marc,
> > > >>>>>>>>>>> - your KRB5 tracing looks quite different. What OS and
> > > >>>>>>>>>>> mit-kerberos
> > > >>>>>>>> version did you use?
> > > >>>>>>>> I use mac os and the python version is 2.7.10
> > > >>>>>>>>
> > > >>>>>>>>>>> - your KRB5 tracing shows UDP comms between kerberos
> > > >>>>>>>>>>> client and KDC,
> > > >>>>>>>> despite the allowUDP = false setting
> > > >>>>>>>>>>> in my test. I did this setting because I get different
> > > >>>>>>>>>>> problems
> > > >>>>>>>> without it, see the additional logs below. So,
> > > >>>>>>>>>>> we must also be aware of networking problems at my side.
> > > >>>>>>>> I enable the UDP and use netty network, there are some issues
> > > >>>>>>>> if UDP disabled, you can create a JIRA for this and we can
> > > >>>>>>>> fix this issue in the next release version.
> > > >>>>>>>>
> > > >>>>>>>> The changes in my side as following:
> > > >>>>>>>>
> > > >>>>>>>> protected boolean allowUdp() { return true; } @Override
> > > >>>>>>>> protected void prepareKdc() throws KrbException {
> > > >>>>>>>> getKdcServer().setInnerKdcImpl(
> > > >>>>>>>> new
> > > >>>>>>>> NettyKdcServerImpl(getKdcServer().getKdcSetting()));
> > > >>>>>>>> super.prepareKdc();
> > > >>>>>>>> }
> > > >>>>>>>>
> > > >>>>>>>> Here is log of MitIssueTest:
> > > >>>>>>>> [INFO] Running
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > > >>>>>>>> io.netty.handler.logging.LoggingHandler
> > > >>>>>>>> -
> > > >>>>>>>> [id: 0x2634fe6b] REGISTERED
> > > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > > >>>>>>>> io.netty.handler.logging.LoggingHandler
> > > >>>>>>>> -
> > > >>>>>>>> [id: 0x2634fe6b] BIND(0.0.0.0/0.0.0.0:53957)
> > > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > > >>>>>>>> io.netty.handler.logging.LoggingHandler -
> > > >>>>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] ACTIVE [main] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kdc.impl.NettyKdcServerImpl - Netty
> > > >>>>>>>> kdc server started.
> > > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > > >>>>>>>> io.netty.handler.logging.LoggingHandler
> > > >>>>>>>> -
> > > >>>>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] RECEIVED: [id:
> > > >>>>>>>> 0xdac7228b, /
> > > >>>>>>>> 127.0.0.1:53961 => /127.0.0.1:53957]
> > > >>>>>>>> [defaultEventExecutorGroup-4-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
> > > >>>>>>>> - AS_REQ ISSUE: authtime 1493991123792,drankye@TEST.COM for
> > > >>>>>>>> krbtgt/ TEST.COM@TEST.COM [main] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> > > DefaultInternalKrbClien
> > > >>>>>>>> t
> > > >>>>>>>> - Send to kdc success.
> > > >>>>>>>> [main] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing
> > the tgt to the credential cache file.
> > > >>>>>>>> [nioEventLoopGroup-5-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> > > >>>>>>>> - The preauth data is empty.
> > > >>>>>>>> [nioEventLoopGroup-5-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> > > >>>>>>>> - KRB error occurred while processing request:Additional
> > > >>>>>>>> pre-authentication required [nioEventLoopGroup-5-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
> > > >>>>>>>> - AS_REQ ISSUE: authtime
> > > >>>>>>>> 1493991123859,test-service/localhost@TEST.COM
> > > >>>>>>>> for krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>> [nioEventLoopGroup-5-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.TgsRequest
> > > >>>>>>>> - TGS_REQ ISSUE: authtime 1493991142850,drankye for
> > > >>>>>>>> test-service/ localhost@TEST.COM
> > > >>>>>>>>
> > > >>>>>>>> Thanks
> > > >>>>>>>> Jiajia
> > > >>>>>>>>
> > > >>>>>>>> -----Original Message-----
> > > >>>>>>>> From: Zheng, Kai
> > > >>>>>>>> Sent: Friday, May 5, 2017 7:46 PM
> > > >>>>>>>> To: kerby@directory.apache.org; Li, Jiajia
> > > >>>>>>>> <ji...@intel.com>
> > > >>>>>>>> Subject: RE: MIT Kerberos compatibility
> > > >>>>>>>>
> > > >>>>>>>> Hi Marc,
> > > >>>>>>>>
> > > >>>>>>>> Looks like this is quite environment related, could you fire
> > > >>>>>>>> an issue for this? I would suggest we target it to 1.1.0,
> > > >>>>>>>> which can be done in
> > > >>>>>>> June.
> > > >>>>>>>>
> > > >>>>>>>> Regards,
> > > >>>>>>>> Kai
> > > >>>>>>>>
> > > >>>>>>>> -----Original Message-----
> > > >>>>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> > > >>>>>>>> Sent: Friday, May 05, 2017 4:44 PM
> > > >>>>>>>> To: Li, Jiajia <ji...@intel.com>
> > > >>>>>>>> Cc: kerby@directory.apache.org
> > > >>>>>>>> Subject: Re: MIT Kerberos compatibility
> > > >>>>>>>>
> > > >>>>>>>> Hi Jiajia,
> > > >>>>>>>>
> > > >>>>>>>> Great to read that you made progress on this issue and to see
> > > >>>>>>>> a working config at your side. Below, I list my progress
> > > >>>>>>>> below (with trunk merged into my MitIssue branch), but I am
> > > >>>>>>>> afraid we are not done
> > > >>>>>>> yet.
> > > >>>>>>>>
> > > >>>>>>>> Things that stand out:
> > > >>>>>>>>
> > > >>>>>>>> - the kdc decoding error is solved, relative to the logs
> > > >>>>>>>> without your patch
> > > >>>>>>>>
> > > >>>>>>>> - your KRB5 tracing looks quite different. What OS and
> > > >>>>>>>> mit-kerberos version did you use?
> > > >>>>>>>>
> > > >>>>>>>> - your KRB5 tracing shows UDP comms between kerberos client
> > > >>>>>>>> and KDC, despite the allowUDP = false setting in my test. I
> > > >>>>>>>> did this setting because I get different problems without it,
> > > >>>>>>>> see the additional logs below. So, we must also be aware of
> > > >>>>>>>> networking
> > > >>>>> problems at my side.
> > > >>>>>>>>
> > > >>>>>>>> - the "Response was not from master KDC" msg is not relevant;
> > > >>>>>>>> it disappears if you manually add master_kdc to the realms
> > > >>>>>>>> section of the krb5.conf
> > > >>>>>>>>
> > > >>>>>>>> I have no idea how to proceed from here, so that is why I
> > > >>>>>>>> just document the status at my side and ask about your -
> > > >>>>>>>> apparently working -
> > > >>>>>>> config.
> > > >>>>>>>>
> > > >>>>>>>> Cheers, Marc
> > > >>>>>>>>
> > > >>>>>>>>
> > > >>>>>>>> KDC logging with allowUDP = false:
> > > >>>>>>>>
> > > >>>>>>>> [INFO] Running
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > > >>>>>>>> [pool-1-thread-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > > >>>>>>>> AS_REQ
> > > >>>>>> ISSUE:
> > > >>>>>>>> authtime 1493970789075,drankye@TEST.COM for
> > > >>>>>>>> krbtgt/TEST.COM@TEST.COM [main] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> > > DefaultInternalKrbClien
> > > >>>>>>>> t
> > > >>>>>>>> - Send to kdc success.
> > > >>>>>>>> [main] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing
> > the tgt to the credential cache file.
> > > >>>>>>>> [pool-1-thread-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest -
> > > >>>>>>>> The preauth data is empty.
> > > >>>>>>>> [pool-1-thread-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> > > >>>>>>>> - KRB error occurred while processing request:Additional
> > > >>>>>>>> pre-authentication required [pool-1-thread-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > > >>>>>>>> AS_REQ
> > > >>>>>> ISSUE:
> > > >>>>>>>> authtime 1493970789108,test-service/localhost@TEST.COM for
> > > krbtgt/
> > > >>>>>>>> TEST.COM@TEST.COM [pool-1-thread-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> > > >>>>>>>> - Found fast padata and starting to process it.
> > > >>>>>>>> [pool-1-thread-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest -
> > > >>>>>>>> Found fast padata and starting to process it.
> > > >>>>>>>>
> > > >>>>>>>> Python script KRB5 tracing (MIT Kerberos 1.13.2 of Ubuntu
> > > >>>>>>>> Xenial) with allowUDP = false:
> > > >>>>>>>>
> > > >>>>>>>> $ .
> > > >>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/
> > > >>>>>>>> kerberos/kerb/server/MitIssueTest.sh
> > > >>>>>>>> [25281] 1493970797.298753: Retrieving drankye@TEST.COM from
> > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>> with
> > > >>>>> result:
> > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>> found [25281]
> > > >>>>>>>> 1493970797.298952: Retrieving drankye@TEST.COM from
> > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>> with
> > > >>>>> result:
> > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>> found [25281]
> > > >>>>>>>> 1493970797.299106: Retrieving drankye@TEST.COM from
> > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>> with
> > > >>>>> result:
> > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>> found [25281]
> > > >>>>>>>> 1493970797.299213: Retrieving drankye@TEST.COM from
> > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>> with
> > > >>>>> result:
> > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>> found [25281]
> > > >>>>>>>> 1493970797.299323: Retrieving drankye@TEST.COM from
> > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>> with
> > > >>>>> result:
> > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>> found [25281]
> > > >>>>>>>> 1493970797.299436: Retrieving drankye@TEST.COM from
> > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>> with
> > > >>>>> result:
> > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>> found [25281]
> > > >>>>>>>> 1493970797.299545: Retrieving drankye@TEST.COM from
> > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>> with
> > > >>>>> result:
> > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>> found [25281]
> > > >>>>>>>> 1493970797.299654: Retrieving drankye@TEST.COM from
> > > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>> with
> > > >>>>> result:
> > > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>> found kerberos.authGSSClientInit successful [25281]
> > 1493970797.299922:
> > > >>>>>>>> Getting credentials drankye@TEST.COM ->
> > > >>>>>>>> test-service/localhost@ using ccache
> > > >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>> [25281] 1493970797.299945: Retrieving drankye@TEST.COM ->
> > > >>>>>>>> test-service/localhost@ from
> > > >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>> with result:
> > > >>>>>>>> -1765328243/Matching credential not found [25281]
> > > 1493970797.299959:
> > > >>>>>>>> Retrying drankye@TEST.COM -> test-service/localhost@TEST.COM
> > > >>>>>>>> with
> > > >>>>>>> result:
> > > >>>>>>>> -1765328243/Matching credential not found [25281]
> > > 1493970797.299962:
> > > >>>>>>>> Server has referral realm; starting with
> > > >>>>>>>> test-service/localhost@TEST.COM [25281]
> > > >>>>>>>> 1493970797.299975: Retrieving drankye@TEST.COM ->
> > > >>>>>>>> krbtgt/TEST.COM@TEST.COM from
> > > >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>> with result:
> > > >>>>>>>> 0/Success [25281] 1493970797.299979: Starting with TGT for
> > > >>>>>>>> client
> > > >>>>>> realm:
> > > >>>>>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [25281]
> > > >>>>>> 1493970797.299981:
> > > >>>>>>>> Requesting tickets for test-service/localhost@TEST.COM,
> > > >>>>>>>> referrals on [25281] 1493970797.299994: Generated subkey for
> > TGS request:
> > > >>>>>>>> aes128-cts/1B9B [25281] 1493970797.300009: etypes requested
> > > >>>>>>>> in TGS
> > > >>>>>>> request:
> > > >>>>>>>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac,
> > > >>>>>>>> camellia128-cts, camellia256-cts [25281] 1493970797.300054:
> > > >>>>>>>> Encoding request body and padata into FAST request [25281]
> > > >>>>>>>> 1493970797.300080: Sending request
> > > >>>>>>>> (823 bytes) to TEST.COM [25281] 1493970797.300091: Resolving
> > > >>>>>>>> hostname localhost [25281]
> > > >>>>>>>> 1493970797.300136: Initiating TCP connection to stream
> > > >>>>>>>> 127.0.0.1:34319
> > > >>>>>>>> [25281] 1493970797.300191: Sending TCP request to stream
> > > >>>>>>>> 127.0.0.1:34319 [25281] 1493970797.303610: Received answer
> > > >>>>>>>> (125
> > > >>>>>>>> bytes) from stream
> > > >>>>>>>> 127.0.0.1:34319
> > > >>>>>>>> [25281] 1493970797.303618: Terminating TCP connection to
> > > >>>>>>>> stream
> > > >>>>>>>> 127.0.0.1:34319
> > > >>>>>>>> [25281] 1493970797.553126: Response was not from master KDC
> > > >>>>>>>> [25281]
> > > >>>>>>>> 1493970797.553198: TGS request result: -1765323383/Unknown
> > > >>>>>>>> code krcM
> > > >>>>>>>> 137 [25281] 1493970797.553234: Requesting tickets for
> > > >>>>>>>> test-service/ localhost@TEST.COM, referrals off [25281]
> > > >>>>> 1493970797.553273:
> > > >>>>>>>> Generated subkey for TGS request: aes128-cts/94C6 [25281]
> > > >>>>>> 1493970797.553323:
> > > >>>>>>>> etypes requested in TGS request: aes256-cts, aes128-cts,
> > > >>>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
> > > >>>>>>>> [25281]
> > > >>>>>>>> 1493970797.553436: Encoding request body and padata into FAST
> > > >>>>>>>> request
> > > >>>>>>> [25281] 1493970797.553532:
> > > >>>>>>>> Sending request (823 bytes) to TEST.COM [25281]
> > > 1493970797.553567:
> > > >>>>>>>> Resolving hostname localhost [25281] 1493970797.553745:
> > > >>>>>>>> Initiating TCP connection to stream
> > > >>>>>>>> 127.0.0.1:34319
> > > >>>>>>>> [25281] 1493970797.553889: Sending TCP request to stream
> > > >>>>>>>> 127.0.0.1:34319 [25281] 1493970797.558297: Received answer
> > > >>>>>>>> (125
> > > >>>>>>>> bytes) from stream
> > > >>>>>>>> 127.0.0.1:34319
> > > >>>>>>>> [25281] 1493970797.558318: Terminating TCP connection to
> > > >>>>>>>> stream
> > > >>>>>>>> 127.0.0.1:34319
> > > >>>>>>>> [25281] 1493970797.561189: Response was not from master KDC
> > > >>>>>>>> [25281]
> > > >>>>>>>> 1493970797.561258: TGS request result: -1765323383/Unknown
> > > >>>>>>>> code krcM
> > > >>>>>>>> 137 ('First kerberos.authGSSClientStep not successful',
> > > >>>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide
> > > >>>>>>>> more information', 851968), ('Unknown code krcM 137',
> > > >>>>>>>> -1765323383)))
> > > >>>>>>>>
> > > >>>>>>>>
> > > >>>>>>>> KDC logging with allowUDP = true:
> > > >>>>>>>>
> > > >>>>>>>> [INFO] Running
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > > >>>>>>>> [pool-1-thread-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > > >>>>>>>> AS_REQ
> > > >>>>>> ISSUE:
> > > >>>>>>>> authtime 1493972505784,drankye@TEST.COM for
> > > >>>>>>>> krbtgt/TEST.COM@TEST.COM [main] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> > > DefaultInternalKrbClien
> > > >>>>>>>> t
> > > >>>>>>>> - Send to kdc success.
> > > >>>>>>>> [main] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing
> > the tgt to the credential cache file.
> > > >>>>>>>> [pool-1-thread-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest -
> > > >>>>>>>> The preauth data is empty.
> > > >>>>>>>> [pool-1-thread-1] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> > > >>>>>>>> - KRB error occurred while processing request:Additional
> > > >>>>>>>> pre-authentication required [pool-1-thread-2] INFO
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > > >>>>>>>> AS_REQ
> > > >>>>>> ISSUE:
> > > >>>>>>>> authtime 1493972505948,test-service/localhost@TEST.COM for
> > > krbtgt/
> > > >>>>>>>> TEST.COM@TEST.COM Exception in thread "Thread-0"
> > > >>>>>>>> java.lang.RuntimeException: Error occured while checking udp
> > > >>>>>> connections
> > > >>>>>>>> at
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > >>>>>>>> KdcNetwork.java:105)
> > > >>>>>>>> at
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > >>>>>>>> access$000(KdcNetwork.java:39)
> > > >>>>>>>> at
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > > >>>>>>>> run(KdcNetwork.java:75)
> > > >>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > > >>>>>>>> Caused by: java.nio.channels.ClosedChannelException
> > > >>>>>>>> at
> > > >>>>>>>> sun.nio.ch.DatagramChannelImpl.ensureOpen(
> > > >>>>>> DatagramChannelImpl.java:320)
> > > >>>>>>>> at sun.nio.ch.DatagramChannelImpl.receive(
> > > >>>>>>>> DatagramChannelImpl.java:331)
> > > >>>>>>>> at
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > >>>>>>>> checkUdpMessage(KdcNetwork.java:132)
> > > >>>>>>>> at
> > > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > >>>>>>>> KdcNetwork.java:101)
> > > >>>>>>>> ... 3 more
> > > >>>>>>>>
> > > >>>>>>>>
> > > >>>>>>>> krb5.conf:
> > > >>>>>>>>
> > > >>>>>>>> [libdefaults]
> > > >>>>>>>> kdc_realm = TEST.COM
> > > >>>>>>>> default_realm = TEST.COM
> > > >>>>>>>> udp_preference_limit = 4096
> > > >>>>>>>> kdc_tcp_port = 37080
> > > >>>>>>>> kdc_udp_port = 36525
> > > >>>>>>>>
> > > >>>>>>>> [realms]
> > > >>>>>>>> TEST.COM = {
> > > >>>>>>>> kdc = localhost:36525
> > > >>>>>>>> }
> > > >>>>>>>>
> > > >>>>>>>> And port 36525 does not show up in `netstat -l` (while 37080
> > > >>>>>>>> does)
> > > >>>>>>>>
> > > >>>>>>>>
> > > >>>>>>>> Op 04-05-17 om 14:55 schreef Li, Jiajia:
> > > >>>>>>>>> Hi Marc,
> > > >>>>>>>>> I try to run your test(through applying your patch in the
> > > >>>>>>>>> trunk) , I
> > > >>>>>>>> think it's success now. Could you take some time to check
> > > >>>>>>>> about
> > > it?
> > > >>>>>>>>> Here is the log:
> > > >>>>>>>>>
> > > >>>>>>>>> directory-kerby git:(trunk) ? .
> > > >>>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerb
> > > >>>>>>>>> eros
> > > >>>>>>>>> /k
> > > >>>>>>>>> er
> > > >>>>>>>>> b/
> > > >>>>>>>>> server/MitIssueTest.sh
> > > >>>>>>>>> kerberos.authGSSClientInit successful
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: entypes not
> > > >>>>>>>>> supported
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > >>>>>>>>> credential for krb5_ccache_conf_data/realm-
> config@X-CACHECONF:
> > > >>>>>>>>> in cache
> > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > >>>>>>>>> credential for test-service/localhost@TEST.COM in cache
> > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > >>>>>>>>> credential for
> > > >>>>>>>>> krb5_ccache_conf_data/negative-cache/test-service\134/localh
> > > >>>>>>>>> ost\
> > > >>>>>>>>> 13
> > > >>>>>>>>> 4@
> > > >>>>>>>>> TE
> > > >>>>>>>>> ST.COM@X-CACHECONF: in cache
> > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > >>>>>>>>> credential for krb5_ccache_conf_data/lkdc-
> hostname@X-CACHECONF
> > :
> > > >>>>>>>>> in cache
> > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > >>>>>>>>> credential for krb5_ccache_conf_data/sitename@X-CACHECONF:
> > > >>>>>>>>> in cache
> > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > >>>>>>>>> credential for test-service/localhost@TEST.COM in cache
> > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > >>>>>>>>> des-cbc-md5-deprecated not supported
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > >>>>>>>>> des-cbc-md4-deprecated not supported
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > >>>>>>>>> des-cbc-crc-deprecated not supported
> > > >>>>>>>>> 2017-05-04T20:44:06 Trying to find service kdc for realm
> > > >>>>>>>>> TEST.COM flags 0
> > > >>>>>>>>> 2017-05-04T20:44:06 configuration file for realm TEST.COM
> > > >>>>>>>>> found
> > > >>>>>>>>> 2017-05-04T20:44:06 submissing new requests to new host
> > > >>>>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
> > > >>>>>>>>> 2017-05-04T20:44:06 connecting to host: udp ::1:52534
> > > >>>>>>>>> (localhost)
> > > >>>>>> tid:
> > > >>>>>>>>> 00000001
> > > >>>>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
> > > >>>>>>>>> 2017-05-04T20:44:06 Queuing host in future (in 3s), its the
> > > >>>>>>>>> 2 address on the same name: udp 127.0.0.1:52534 (localhost)
> > tid:
> > > >>>>>>>>> 00000002
> > > >>>>>>>>> 2017-05-04T20:44:06 writing packet: udp ::1:52534
> > > >>>>>>>>> (localhost)
> > > tid:
> > > >>>>>>>>> 00000001
> > > >>>>>>>>> 2017-05-04T20:44:06 reading packet: udp ::1:52534
> > > >>>>>>>>> (localhost)
> > > tid:
> > > >>>>>>>>> 00000001
> > > >>>>>>>>> 2017-05-04T20:44:06 host completed: udp ::1:52534
> > > >>>>>>>>> (localhost)
> > > tid:
> > > >>>>>>>>> 00000001
> > > >>>>>>>>> 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0
> > > >>>>>>>>> hosts 1 packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814
> > > >>>>>>>>> tid: 00000002
> > > >>>>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/763641F3
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328353: Decrypt
> > > >>>>>>>>> integrity check failed for checksum type
> > > >>>>>>>>> hmac-sha1-96-aes128, key type
> > > >>>>>>>>> aes128-cts-hmac-sha1-96
> > > >>>>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
> > > >>>>>>>>> 2017-05-04T20:44:06 krb5_get_credentials_with_flags:
> > > >>>>>>>>> TEST.COM
> > > wc:
> > > >>>>>>>>> 0.050317
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > >>>>>>>>> credential for krb5_ccache_conf_data/realm-
> config@X-CACHECONF:
> > > >>>>>>>>> in cache
> > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > >>>>>>>>> credential for
> > > >>>>>>>>> krb5_ccache_conf_data/time-offset/test-service\134/
> > > >>>>>> localhost\134@TEST.
> > > >>>>>>>>> COM@X-CACHECONF: in cache
> > > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>> 2017-05-04T20:44:06 Setting up PFS for auth context
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > >>>>>>>>> des-cbc-md5-deprecated not supported
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > >>>>>>>>> des-cbc-md4-deprecated not supported
> > > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > >>>>>>>>> des-cbc-crc-deprecated not supported First
> > > >>>>>>>>> kerberos.authGSSClientStep successful
> > > >>>>>>>>>
> > > >>>>>>>>> Thanks
> > > >>>>>>>>> Jiajia
> > > >>>>>>>>>
> > > >>>>>>>>> -----Original Message-----
> > > >>>>>>>>> From: Zheng, Kai [mailto:kai.zheng@intel.com]
> > > >>>>>>>>> Sent: Wednesday, May 3, 2017 7:29 PM
> > > >>>>>>>>> To: kerby@directory.apache.org
> > > >>>>>>>>> Subject: RE: MIT Kerberos compatibility
> > > >>>>>>>>>
> > > >>>>>>>>> Hi Marc,
> > > >>>>>>>>>
> > > >>>>>>>>> In case you're not aware of this, please check out the
> > > >>>>>>>>> latest fix made
> > > >>>>>>>> by Jiajia. We thought your case may be different, but would
> > > >>>>>>>> be good to have a check before we can repeat/fix your case.
> > Thanks.
> > > >>>>>>>>> https://issues.apache.org/jira/browse/DIRKRB-625
> > > >>>>>>>>>
> > > >>>>>>>>> Regards,
> > > >>>>>>>>> Kai
> > > >>>>>>>>>
> > > >>>>>>>>> -----Original Message-----
> > > >>>>>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> > > >>>>>>>>> Sent: Sunday, April 30, 2017 7:45 PM
> > > >>>>>>>>> To: kerby@directory.apache.org
> > > >>>>>>>>> Subject: Re: MIT Kerberos compatibility
> > > >>>>>>>>>
> > > >>>>>>>>> Hi Kai,
> > > >>>>>>>>>
> > > >>>>>>>>> The terminal output below is for the latest MIT Kerberos
> > > >>>>>>>>> 1.15.1 (locally
> > > >>>>>>>> built on Ubuntu Xenial). Before that, I also tested with the
> > > >>>>>>>> default Xenial MIT Kerberos packages (1.13.2), with the same
> > > >>>>>>>> result. I did not try earlier MIT Kerberos versions.
> > > >>>>>>>>>
> > > >>>>>>>>> Marc
> > > >>>>>>>>>
> > > >>>>>>>>> Op 29-04-17 om 21:42 schreef Marc de Lignie:
> > > >>>>>>>>>> Hi Kai,
> > > >>>>>>>>>>
> > > >>>>>>>>>> Thanks for the response. I prepared a minimal config that
> > > >>>>>>>>>> reproduces my problem.
> > > >>>>>>>>>>
> > > >>>>>>>>>> You can fetch the branch/commit from:
> > > >>>>>>>>>> https://github.com/vtslab/directory-kerby/commits/MitIssue
> > > >>>>>>>>>>
> > > >>>>>>>>>> This is relative to RC2, but I also tried this on trunk for
> > > >>>>>>>>>> my actual project.
> > > >>>>>>>>>>
> > > >>>>>>>>>> This config produces the debug and error messages below.
> > > >>>>>>>>>>
> > > >>>>>>>>>> 1. For the terminal with the bash + python script $ klist
> > > >>>>>>>>>> Ticket
> > > >>>>>>>>>> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>>> Default principal: drankye@TEST.COM
> > > >>>>>>>>>>
> > > >>>>>>>>>> Valid starting Expires Service principal
> > > >>>>>>>>>> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/
> > TEST.COM@TEST.COM
> > > >>>>>>>>>> renew until 29-04-17 21:07:39
> > > >>>>>>>>>>
> > > >>>>>>>>>> $ .
> > > >>>>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/ker
> > > >>>>>>>>>> bero s/ ke rb / server/MitIssueTest.sh [15538]
> > > >>>>>>>>>> 1493491231.917606:
> > > >>>>>>>>>> Retrieving drankye@TEST.COM from
> > > >>>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>>>> with
> > > >>>>>>>>>> result:
> > > >>>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>>>> found [15538]
> > > >>>>>>>>>> 1493491231.917827: Retrieving drankye@TEST.COM from
> > > >>>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > > >>>>>>>>>> with
> > > >>>>>>> result:
> > > >>>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > > >>>>>>>>>> found kerberos.authGSSClientInit successful [15538]
> > 1493491231.918185:
> > > >>>>>>>>>> Getting credentials drankye@TEST.COM ->
> > > >>>>>>>>>> test-service/localhost@ using ccache
> > > >>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>>> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
> > > >>>>>>>>>> test-service/localhost@ from
> > > >>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with
> > > result:
> > > >>>>>>>>>> -1765328243/Matching credential not found (filename:
> > > >>>>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> > > >>>>>>>>>> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
> > > >>>>>>>>>> test-service/localhost@TEST.COM with result:
> > > >>>>>>>>>> -1765328243/Matching credential not found (filename:
> > > >>>>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> > > >>>>>>>>>> [15538] 1493491231.918229: Server has referral realm;
> > > >>>>>>>>>> starting with test-service/localhost@TEST.COM [15538]
> > 1493491231.918278:
> > > >>>>>>>>>> Retrieving drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> from FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >>>>>>>>>> with
> > > result:
> > > >>>>>>>>>> 0/Success
> > > >>>>>>>>>> [15538] 1493491231.918281: Starting with TGT for client
> realm:
> > > >>>>>>>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
> > > >>>>>>>>>> 1493491231.918301: Requesting tickets for
> > > >>>>>>>>>> test-service/localhost@TEST.COM, referrals on [15538]
> > > >>>>>>>>>> 1493491231.918326: Generated subkey for TGS request:
> > > >>>>>>>>>> aes128-cts/FA30
> > > >>>>>>>>>> [15538] 1493491231.918359: etypes requested in TGS request:
> > > >>>>>>>>>> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2,
> > > >>>>>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
> > > >>>>>>>>>> [15538]
> > > >>>>>> 1493491231.918484:
> > > >>>>>>>>>> Encoding request body and padata into FAST request [15538]
> > > >>>>>>>>>> 1493491231.918541: Sending request (836 bytes) to TEST.COM
> > > >>>>>>>>>> [15538]
> > > >>>>>>>>>> 1493491231.918597: Resolving hostname localhost [15538]
> > > >>>>>>>>>> 1493491231.918703: Initiating TCP connection to stream
> > > >>>>>>>>>> 127.0.0.1:44292
> > > >>>>>>>>>> [15538] 1493491231.918777: Sending TCP request to stream
> > > >>>>>>>>>> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error
> > > >>>>>>>>>> receiving from stream
> > > >>>>>>>>>> 127.0.0.1:44292: 104/Connection reset by peer [15538]
> > > >>>>>>>>>> 1493491231.922812: Terminating TCP connection to stream
> > > >>>>>>>>>> 127.0.0.1:44292
> > > >>>>>>>>>> [15538] 1493491231.922858: Sending initial UDP request to
> > > >>>>>>>>>> dgram
> > > >>>>>>>>>> 127.0.0.1:44292
> > > >>>>>>>>>> ('First kerberos.authGSSClientStep not successful',
> > > >>>>>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide
> > > >>>>>>>>>> more information', 851968), ("Cannot contact any KDC for
> > > >>>>>>>>>> realm 'TEST.COM'",
> > > >>>>>>>>>> -1765328228)))
> > > >>>>>>>>>>
> > > >>>>>>>>>> 2. For the terminal that runs mvn clean test
> > > >>>>>>>>>> -Dtest=MitIssueTest Running
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > > >>>>>>>>>> 2017-04-29 21:07:39,182 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> initialize called
> > > >>>>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> getIdentity called, principalName =
> > > >>>>>>>>>> krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> getIdentity failed, principalName =
> > > >>>>>>>>>> krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> addIdentity successful, principalName =
> > > >>>>>>>>>> krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> getIdentity called, principalName =
> > > >>>>>>>>>> kadmin/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> getIdentity failed, principalName =
> > > >>>>>>>>>> kadmin/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,213 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> addIdentity successful, principalName =
> > > >>>>>>>>>> kadmin/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,216 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> start called
> > > >>>>>>>>>> 2017-04-29 21:07:39,232 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> addIdentity successful, principalName =
> > > >>>>>>>>>> test-service/localhost@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,425 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> addIdentity successful, principalName = drankye@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1]
> > > >>>>> request.KdcRequest:
> > > >>>>>>>>>> Client entry is empty.
> > > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = drankye@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = drankye@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > > >>>>>>>>>> occurred, disconnecting abnormally java.io.EOFException
> > > >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:
> > 392)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > > >>>>>>>>>> r.ru
> > > >>>>>>>>>> n(
> > > >>>>>>>> DefaultKdcHandler.java:46)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > >>>>>>>> ThreadPoolExecutor.java:1142)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > >>>>>>>> ThreadPoolExecutor.java:617)
> > > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > > >>>>>>>>>> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase:
> > > >>>>>>>>>> Storing the tgt to the credential cache file.
> > > >>>>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> getIdentity called, principalName =
> > > >>>>>>>>>> test-service/localhost@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
> > > >>>>>> AbstractIdentityBackend:
> > > >>>>>>>>>> getIdentity successful, principalName =
> > > >>>>>>>>>> test-service/localhost@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1]
> > > >>>>> request.KdcRequest:
> > > >>>>>>>>>> Client entry is empty.
> > > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1]
> > > >>>>> request.KdcRequest:
> > > >>>>>>>>>> The preauth data is empty.
> > > >>>>>>>>>> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1]
> > > server.KdcHandler:
> > > >>>>>>>>>> KRB error occurred while processing request:Additional
> > > >>>>>>>>>> pre-authentication required
> > > >>>>>>>>>> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > > >>>>>>>>>> occurred, disconnecting abnormally java.io.EOFException
> > > >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:
> > 392)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > > >>>>>>>>>> r.ru
> > > >>>>>>>>>> n(
> > > >>>>>>>> DefaultKdcHandler.java:46)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > >>>>>>>> ThreadPoolExecutor.java:1142)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > >>>>>>>> ThreadPoolExecutor.java:617)
> > > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > > >>>>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1]
> > > >>>>> request.KdcRequest:
> > > >>>>>>>>>> Client entry is empty.
> > > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > > >>>>>>>>>> occurred, disconnecting abnormally java.io.EOFException
> > > >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:
> > 392)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > > >>>>>>>>>> r.ru
> > > >>>>>>>>>> n(
> > > >>>>>>>> DefaultKdcHandler.java:46)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > >>>>>>>> ThreadPoolExecutor.java:1142)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > >>>>>>>> ThreadPoolExecutor.java:617)
> > > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > > >>>>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > > >>>>>>>>>> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1]
> > > >>>>> request.KdcRequest:
> > > >>>>>>>>>> Found fast padata and start to process it.
> > > >>>>>>>>>> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
> > > >>>>>>>>>> impl.DefaultKdcHandler: Error occured while processing
> > request:
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding
> failed
> > > >>>>>>>>>> at org.apache.kerby.kerberos.
> kerb.KrbCodec.decode(KrbCodec.
> > > >>>>>>>> java:85)
> > > >>>>>>>>>> at org.apache.kerby.kerberos.
> kerb.KrbCodec.decode(KrbCodec.
> > > >>>>>>>> java:70)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kd
> > > >>>>>>>>>> cFin
> > > >>>>>>>>>> dF
> > > >>>>>>>>>> as
> > > >>>>>>>>>> t(
> > > >>>>>>>> KdcRequest.java:208)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.
> > > >>>>>>>> KdcRequest.process(KdcRequest.java:168)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
> > > >>>>>>>> handleMessage(KdcHandler.java:115)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.
> DefaultKdcHandler.
> > > >>>>>>>> handleMessage(DefaultKdcHandler.java:67)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > > >>>>>>>>>> r.ru
> > > >>>>>>>>>> n(
> > > >>>>>>>> DefaultKdcHandler.java:52)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > >>>>>>>> ThreadPoolExecutor.java:1142)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > >>>>>>>> ThreadPoolExecutor.java:617)
> > > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > > >>>>>>>>>> Caused by: java.io.IOException: Unexpected item context [0]
> > > >>>>>>>>>> [tag=0xA0, off=0, len=3+207], expecting 0x30
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > > >>>>>>>> Asn1Encodeable.java:210)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > > >>>>>>>> Asn1Encodeable.java:197)
> > > >>>>>>>>>> at org.apache.kerby.kerberos.
> kerb.KrbCodec.decode(KrbCodec.
> > > >>>>>>>> java:83)
> > > >>>>>>>>>> ... 9 more
> > > >>>>>>>>>> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
> > > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > > >>>>>>>>>> occurred, disconnecting abnormally
> > > >>>>>>>>>> java.net.SocketException: Socket closed
> > > >>>>>>>>>> at java.net.SocketInputStream.socketRead0(Native Method)
> > > >>>>>>>>>> at java.net.SocketInputStream.
> socketRead(SocketInputStream.
> > > >>>>>>>> java:116)
> > > >>>>>>>>>> at java.net.SocketInputStream.
> read(SocketInputStream.java:
> > > >>>>> 171)
> > > >>>>>>>>>> at java.net.SocketInputStream.
> read(SocketInputStream.java:
> > > >>>>> 141)
> > > >>>>>>>>>> at java.net.SocketInputStream.
> read(SocketInputStream.java:
> > > >>>>> 224)
> > > >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:
> > 387)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > > >>>>>>>>>> r.ru
> > > >>>>>>>>>> n(
> > > >>>>>>>> DefaultKdcHandler.java:46)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > >>>>>>>> ThreadPoolExecutor.java:1142)
> > > >>>>>>>>>> at
> > > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > >>>>>>>> ThreadPoolExecutor.java:617)
> > > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > > >>>>>>>>>>
> > > >>>>>>>>>> In a FreeIPA environment these python lines "just" work.
> > > >>>>>>>>>>
> > > >>>>>>>>>> Any suggestions are welcome!
> > > >>>>>>>>>>
> > > >>>>>>>>>> Marc
> > > >>>>>>>>>>
> > > >>>>>>>>>>
> > > >>>>>>>>> --
> > > >>>>>>>>> Marc de Lignie
> > > >>>>>>>>>
> > > >>>>>>>>
> > > >>>>>>>> --
> > > >>>>>>>> Marc de Lignie
> > > >>>>>>>>
> > > >>>>>>>>
> > > >>>>>>>
> > > >>>>>>>
> > > >>>>>>> --
> > > >>>>>>> Colm O hEigeartaigh
> > > >>>>>>>
> > > >>>>>>> Talend Community Coder
> > > >>>>>>> http://coders.talend.com
> > > >>>>>>>
> > > >>>>>>
> > > >>>>>>
> > > >>>>>>
> > > >>>>>> --
> > > >>>>>> Colm O hEigeartaigh
> > > >>>>>>
> > > >>>>>> Talend Community Coder
> > > >>>>>> http://coders.talend.com
> > > >>>>>>
> > > >>>>>
> > > >>>>>
> > > >>>>>
> > > >>>>> --
> > > >>>>> Colm O hEigeartaigh
> > > >>>>>
> > > >>>>> Talend Community Coder
> > > >>>>> http://coders.talend.com
> > > >>>>>
> > > >>>>
> > > >>>>
> > > >>>>
> > > >>>> --
> > > >>>> Colm O hEigeartaigh
> > > >>>>
> > > >>>> Talend Community Coder
> > > >>>> http://coders.talend.com
> > > >>>
> > > >>>
> > > >>
> > > >>
> > > >> --
> > > >> Colm O hEigeartaigh
> > > >>
> > > >> Talend Community Coder
> > > >> http://coders.talend.com
> > >
> >
> >
> >
> > --
> > Colm O hEigeartaigh
> >
> > Talend Community Coder
> > http://coders.talend.com
> >
>
>
>
> --
> Colm O hEigeartaigh
>
> Talend Community Coder
> http://coders.talend.com
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
RE: MIT Kerberos compatibility
Posted by "Li, Jiajia" <ji...@intel.com>.
Hi Colm,
Thanks for providing the way to reproduce the error, and I have the fix in trunk code, can you take some time to check it?
Commit log:
commit 106299efb7aa3001da89ae821eb43285c544bab7
Author: plusplusjiajia <ji...@intel.com>
Date: Mon Jun 19 13:07:04 2017 +0800
Fix DIRKRB-629:ICMP Port Unreachable error message with GSS + default transport.
Thanks
Jiajia
-----Original Message-----
From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
Sent: Monday, May 8, 2017 6:19 PM
To: kerby@directory.apache.org
Subject: Re: MIT Kerberos compatibility
OK I have created a JIRA and attached a patch that you have to apply to the
Apache WSS4J project to reproduce the error. If you uncomment the line that
uses Netty then the tests all work perfectly. The tests appear to work fine
when run in isolation, it's only when you run a few of them after one
another that you can see the failures.
Please let me know if you have any difficulty in reproducing, thanks!
Colm.
On Mon, May 8, 2017 at 11:08 AM, Zheng, Kai <ka...@intel.com> wrote:
> Hi Colm,
>
> Sure, please do it. Could you review my change and see how it would cause
> the new failures? Any difference between the failed GSS tests and the Kerby
> GSS tests?
>
> Regards,
> Kai
>
> -----Original Message-----
> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> Sent: Monday, May 08, 2017 5:42 PM
> To: Zheng, Kai <ka...@intel.com>
> Cc: kerby@directory.apache.org
> Subject: Re: MIT Kerberos compatibility
>
> Hi Kai,
>
> Your changes fixed the error message I was seeing. However, I now see
> another problem when I run a few GSS client tests in a row:
>
> >>> EType: sun.security.krb5.internal.crypto.Aes128CtsHmacSha1EType
> >>> KrbAsReq creating message
> >>> KrbKdcReq send: kdc=localhost UDP:42665, timeout=30000, number of
> retries =3, #bytes=245
> >>> KDCCommunication: kdc=localhost UDP:42665, timeout=30000,Attempt =1,
> #bytes=245
> SocketTimeOutException with attempt: 1
> >>> KDCCommunication: kdc=localhost UDP:42665, timeout=30000,Attempt =2,
> #bytes=245
> >>> KrbKdcReq send: error trying localhost:42665
> java.net.PortUnreachableException: ICMP Port Unreachable
>
> Do you want me to create a JIRA + attach a test-case?
>
> Colm.
>
> On Sat, May 6, 2017 at 2:01 AM, Zheng, Kai <ka...@intel.com> wrote:
>
> > I haven't repeated the issue but revisited the codes again and made
> > improvements. Would you check it out? Thanks!
> >
> > Sent from iPhone
> >
> > > 在 2017年5月6日，上午6:28，Zheng, Kai <ka...@intel.com> 写道：
> > >
> > > Thanks colm for the clarification and it sounds an issue we need to
> > address. I will investigate it soon.
> > >
> > > Sent from iPhone
> > >
> > >> 在 2017年5月6日，上午2:14，Colm O hEigeartaigh <co...@apache.org> 写道：
> > >>
> > >> Hi Kai,
> > >>
> > >> If I enable UDP with the default Transport, I can get a ticket fine
> > using
> > >> kinit. However then the following error pops up in the window I'm
> > running
> > >> Kerby in (as a test):
> > >>
> > >> Exception in thread "Thread-1" java.lang.RuntimeException: Error
> > >> occured while checking udp connections
> > >> at
> > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > KdcNetwork.java:105)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > access$000(KdcNetwork.java:39)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > run(KdcNetwork.java:75)
> > >> at java.lang.Thread.run(Thread.java:748)
> > >> Caused by: java.nio.channels.ClosedChannelException
> > >> at
> > >> sun.nio.ch.DatagramChannelImpl.ensureOpen(
> DatagramChannelImpl.java:320)
> > >> at sun.nio.ch.DatagramChannelImpl.receive(
> > DatagramChannelImpl.java:331)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > checkUdpMessage(KdcNetwork.java:132)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > KdcNetwork.java:101)
> > >>
> > >> Colm.
> > >>
> > >>
> > >>> On Fri, May 5, 2017 at 5:56 PM, Zheng, Kai <ka...@intel.com>
> > wrote:
> > >>>
> > >>> Colm, did you see udp problem now instead? I'm a little confused.
> > >>> Udp
> > is
> > >>> sure supported but may not be enabled by default, which should be
> > >>> okay, imo. Thanks.
> > >>>
> > >>> Sent from iPhone
> > >>>
> > >>>> 在 2017年5月6日，上午12:02，Colm O hEigeartaigh <co...@apache.org> 写道：
> > >>>>
> > >>>> That's probably it. Why does the default transport not support
> > >>>> UDP in
> > >>> Kerby?
> > >>>>
> > >>>> Colm.
> > >>>>
> > >>>>> On Fri, May 5, 2017 at 4:54 PM, Li, Jiajia <ji...@intel.com>
> > wrote:
> > >>>>>
> > >>>>> Are you sure add kdc_allow_udp = false in kdc.conf?
> > >>>>>
> > >>>>> Thanks
> > >>>>> Jiajia
> > >>>>>
> > >>>>> -----Original Message-----
> > >>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > >>>>> Sent: Friday, May 5, 2017 11:41 PM
> > >>>>> To: Li, Jiajia <ji...@intel.com>
> > >>>>> Cc: kerby@directory.apache.org; Zheng, Kai
> > >>>>> <ka...@intel.com>;
> > >>> mailto:
> > >>>>> m.c.delignie@xs4all.nl <m....@xs4all.nl>
> > >>>>> Subject: Re: MIT Kerberos compatibility
> > >>>>>
> > >>>>> Sorry, it was my error, UDP was actually enabled there. But why
> > >>>>> am I
> > >>> still
> > >>>>> seeing that error message?
> > >>>>>
> > >>>>> Colm.
> > >>>>>
> > >>>>>> On Fri, May 5, 2017 at 4:39 PM, Li, Jiajia
> > >>>>>> <ji...@intel.com>
> > >>> wrote:
> > >>>>>>
> > >>>>>> Hi Colm,
> > >>>>>> I also test the Kerby KDC with kerby kint and MIT kinit, and
> > >>>>>> only listen the tcp port(disable udp), both got ticket
> > >>>>>> successfully. But
> > I
> > >>>>>> don't get the error message. Both krb.conf and kdc.conf should
> > >>>>>> set
> > udp
> > >>>>>> to be false, udp is enabled in default.
> > >>>>>>
> > >>>>>> Thanks
> > >>>>>> Jiajia
> > >>>>>>
> > >>>>>> -----Original Message-----
> > >>>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > >>>>>> Sent: Friday, May 5, 2017 11:34 PM
> > >>>>>> To: kerby@directory.apache.org
> > >>>>>> Cc: Zheng, Kai <ka...@intel.com>;
> > >>>>>> mailto:m.c.delignie@xs4all.nl
> > <
> > >>>>>> m.c.delignie@xs4all.nl>
> > >>>>>> Subject: Re: MIT Kerberos compatibility
> > >>>>>>
> > >>>>>> Hi Jiajia,
> > >>>>>>
> > >>>>>> If UDP is disabled and we don't use Netty, I can get a token
> > >>>>>> successfully via kinit. However I then see an error message in
> > >>>>>> the
> > >>> Kerby
> > >>>>> console:
> > >>>>>>
> > >>>>>> Exception in thread "Thread-1" java.lang.RuntimeException:
> > >>>>>> Error occured while checking udp connections at
> > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > >>>>>> KdcNetwork.java:105)
> > >>>>>> at
> > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > >>>>>> access$000(KdcNetwork.java:39)
> > >>>>>> at
> > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > >>>>>> run(KdcNetwork.java:75)
> > >>>>>> at java.lang.Thread.run(Thread.java:748)
> > >>>>>> Caused by: java.nio.channels.ClosedChannelException
> > >>>>>> at
> > >>>>>> sun.nio.ch.DatagramChannelImpl.ensureOpen(
> > >>> DatagramChannelImpl.java:320)
> > >>>>>> at sun.nio.ch.DatagramChannelImpl.receive(
> > >>>>>> DatagramChannelImpl.java:331)
> > >>>>>> at
> > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > >>>>>> checkUdpMessage(KdcNetwork.java:132)
> > >>>>>> at
> > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > >>>>>> KdcNetwork.java:101)
> > >>>>>>
> > >>>>>> I'm not sure why we are seeing UDP errors when it's disabled?
> > >>>>>>
> > >>>>>> Colm.
> > >>>>>>
> > >>>>>>> On Fri, May 5, 2017 at 3:57 PM, Li, Jiajia
> > >>>>>>> <ji...@intel.com>
> > >>> wrote:
> > >>>>>>>
> > >>>>>>> Hi Colm,
> > >>>>>>> The shell client can't connect to kdc if the UDP is disabled.
> > >>>>>>> We don't use Netty in default.
> > >>>>>>> What's your test-cases? The same as the Marc's?
> > >>>>>>>
> > >>>>>>> Thanks
> > >>>>>>> Jiajia
> > >>>>>>>
> > >>>>>>> -----Original Message-----
> > >>>>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > >>>>>>> Sent: Friday, May 5, 2017 10:09 PM
> > >>>>>>> To: kerby@directory.apache.org
> > >>>>>>> Cc: Zheng, Kai <ka...@intel.com>; mailto:
> > m.c.delignie@xs4all.nl
> > >>>>>>> < m.c.delignie@xs4all.nl>
> > >>>>>>> Subject: Re: MIT Kerberos compatibility
> > >>>>>>>
> > >>>>>>> Hi Jiajia,
> > >>>>>>>
> > >>>>>>> What are the issues if UDP is disabled and we don't use Netty?
> > >>>>>>> I tried doing this with my own test-cases and it didn't work,
> > >>>>>>> so it would be good to get this fixed soon.
> > >>>>>>>
> > >>>>>>> Colm.
> > >>>>>>>
> > >>>>>>> On Fri, May 5, 2017 at 2:46 PM, Li, Jiajia
> > >>>>>>> <ji...@intel.com>
> > >>>>> wrote:
> > >>>>>>>
> > >>>>>>>> Hi Marc,
> > >>>>>>>>>>> - your KRB5 tracing looks quite different. What OS and
> > >>>>>>>>>>> mit-kerberos
> > >>>>>>>> version did you use?
> > >>>>>>>> I use mac os and the python version is 2.7.10
> > >>>>>>>>
> > >>>>>>>>>>> - your KRB5 tracing shows UDP comms between kerberos
> > >>>>>>>>>>> client and KDC,
> > >>>>>>>> despite the allowUDP = false setting
> > >>>>>>>>>>> in my test. I did this setting because I get different
> > >>>>>>>>>>> problems
> > >>>>>>>> without it, see the additional logs below. So,
> > >>>>>>>>>>> we must also be aware of networking problems at my side.
> > >>>>>>>> I enable the UDP and use netty network, there are some issues
> > >>>>>>>> if UDP disabled, you can create a JIRA for this and we can
> > >>>>>>>> fix this issue in the next release version.
> > >>>>>>>>
> > >>>>>>>> The changes in my side as following:
> > >>>>>>>>
> > >>>>>>>> protected boolean allowUdp() { return true; } @Override
> > >>>>>>>> protected void prepareKdc() throws KrbException {
> > >>>>>>>> getKdcServer().setInnerKdcImpl(
> > >>>>>>>> new
> > >>>>>>>> NettyKdcServerImpl(getKdcServer().getKdcSetting()));
> > >>>>>>>> super.prepareKdc();
> > >>>>>>>> }
> > >>>>>>>>
> > >>>>>>>> Here is log of MitIssueTest:
> > >>>>>>>> [INFO] Running
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > >>>>>>>> io.netty.handler.logging.LoggingHandler
> > >>>>>>>> -
> > >>>>>>>> [id: 0x2634fe6b] REGISTERED
> > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > >>>>>>>> io.netty.handler.logging.LoggingHandler
> > >>>>>>>> -
> > >>>>>>>> [id: 0x2634fe6b] BIND(0.0.0.0/0.0.0.0:53957)
> > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > >>>>>>>> io.netty.handler.logging.LoggingHandler -
> > >>>>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] ACTIVE [main] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kdc.impl.NettyKdcServerImpl - Netty
> > >>>>>>>> kdc server started.
> > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > >>>>>>>> io.netty.handler.logging.LoggingHandler
> > >>>>>>>> -
> > >>>>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] RECEIVED: [id:
> > >>>>>>>> 0xdac7228b, /
> > >>>>>>>> 127.0.0.1:53961 => /127.0.0.1:53957]
> > >>>>>>>> [defaultEventExecutorGroup-4-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
> > >>>>>>>> - AS_REQ ISSUE: authtime 1493991123792,drankye@TEST.COM for
> > >>>>>>>> krbtgt/ TEST.COM@TEST.COM [main] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> > DefaultInternalKrbClien
> > >>>>>>>> t
> > >>>>>>>> - Send to kdc success.
> > >>>>>>>> [main] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing
> the tgt to the credential cache file.
> > >>>>>>>> [nioEventLoopGroup-5-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> > >>>>>>>> - The preauth data is empty.
> > >>>>>>>> [nioEventLoopGroup-5-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> > >>>>>>>> - KRB error occurred while processing request:Additional
> > >>>>>>>> pre-authentication required [nioEventLoopGroup-5-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
> > >>>>>>>> - AS_REQ ISSUE: authtime
> > >>>>>>>> 1493991123859,test-service/localhost@TEST.COM
> > >>>>>>>> for krbtgt/TEST.COM@TEST.COM
> > >>>>>>>> [nioEventLoopGroup-5-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.TgsRequest
> > >>>>>>>> - TGS_REQ ISSUE: authtime 1493991142850,drankye for
> > >>>>>>>> test-service/ localhost@TEST.COM
> > >>>>>>>>
> > >>>>>>>> Thanks
> > >>>>>>>> Jiajia
> > >>>>>>>>
> > >>>>>>>> -----Original Message-----
> > >>>>>>>> From: Zheng, Kai
> > >>>>>>>> Sent: Friday, May 5, 2017 7:46 PM
> > >>>>>>>> To: kerby@directory.apache.org; Li, Jiajia
> > >>>>>>>> <ji...@intel.com>
> > >>>>>>>> Subject: RE: MIT Kerberos compatibility
> > >>>>>>>>
> > >>>>>>>> Hi Marc,
> > >>>>>>>>
> > >>>>>>>> Looks like this is quite environment related, could you fire
> > >>>>>>>> an issue for this? I would suggest we target it to 1.1.0,
> > >>>>>>>> which can be done in
> > >>>>>>> June.
> > >>>>>>>>
> > >>>>>>>> Regards,
> > >>>>>>>> Kai
> > >>>>>>>>
> > >>>>>>>> -----Original Message-----
> > >>>>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> > >>>>>>>> Sent: Friday, May 05, 2017 4:44 PM
> > >>>>>>>> To: Li, Jiajia <ji...@intel.com>
> > >>>>>>>> Cc: kerby@directory.apache.org
> > >>>>>>>> Subject: Re: MIT Kerberos compatibility
> > >>>>>>>>
> > >>>>>>>> Hi Jiajia,
> > >>>>>>>>
> > >>>>>>>> Great to read that you made progress on this issue and to see
> > >>>>>>>> a working config at your side. Below, I list my progress
> > >>>>>>>> below (with trunk merged into my MitIssue branch), but I am
> > >>>>>>>> afraid we are not done
> > >>>>>>> yet.
> > >>>>>>>>
> > >>>>>>>> Things that stand out:
> > >>>>>>>>
> > >>>>>>>> - the kdc decoding error is solved, relative to the logs
> > >>>>>>>> without your patch
> > >>>>>>>>
> > >>>>>>>> - your KRB5 tracing looks quite different. What OS and
> > >>>>>>>> mit-kerberos version did you use?
> > >>>>>>>>
> > >>>>>>>> - your KRB5 tracing shows UDP comms between kerberos client
> > >>>>>>>> and KDC, despite the allowUDP = false setting in my test. I
> > >>>>>>>> did this setting because I get different problems without it,
> > >>>>>>>> see the additional logs below. So, we must also be aware of
> > >>>>>>>> networking
> > >>>>> problems at my side.
> > >>>>>>>>
> > >>>>>>>> - the "Response was not from master KDC" msg is not relevant;
> > >>>>>>>> it disappears if you manually add master_kdc to the realms
> > >>>>>>>> section of the krb5.conf
> > >>>>>>>>
> > >>>>>>>> I have no idea how to proceed from here, so that is why I
> > >>>>>>>> just document the status at my side and ask about your -
> > >>>>>>>> apparently working -
> > >>>>>>> config.
> > >>>>>>>>
> > >>>>>>>> Cheers, Marc
> > >>>>>>>>
> > >>>>>>>>
> > >>>>>>>> KDC logging with allowUDP = false:
> > >>>>>>>>
> > >>>>>>>> [INFO] Running
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > >>>>>>>> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > >>>>>>>> AS_REQ
> > >>>>>> ISSUE:
> > >>>>>>>> authtime 1493970789075,drankye@TEST.COM for
> > >>>>>>>> krbtgt/TEST.COM@TEST.COM [main] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> > DefaultInternalKrbClien
> > >>>>>>>> t
> > >>>>>>>> - Send to kdc success.
> > >>>>>>>> [main] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing
> the tgt to the credential cache file.
> > >>>>>>>> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest -
> > >>>>>>>> The preauth data is empty.
> > >>>>>>>> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> > >>>>>>>> - KRB error occurred while processing request:Additional
> > >>>>>>>> pre-authentication required [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > >>>>>>>> AS_REQ
> > >>>>>> ISSUE:
> > >>>>>>>> authtime 1493970789108,test-service/localhost@TEST.COM for
> > krbtgt/
> > >>>>>>>> TEST.COM@TEST.COM [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> > >>>>>>>> - Found fast padata and starting to process it.
> > >>>>>>>> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest -
> > >>>>>>>> Found fast padata and starting to process it.
> > >>>>>>>>
> > >>>>>>>> Python script KRB5 tracing (MIT Kerberos 1.13.2 of Ubuntu
> > >>>>>>>> Xenial) with allowUDP = false:
> > >>>>>>>>
> > >>>>>>>> $ .
> > >>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/
> > >>>>>>>> kerberos/kerb/server/MitIssueTest.sh
> > >>>>>>>> [25281] 1493970797.298753: Retrieving drankye@TEST.COM from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found [25281]
> > >>>>>>>> 1493970797.298952: Retrieving drankye@TEST.COM from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found [25281]
> > >>>>>>>> 1493970797.299106: Retrieving drankye@TEST.COM from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found [25281]
> > >>>>>>>> 1493970797.299213: Retrieving drankye@TEST.COM from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found [25281]
> > >>>>>>>> 1493970797.299323: Retrieving drankye@TEST.COM from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found [25281]
> > >>>>>>>> 1493970797.299436: Retrieving drankye@TEST.COM from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found [25281]
> > >>>>>>>> 1493970797.299545: Retrieving drankye@TEST.COM from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found [25281]
> > >>>>>>>> 1493970797.299654: Retrieving drankye@TEST.COM from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found kerberos.authGSSClientInit successful [25281]
> 1493970797.299922:
> > >>>>>>>> Getting credentials drankye@TEST.COM ->
> > >>>>>>>> test-service/localhost@ using ccache
> > >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>> [25281] 1493970797.299945: Retrieving drankye@TEST.COM ->
> > >>>>>>>> test-service/localhost@ from
> > >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>> with result:
> > >>>>>>>> -1765328243/Matching credential not found [25281]
> > 1493970797.299959:
> > >>>>>>>> Retrying drankye@TEST.COM -> test-service/localhost@TEST.COM
> > >>>>>>>> with
> > >>>>>>> result:
> > >>>>>>>> -1765328243/Matching credential not found [25281]
> > 1493970797.299962:
> > >>>>>>>> Server has referral realm; starting with
> > >>>>>>>> test-service/localhost@TEST.COM [25281]
> > >>>>>>>> 1493970797.299975: Retrieving drankye@TEST.COM ->
> > >>>>>>>> krbtgt/TEST.COM@TEST.COM from
> > >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>> with result:
> > >>>>>>>> 0/Success [25281] 1493970797.299979: Starting with TGT for
> > >>>>>>>> client
> > >>>>>> realm:
> > >>>>>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [25281]
> > >>>>>> 1493970797.299981:
> > >>>>>>>> Requesting tickets for test-service/localhost@TEST.COM,
> > >>>>>>>> referrals on [25281] 1493970797.299994: Generated subkey for
> TGS request:
> > >>>>>>>> aes128-cts/1B9B [25281] 1493970797.300009: etypes requested
> > >>>>>>>> in TGS
> > >>>>>>> request:
> > >>>>>>>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac,
> > >>>>>>>> camellia128-cts, camellia256-cts [25281] 1493970797.300054:
> > >>>>>>>> Encoding request body and padata into FAST request [25281]
> > >>>>>>>> 1493970797.300080: Sending request
> > >>>>>>>> (823 bytes) to TEST.COM [25281] 1493970797.300091: Resolving
> > >>>>>>>> hostname localhost [25281]
> > >>>>>>>> 1493970797.300136: Initiating TCP connection to stream
> > >>>>>>>> 127.0.0.1:34319
> > >>>>>>>> [25281] 1493970797.300191: Sending TCP request to stream
> > >>>>>>>> 127.0.0.1:34319 [25281] 1493970797.303610: Received answer
> > >>>>>>>> (125
> > >>>>>>>> bytes) from stream
> > >>>>>>>> 127.0.0.1:34319
> > >>>>>>>> [25281] 1493970797.303618: Terminating TCP connection to
> > >>>>>>>> stream
> > >>>>>>>> 127.0.0.1:34319
> > >>>>>>>> [25281] 1493970797.553126: Response was not from master KDC
> > >>>>>>>> [25281]
> > >>>>>>>> 1493970797.553198: TGS request result: -1765323383/Unknown
> > >>>>>>>> code krcM
> > >>>>>>>> 137 [25281] 1493970797.553234: Requesting tickets for
> > >>>>>>>> test-service/ localhost@TEST.COM, referrals off [25281]
> > >>>>> 1493970797.553273:
> > >>>>>>>> Generated subkey for TGS request: aes128-cts/94C6 [25281]
> > >>>>>> 1493970797.553323:
> > >>>>>>>> etypes requested in TGS request: aes256-cts, aes128-cts,
> > >>>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
> > >>>>>>>> [25281]
> > >>>>>>>> 1493970797.553436: Encoding request body and padata into FAST
> > >>>>>>>> request
> > >>>>>>> [25281] 1493970797.553532:
> > >>>>>>>> Sending request (823 bytes) to TEST.COM [25281]
> > 1493970797.553567:
> > >>>>>>>> Resolving hostname localhost [25281] 1493970797.553745:
> > >>>>>>>> Initiating TCP connection to stream
> > >>>>>>>> 127.0.0.1:34319
> > >>>>>>>> [25281] 1493970797.553889: Sending TCP request to stream
> > >>>>>>>> 127.0.0.1:34319 [25281] 1493970797.558297: Received answer
> > >>>>>>>> (125
> > >>>>>>>> bytes) from stream
> > >>>>>>>> 127.0.0.1:34319
> > >>>>>>>> [25281] 1493970797.558318: Terminating TCP connection to
> > >>>>>>>> stream
> > >>>>>>>> 127.0.0.1:34319
> > >>>>>>>> [25281] 1493970797.561189: Response was not from master KDC
> > >>>>>>>> [25281]
> > >>>>>>>> 1493970797.561258: TGS request result: -1765323383/Unknown
> > >>>>>>>> code krcM
> > >>>>>>>> 137 ('First kerberos.authGSSClientStep not successful',
> > >>>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide
> > >>>>>>>> more information', 851968), ('Unknown code krcM 137',
> > >>>>>>>> -1765323383)))
> > >>>>>>>>
> > >>>>>>>>
> > >>>>>>>> KDC logging with allowUDP = true:
> > >>>>>>>>
> > >>>>>>>> [INFO] Running
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > >>>>>>>> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > >>>>>>>> AS_REQ
> > >>>>>> ISSUE:
> > >>>>>>>> authtime 1493972505784,drankye@TEST.COM for
> > >>>>>>>> krbtgt/TEST.COM@TEST.COM [main] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> > DefaultInternalKrbClien
> > >>>>>>>> t
> > >>>>>>>> - Send to kdc success.
> > >>>>>>>> [main] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing
> the tgt to the credential cache file.
> > >>>>>>>> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest -
> > >>>>>>>> The preauth data is empty.
> > >>>>>>>> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> > >>>>>>>> - KRB error occurred while processing request:Additional
> > >>>>>>>> pre-authentication required [pool-1-thread-2] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > >>>>>>>> AS_REQ
> > >>>>>> ISSUE:
> > >>>>>>>> authtime 1493972505948,test-service/localhost@TEST.COM for
> > krbtgt/
> > >>>>>>>> TEST.COM@TEST.COM Exception in thread "Thread-0"
> > >>>>>>>> java.lang.RuntimeException: Error occured while checking udp
> > >>>>>> connections
> > >>>>>>>> at
> > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > >>>>>>>> KdcNetwork.java:105)
> > >>>>>>>> at
> > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > >>>>>>>> access$000(KdcNetwork.java:39)
> > >>>>>>>> at
> > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > >>>>>>>> run(KdcNetwork.java:75)
> > >>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > >>>>>>>> Caused by: java.nio.channels.ClosedChannelException
> > >>>>>>>> at
> > >>>>>>>> sun.nio.ch.DatagramChannelImpl.ensureOpen(
> > >>>>>> DatagramChannelImpl.java:320)
> > >>>>>>>> at sun.nio.ch.DatagramChannelImpl.receive(
> > >>>>>>>> DatagramChannelImpl.java:331)
> > >>>>>>>> at
> > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > >>>>>>>> checkUdpMessage(KdcNetwork.java:132)
> > >>>>>>>> at
> > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > >>>>>>>> KdcNetwork.java:101)
> > >>>>>>>> ... 3 more
> > >>>>>>>>
> > >>>>>>>>
> > >>>>>>>> krb5.conf:
> > >>>>>>>>
> > >>>>>>>> [libdefaults]
> > >>>>>>>> kdc_realm = TEST.COM
> > >>>>>>>> default_realm = TEST.COM
> > >>>>>>>> udp_preference_limit = 4096
> > >>>>>>>> kdc_tcp_port = 37080
> > >>>>>>>> kdc_udp_port = 36525
> > >>>>>>>>
> > >>>>>>>> [realms]
> > >>>>>>>> TEST.COM = {
> > >>>>>>>> kdc = localhost:36525
> > >>>>>>>> }
> > >>>>>>>>
> > >>>>>>>> And port 36525 does not show up in `netstat -l` (while 37080
> > >>>>>>>> does)
> > >>>>>>>>
> > >>>>>>>>
> > >>>>>>>> Op 04-05-17 om 14:55 schreef Li, Jiajia:
> > >>>>>>>>> Hi Marc,
> > >>>>>>>>> I try to run your test(through applying your patch in the
> > >>>>>>>>> trunk) , I
> > >>>>>>>> think it's success now. Could you take some time to check
> > >>>>>>>> about
> > it?
> > >>>>>>>>> Here is the log:
> > >>>>>>>>>
> > >>>>>>>>> directory-kerby git:(trunk) ? .
> > >>>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerb
> > >>>>>>>>> eros
> > >>>>>>>>> /k
> > >>>>>>>>> er
> > >>>>>>>>> b/
> > >>>>>>>>> server/MitIssueTest.sh
> > >>>>>>>>> kerberos.authGSSClientInit successful
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: entypes not
> > >>>>>>>>> supported
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for krb5_ccache_conf_data/realm-config@X-CACHECONF:
> > >>>>>>>>> in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for test-service/localhost@TEST.COM in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for
> > >>>>>>>>> krb5_ccache_conf_data/negative-cache/test-service\134/localh
> > >>>>>>>>> ost\
> > >>>>>>>>> 13
> > >>>>>>>>> 4@
> > >>>>>>>>> TE
> > >>>>>>>>> ST.COM@X-CACHECONF: in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF
> :
> > >>>>>>>>> in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for krb5_ccache_conf_data/sitename@X-CACHECONF:
> > >>>>>>>>> in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for test-service/localhost@TEST.COM in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > >>>>>>>>> des-cbc-md5-deprecated not supported
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > >>>>>>>>> des-cbc-md4-deprecated not supported
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > >>>>>>>>> des-cbc-crc-deprecated not supported
> > >>>>>>>>> 2017-05-04T20:44:06 Trying to find service kdc for realm
> > >>>>>>>>> TEST.COM flags 0
> > >>>>>>>>> 2017-05-04T20:44:06 configuration file for realm TEST.COM
> > >>>>>>>>> found
> > >>>>>>>>> 2017-05-04T20:44:06 submissing new requests to new host
> > >>>>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
> > >>>>>>>>> 2017-05-04T20:44:06 connecting to host: udp ::1:52534
> > >>>>>>>>> (localhost)
> > >>>>>> tid:
> > >>>>>>>>> 00000001
> > >>>>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
> > >>>>>>>>> 2017-05-04T20:44:06 Queuing host in future (in 3s), its the
> > >>>>>>>>> 2 address on the same name: udp 127.0.0.1:52534 (localhost)
> tid:
> > >>>>>>>>> 00000002
> > >>>>>>>>> 2017-05-04T20:44:06 writing packet: udp ::1:52534
> > >>>>>>>>> (localhost)
> > tid:
> > >>>>>>>>> 00000001
> > >>>>>>>>> 2017-05-04T20:44:06 reading packet: udp ::1:52534
> > >>>>>>>>> (localhost)
> > tid:
> > >>>>>>>>> 00000001
> > >>>>>>>>> 2017-05-04T20:44:06 host completed: udp ::1:52534
> > >>>>>>>>> (localhost)
> > tid:
> > >>>>>>>>> 00000001
> > >>>>>>>>> 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0
> > >>>>>>>>> hosts 1 packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814
> > >>>>>>>>> tid: 00000002
> > >>>>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/763641F3
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328353: Decrypt
> > >>>>>>>>> integrity check failed for checksum type
> > >>>>>>>>> hmac-sha1-96-aes128, key type
> > >>>>>>>>> aes128-cts-hmac-sha1-96
> > >>>>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
> > >>>>>>>>> 2017-05-04T20:44:06 krb5_get_credentials_with_flags:
> > >>>>>>>>> TEST.COM
> > wc:
> > >>>>>>>>> 0.050317
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for krb5_ccache_conf_data/realm-config@X-CACHECONF:
> > >>>>>>>>> in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for
> > >>>>>>>>> krb5_ccache_conf_data/time-offset/test-service\134/
> > >>>>>> localhost\134@TEST.
> > >>>>>>>>> COM@X-CACHECONF: in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 Setting up PFS for auth context
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > >>>>>>>>> des-cbc-md5-deprecated not supported
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > >>>>>>>>> des-cbc-md4-deprecated not supported
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > >>>>>>>>> des-cbc-crc-deprecated not supported First
> > >>>>>>>>> kerberos.authGSSClientStep successful
> > >>>>>>>>>
> > >>>>>>>>> Thanks
> > >>>>>>>>> Jiajia
> > >>>>>>>>>
> > >>>>>>>>> -----Original Message-----
> > >>>>>>>>> From: Zheng, Kai [mailto:kai.zheng@intel.com]
> > >>>>>>>>> Sent: Wednesday, May 3, 2017 7:29 PM
> > >>>>>>>>> To: kerby@directory.apache.org
> > >>>>>>>>> Subject: RE: MIT Kerberos compatibility
> > >>>>>>>>>
> > >>>>>>>>> Hi Marc,
> > >>>>>>>>>
> > >>>>>>>>> In case you're not aware of this, please check out the
> > >>>>>>>>> latest fix made
> > >>>>>>>> by Jiajia. We thought your case may be different, but would
> > >>>>>>>> be good to have a check before we can repeat/fix your case.
> Thanks.
> > >>>>>>>>> https://issues.apache.org/jira/browse/DIRKRB-625
> > >>>>>>>>>
> > >>>>>>>>> Regards,
> > >>>>>>>>> Kai
> > >>>>>>>>>
> > >>>>>>>>> -----Original Message-----
> > >>>>>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> > >>>>>>>>> Sent: Sunday, April 30, 2017 7:45 PM
> > >>>>>>>>> To: kerby@directory.apache.org
> > >>>>>>>>> Subject: Re: MIT Kerberos compatibility
> > >>>>>>>>>
> > >>>>>>>>> Hi Kai,
> > >>>>>>>>>
> > >>>>>>>>> The terminal output below is for the latest MIT Kerberos
> > >>>>>>>>> 1.15.1 (locally
> > >>>>>>>> built on Ubuntu Xenial). Before that, I also tested with the
> > >>>>>>>> default Xenial MIT Kerberos packages (1.13.2), with the same
> > >>>>>>>> result. I did not try earlier MIT Kerberos versions.
> > >>>>>>>>>
> > >>>>>>>>> Marc
> > >>>>>>>>>
> > >>>>>>>>> Op 29-04-17 om 21:42 schreef Marc de Lignie:
> > >>>>>>>>>> Hi Kai,
> > >>>>>>>>>>
> > >>>>>>>>>> Thanks for the response. I prepared a minimal config that
> > >>>>>>>>>> reproduces my problem.
> > >>>>>>>>>>
> > >>>>>>>>>> You can fetch the branch/commit from:
> > >>>>>>>>>> https://github.com/vtslab/directory-kerby/commits/MitIssue
> > >>>>>>>>>>
> > >>>>>>>>>> This is relative to RC2, but I also tried this on trunk for
> > >>>>>>>>>> my actual project.
> > >>>>>>>>>>
> > >>>>>>>>>> This config produces the debug and error messages below.
> > >>>>>>>>>>
> > >>>>>>>>>> 1. For the terminal with the bash + python script $ klist
> > >>>>>>>>>> Ticket
> > >>>>>>>>>> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>>> Default principal: drankye@TEST.COM
> > >>>>>>>>>>
> > >>>>>>>>>> Valid starting Expires Service principal
> > >>>>>>>>>> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/
> TEST.COM@TEST.COM
> > >>>>>>>>>> renew until 29-04-17 21:07:39
> > >>>>>>>>>>
> > >>>>>>>>>> $ .
> > >>>>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/ker
> > >>>>>>>>>> bero s/ ke rb / server/MitIssueTest.sh [15538]
> > >>>>>>>>>> 1493491231.917606:
> > >>>>>>>>>> Retrieving drankye@TEST.COM from
> > >>>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>>>> with
> > >>>>>>>>>> result:
> > >>>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>>>> found [15538]
> > >>>>>>>>>> 1493491231.917827: Retrieving drankye@TEST.COM from
> > >>>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>>>> with
> > >>>>>>> result:
> > >>>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>>>> found kerberos.authGSSClientInit successful [15538]
> 1493491231.918185:
> > >>>>>>>>>> Getting credentials drankye@TEST.COM ->
> > >>>>>>>>>> test-service/localhost@ using ccache
> > >>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>>> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
> > >>>>>>>>>> test-service/localhost@ from
> > >>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with
> > result:
> > >>>>>>>>>> -1765328243/Matching credential not found (filename:
> > >>>>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> > >>>>>>>>>> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
> > >>>>>>>>>> test-service/localhost@TEST.COM with result:
> > >>>>>>>>>> -1765328243/Matching credential not found (filename:
> > >>>>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> > >>>>>>>>>> [15538] 1493491231.918229: Server has referral realm;
> > >>>>>>>>>> starting with test-service/localhost@TEST.COM [15538]
> 1493491231.918278:
> > >>>>>>>>>> Retrieving drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> from FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>>> with
> > result:
> > >>>>>>>>>> 0/Success
> > >>>>>>>>>> [15538] 1493491231.918281: Starting with TGT for client realm:
> > >>>>>>>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
> > >>>>>>>>>> 1493491231.918301: Requesting tickets for
> > >>>>>>>>>> test-service/localhost@TEST.COM, referrals on [15538]
> > >>>>>>>>>> 1493491231.918326: Generated subkey for TGS request:
> > >>>>>>>>>> aes128-cts/FA30
> > >>>>>>>>>> [15538] 1493491231.918359: etypes requested in TGS request:
> > >>>>>>>>>> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2,
> > >>>>>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
> > >>>>>>>>>> [15538]
> > >>>>>> 1493491231.918484:
> > >>>>>>>>>> Encoding request body and padata into FAST request [15538]
> > >>>>>>>>>> 1493491231.918541: Sending request (836 bytes) to TEST.COM
> > >>>>>>>>>> [15538]
> > >>>>>>>>>> 1493491231.918597: Resolving hostname localhost [15538]
> > >>>>>>>>>> 1493491231.918703: Initiating TCP connection to stream
> > >>>>>>>>>> 127.0.0.1:44292
> > >>>>>>>>>> [15538] 1493491231.918777: Sending TCP request to stream
> > >>>>>>>>>> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error
> > >>>>>>>>>> receiving from stream
> > >>>>>>>>>> 127.0.0.1:44292: 104/Connection reset by peer [15538]
> > >>>>>>>>>> 1493491231.922812: Terminating TCP connection to stream
> > >>>>>>>>>> 127.0.0.1:44292
> > >>>>>>>>>> [15538] 1493491231.922858: Sending initial UDP request to
> > >>>>>>>>>> dgram
> > >>>>>>>>>> 127.0.0.1:44292
> > >>>>>>>>>> ('First kerberos.authGSSClientStep not successful',
> > >>>>>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide
> > >>>>>>>>>> more information', 851968), ("Cannot contact any KDC for
> > >>>>>>>>>> realm 'TEST.COM'",
> > >>>>>>>>>> -1765328228)))
> > >>>>>>>>>>
> > >>>>>>>>>> 2. For the terminal that runs mvn clean test
> > >>>>>>>>>> -Dtest=MitIssueTest Running
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > >>>>>>>>>> 2017-04-29 21:07:39,182 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> initialize called
> > >>>>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> getIdentity called, principalName =
> > >>>>>>>>>> krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> getIdentity failed, principalName =
> > >>>>>>>>>> krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> addIdentity successful, principalName =
> > >>>>>>>>>> krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> getIdentity called, principalName =
> > >>>>>>>>>> kadmin/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> getIdentity failed, principalName =
> > >>>>>>>>>> kadmin/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,213 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> addIdentity successful, principalName =
> > >>>>>>>>>> kadmin/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,216 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> start called
> > >>>>>>>>>> 2017-04-29 21:07:39,232 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> addIdentity successful, principalName =
> > >>>>>>>>>> test-service/localhost@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,425 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> addIdentity successful, principalName = drankye@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1]
> > >>>>> request.KdcRequest:
> > >>>>>>>>>> Client entry is empty.
> > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = drankye@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = drankye@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > >>>>>>>>>> occurred, disconnecting abnormally java.io.EOFException
> > >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:
> 392)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > >>>>>>>>>> r.ru
> > >>>>>>>>>> n(
> > >>>>>>>> DefaultKdcHandler.java:46)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > >>>>>>>> ThreadPoolExecutor.java:1142)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > >>>>>>>> ThreadPoolExecutor.java:617)
> > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > >>>>>>>>>> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase:
> > >>>>>>>>>> Storing the tgt to the credential cache file.
> > >>>>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> getIdentity called, principalName =
> > >>>>>>>>>> test-service/localhost@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> getIdentity successful, principalName =
> > >>>>>>>>>> test-service/localhost@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1]
> > >>>>> request.KdcRequest:
> > >>>>>>>>>> Client entry is empty.
> > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1]
> > >>>>> request.KdcRequest:
> > >>>>>>>>>> The preauth data is empty.
> > >>>>>>>>>> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1]
> > server.KdcHandler:
> > >>>>>>>>>> KRB error occurred while processing request:Additional
> > >>>>>>>>>> pre-authentication required
> > >>>>>>>>>> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > >>>>>>>>>> occurred, disconnecting abnormally java.io.EOFException
> > >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:
> 392)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > >>>>>>>>>> r.ru
> > >>>>>>>>>> n(
> > >>>>>>>> DefaultKdcHandler.java:46)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > >>>>>>>> ThreadPoolExecutor.java:1142)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > >>>>>>>> ThreadPoolExecutor.java:617)
> > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > >>>>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1]
> > >>>>> request.KdcRequest:
> > >>>>>>>>>> Client entry is empty.
> > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > >>>>>>>>>> occurred, disconnecting abnormally java.io.EOFException
> > >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:
> 392)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > >>>>>>>>>> r.ru
> > >>>>>>>>>> n(
> > >>>>>>>> DefaultKdcHandler.java:46)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > >>>>>>>> ThreadPoolExecutor.java:1142)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > >>>>>>>> ThreadPoolExecutor.java:617)
> > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > >>>>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1]
> > >>>>> request.KdcRequest:
> > >>>>>>>>>> Found fast padata and start to process it.
> > >>>>>>>>>> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
> > >>>>>>>>>> impl.DefaultKdcHandler: Error occured while processing
> request:
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
> > >>>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> > >>>>>>>> java:85)
> > >>>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> > >>>>>>>> java:70)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kd
> > >>>>>>>>>> cFin
> > >>>>>>>>>> dF
> > >>>>>>>>>> as
> > >>>>>>>>>> t(
> > >>>>>>>> KdcRequest.java:208)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.
> > >>>>>>>> KdcRequest.process(KdcRequest.java:168)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
> > >>>>>>>> handleMessage(KdcHandler.java:115)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
> > >>>>>>>> handleMessage(DefaultKdcHandler.java:67)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > >>>>>>>>>> r.ru
> > >>>>>>>>>> n(
> > >>>>>>>> DefaultKdcHandler.java:52)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > >>>>>>>> ThreadPoolExecutor.java:1142)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > >>>>>>>> ThreadPoolExecutor.java:617)
> > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > >>>>>>>>>> Caused by: java.io.IOException: Unexpected item context [0]
> > >>>>>>>>>> [tag=0xA0, off=0, len=3+207], expecting 0x30
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > >>>>>>>> Asn1Encodeable.java:210)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > >>>>>>>> Asn1Encodeable.java:197)
> > >>>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> > >>>>>>>> java:83)
> > >>>>>>>>>> ... 9 more
> > >>>>>>>>>> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > >>>>>>>>>> occurred, disconnecting abnormally
> > >>>>>>>>>> java.net.SocketException: Socket closed
> > >>>>>>>>>> at java.net.SocketInputStream.socketRead0(Native Method)
> > >>>>>>>>>> at java.net.SocketInputStream.socketRead(SocketInputStream.
> > >>>>>>>> java:116)
> > >>>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
> > >>>>> 171)
> > >>>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
> > >>>>> 141)
> > >>>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
> > >>>>> 224)
> > >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:
> 387)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > >>>>>>>>>> r.ru
> > >>>>>>>>>> n(
> > >>>>>>>> DefaultKdcHandler.java:46)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > >>>>>>>> ThreadPoolExecutor.java:1142)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > >>>>>>>> ThreadPoolExecutor.java:617)
> > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > >>>>>>>>>>
> > >>>>>>>>>> In a FreeIPA environment these python lines "just" work.
> > >>>>>>>>>>
> > >>>>>>>>>> Any suggestions are welcome!
> > >>>>>>>>>>
> > >>>>>>>>>> Marc
> > >>>>>>>>>>
> > >>>>>>>>>>
> > >>>>>>>>> --
> > >>>>>>>>> Marc de Lignie
> > >>>>>>>>>
> > >>>>>>>>
> > >>>>>>>> --
> > >>>>>>>> Marc de Lignie
> > >>>>>>>>
> > >>>>>>>>
> > >>>>>>>
> > >>>>>>>
> > >>>>>>> --
> > >>>>>>> Colm O hEigeartaigh
> > >>>>>>>
> > >>>>>>> Talend Community Coder
> > >>>>>>> http://coders.talend.com
> > >>>>>>>
> > >>>>>>
> > >>>>>>
> > >>>>>>
> > >>>>>> --
> > >>>>>> Colm O hEigeartaigh
> > >>>>>>
> > >>>>>> Talend Community Coder
> > >>>>>> http://coders.talend.com
> > >>>>>>
> > >>>>>
> > >>>>>
> > >>>>>
> > >>>>> --
> > >>>>> Colm O hEigeartaigh
> > >>>>>
> > >>>>> Talend Community Coder
> > >>>>> http://coders.talend.com
> > >>>>>
> > >>>>
> > >>>>
> > >>>>
> > >>>> --
> > >>>> Colm O hEigeartaigh
> > >>>>
> > >>>> Talend Community Coder
> > >>>> http://coders.talend.com
> > >>>
> > >>>
> > >>
> > >>
> > >> --
> > >> Colm O hEigeartaigh
> > >>
> > >> Talend Community Coder
> > >> http://coders.talend.com
> >
>
>
>
> --
> Colm O hEigeartaigh
>
> Talend Community Coder
> http://coders.talend.com
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
Re: MIT Kerberos compatibility
Posted by Colm O hEigeartaigh <co...@apache.org>.
OK I have created a JIRA and attached a patch that you have to apply to the
Apache WSS4J project to reproduce the error. If you uncomment the line that
uses Netty then the tests all work perfectly. The tests appear to work fine
when run in isolation, it's only when you run a few of them after one
another that you can see the failures.
Please let me know if you have any difficulty in reproducing, thanks!
Colm.
On Mon, May 8, 2017 at 11:08 AM, Zheng, Kai <ka...@intel.com> wrote:
> Hi Colm,
>
> Sure, please do it. Could you review my change and see how it would cause
> the new failures? Any difference between the failed GSS tests and the Kerby
> GSS tests?
>
> Regards,
> Kai
>
> -----Original Message-----
> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> Sent: Monday, May 08, 2017 5:42 PM
> To: Zheng, Kai <ka...@intel.com>
> Cc: kerby@directory.apache.org
> Subject: Re: MIT Kerberos compatibility
>
> Hi Kai,
>
> Your changes fixed the error message I was seeing. However, I now see
> another problem when I run a few GSS client tests in a row:
>
> >>> EType: sun.security.krb5.internal.crypto.Aes128CtsHmacSha1EType
> >>> KrbAsReq creating message
> >>> KrbKdcReq send: kdc=localhost UDP:42665, timeout=30000, number of
> retries =3, #bytes=245
> >>> KDCCommunication: kdc=localhost UDP:42665, timeout=30000,Attempt =1,
> #bytes=245
> SocketTimeOutException with attempt: 1
> >>> KDCCommunication: kdc=localhost UDP:42665, timeout=30000,Attempt =2,
> #bytes=245
> >>> KrbKdcReq send: error trying localhost:42665
> java.net.PortUnreachableException: ICMP Port Unreachable
>
> Do you want me to create a JIRA + attach a test-case?
>
> Colm.
>
> On Sat, May 6, 2017 at 2:01 AM, Zheng, Kai <ka...@intel.com> wrote:
>
> > I haven't repeated the issue but revisited the codes again and made
> > improvements. Would you check it out? Thanks!
> >
> > Sent from iPhone
> >
> > > 在 2017年5月6日，上午6:28，Zheng, Kai <ka...@intel.com> 写道：
> > >
> > > Thanks colm for the clarification and it sounds an issue we need to
> > address. I will investigate it soon.
> > >
> > > Sent from iPhone
> > >
> > >> 在 2017年5月6日，上午2:14，Colm O hEigeartaigh <co...@apache.org> 写道：
> > >>
> > >> Hi Kai,
> > >>
> > >> If I enable UDP with the default Transport, I can get a ticket fine
> > using
> > >> kinit. However then the following error pops up in the window I'm
> > running
> > >> Kerby in (as a test):
> > >>
> > >> Exception in thread "Thread-1" java.lang.RuntimeException: Error
> > >> occured while checking udp connections
> > >> at
> > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > KdcNetwork.java:105)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > access$000(KdcNetwork.java:39)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > run(KdcNetwork.java:75)
> > >> at java.lang.Thread.run(Thread.java:748)
> > >> Caused by: java.nio.channels.ClosedChannelException
> > >> at
> > >> sun.nio.ch.DatagramChannelImpl.ensureOpen(
> DatagramChannelImpl.java:320)
> > >> at sun.nio.ch.DatagramChannelImpl.receive(
> > DatagramChannelImpl.java:331)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > checkUdpMessage(KdcNetwork.java:132)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > KdcNetwork.java:101)
> > >>
> > >> Colm.
> > >>
> > >>
> > >>> On Fri, May 5, 2017 at 5:56 PM, Zheng, Kai <ka...@intel.com>
> > wrote:
> > >>>
> > >>> Colm, did you see udp problem now instead? I'm a little confused.
> > >>> Udp
> > is
> > >>> sure supported but may not be enabled by default, which should be
> > >>> okay, imo. Thanks.
> > >>>
> > >>> Sent from iPhone
> > >>>
> > >>>> 在 2017年5月6日，上午12:02，Colm O hEigeartaigh <co...@apache.org> 写道：
> > >>>>
> > >>>> That's probably it. Why does the default transport not support
> > >>>> UDP in
> > >>> Kerby?
> > >>>>
> > >>>> Colm.
> > >>>>
> > >>>>> On Fri, May 5, 2017 at 4:54 PM, Li, Jiajia <ji...@intel.com>
> > wrote:
> > >>>>>
> > >>>>> Are you sure add kdc_allow_udp = false in kdc.conf?
> > >>>>>
> > >>>>> Thanks
> > >>>>> Jiajia
> > >>>>>
> > >>>>> -----Original Message-----
> > >>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > >>>>> Sent: Friday, May 5, 2017 11:41 PM
> > >>>>> To: Li, Jiajia <ji...@intel.com>
> > >>>>> Cc: kerby@directory.apache.org; Zheng, Kai
> > >>>>> <ka...@intel.com>;
> > >>> mailto:
> > >>>>> m.c.delignie@xs4all.nl <m....@xs4all.nl>
> > >>>>> Subject: Re: MIT Kerberos compatibility
> > >>>>>
> > >>>>> Sorry, it was my error, UDP was actually enabled there. But why
> > >>>>> am I
> > >>> still
> > >>>>> seeing that error message?
> > >>>>>
> > >>>>> Colm.
> > >>>>>
> > >>>>>> On Fri, May 5, 2017 at 4:39 PM, Li, Jiajia
> > >>>>>> <ji...@intel.com>
> > >>> wrote:
> > >>>>>>
> > >>>>>> Hi Colm,
> > >>>>>> I also test the Kerby KDC with kerby kint and MIT kinit, and
> > >>>>>> only listen the tcp port(disable udp), both got ticket
> > >>>>>> successfully. But
> > I
> > >>>>>> don't get the error message. Both krb.conf and kdc.conf should
> > >>>>>> set
> > udp
> > >>>>>> to be false, udp is enabled in default.
> > >>>>>>
> > >>>>>> Thanks
> > >>>>>> Jiajia
> > >>>>>>
> > >>>>>> -----Original Message-----
> > >>>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > >>>>>> Sent: Friday, May 5, 2017 11:34 PM
> > >>>>>> To: kerby@directory.apache.org
> > >>>>>> Cc: Zheng, Kai <ka...@intel.com>;
> > >>>>>> mailto:m.c.delignie@xs4all.nl
> > <
> > >>>>>> m.c.delignie@xs4all.nl>
> > >>>>>> Subject: Re: MIT Kerberos compatibility
> > >>>>>>
> > >>>>>> Hi Jiajia,
> > >>>>>>
> > >>>>>> If UDP is disabled and we don't use Netty, I can get a token
> > >>>>>> successfully via kinit. However I then see an error message in
> > >>>>>> the
> > >>> Kerby
> > >>>>> console:
> > >>>>>>
> > >>>>>> Exception in thread "Thread-1" java.lang.RuntimeException:
> > >>>>>> Error occured while checking udp connections at
> > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > >>>>>> KdcNetwork.java:105)
> > >>>>>> at
> > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > >>>>>> access$000(KdcNetwork.java:39)
> > >>>>>> at
> > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > >>>>>> run(KdcNetwork.java:75)
> > >>>>>> at java.lang.Thread.run(Thread.java:748)
> > >>>>>> Caused by: java.nio.channels.ClosedChannelException
> > >>>>>> at
> > >>>>>> sun.nio.ch.DatagramChannelImpl.ensureOpen(
> > >>> DatagramChannelImpl.java:320)
> > >>>>>> at sun.nio.ch.DatagramChannelImpl.receive(
> > >>>>>> DatagramChannelImpl.java:331)
> > >>>>>> at
> > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > >>>>>> checkUdpMessage(KdcNetwork.java:132)
> > >>>>>> at
> > >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > >>>>>> KdcNetwork.java:101)
> > >>>>>>
> > >>>>>> I'm not sure why we are seeing UDP errors when it's disabled?
> > >>>>>>
> > >>>>>> Colm.
> > >>>>>>
> > >>>>>>> On Fri, May 5, 2017 at 3:57 PM, Li, Jiajia
> > >>>>>>> <ji...@intel.com>
> > >>> wrote:
> > >>>>>>>
> > >>>>>>> Hi Colm,
> > >>>>>>> The shell client can't connect to kdc if the UDP is disabled.
> > >>>>>>> We don't use Netty in default.
> > >>>>>>> What's your test-cases? The same as the Marc's?
> > >>>>>>>
> > >>>>>>> Thanks
> > >>>>>>> Jiajia
> > >>>>>>>
> > >>>>>>> -----Original Message-----
> > >>>>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > >>>>>>> Sent: Friday, May 5, 2017 10:09 PM
> > >>>>>>> To: kerby@directory.apache.org
> > >>>>>>> Cc: Zheng, Kai <ka...@intel.com>; mailto:
> > m.c.delignie@xs4all.nl
> > >>>>>>> < m.c.delignie@xs4all.nl>
> > >>>>>>> Subject: Re: MIT Kerberos compatibility
> > >>>>>>>
> > >>>>>>> Hi Jiajia,
> > >>>>>>>
> > >>>>>>> What are the issues if UDP is disabled and we don't use Netty?
> > >>>>>>> I tried doing this with my own test-cases and it didn't work,
> > >>>>>>> so it would be good to get this fixed soon.
> > >>>>>>>
> > >>>>>>> Colm.
> > >>>>>>>
> > >>>>>>> On Fri, May 5, 2017 at 2:46 PM, Li, Jiajia
> > >>>>>>> <ji...@intel.com>
> > >>>>> wrote:
> > >>>>>>>
> > >>>>>>>> Hi Marc,
> > >>>>>>>>>>> - your KRB5 tracing looks quite different. What OS and
> > >>>>>>>>>>> mit-kerberos
> > >>>>>>>> version did you use?
> > >>>>>>>> I use mac os and the python version is 2.7.10
> > >>>>>>>>
> > >>>>>>>>>>> - your KRB5 tracing shows UDP comms between kerberos
> > >>>>>>>>>>> client and KDC,
> > >>>>>>>> despite the allowUDP = false setting
> > >>>>>>>>>>> in my test. I did this setting because I get different
> > >>>>>>>>>>> problems
> > >>>>>>>> without it, see the additional logs below. So,
> > >>>>>>>>>>> we must also be aware of networking problems at my side.
> > >>>>>>>> I enable the UDP and use netty network, there are some issues
> > >>>>>>>> if UDP disabled, you can create a JIRA for this and we can
> > >>>>>>>> fix this issue in the next release version.
> > >>>>>>>>
> > >>>>>>>> The changes in my side as following:
> > >>>>>>>>
> > >>>>>>>> protected boolean allowUdp() { return true; } @Override
> > >>>>>>>> protected void prepareKdc() throws KrbException {
> > >>>>>>>> getKdcServer().setInnerKdcImpl(
> > >>>>>>>> new
> > >>>>>>>> NettyKdcServerImpl(getKdcServer().getKdcSetting()));
> > >>>>>>>> super.prepareKdc();
> > >>>>>>>> }
> > >>>>>>>>
> > >>>>>>>> Here is log of MitIssueTest:
> > >>>>>>>> [INFO] Running
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > >>>>>>>> io.netty.handler.logging.LoggingHandler
> > >>>>>>>> -
> > >>>>>>>> [id: 0x2634fe6b] REGISTERED
> > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > >>>>>>>> io.netty.handler.logging.LoggingHandler
> > >>>>>>>> -
> > >>>>>>>> [id: 0x2634fe6b] BIND(0.0.0.0/0.0.0.0:53957)
> > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > >>>>>>>> io.netty.handler.logging.LoggingHandler -
> > >>>>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] ACTIVE [main] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kdc.impl.NettyKdcServerImpl - Netty
> > >>>>>>>> kdc server started.
> > >>>>>>>> [nioEventLoopGroup-2-1] INFO
> > >>>>>>>> io.netty.handler.logging.LoggingHandler
> > >>>>>>>> -
> > >>>>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] RECEIVED: [id:
> > >>>>>>>> 0xdac7228b, /
> > >>>>>>>> 127.0.0.1:53961 => /127.0.0.1:53957]
> > >>>>>>>> [defaultEventExecutorGroup-4-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
> > >>>>>>>> - AS_REQ ISSUE: authtime 1493991123792,drankye@TEST.COM for
> > >>>>>>>> krbtgt/ TEST.COM@TEST.COM [main] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> > DefaultInternalKrbClien
> > >>>>>>>> t
> > >>>>>>>> - Send to kdc success.
> > >>>>>>>> [main] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing
> the tgt to the credential cache file.
> > >>>>>>>> [nioEventLoopGroup-5-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> > >>>>>>>> - The preauth data is empty.
> > >>>>>>>> [nioEventLoopGroup-5-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> > >>>>>>>> - KRB error occurred while processing request:Additional
> > >>>>>>>> pre-authentication required [nioEventLoopGroup-5-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
> > >>>>>>>> - AS_REQ ISSUE: authtime
> > >>>>>>>> 1493991123859,test-service/localhost@TEST.COM
> > >>>>>>>> for krbtgt/TEST.COM@TEST.COM
> > >>>>>>>> [nioEventLoopGroup-5-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.TgsRequest
> > >>>>>>>> - TGS_REQ ISSUE: authtime 1493991142850,drankye for
> > >>>>>>>> test-service/ localhost@TEST.COM
> > >>>>>>>>
> > >>>>>>>> Thanks
> > >>>>>>>> Jiajia
> > >>>>>>>>
> > >>>>>>>> -----Original Message-----
> > >>>>>>>> From: Zheng, Kai
> > >>>>>>>> Sent: Friday, May 5, 2017 7:46 PM
> > >>>>>>>> To: kerby@directory.apache.org; Li, Jiajia
> > >>>>>>>> <ji...@intel.com>
> > >>>>>>>> Subject: RE: MIT Kerberos compatibility
> > >>>>>>>>
> > >>>>>>>> Hi Marc,
> > >>>>>>>>
> > >>>>>>>> Looks like this is quite environment related, could you fire
> > >>>>>>>> an issue for this? I would suggest we target it to 1.1.0,
> > >>>>>>>> which can be done in
> > >>>>>>> June.
> > >>>>>>>>
> > >>>>>>>> Regards,
> > >>>>>>>> Kai
> > >>>>>>>>
> > >>>>>>>> -----Original Message-----
> > >>>>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> > >>>>>>>> Sent: Friday, May 05, 2017 4:44 PM
> > >>>>>>>> To: Li, Jiajia <ji...@intel.com>
> > >>>>>>>> Cc: kerby@directory.apache.org
> > >>>>>>>> Subject: Re: MIT Kerberos compatibility
> > >>>>>>>>
> > >>>>>>>> Hi Jiajia,
> > >>>>>>>>
> > >>>>>>>> Great to read that you made progress on this issue and to see
> > >>>>>>>> a working config at your side. Below, I list my progress
> > >>>>>>>> below (with trunk merged into my MitIssue branch), but I am
> > >>>>>>>> afraid we are not done
> > >>>>>>> yet.
> > >>>>>>>>
> > >>>>>>>> Things that stand out:
> > >>>>>>>>
> > >>>>>>>> - the kdc decoding error is solved, relative to the logs
> > >>>>>>>> without your patch
> > >>>>>>>>
> > >>>>>>>> - your KRB5 tracing looks quite different. What OS and
> > >>>>>>>> mit-kerberos version did you use?
> > >>>>>>>>
> > >>>>>>>> - your KRB5 tracing shows UDP comms between kerberos client
> > >>>>>>>> and KDC, despite the allowUDP = false setting in my test. I
> > >>>>>>>> did this setting because I get different problems without it,
> > >>>>>>>> see the additional logs below. So, we must also be aware of
> > >>>>>>>> networking
> > >>>>> problems at my side.
> > >>>>>>>>
> > >>>>>>>> - the "Response was not from master KDC" msg is not relevant;
> > >>>>>>>> it disappears if you manually add master_kdc to the realms
> > >>>>>>>> section of the krb5.conf
> > >>>>>>>>
> > >>>>>>>> I have no idea how to proceed from here, so that is why I
> > >>>>>>>> just document the status at my side and ask about your -
> > >>>>>>>> apparently working -
> > >>>>>>> config.
> > >>>>>>>>
> > >>>>>>>> Cheers, Marc
> > >>>>>>>>
> > >>>>>>>>
> > >>>>>>>> KDC logging with allowUDP = false:
> > >>>>>>>>
> > >>>>>>>> [INFO] Running
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > >>>>>>>> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > >>>>>>>> AS_REQ
> > >>>>>> ISSUE:
> > >>>>>>>> authtime 1493970789075,drankye@TEST.COM for
> > >>>>>>>> krbtgt/TEST.COM@TEST.COM [main] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> > DefaultInternalKrbClien
> > >>>>>>>> t
> > >>>>>>>> - Send to kdc success.
> > >>>>>>>> [main] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing
> the tgt to the credential cache file.
> > >>>>>>>> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest -
> > >>>>>>>> The preauth data is empty.
> > >>>>>>>> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> > >>>>>>>> - KRB error occurred while processing request:Additional
> > >>>>>>>> pre-authentication required [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > >>>>>>>> AS_REQ
> > >>>>>> ISSUE:
> > >>>>>>>> authtime 1493970789108,test-service/localhost@TEST.COM for
> > krbtgt/
> > >>>>>>>> TEST.COM@TEST.COM [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> > >>>>>>>> - Found fast padata and starting to process it.
> > >>>>>>>> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest -
> > >>>>>>>> Found fast padata and starting to process it.
> > >>>>>>>>
> > >>>>>>>> Python script KRB5 tracing (MIT Kerberos 1.13.2 of Ubuntu
> > >>>>>>>> Xenial) with allowUDP = false:
> > >>>>>>>>
> > >>>>>>>> $ .
> > >>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/
> > >>>>>>>> kerberos/kerb/server/MitIssueTest.sh
> > >>>>>>>> [25281] 1493970797.298753: Retrieving drankye@TEST.COM from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found [25281]
> > >>>>>>>> 1493970797.298952: Retrieving drankye@TEST.COM from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found [25281]
> > >>>>>>>> 1493970797.299106: Retrieving drankye@TEST.COM from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found [25281]
> > >>>>>>>> 1493970797.299213: Retrieving drankye@TEST.COM from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found [25281]
> > >>>>>>>> 1493970797.299323: Retrieving drankye@TEST.COM from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found [25281]
> > >>>>>>>> 1493970797.299436: Retrieving drankye@TEST.COM from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found [25281]
> > >>>>>>>> 1493970797.299545: Retrieving drankye@TEST.COM from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found [25281]
> > >>>>>>>> 1493970797.299654: Retrieving drankye@TEST.COM from
> > >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>> with
> > >>>>> result:
> > >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>> found kerberos.authGSSClientInit successful [25281]
> 1493970797.299922:
> > >>>>>>>> Getting credentials drankye@TEST.COM ->
> > >>>>>>>> test-service/localhost@ using ccache
> > >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>> [25281] 1493970797.299945: Retrieving drankye@TEST.COM ->
> > >>>>>>>> test-service/localhost@ from
> > >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>> with result:
> > >>>>>>>> -1765328243/Matching credential not found [25281]
> > 1493970797.299959:
> > >>>>>>>> Retrying drankye@TEST.COM -> test-service/localhost@TEST.COM
> > >>>>>>>> with
> > >>>>>>> result:
> > >>>>>>>> -1765328243/Matching credential not found [25281]
> > 1493970797.299962:
> > >>>>>>>> Server has referral realm; starting with
> > >>>>>>>> test-service/localhost@TEST.COM [25281]
> > >>>>>>>> 1493970797.299975: Retrieving drankye@TEST.COM ->
> > >>>>>>>> krbtgt/TEST.COM@TEST.COM from
> > >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>> with result:
> > >>>>>>>> 0/Success [25281] 1493970797.299979: Starting with TGT for
> > >>>>>>>> client
> > >>>>>> realm:
> > >>>>>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [25281]
> > >>>>>> 1493970797.299981:
> > >>>>>>>> Requesting tickets for test-service/localhost@TEST.COM,
> > >>>>>>>> referrals on [25281] 1493970797.299994: Generated subkey for
> TGS request:
> > >>>>>>>> aes128-cts/1B9B [25281] 1493970797.300009: etypes requested
> > >>>>>>>> in TGS
> > >>>>>>> request:
> > >>>>>>>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac,
> > >>>>>>>> camellia128-cts, camellia256-cts [25281] 1493970797.300054:
> > >>>>>>>> Encoding request body and padata into FAST request [25281]
> > >>>>>>>> 1493970797.300080: Sending request
> > >>>>>>>> (823 bytes) to TEST.COM [25281] 1493970797.300091: Resolving
> > >>>>>>>> hostname localhost [25281]
> > >>>>>>>> 1493970797.300136: Initiating TCP connection to stream
> > >>>>>>>> 127.0.0.1:34319
> > >>>>>>>> [25281] 1493970797.300191: Sending TCP request to stream
> > >>>>>>>> 127.0.0.1:34319 [25281] 1493970797.303610: Received answer
> > >>>>>>>> (125
> > >>>>>>>> bytes) from stream
> > >>>>>>>> 127.0.0.1:34319
> > >>>>>>>> [25281] 1493970797.303618: Terminating TCP connection to
> > >>>>>>>> stream
> > >>>>>>>> 127.0.0.1:34319
> > >>>>>>>> [25281] 1493970797.553126: Response was not from master KDC
> > >>>>>>>> [25281]
> > >>>>>>>> 1493970797.553198: TGS request result: -1765323383/Unknown
> > >>>>>>>> code krcM
> > >>>>>>>> 137 [25281] 1493970797.553234: Requesting tickets for
> > >>>>>>>> test-service/ localhost@TEST.COM, referrals off [25281]
> > >>>>> 1493970797.553273:
> > >>>>>>>> Generated subkey for TGS request: aes128-cts/94C6 [25281]
> > >>>>>> 1493970797.553323:
> > >>>>>>>> etypes requested in TGS request: aes256-cts, aes128-cts,
> > >>>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
> > >>>>>>>> [25281]
> > >>>>>>>> 1493970797.553436: Encoding request body and padata into FAST
> > >>>>>>>> request
> > >>>>>>> [25281] 1493970797.553532:
> > >>>>>>>> Sending request (823 bytes) to TEST.COM [25281]
> > 1493970797.553567:
> > >>>>>>>> Resolving hostname localhost [25281] 1493970797.553745:
> > >>>>>>>> Initiating TCP connection to stream
> > >>>>>>>> 127.0.0.1:34319
> > >>>>>>>> [25281] 1493970797.553889: Sending TCP request to stream
> > >>>>>>>> 127.0.0.1:34319 [25281] 1493970797.558297: Received answer
> > >>>>>>>> (125
> > >>>>>>>> bytes) from stream
> > >>>>>>>> 127.0.0.1:34319
> > >>>>>>>> [25281] 1493970797.558318: Terminating TCP connection to
> > >>>>>>>> stream
> > >>>>>>>> 127.0.0.1:34319
> > >>>>>>>> [25281] 1493970797.561189: Response was not from master KDC
> > >>>>>>>> [25281]
> > >>>>>>>> 1493970797.561258: TGS request result: -1765323383/Unknown
> > >>>>>>>> code krcM
> > >>>>>>>> 137 ('First kerberos.authGSSClientStep not successful',
> > >>>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide
> > >>>>>>>> more information', 851968), ('Unknown code krcM 137',
> > >>>>>>>> -1765323383)))
> > >>>>>>>>
> > >>>>>>>>
> > >>>>>>>> KDC logging with allowUDP = true:
> > >>>>>>>>
> > >>>>>>>> [INFO] Running
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > >>>>>>>> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > >>>>>>>> AS_REQ
> > >>>>>> ISSUE:
> > >>>>>>>> authtime 1493972505784,drankye@TEST.COM for
> > >>>>>>>> krbtgt/TEST.COM@TEST.COM [main] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> > DefaultInternalKrbClien
> > >>>>>>>> t
> > >>>>>>>> - Send to kdc success.
> > >>>>>>>> [main] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing
> the tgt to the credential cache file.
> > >>>>>>>> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest -
> > >>>>>>>> The preauth data is empty.
> > >>>>>>>> [pool-1-thread-1] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> > >>>>>>>> - KRB error occurred while processing request:Additional
> > >>>>>>>> pre-authentication required [pool-1-thread-2] INFO
> > >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> > >>>>>>>> AS_REQ
> > >>>>>> ISSUE:
> > >>>>>>>> authtime 1493972505948,test-service/localhost@TEST.COM for
> > krbtgt/
> > >>>>>>>> TEST.COM@TEST.COM Exception in thread "Thread-0"
> > >>>>>>>> java.lang.RuntimeException: Error occured while checking udp
> > >>>>>> connections
> > >>>>>>>> at
> > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > >>>>>>>> KdcNetwork.java:105)
> > >>>>>>>> at
> > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > >>>>>>>> access$000(KdcNetwork.java:39)
> > >>>>>>>> at
> > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > >>>>>>>> run(KdcNetwork.java:75)
> > >>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > >>>>>>>> Caused by: java.nio.channels.ClosedChannelException
> > >>>>>>>> at
> > >>>>>>>> sun.nio.ch.DatagramChannelImpl.ensureOpen(
> > >>>>>> DatagramChannelImpl.java:320)
> > >>>>>>>> at sun.nio.ch.DatagramChannelImpl.receive(
> > >>>>>>>> DatagramChannelImpl.java:331)
> > >>>>>>>> at
> > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > >>>>>>>> checkUdpMessage(KdcNetwork.java:132)
> > >>>>>>>> at
> > >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > >>>>>>>> KdcNetwork.java:101)
> > >>>>>>>> ... 3 more
> > >>>>>>>>
> > >>>>>>>>
> > >>>>>>>> krb5.conf:
> > >>>>>>>>
> > >>>>>>>> [libdefaults]
> > >>>>>>>> kdc_realm = TEST.COM
> > >>>>>>>> default_realm = TEST.COM
> > >>>>>>>> udp_preference_limit = 4096
> > >>>>>>>> kdc_tcp_port = 37080
> > >>>>>>>> kdc_udp_port = 36525
> > >>>>>>>>
> > >>>>>>>> [realms]
> > >>>>>>>> TEST.COM = {
> > >>>>>>>> kdc = localhost:36525
> > >>>>>>>> }
> > >>>>>>>>
> > >>>>>>>> And port 36525 does not show up in `netstat -l` (while 37080
> > >>>>>>>> does)
> > >>>>>>>>
> > >>>>>>>>
> > >>>>>>>> Op 04-05-17 om 14:55 schreef Li, Jiajia:
> > >>>>>>>>> Hi Marc,
> > >>>>>>>>> I try to run your test(through applying your patch in the
> > >>>>>>>>> trunk) , I
> > >>>>>>>> think it's success now. Could you take some time to check
> > >>>>>>>> about
> > it?
> > >>>>>>>>> Here is the log:
> > >>>>>>>>>
> > >>>>>>>>> directory-kerby git:(trunk) ? .
> > >>>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerb
> > >>>>>>>>> eros
> > >>>>>>>>> /k
> > >>>>>>>>> er
> > >>>>>>>>> b/
> > >>>>>>>>> server/MitIssueTest.sh
> > >>>>>>>>> kerberos.authGSSClientInit successful
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: entypes not
> > >>>>>>>>> supported
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for krb5_ccache_conf_data/realm-config@X-CACHECONF:
> > >>>>>>>>> in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for test-service/localhost@TEST.COM in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for
> > >>>>>>>>> krb5_ccache_conf_data/negative-cache/test-service\134/localh
> > >>>>>>>>> ost\
> > >>>>>>>>> 13
> > >>>>>>>>> 4@
> > >>>>>>>>> TE
> > >>>>>>>>> ST.COM@X-CACHECONF: in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF
> :
> > >>>>>>>>> in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for krb5_ccache_conf_data/sitename@X-CACHECONF:
> > >>>>>>>>> in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for test-service/localhost@TEST.COM in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > >>>>>>>>> des-cbc-md5-deprecated not supported
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > >>>>>>>>> des-cbc-md4-deprecated not supported
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > >>>>>>>>> des-cbc-crc-deprecated not supported
> > >>>>>>>>> 2017-05-04T20:44:06 Trying to find service kdc for realm
> > >>>>>>>>> TEST.COM flags 0
> > >>>>>>>>> 2017-05-04T20:44:06 configuration file for realm TEST.COM
> > >>>>>>>>> found
> > >>>>>>>>> 2017-05-04T20:44:06 submissing new requests to new host
> > >>>>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
> > >>>>>>>>> 2017-05-04T20:44:06 connecting to host: udp ::1:52534
> > >>>>>>>>> (localhost)
> > >>>>>> tid:
> > >>>>>>>>> 00000001
> > >>>>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
> > >>>>>>>>> 2017-05-04T20:44:06 Queuing host in future (in 3s), its the
> > >>>>>>>>> 2 address on the same name: udp 127.0.0.1:52534 (localhost)
> tid:
> > >>>>>>>>> 00000002
> > >>>>>>>>> 2017-05-04T20:44:06 writing packet: udp ::1:52534
> > >>>>>>>>> (localhost)
> > tid:
> > >>>>>>>>> 00000001
> > >>>>>>>>> 2017-05-04T20:44:06 reading packet: udp ::1:52534
> > >>>>>>>>> (localhost)
> > tid:
> > >>>>>>>>> 00000001
> > >>>>>>>>> 2017-05-04T20:44:06 host completed: udp ::1:52534
> > >>>>>>>>> (localhost)
> > tid:
> > >>>>>>>>> 00000001
> > >>>>>>>>> 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0
> > >>>>>>>>> hosts 1 packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814
> > >>>>>>>>> tid: 00000002
> > >>>>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/763641F3
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328353: Decrypt
> > >>>>>>>>> integrity check failed for checksum type
> > >>>>>>>>> hmac-sha1-96-aes128, key type
> > >>>>>>>>> aes128-cts-hmac-sha1-96
> > >>>>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
> > >>>>>>>>> 2017-05-04T20:44:06 krb5_get_credentials_with_flags:
> > >>>>>>>>> TEST.COM
> > wc:
> > >>>>>>>>> 0.050317
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for krb5_ccache_conf_data/realm-config@X-CACHECONF:
> > >>>>>>>>> in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > >>>>>>>>> credential for
> > >>>>>>>>> krb5_ccache_conf_data/time-offset/test-service\134/
> > >>>>>> localhost\134@TEST.
> > >>>>>>>>> COM@X-CACHECONF: in cache
> > >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>> 2017-05-04T20:44:06 Setting up PFS for auth context
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > >>>>>>>>> des-cbc-md5-deprecated not supported
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > >>>>>>>>> des-cbc-md4-deprecated not supported
> > >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > >>>>>>>>> des-cbc-crc-deprecated not supported First
> > >>>>>>>>> kerberos.authGSSClientStep successful
> > >>>>>>>>>
> > >>>>>>>>> Thanks
> > >>>>>>>>> Jiajia
> > >>>>>>>>>
> > >>>>>>>>> -----Original Message-----
> > >>>>>>>>> From: Zheng, Kai [mailto:kai.zheng@intel.com]
> > >>>>>>>>> Sent: Wednesday, May 3, 2017 7:29 PM
> > >>>>>>>>> To: kerby@directory.apache.org
> > >>>>>>>>> Subject: RE: MIT Kerberos compatibility
> > >>>>>>>>>
> > >>>>>>>>> Hi Marc,
> > >>>>>>>>>
> > >>>>>>>>> In case you're not aware of this, please check out the
> > >>>>>>>>> latest fix made
> > >>>>>>>> by Jiajia. We thought your case may be different, but would
> > >>>>>>>> be good to have a check before we can repeat/fix your case.
> Thanks.
> > >>>>>>>>> https://issues.apache.org/jira/browse/DIRKRB-625
> > >>>>>>>>>
> > >>>>>>>>> Regards,
> > >>>>>>>>> Kai
> > >>>>>>>>>
> > >>>>>>>>> -----Original Message-----
> > >>>>>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> > >>>>>>>>> Sent: Sunday, April 30, 2017 7:45 PM
> > >>>>>>>>> To: kerby@directory.apache.org
> > >>>>>>>>> Subject: Re: MIT Kerberos compatibility
> > >>>>>>>>>
> > >>>>>>>>> Hi Kai,
> > >>>>>>>>>
> > >>>>>>>>> The terminal output below is for the latest MIT Kerberos
> > >>>>>>>>> 1.15.1 (locally
> > >>>>>>>> built on Ubuntu Xenial). Before that, I also tested with the
> > >>>>>>>> default Xenial MIT Kerberos packages (1.13.2), with the same
> > >>>>>>>> result. I did not try earlier MIT Kerberos versions.
> > >>>>>>>>>
> > >>>>>>>>> Marc
> > >>>>>>>>>
> > >>>>>>>>> Op 29-04-17 om 21:42 schreef Marc de Lignie:
> > >>>>>>>>>> Hi Kai,
> > >>>>>>>>>>
> > >>>>>>>>>> Thanks for the response. I prepared a minimal config that
> > >>>>>>>>>> reproduces my problem.
> > >>>>>>>>>>
> > >>>>>>>>>> You can fetch the branch/commit from:
> > >>>>>>>>>> https://github.com/vtslab/directory-kerby/commits/MitIssue
> > >>>>>>>>>>
> > >>>>>>>>>> This is relative to RC2, but I also tried this on trunk for
> > >>>>>>>>>> my actual project.
> > >>>>>>>>>>
> > >>>>>>>>>> This config produces the debug and error messages below.
> > >>>>>>>>>>
> > >>>>>>>>>> 1. For the terminal with the bash + python script $ klist
> > >>>>>>>>>> Ticket
> > >>>>>>>>>> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>>> Default principal: drankye@TEST.COM
> > >>>>>>>>>>
> > >>>>>>>>>> Valid starting Expires Service principal
> > >>>>>>>>>> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/
> TEST.COM@TEST.COM
> > >>>>>>>>>> renew until 29-04-17 21:07:39
> > >>>>>>>>>>
> > >>>>>>>>>> $ .
> > >>>>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/ker
> > >>>>>>>>>> bero s/ ke rb / server/MitIssueTest.sh [15538]
> > >>>>>>>>>> 1493491231.917606:
> > >>>>>>>>>> Retrieving drankye@TEST.COM from
> > >>>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>>>> with
> > >>>>>>>>>> result:
> > >>>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>>>> found [15538]
> > >>>>>>>>>> 1493491231.917827: Retrieving drankye@TEST.COM from
> > >>>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> > >>>>>>>>>> with
> > >>>>>>> result:
> > >>>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> > >>>>>>>>>> found kerberos.authGSSClientInit successful [15538]
> 1493491231.918185:
> > >>>>>>>>>> Getting credentials drankye@TEST.COM ->
> > >>>>>>>>>> test-service/localhost@ using ccache
> > >>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>>> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
> > >>>>>>>>>> test-service/localhost@ from
> > >>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with
> > result:
> > >>>>>>>>>> -1765328243/Matching credential not found (filename:
> > >>>>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> > >>>>>>>>>> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
> > >>>>>>>>>> test-service/localhost@TEST.COM with result:
> > >>>>>>>>>> -1765328243/Matching credential not found (filename:
> > >>>>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> > >>>>>>>>>> [15538] 1493491231.918229: Server has referral realm;
> > >>>>>>>>>> starting with test-service/localhost@TEST.COM [15538]
> 1493491231.918278:
> > >>>>>>>>>> Retrieving drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> from FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >>>>>>>>>> with
> > result:
> > >>>>>>>>>> 0/Success
> > >>>>>>>>>> [15538] 1493491231.918281: Starting with TGT for client realm:
> > >>>>>>>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
> > >>>>>>>>>> 1493491231.918301: Requesting tickets for
> > >>>>>>>>>> test-service/localhost@TEST.COM, referrals on [15538]
> > >>>>>>>>>> 1493491231.918326: Generated subkey for TGS request:
> > >>>>>>>>>> aes128-cts/FA30
> > >>>>>>>>>> [15538] 1493491231.918359: etypes requested in TGS request:
> > >>>>>>>>>> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2,
> > >>>>>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
> > >>>>>>>>>> [15538]
> > >>>>>> 1493491231.918484:
> > >>>>>>>>>> Encoding request body and padata into FAST request [15538]
> > >>>>>>>>>> 1493491231.918541: Sending request (836 bytes) to TEST.COM
> > >>>>>>>>>> [15538]
> > >>>>>>>>>> 1493491231.918597: Resolving hostname localhost [15538]
> > >>>>>>>>>> 1493491231.918703: Initiating TCP connection to stream
> > >>>>>>>>>> 127.0.0.1:44292
> > >>>>>>>>>> [15538] 1493491231.918777: Sending TCP request to stream
> > >>>>>>>>>> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error
> > >>>>>>>>>> receiving from stream
> > >>>>>>>>>> 127.0.0.1:44292: 104/Connection reset by peer [15538]
> > >>>>>>>>>> 1493491231.922812: Terminating TCP connection to stream
> > >>>>>>>>>> 127.0.0.1:44292
> > >>>>>>>>>> [15538] 1493491231.922858: Sending initial UDP request to
> > >>>>>>>>>> dgram
> > >>>>>>>>>> 127.0.0.1:44292
> > >>>>>>>>>> ('First kerberos.authGSSClientStep not successful',
> > >>>>>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide
> > >>>>>>>>>> more information', 851968), ("Cannot contact any KDC for
> > >>>>>>>>>> realm 'TEST.COM'",
> > >>>>>>>>>> -1765328228)))
> > >>>>>>>>>>
> > >>>>>>>>>> 2. For the terminal that runs mvn clean test
> > >>>>>>>>>> -Dtest=MitIssueTest Running
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > >>>>>>>>>> 2017-04-29 21:07:39,182 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> initialize called
> > >>>>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> getIdentity called, principalName =
> > >>>>>>>>>> krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> getIdentity failed, principalName =
> > >>>>>>>>>> krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> addIdentity successful, principalName =
> > >>>>>>>>>> krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> getIdentity called, principalName =
> > >>>>>>>>>> kadmin/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> getIdentity failed, principalName =
> > >>>>>>>>>> kadmin/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,213 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> addIdentity successful, principalName =
> > >>>>>>>>>> kadmin/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,216 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> start called
> > >>>>>>>>>> 2017-04-29 21:07:39,232 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> addIdentity successful, principalName =
> > >>>>>>>>>> test-service/localhost@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,425 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> addIdentity successful, principalName = drankye@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1]
> > >>>>> request.KdcRequest:
> > >>>>>>>>>> Client entry is empty.
> > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = drankye@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = drankye@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > >>>>>>>>>> occurred, disconnecting abnormally java.io.EOFException
> > >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:
> 392)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > >>>>>>>>>> r.ru
> > >>>>>>>>>> n(
> > >>>>>>>> DefaultKdcHandler.java:46)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > >>>>>>>> ThreadPoolExecutor.java:1142)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > >>>>>>>> ThreadPoolExecutor.java:617)
> > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > >>>>>>>>>> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase:
> > >>>>>>>>>> Storing the tgt to the credential cache file.
> > >>>>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> getIdentity called, principalName =
> > >>>>>>>>>> test-service/localhost@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
> > >>>>>> AbstractIdentityBackend:
> > >>>>>>>>>> getIdentity successful, principalName =
> > >>>>>>>>>> test-service/localhost@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1]
> > >>>>> request.KdcRequest:
> > >>>>>>>>>> Client entry is empty.
> > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1]
> > >>>>> request.KdcRequest:
> > >>>>>>>>>> The preauth data is empty.
> > >>>>>>>>>> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1]
> > server.KdcHandler:
> > >>>>>>>>>> KRB error occurred while processing request:Additional
> > >>>>>>>>>> pre-authentication required
> > >>>>>>>>>> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > >>>>>>>>>> occurred, disconnecting abnormally java.io.EOFException
> > >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:
> 392)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > >>>>>>>>>> r.ru
> > >>>>>>>>>> n(
> > >>>>>>>> DefaultKdcHandler.java:46)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > >>>>>>>> ThreadPoolExecutor.java:1142)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > >>>>>>>> ThreadPoolExecutor.java:617)
> > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > >>>>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1]
> > >>>>> request.KdcRequest:
> > >>>>>>>>>> Client entry is empty.
> > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > >>>>>>>>>> occurred, disconnecting abnormally java.io.EOFException
> > >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:
> 392)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > >>>>>>>>>> r.ru
> > >>>>>>>>>> n(
> > >>>>>>>> DefaultKdcHandler.java:46)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > >>>>>>>> ThreadPoolExecutor.java:1142)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > >>>>>>>> ThreadPoolExecutor.java:617)
> > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > >>>>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> > >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> > >>>>>>>>>> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1]
> > >>>>> request.KdcRequest:
> > >>>>>>>>>> Found fast padata and start to process it.
> > >>>>>>>>>> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
> > >>>>>>>>>> impl.DefaultKdcHandler: Error occured while processing
> request:
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
> > >>>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> > >>>>>>>> java:85)
> > >>>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> > >>>>>>>> java:70)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kd
> > >>>>>>>>>> cFin
> > >>>>>>>>>> dF
> > >>>>>>>>>> as
> > >>>>>>>>>> t(
> > >>>>>>>> KdcRequest.java:208)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.
> > >>>>>>>> KdcRequest.process(KdcRequest.java:168)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
> > >>>>>>>> handleMessage(KdcHandler.java:115)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
> > >>>>>>>> handleMessage(DefaultKdcHandler.java:67)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > >>>>>>>>>> r.ru
> > >>>>>>>>>> n(
> > >>>>>>>> DefaultKdcHandler.java:52)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > >>>>>>>> ThreadPoolExecutor.java:1142)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > >>>>>>>> ThreadPoolExecutor.java:617)
> > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > >>>>>>>>>> Caused by: java.io.IOException: Unexpected item context [0]
> > >>>>>>>>>> [tag=0xA0, off=0, len=3+207], expecting 0x30
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > >>>>>>>> Asn1Encodeable.java:210)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > >>>>>>>> Asn1Encodeable.java:197)
> > >>>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> > >>>>>>>> java:83)
> > >>>>>>>>>> ... 9 more
> > >>>>>>>>>> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
> > >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> > >>>>>>>>>> occurred, disconnecting abnormally
> > >>>>>>>>>> java.net.SocketException: Socket closed
> > >>>>>>>>>> at java.net.SocketInputStream.socketRead0(Native Method)
> > >>>>>>>>>> at java.net.SocketInputStream.socketRead(SocketInputStream.
> > >>>>>>>> java:116)
> > >>>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
> > >>>>> 171)
> > >>>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
> > >>>>> 141)
> > >>>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
> > >>>>> 224)
> > >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:
> 387)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> > >>>>>>>>>> at
> > >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> > >>>>>>>>>> r.ru
> > >>>>>>>>>> n(
> > >>>>>>>> DefaultKdcHandler.java:46)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > >>>>>>>> ThreadPoolExecutor.java:1142)
> > >>>>>>>>>> at
> > >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > >>>>>>>> ThreadPoolExecutor.java:617)
> > >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> > >>>>>>>>>>
> > >>>>>>>>>> In a FreeIPA environment these python lines "just" work.
> > >>>>>>>>>>
> > >>>>>>>>>> Any suggestions are welcome!
> > >>>>>>>>>>
> > >>>>>>>>>> Marc
> > >>>>>>>>>>
> > >>>>>>>>>>
> > >>>>>>>>> --
> > >>>>>>>>> Marc de Lignie
> > >>>>>>>>>
> > >>>>>>>>
> > >>>>>>>> --
> > >>>>>>>> Marc de Lignie
> > >>>>>>>>
> > >>>>>>>>
> > >>>>>>>
> > >>>>>>>
> > >>>>>>> --
> > >>>>>>> Colm O hEigeartaigh
> > >>>>>>>
> > >>>>>>> Talend Community Coder
> > >>>>>>> http://coders.talend.com
> > >>>>>>>
> > >>>>>>
> > >>>>>>
> > >>>>>>
> > >>>>>> --
> > >>>>>> Colm O hEigeartaigh
> > >>>>>>
> > >>>>>> Talend Community Coder
> > >>>>>> http://coders.talend.com
> > >>>>>>
> > >>>>>
> > >>>>>
> > >>>>>
> > >>>>> --
> > >>>>> Colm O hEigeartaigh
> > >>>>>
> > >>>>> Talend Community Coder
> > >>>>> http://coders.talend.com
> > >>>>>
> > >>>>
> > >>>>
> > >>>>
> > >>>> --
> > >>>> Colm O hEigeartaigh
> > >>>>
> > >>>> Talend Community Coder
> > >>>> http://coders.talend.com
> > >>>
> > >>>
> > >>
> > >>
> > >> --
> > >> Colm O hEigeartaigh
> > >>
> > >> Talend Community Coder
> > >> http://coders.talend.com
> >
>
>
>
> --
> Colm O hEigeartaigh
>
> Talend Community Coder
> http://coders.talend.com
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
RE: MIT Kerberos compatibility
Posted by "Zheng, Kai" <ka...@intel.com>.
Hi Colm,
Sure, please do it. Could you review my change and see how it would cause the new failures? Any difference between the failed GSS tests and the Kerby GSS tests?
Regards,
Kai
-----Original Message-----
From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
Sent: Monday, May 08, 2017 5:42 PM
To: Zheng, Kai <ka...@intel.com>
Cc: kerby@directory.apache.org
Subject: Re: MIT Kerberos compatibility
Hi Kai,
Your changes fixed the error message I was seeing. However, I now see another problem when I run a few GSS client tests in a row:
>>> EType: sun.security.krb5.internal.crypto.Aes128CtsHmacSha1EType
>>> KrbAsReq creating message
>>> KrbKdcReq send: kdc=localhost UDP:42665, timeout=30000, number of
retries =3, #bytes=245
>>> KDCCommunication: kdc=localhost UDP:42665, timeout=30000,Attempt =1,
#bytes=245
SocketTimeOutException with attempt: 1
>>> KDCCommunication: kdc=localhost UDP:42665, timeout=30000,Attempt =2,
#bytes=245
>>> KrbKdcReq send: error trying localhost:42665
java.net.PortUnreachableException: ICMP Port Unreachable
Do you want me to create a JIRA + attach a test-case?
Colm.
On Sat, May 6, 2017 at 2:01 AM, Zheng, Kai <ka...@intel.com> wrote:
> I haven't repeated the issue but revisited the codes again and made
> improvements. Would you check it out? Thanks!
>
> Sent from iPhone
>
> > 在 2017年5月6日，上午6:28，Zheng, Kai <ka...@intel.com> 写道：
> >
> > Thanks colm for the clarification and it sounds an issue we need to
> address. I will investigate it soon.
> >
> > Sent from iPhone
> >
> >> 在 2017年5月6日，上午2:14，Colm O hEigeartaigh <co...@apache.org> 写道：
> >>
> >> Hi Kai,
> >>
> >> If I enable UDP with the default Transport, I can get a ticket fine
> using
> >> kinit. However then the following error pops up in the window I'm
> running
> >> Kerby in (as a test):
> >>
> >> Exception in thread "Thread-1" java.lang.RuntimeException: Error
> >> occured while checking udp connections
> >> at
> >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> KdcNetwork.java:105)
> >> at
> >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> access$000(KdcNetwork.java:39)
> >> at
> >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> run(KdcNetwork.java:75)
> >> at java.lang.Thread.run(Thread.java:748)
> >> Caused by: java.nio.channels.ClosedChannelException
> >> at
> >> sun.nio.ch.DatagramChannelImpl.ensureOpen(DatagramChannelImpl.java:320)
> >> at sun.nio.ch.DatagramChannelImpl.receive(
> DatagramChannelImpl.java:331)
> >> at
> >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> checkUdpMessage(KdcNetwork.java:132)
> >> at
> >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> KdcNetwork.java:101)
> >>
> >> Colm.
> >>
> >>
> >>> On Fri, May 5, 2017 at 5:56 PM, Zheng, Kai <ka...@intel.com>
> wrote:
> >>>
> >>> Colm, did you see udp problem now instead? I'm a little confused.
> >>> Udp
> is
> >>> sure supported but may not be enabled by default, which should be
> >>> okay, imo. Thanks.
> >>>
> >>> Sent from iPhone
> >>>
> >>>> 在 2017年5月6日，上午12:02，Colm O hEigeartaigh <co...@apache.org> 写道：
> >>>>
> >>>> That's probably it. Why does the default transport not support
> >>>> UDP in
> >>> Kerby?
> >>>>
> >>>> Colm.
> >>>>
> >>>>> On Fri, May 5, 2017 at 4:54 PM, Li, Jiajia <ji...@intel.com>
> wrote:
> >>>>>
> >>>>> Are you sure add kdc_allow_udp = false in kdc.conf?
> >>>>>
> >>>>> Thanks
> >>>>> Jiajia
> >>>>>
> >>>>> -----Original Message-----
> >>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> >>>>> Sent: Friday, May 5, 2017 11:41 PM
> >>>>> To: Li, Jiajia <ji...@intel.com>
> >>>>> Cc: kerby@directory.apache.org; Zheng, Kai
> >>>>> <ka...@intel.com>;
> >>> mailto:
> >>>>> m.c.delignie@xs4all.nl <m....@xs4all.nl>
> >>>>> Subject: Re: MIT Kerberos compatibility
> >>>>>
> >>>>> Sorry, it was my error, UDP was actually enabled there. But why
> >>>>> am I
> >>> still
> >>>>> seeing that error message?
> >>>>>
> >>>>> Colm.
> >>>>>
> >>>>>> On Fri, May 5, 2017 at 4:39 PM, Li, Jiajia
> >>>>>> <ji...@intel.com>
> >>> wrote:
> >>>>>>
> >>>>>> Hi Colm,
> >>>>>> I also test the Kerby KDC with kerby kint and MIT kinit, and
> >>>>>> only listen the tcp port(disable udp), both got ticket
> >>>>>> successfully. But
> I
> >>>>>> don't get the error message. Both krb.conf and kdc.conf should
> >>>>>> set
> udp
> >>>>>> to be false, udp is enabled in default.
> >>>>>>
> >>>>>> Thanks
> >>>>>> Jiajia
> >>>>>>
> >>>>>> -----Original Message-----
> >>>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> >>>>>> Sent: Friday, May 5, 2017 11:34 PM
> >>>>>> To: kerby@directory.apache.org
> >>>>>> Cc: Zheng, Kai <ka...@intel.com>;
> >>>>>> mailto:m.c.delignie@xs4all.nl
> <
> >>>>>> m.c.delignie@xs4all.nl>
> >>>>>> Subject: Re: MIT Kerberos compatibility
> >>>>>>
> >>>>>> Hi Jiajia,
> >>>>>>
> >>>>>> If UDP is disabled and we don't use Netty, I can get a token
> >>>>>> successfully via kinit. However I then see an error message in
> >>>>>> the
> >>> Kerby
> >>>>> console:
> >>>>>>
> >>>>>> Exception in thread "Thread-1" java.lang.RuntimeException:
> >>>>>> Error occured while checking udp connections at
> >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> >>>>>> KdcNetwork.java:105)
> >>>>>> at
> >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> >>>>>> access$000(KdcNetwork.java:39)
> >>>>>> at
> >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> >>>>>> run(KdcNetwork.java:75)
> >>>>>> at java.lang.Thread.run(Thread.java:748)
> >>>>>> Caused by: java.nio.channels.ClosedChannelException
> >>>>>> at
> >>>>>> sun.nio.ch.DatagramChannelImpl.ensureOpen(
> >>> DatagramChannelImpl.java:320)
> >>>>>> at sun.nio.ch.DatagramChannelImpl.receive(
> >>>>>> DatagramChannelImpl.java:331)
> >>>>>> at
> >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> >>>>>> checkUdpMessage(KdcNetwork.java:132)
> >>>>>> at
> >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> >>>>>> KdcNetwork.java:101)
> >>>>>>
> >>>>>> I'm not sure why we are seeing UDP errors when it's disabled?
> >>>>>>
> >>>>>> Colm.
> >>>>>>
> >>>>>>> On Fri, May 5, 2017 at 3:57 PM, Li, Jiajia
> >>>>>>> <ji...@intel.com>
> >>> wrote:
> >>>>>>>
> >>>>>>> Hi Colm,
> >>>>>>> The shell client can't connect to kdc if the UDP is disabled.
> >>>>>>> We don't use Netty in default.
> >>>>>>> What's your test-cases? The same as the Marc's?
> >>>>>>>
> >>>>>>> Thanks
> >>>>>>> Jiajia
> >>>>>>>
> >>>>>>> -----Original Message-----
> >>>>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> >>>>>>> Sent: Friday, May 5, 2017 10:09 PM
> >>>>>>> To: kerby@directory.apache.org
> >>>>>>> Cc: Zheng, Kai <ka...@intel.com>; mailto:
> m.c.delignie@xs4all.nl
> >>>>>>> < m.c.delignie@xs4all.nl>
> >>>>>>> Subject: Re: MIT Kerberos compatibility
> >>>>>>>
> >>>>>>> Hi Jiajia,
> >>>>>>>
> >>>>>>> What are the issues if UDP is disabled and we don't use Netty?
> >>>>>>> I tried doing this with my own test-cases and it didn't work,
> >>>>>>> so it would be good to get this fixed soon.
> >>>>>>>
> >>>>>>> Colm.
> >>>>>>>
> >>>>>>> On Fri, May 5, 2017 at 2:46 PM, Li, Jiajia
> >>>>>>> <ji...@intel.com>
> >>>>> wrote:
> >>>>>>>
> >>>>>>>> Hi Marc,
> >>>>>>>>>>> - your KRB5 tracing looks quite different. What OS and
> >>>>>>>>>>> mit-kerberos
> >>>>>>>> version did you use?
> >>>>>>>> I use mac os and the python version is 2.7.10
> >>>>>>>>
> >>>>>>>>>>> - your KRB5 tracing shows UDP comms between kerberos
> >>>>>>>>>>> client and KDC,
> >>>>>>>> despite the allowUDP = false setting
> >>>>>>>>>>> in my test. I did this setting because I get different
> >>>>>>>>>>> problems
> >>>>>>>> without it, see the additional logs below. So,
> >>>>>>>>>>> we must also be aware of networking problems at my side.
> >>>>>>>> I enable the UDP and use netty network, there are some issues
> >>>>>>>> if UDP disabled, you can create a JIRA for this and we can
> >>>>>>>> fix this issue in the next release version.
> >>>>>>>>
> >>>>>>>> The changes in my side as following:
> >>>>>>>>
> >>>>>>>> protected boolean allowUdp() { return true; } @Override
> >>>>>>>> protected void prepareKdc() throws KrbException {
> >>>>>>>> getKdcServer().setInnerKdcImpl(
> >>>>>>>> new
> >>>>>>>> NettyKdcServerImpl(getKdcServer().getKdcSetting()));
> >>>>>>>> super.prepareKdc();
> >>>>>>>> }
> >>>>>>>>
> >>>>>>>> Here is log of MitIssueTest:
> >>>>>>>> [INFO] Running
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> >>>>>>>> [nioEventLoopGroup-2-1] INFO
> >>>>>>>> io.netty.handler.logging.LoggingHandler
> >>>>>>>> -
> >>>>>>>> [id: 0x2634fe6b] REGISTERED
> >>>>>>>> [nioEventLoopGroup-2-1] INFO
> >>>>>>>> io.netty.handler.logging.LoggingHandler
> >>>>>>>> -
> >>>>>>>> [id: 0x2634fe6b] BIND(0.0.0.0/0.0.0.0:53957)
> >>>>>>>> [nioEventLoopGroup-2-1] INFO
> >>>>>>>> io.netty.handler.logging.LoggingHandler -
> >>>>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] ACTIVE [main] INFO
> >>>>>>>> org.apache.kerby.kerberos.kdc.impl.NettyKdcServerImpl - Netty
> >>>>>>>> kdc server started.
> >>>>>>>> [nioEventLoopGroup-2-1] INFO
> >>>>>>>> io.netty.handler.logging.LoggingHandler
> >>>>>>>> -
> >>>>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] RECEIVED: [id:
> >>>>>>>> 0xdac7228b, /
> >>>>>>>> 127.0.0.1:53961 => /127.0.0.1:53957]
> >>>>>>>> [defaultEventExecutorGroup-4-1] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
> >>>>>>>> - AS_REQ ISSUE: authtime 1493991123792,drankye@TEST.COM for
> >>>>>>>> krbtgt/ TEST.COM@TEST.COM [main] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> DefaultInternalKrbClien
> >>>>>>>> t
> >>>>>>>> - Send to kdc success.
> >>>>>>>> [main] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing the tgt to the credential cache file.
> >>>>>>>> [nioEventLoopGroup-5-1] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> >>>>>>>> - The preauth data is empty.
> >>>>>>>> [nioEventLoopGroup-5-1] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> >>>>>>>> - KRB error occurred while processing request:Additional
> >>>>>>>> pre-authentication required [nioEventLoopGroup-5-1] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
> >>>>>>>> - AS_REQ ISSUE: authtime
> >>>>>>>> 1493991123859,test-service/localhost@TEST.COM
> >>>>>>>> for krbtgt/TEST.COM@TEST.COM
> >>>>>>>> [nioEventLoopGroup-5-1] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.TgsRequest
> >>>>>>>> - TGS_REQ ISSUE: authtime 1493991142850,drankye for
> >>>>>>>> test-service/ localhost@TEST.COM
> >>>>>>>>
> >>>>>>>> Thanks
> >>>>>>>> Jiajia
> >>>>>>>>
> >>>>>>>> -----Original Message-----
> >>>>>>>> From: Zheng, Kai
> >>>>>>>> Sent: Friday, May 5, 2017 7:46 PM
> >>>>>>>> To: kerby@directory.apache.org; Li, Jiajia
> >>>>>>>> <ji...@intel.com>
> >>>>>>>> Subject: RE: MIT Kerberos compatibility
> >>>>>>>>
> >>>>>>>> Hi Marc,
> >>>>>>>>
> >>>>>>>> Looks like this is quite environment related, could you fire
> >>>>>>>> an issue for this? I would suggest we target it to 1.1.0,
> >>>>>>>> which can be done in
> >>>>>>> June.
> >>>>>>>>
> >>>>>>>> Regards,
> >>>>>>>> Kai
> >>>>>>>>
> >>>>>>>> -----Original Message-----
> >>>>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> >>>>>>>> Sent: Friday, May 05, 2017 4:44 PM
> >>>>>>>> To: Li, Jiajia <ji...@intel.com>
> >>>>>>>> Cc: kerby@directory.apache.org
> >>>>>>>> Subject: Re: MIT Kerberos compatibility
> >>>>>>>>
> >>>>>>>> Hi Jiajia,
> >>>>>>>>
> >>>>>>>> Great to read that you made progress on this issue and to see
> >>>>>>>> a working config at your side. Below, I list my progress
> >>>>>>>> below (with trunk merged into my MitIssue branch), but I am
> >>>>>>>> afraid we are not done
> >>>>>>> yet.
> >>>>>>>>
> >>>>>>>> Things that stand out:
> >>>>>>>>
> >>>>>>>> - the kdc decoding error is solved, relative to the logs
> >>>>>>>> without your patch
> >>>>>>>>
> >>>>>>>> - your KRB5 tracing looks quite different. What OS and
> >>>>>>>> mit-kerberos version did you use?
> >>>>>>>>
> >>>>>>>> - your KRB5 tracing shows UDP comms between kerberos client
> >>>>>>>> and KDC, despite the allowUDP = false setting in my test. I
> >>>>>>>> did this setting because I get different problems without it,
> >>>>>>>> see the additional logs below. So, we must also be aware of
> >>>>>>>> networking
> >>>>> problems at my side.
> >>>>>>>>
> >>>>>>>> - the "Response was not from master KDC" msg is not relevant;
> >>>>>>>> it disappears if you manually add master_kdc to the realms
> >>>>>>>> section of the krb5.conf
> >>>>>>>>
> >>>>>>>> I have no idea how to proceed from here, so that is why I
> >>>>>>>> just document the status at my side and ask about your -
> >>>>>>>> apparently working -
> >>>>>>> config.
> >>>>>>>>
> >>>>>>>> Cheers, Marc
> >>>>>>>>
> >>>>>>>>
> >>>>>>>> KDC logging with allowUDP = false:
> >>>>>>>>
> >>>>>>>> [INFO] Running
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> >>>>>>>> [pool-1-thread-1] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> >>>>>>>> AS_REQ
> >>>>>> ISSUE:
> >>>>>>>> authtime 1493970789075,drankye@TEST.COM for
> >>>>>>>> krbtgt/TEST.COM@TEST.COM [main] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> DefaultInternalKrbClien
> >>>>>>>> t
> >>>>>>>> - Send to kdc success.
> >>>>>>>> [main] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing the tgt to the credential cache file.
> >>>>>>>> [pool-1-thread-1] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest -
> >>>>>>>> The preauth data is empty.
> >>>>>>>> [pool-1-thread-1] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> >>>>>>>> - KRB error occurred while processing request:Additional
> >>>>>>>> pre-authentication required [pool-1-thread-1] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> >>>>>>>> AS_REQ
> >>>>>> ISSUE:
> >>>>>>>> authtime 1493970789108,test-service/localhost@TEST.COM for
> krbtgt/
> >>>>>>>> TEST.COM@TEST.COM [pool-1-thread-1] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> >>>>>>>> - Found fast padata and starting to process it.
> >>>>>>>> [pool-1-thread-1] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest -
> >>>>>>>> Found fast padata and starting to process it.
> >>>>>>>>
> >>>>>>>> Python script KRB5 tracing (MIT Kerberos 1.13.2 of Ubuntu
> >>>>>>>> Xenial) with allowUDP = false:
> >>>>>>>>
> >>>>>>>> $ .
> >>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/
> >>>>>>>> kerberos/kerb/server/MitIssueTest.sh
> >>>>>>>> [25281] 1493970797.298753: Retrieving drankye@TEST.COM from
> >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> >>>>>>>> with
> >>>>> result:
> >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> >>>>>>>> found [25281]
> >>>>>>>> 1493970797.298952: Retrieving drankye@TEST.COM from
> >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> >>>>>>>> with
> >>>>> result:
> >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> >>>>>>>> found [25281]
> >>>>>>>> 1493970797.299106: Retrieving drankye@TEST.COM from
> >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> >>>>>>>> with
> >>>>> result:
> >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> >>>>>>>> found [25281]
> >>>>>>>> 1493970797.299213: Retrieving drankye@TEST.COM from
> >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> >>>>>>>> with
> >>>>> result:
> >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> >>>>>>>> found [25281]
> >>>>>>>> 1493970797.299323: Retrieving drankye@TEST.COM from
> >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> >>>>>>>> with
> >>>>> result:
> >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> >>>>>>>> found [25281]
> >>>>>>>> 1493970797.299436: Retrieving drankye@TEST.COM from
> >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> >>>>>>>> with
> >>>>> result:
> >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> >>>>>>>> found [25281]
> >>>>>>>> 1493970797.299545: Retrieving drankye@TEST.COM from
> >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> >>>>>>>> with
> >>>>> result:
> >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> >>>>>>>> found [25281]
> >>>>>>>> 1493970797.299654: Retrieving drankye@TEST.COM from
> >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> >>>>>>>> with
> >>>>> result:
> >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> >>>>>>>> found kerberos.authGSSClientInit successful [25281] 1493970797.299922:
> >>>>>>>> Getting credentials drankye@TEST.COM ->
> >>>>>>>> test-service/localhost@ using ccache
> >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>>> [25281] 1493970797.299945: Retrieving drankye@TEST.COM ->
> >>>>>>>> test-service/localhost@ from
> >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>>> with result:
> >>>>>>>> -1765328243/Matching credential not found [25281]
> 1493970797.299959:
> >>>>>>>> Retrying drankye@TEST.COM -> test-service/localhost@TEST.COM
> >>>>>>>> with
> >>>>>>> result:
> >>>>>>>> -1765328243/Matching credential not found [25281]
> 1493970797.299962:
> >>>>>>>> Server has referral realm; starting with
> >>>>>>>> test-service/localhost@TEST.COM [25281]
> >>>>>>>> 1493970797.299975: Retrieving drankye@TEST.COM ->
> >>>>>>>> krbtgt/TEST.COM@TEST.COM from
> >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>> with result:
> >>>>>>>> 0/Success [25281] 1493970797.299979: Starting with TGT for
> >>>>>>>> client
> >>>>>> realm:
> >>>>>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [25281]
> >>>>>> 1493970797.299981:
> >>>>>>>> Requesting tickets for test-service/localhost@TEST.COM,
> >>>>>>>> referrals on [25281] 1493970797.299994: Generated subkey for TGS request:
> >>>>>>>> aes128-cts/1B9B [25281] 1493970797.300009: etypes requested
> >>>>>>>> in TGS
> >>>>>>> request:
> >>>>>>>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac,
> >>>>>>>> camellia128-cts, camellia256-cts [25281] 1493970797.300054:
> >>>>>>>> Encoding request body and padata into FAST request [25281]
> >>>>>>>> 1493970797.300080: Sending request
> >>>>>>>> (823 bytes) to TEST.COM [25281] 1493970797.300091: Resolving
> >>>>>>>> hostname localhost [25281]
> >>>>>>>> 1493970797.300136: Initiating TCP connection to stream
> >>>>>>>> 127.0.0.1:34319
> >>>>>>>> [25281] 1493970797.300191: Sending TCP request to stream
> >>>>>>>> 127.0.0.1:34319 [25281] 1493970797.303610: Received answer
> >>>>>>>> (125
> >>>>>>>> bytes) from stream
> >>>>>>>> 127.0.0.1:34319
> >>>>>>>> [25281] 1493970797.303618: Terminating TCP connection to
> >>>>>>>> stream
> >>>>>>>> 127.0.0.1:34319
> >>>>>>>> [25281] 1493970797.553126: Response was not from master KDC
> >>>>>>>> [25281]
> >>>>>>>> 1493970797.553198: TGS request result: -1765323383/Unknown
> >>>>>>>> code krcM
> >>>>>>>> 137 [25281] 1493970797.553234: Requesting tickets for
> >>>>>>>> test-service/ localhost@TEST.COM, referrals off [25281]
> >>>>> 1493970797.553273:
> >>>>>>>> Generated subkey for TGS request: aes128-cts/94C6 [25281]
> >>>>>> 1493970797.553323:
> >>>>>>>> etypes requested in TGS request: aes256-cts, aes128-cts,
> >>>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
> >>>>>>>> [25281]
> >>>>>>>> 1493970797.553436: Encoding request body and padata into FAST
> >>>>>>>> request
> >>>>>>> [25281] 1493970797.553532:
> >>>>>>>> Sending request (823 bytes) to TEST.COM [25281]
> 1493970797.553567:
> >>>>>>>> Resolving hostname localhost [25281] 1493970797.553745:
> >>>>>>>> Initiating TCP connection to stream
> >>>>>>>> 127.0.0.1:34319
> >>>>>>>> [25281] 1493970797.553889: Sending TCP request to stream
> >>>>>>>> 127.0.0.1:34319 [25281] 1493970797.558297: Received answer
> >>>>>>>> (125
> >>>>>>>> bytes) from stream
> >>>>>>>> 127.0.0.1:34319
> >>>>>>>> [25281] 1493970797.558318: Terminating TCP connection to
> >>>>>>>> stream
> >>>>>>>> 127.0.0.1:34319
> >>>>>>>> [25281] 1493970797.561189: Response was not from master KDC
> >>>>>>>> [25281]
> >>>>>>>> 1493970797.561258: TGS request result: -1765323383/Unknown
> >>>>>>>> code krcM
> >>>>>>>> 137 ('First kerberos.authGSSClientStep not successful',
> >>>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide
> >>>>>>>> more information', 851968), ('Unknown code krcM 137',
> >>>>>>>> -1765323383)))
> >>>>>>>>
> >>>>>>>>
> >>>>>>>> KDC logging with allowUDP = true:
> >>>>>>>>
> >>>>>>>> [INFO] Running
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> >>>>>>>> [pool-1-thread-1] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> >>>>>>>> AS_REQ
> >>>>>> ISSUE:
> >>>>>>>> authtime 1493972505784,drankye@TEST.COM for
> >>>>>>>> krbtgt/TEST.COM@TEST.COM [main] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> DefaultInternalKrbClien
> >>>>>>>> t
> >>>>>>>> - Send to kdc success.
> >>>>>>>> [main] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing the tgt to the credential cache file.
> >>>>>>>> [pool-1-thread-1] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest -
> >>>>>>>> The preauth data is empty.
> >>>>>>>> [pool-1-thread-1] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> >>>>>>>> - KRB error occurred while processing request:Additional
> >>>>>>>> pre-authentication required [pool-1-thread-2] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
> >>>>>>>> AS_REQ
> >>>>>> ISSUE:
> >>>>>>>> authtime 1493972505948,test-service/localhost@TEST.COM for
> krbtgt/
> >>>>>>>> TEST.COM@TEST.COM Exception in thread "Thread-0"
> >>>>>>>> java.lang.RuntimeException: Error occured while checking udp
> >>>>>> connections
> >>>>>>>> at
> >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> >>>>>>>> KdcNetwork.java:105)
> >>>>>>>> at
> >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> >>>>>>>> access$000(KdcNetwork.java:39)
> >>>>>>>> at
> >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> >>>>>>>> run(KdcNetwork.java:75)
> >>>>>>>> at java.lang.Thread.run(Thread.java:748)
> >>>>>>>> Caused by: java.nio.channels.ClosedChannelException
> >>>>>>>> at
> >>>>>>>> sun.nio.ch.DatagramChannelImpl.ensureOpen(
> >>>>>> DatagramChannelImpl.java:320)
> >>>>>>>> at sun.nio.ch.DatagramChannelImpl.receive(
> >>>>>>>> DatagramChannelImpl.java:331)
> >>>>>>>> at
> >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> >>>>>>>> checkUdpMessage(KdcNetwork.java:132)
> >>>>>>>> at
> >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> >>>>>>>> KdcNetwork.java:101)
> >>>>>>>> ... 3 more
> >>>>>>>>
> >>>>>>>>
> >>>>>>>> krb5.conf:
> >>>>>>>>
> >>>>>>>> [libdefaults]
> >>>>>>>> kdc_realm = TEST.COM
> >>>>>>>> default_realm = TEST.COM
> >>>>>>>> udp_preference_limit = 4096
> >>>>>>>> kdc_tcp_port = 37080
> >>>>>>>> kdc_udp_port = 36525
> >>>>>>>>
> >>>>>>>> [realms]
> >>>>>>>> TEST.COM = {
> >>>>>>>> kdc = localhost:36525
> >>>>>>>> }
> >>>>>>>>
> >>>>>>>> And port 36525 does not show up in `netstat -l` (while 37080
> >>>>>>>> does)
> >>>>>>>>
> >>>>>>>>
> >>>>>>>> Op 04-05-17 om 14:55 schreef Li, Jiajia:
> >>>>>>>>> Hi Marc,
> >>>>>>>>> I try to run your test(through applying your patch in the
> >>>>>>>>> trunk) , I
> >>>>>>>> think it's success now. Could you take some time to check
> >>>>>>>> about
> it?
> >>>>>>>>> Here is the log:
> >>>>>>>>>
> >>>>>>>>> directory-kerby git:(trunk) ? .
> >>>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerb
> >>>>>>>>> eros
> >>>>>>>>> /k
> >>>>>>>>> er
> >>>>>>>>> b/
> >>>>>>>>> server/MitIssueTest.sh
> >>>>>>>>> kerberos.authGSSClientInit successful
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: entypes not
> >>>>>>>>> supported
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> >>>>>>>>> credential for krb5_ccache_conf_data/realm-config@X-CACHECONF:
> >>>>>>>>> in cache
> >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> >>>>>>>>> credential for test-service/localhost@TEST.COM in cache
> >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> >>>>>>>>> credential for
> >>>>>>>>> krb5_ccache_conf_data/negative-cache/test-service\134/localh
> >>>>>>>>> ost\
> >>>>>>>>> 13
> >>>>>>>>> 4@
> >>>>>>>>> TE
> >>>>>>>>> ST.COM@X-CACHECONF: in cache
> >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> >>>>>>>>> credential for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF:
> >>>>>>>>> in cache
> >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> >>>>>>>>> credential for krb5_ccache_conf_data/sitename@X-CACHECONF:
> >>>>>>>>> in cache
> >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> >>>>>>>>> credential for test-service/localhost@TEST.COM in cache
> >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> >>>>>>>>> des-cbc-md5-deprecated not supported
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> >>>>>>>>> des-cbc-md4-deprecated not supported
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> >>>>>>>>> des-cbc-crc-deprecated not supported
> >>>>>>>>> 2017-05-04T20:44:06 Trying to find service kdc for realm
> >>>>>>>>> TEST.COM flags 0
> >>>>>>>>> 2017-05-04T20:44:06 configuration file for realm TEST.COM
> >>>>>>>>> found
> >>>>>>>>> 2017-05-04T20:44:06 submissing new requests to new host
> >>>>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
> >>>>>>>>> 2017-05-04T20:44:06 connecting to host: udp ::1:52534
> >>>>>>>>> (localhost)
> >>>>>> tid:
> >>>>>>>>> 00000001
> >>>>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
> >>>>>>>>> 2017-05-04T20:44:06 Queuing host in future (in 3s), its the
> >>>>>>>>> 2 address on the same name: udp 127.0.0.1:52534 (localhost) tid:
> >>>>>>>>> 00000002
> >>>>>>>>> 2017-05-04T20:44:06 writing packet: udp ::1:52534
> >>>>>>>>> (localhost)
> tid:
> >>>>>>>>> 00000001
> >>>>>>>>> 2017-05-04T20:44:06 reading packet: udp ::1:52534
> >>>>>>>>> (localhost)
> tid:
> >>>>>>>>> 00000001
> >>>>>>>>> 2017-05-04T20:44:06 host completed: udp ::1:52534
> >>>>>>>>> (localhost)
> tid:
> >>>>>>>>> 00000001
> >>>>>>>>> 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0
> >>>>>>>>> hosts 1 packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814
> >>>>>>>>> tid: 00000002
> >>>>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/763641F3
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328353: Decrypt
> >>>>>>>>> integrity check failed for checksum type
> >>>>>>>>> hmac-sha1-96-aes128, key type
> >>>>>>>>> aes128-cts-hmac-sha1-96
> >>>>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
> >>>>>>>>> 2017-05-04T20:44:06 krb5_get_credentials_with_flags:
> >>>>>>>>> TEST.COM
> wc:
> >>>>>>>>> 0.050317
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> >>>>>>>>> credential for krb5_ccache_conf_data/realm-config@X-CACHECONF:
> >>>>>>>>> in cache
> >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> >>>>>>>>> credential for
> >>>>>>>>> krb5_ccache_conf_data/time-offset/test-service\134/
> >>>>>> localhost\134@TEST.
> >>>>>>>>> COM@X-CACHECONF: in cache
> >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>>>> 2017-05-04T20:44:06 Setting up PFS for auth context
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> >>>>>>>>> des-cbc-md5-deprecated not supported
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> >>>>>>>>> des-cbc-md4-deprecated not supported
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> >>>>>>>>> des-cbc-crc-deprecated not supported First
> >>>>>>>>> kerberos.authGSSClientStep successful
> >>>>>>>>>
> >>>>>>>>> Thanks
> >>>>>>>>> Jiajia
> >>>>>>>>>
> >>>>>>>>> -----Original Message-----
> >>>>>>>>> From: Zheng, Kai [mailto:kai.zheng@intel.com]
> >>>>>>>>> Sent: Wednesday, May 3, 2017 7:29 PM
> >>>>>>>>> To: kerby@directory.apache.org
> >>>>>>>>> Subject: RE: MIT Kerberos compatibility
> >>>>>>>>>
> >>>>>>>>> Hi Marc,
> >>>>>>>>>
> >>>>>>>>> In case you're not aware of this, please check out the
> >>>>>>>>> latest fix made
> >>>>>>>> by Jiajia. We thought your case may be different, but would
> >>>>>>>> be good to have a check before we can repeat/fix your case. Thanks.
> >>>>>>>>> https://issues.apache.org/jira/browse/DIRKRB-625
> >>>>>>>>>
> >>>>>>>>> Regards,
> >>>>>>>>> Kai
> >>>>>>>>>
> >>>>>>>>> -----Original Message-----
> >>>>>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> >>>>>>>>> Sent: Sunday, April 30, 2017 7:45 PM
> >>>>>>>>> To: kerby@directory.apache.org
> >>>>>>>>> Subject: Re: MIT Kerberos compatibility
> >>>>>>>>>
> >>>>>>>>> Hi Kai,
> >>>>>>>>>
> >>>>>>>>> The terminal output below is for the latest MIT Kerberos
> >>>>>>>>> 1.15.1 (locally
> >>>>>>>> built on Ubuntu Xenial). Before that, I also tested with the
> >>>>>>>> default Xenial MIT Kerberos packages (1.13.2), with the same
> >>>>>>>> result. I did not try earlier MIT Kerberos versions.
> >>>>>>>>>
> >>>>>>>>> Marc
> >>>>>>>>>
> >>>>>>>>> Op 29-04-17 om 21:42 schreef Marc de Lignie:
> >>>>>>>>>> Hi Kai,
> >>>>>>>>>>
> >>>>>>>>>> Thanks for the response. I prepared a minimal config that
> >>>>>>>>>> reproduces my problem.
> >>>>>>>>>>
> >>>>>>>>>> You can fetch the branch/commit from:
> >>>>>>>>>> https://github.com/vtslab/directory-kerby/commits/MitIssue
> >>>>>>>>>>
> >>>>>>>>>> This is relative to RC2, but I also tried this on trunk for
> >>>>>>>>>> my actual project.
> >>>>>>>>>>
> >>>>>>>>>> This config produces the debug and error messages below.
> >>>>>>>>>>
> >>>>>>>>>> 1. For the terminal with the bash + python script $ klist
> >>>>>>>>>> Ticket
> >>>>>>>>>> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>>>>> Default principal: drankye@TEST.COM
> >>>>>>>>>>
> >>>>>>>>>> Valid starting Expires Service principal
> >>>>>>>>>> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> renew until 29-04-17 21:07:39
> >>>>>>>>>>
> >>>>>>>>>> $ .
> >>>>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/ker
> >>>>>>>>>> bero s/ ke rb / server/MitIssueTest.sh [15538]
> >>>>>>>>>> 1493491231.917606:
> >>>>>>>>>> Retrieving drankye@TEST.COM from
> >>>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> >>>>>>>>>> with
> >>>>>>>>>> result:
> >>>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> >>>>>>>>>> found [15538]
> >>>>>>>>>> 1493491231.917827: Retrieving drankye@TEST.COM from
> >>>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
> >>>>>>>>>> with
> >>>>>>> result:
> >>>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
> >>>>>>>>>> found kerberos.authGSSClientInit successful [15538] 1493491231.918185:
> >>>>>>>>>> Getting credentials drankye@TEST.COM ->
> >>>>>>>>>> test-service/localhost@ using ccache
> >>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>>>>> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
> >>>>>>>>>> test-service/localhost@ from
> >>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with
> result:
> >>>>>>>>>> -1765328243/Matching credential not found (filename:
> >>>>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> >>>>>>>>>> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
> >>>>>>>>>> test-service/localhost@TEST.COM with result:
> >>>>>>>>>> -1765328243/Matching credential not found (filename:
> >>>>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> >>>>>>>>>> [15538] 1493491231.918229: Server has referral realm;
> >>>>>>>>>> starting with test-service/localhost@TEST.COM [15538] 1493491231.918278:
> >>>>>>>>>> Retrieving drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> from FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>>>>> with
> result:
> >>>>>>>>>> 0/Success
> >>>>>>>>>> [15538] 1493491231.918281: Starting with TGT for client realm:
> >>>>>>>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
> >>>>>>>>>> 1493491231.918301: Requesting tickets for
> >>>>>>>>>> test-service/localhost@TEST.COM, referrals on [15538]
> >>>>>>>>>> 1493491231.918326: Generated subkey for TGS request:
> >>>>>>>>>> aes128-cts/FA30
> >>>>>>>>>> [15538] 1493491231.918359: etypes requested in TGS request:
> >>>>>>>>>> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2,
> >>>>>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
> >>>>>>>>>> [15538]
> >>>>>> 1493491231.918484:
> >>>>>>>>>> Encoding request body and padata into FAST request [15538]
> >>>>>>>>>> 1493491231.918541: Sending request (836 bytes) to TEST.COM
> >>>>>>>>>> [15538]
> >>>>>>>>>> 1493491231.918597: Resolving hostname localhost [15538]
> >>>>>>>>>> 1493491231.918703: Initiating TCP connection to stream
> >>>>>>>>>> 127.0.0.1:44292
> >>>>>>>>>> [15538] 1493491231.918777: Sending TCP request to stream
> >>>>>>>>>> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error
> >>>>>>>>>> receiving from stream
> >>>>>>>>>> 127.0.0.1:44292: 104/Connection reset by peer [15538]
> >>>>>>>>>> 1493491231.922812: Terminating TCP connection to stream
> >>>>>>>>>> 127.0.0.1:44292
> >>>>>>>>>> [15538] 1493491231.922858: Sending initial UDP request to
> >>>>>>>>>> dgram
> >>>>>>>>>> 127.0.0.1:44292
> >>>>>>>>>> ('First kerberos.authGSSClientStep not successful',
> >>>>>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide
> >>>>>>>>>> more information', 851968), ("Cannot contact any KDC for
> >>>>>>>>>> realm 'TEST.COM'",
> >>>>>>>>>> -1765328228)))
> >>>>>>>>>>
> >>>>>>>>>> 2. For the terminal that runs mvn clean test
> >>>>>>>>>> -Dtest=MitIssueTest Running
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> >>>>>>>>>> 2017-04-29 21:07:39,182 DEBUG [main] backend.
> >>>>>> AbstractIdentityBackend:
> >>>>>>>>>> initialize called
> >>>>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
> >>>>>> AbstractIdentityBackend:
> >>>>>>>>>> getIdentity called, principalName =
> >>>>>>>>>> krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
> >>>>>> AbstractIdentityBackend:
> >>>>>>>>>> getIdentity failed, principalName =
> >>>>>>>>>> krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> >>>>>> AbstractIdentityBackend:
> >>>>>>>>>> addIdentity successful, principalName =
> >>>>>>>>>> krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> >>>>>> AbstractIdentityBackend:
> >>>>>>>>>> getIdentity called, principalName =
> >>>>>>>>>> kadmin/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> >>>>>> AbstractIdentityBackend:
> >>>>>>>>>> getIdentity failed, principalName =
> >>>>>>>>>> kadmin/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,213 DEBUG [main] backend.
> >>>>>> AbstractIdentityBackend:
> >>>>>>>>>> addIdentity successful, principalName =
> >>>>>>>>>> kadmin/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,216 DEBUG [main] backend.
> >>>>>> AbstractIdentityBackend:
> >>>>>>>>>> start called
> >>>>>>>>>> 2017-04-29 21:07:39,232 DEBUG [main] backend.
> >>>>>> AbstractIdentityBackend:
> >>>>>>>>>> addIdentity successful, principalName =
> >>>>>>>>>> test-service/localhost@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,425 DEBUG [main] backend.
> >>>>>> AbstractIdentityBackend:
> >>>>>>>>>> addIdentity successful, principalName = drankye@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1]
> >>>>> request.KdcRequest:
> >>>>>>>>>> Client entry is empty.
> >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>>>>> principalName = drankye@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>>>>> principalName = drankye@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
> >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> >>>>>>>>>> occurred, disconnecting abnormally java.io.EOFException
> >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> >>>>>>>>>> r.ru
> >>>>>>>>>> n(
> >>>>>>>> DefaultKdcHandler.java:46)
> >>>>>>>>>> at
> >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> >>>>>>>> ThreadPoolExecutor.java:1142)
> >>>>>>>>>> at
> >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> >>>>>>>> ThreadPoolExecutor.java:617)
> >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> >>>>>>>>>> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase:
> >>>>>>>>>> Storing the tgt to the credential cache file.
> >>>>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
> >>>>>> AbstractIdentityBackend:
> >>>>>>>>>> getIdentity called, principalName =
> >>>>>>>>>> test-service/localhost@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
> >>>>>> AbstractIdentityBackend:
> >>>>>>>>>> getIdentity successful, principalName =
> >>>>>>>>>> test-service/localhost@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1]
> >>>>> request.KdcRequest:
> >>>>>>>>>> Client entry is empty.
> >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1]
> >>>>> request.KdcRequest:
> >>>>>>>>>> The preauth data is empty.
> >>>>>>>>>> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1]
> server.KdcHandler:
> >>>>>>>>>> KRB error occurred while processing request:Additional
> >>>>>>>>>> pre-authentication required
> >>>>>>>>>> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
> >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> >>>>>>>>>> occurred, disconnecting abnormally java.io.EOFException
> >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> >>>>>>>>>> r.ru
> >>>>>>>>>> n(
> >>>>>>>> DefaultKdcHandler.java:46)
> >>>>>>>>>> at
> >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> >>>>>>>> ThreadPoolExecutor.java:1142)
> >>>>>>>>>> at
> >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> >>>>>>>> ThreadPoolExecutor.java:617)
> >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> >>>>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1]
> >>>>> request.KdcRequest:
> >>>>>>>>>> Client entry is empty.
> >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
> >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> >>>>>>>>>> occurred, disconnecting abnormally java.io.EOFException
> >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> >>>>>>>>>> r.ru
> >>>>>>>>>> n(
> >>>>>>>> DefaultKdcHandler.java:46)
> >>>>>>>>>> at
> >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> >>>>>>>> ThreadPoolExecutor.java:1142)
> >>>>>>>>>> at
> >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> >>>>>>>> ThreadPoolExecutor.java:617)
> >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> >>>>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1]
> >>>>> request.KdcRequest:
> >>>>>>>>>> Found fast padata and start to process it.
> >>>>>>>>>> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
> >>>>>>>>>> impl.DefaultKdcHandler: Error occured while processing request:
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
> >>>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> >>>>>>>> java:85)
> >>>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> >>>>>>>> java:70)
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kd
> >>>>>>>>>> cFin
> >>>>>>>>>> dF
> >>>>>>>>>> as
> >>>>>>>>>> t(
> >>>>>>>> KdcRequest.java:208)
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.
> >>>>>>>> KdcRequest.process(KdcRequest.java:168)
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
> >>>>>>>> handleMessage(KdcHandler.java:115)
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
> >>>>>>>> handleMessage(DefaultKdcHandler.java:67)
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> >>>>>>>>>> r.ru
> >>>>>>>>>> n(
> >>>>>>>> DefaultKdcHandler.java:52)
> >>>>>>>>>> at
> >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> >>>>>>>> ThreadPoolExecutor.java:1142)
> >>>>>>>>>> at
> >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> >>>>>>>> ThreadPoolExecutor.java:617)
> >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> >>>>>>>>>> Caused by: java.io.IOException: Unexpected item context [0]
> >>>>>>>>>> [tag=0xA0, off=0, len=3+207], expecting 0x30
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> >>>>>>>> Asn1Encodeable.java:210)
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> >>>>>>>> Asn1Encodeable.java:197)
> >>>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> >>>>>>>> java:83)
> >>>>>>>>>> ... 9 more
> >>>>>>>>>> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
> >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error
> >>>>>>>>>> occurred, disconnecting abnormally
> >>>>>>>>>> java.net.SocketException: Socket closed
> >>>>>>>>>> at java.net.SocketInputStream.socketRead0(Native Method)
> >>>>>>>>>> at java.net.SocketInputStream.socketRead(SocketInputStream.
> >>>>>>>> java:116)
> >>>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
> >>>>> 171)
> >>>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
> >>>>> 141)
> >>>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
> >>>>> 224)
> >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:387)
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandle
> >>>>>>>>>> r.ru
> >>>>>>>>>> n(
> >>>>>>>> DefaultKdcHandler.java:46)
> >>>>>>>>>> at
> >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> >>>>>>>> ThreadPoolExecutor.java:1142)
> >>>>>>>>>> at
> >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> >>>>>>>> ThreadPoolExecutor.java:617)
> >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> >>>>>>>>>>
> >>>>>>>>>> In a FreeIPA environment these python lines "just" work.
> >>>>>>>>>>
> >>>>>>>>>> Any suggestions are welcome!
> >>>>>>>>>>
> >>>>>>>>>> Marc
> >>>>>>>>>>
> >>>>>>>>>>
> >>>>>>>>> --
> >>>>>>>>> Marc de Lignie
> >>>>>>>>>
> >>>>>>>>
> >>>>>>>> --
> >>>>>>>> Marc de Lignie
> >>>>>>>>
> >>>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>> --
> >>>>>>> Colm O hEigeartaigh
> >>>>>>>
> >>>>>>> Talend Community Coder
> >>>>>>> http://coders.talend.com
> >>>>>>>
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>> --
> >>>>>> Colm O hEigeartaigh
> >>>>>>
> >>>>>> Talend Community Coder
> >>>>>> http://coders.talend.com
> >>>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>> --
> >>>>> Colm O hEigeartaigh
> >>>>>
> >>>>> Talend Community Coder
> >>>>> http://coders.talend.com
> >>>>>
> >>>>
> >>>>
> >>>>
> >>>> --
> >>>> Colm O hEigeartaigh
> >>>>
> >>>> Talend Community Coder
> >>>> http://coders.talend.com
> >>>
> >>>
> >>
> >>
> >> --
> >> Colm O hEigeartaigh
> >>
> >> Talend Community Coder
> >> http://coders.talend.com
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
Re: MIT Kerberos compatibility
Posted by Colm O hEigeartaigh <co...@apache.org>.
Hi Kai,
Your changes fixed the error message I was seeing. However, I now see
another problem when I run a few GSS client tests in a row:
>>> EType: sun.security.krb5.internal.crypto.Aes128CtsHmacSha1EType
>>> KrbAsReq creating message
>>> KrbKdcReq send: kdc=localhost UDP:42665, timeout=30000, number of
retries =3, #bytes=245
>>> KDCCommunication: kdc=localhost UDP:42665, timeout=30000,Attempt =1,
#bytes=245
SocketTimeOutException with attempt: 1
>>> KDCCommunication: kdc=localhost UDP:42665, timeout=30000,Attempt =2,
#bytes=245
>>> KrbKdcReq send: error trying localhost:42665
java.net.PortUnreachableException: ICMP Port Unreachable
Do you want me to create a JIRA + attach a test-case?
Colm.
On Sat, May 6, 2017 at 2:01 AM, Zheng, Kai <ka...@intel.com> wrote:
> I haven't repeated the issue but revisited the codes again and made
> improvements. Would you check it out? Thanks!
>
> Sent from iPhone
>
> > 在 2017年5月6日，上午6:28，Zheng, Kai <ka...@intel.com> 写道：
> >
> > Thanks colm for the clarification and it sounds an issue we need to
> address. I will investigate it soon.
> >
> > Sent from iPhone
> >
> >> 在 2017年5月6日，上午2:14，Colm O hEigeartaigh <co...@apache.org> 写道：
> >>
> >> Hi Kai,
> >>
> >> If I enable UDP with the default Transport, I can get a ticket fine
> using
> >> kinit. However then the following error pops up in the window I'm
> running
> >> Kerby in (as a test):
> >>
> >> Exception in thread "Thread-1" java.lang.RuntimeException: Error occured
> >> while checking udp connections
> >> at
> >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> KdcNetwork.java:105)
> >> at
> >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> access$000(KdcNetwork.java:39)
> >> at
> >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> run(KdcNetwork.java:75)
> >> at java.lang.Thread.run(Thread.java:748)
> >> Caused by: java.nio.channels.ClosedChannelException
> >> at
> >> sun.nio.ch.DatagramChannelImpl.ensureOpen(DatagramChannelImpl.java:320)
> >> at sun.nio.ch.DatagramChannelImpl.receive(
> DatagramChannelImpl.java:331)
> >> at
> >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> checkUdpMessage(KdcNetwork.java:132)
> >> at
> >> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> KdcNetwork.java:101)
> >>
> >> Colm.
> >>
> >>
> >>> On Fri, May 5, 2017 at 5:56 PM, Zheng, Kai <ka...@intel.com>
> wrote:
> >>>
> >>> Colm, did you see udp problem now instead? I'm a little confused. Udp
> is
> >>> sure supported but may not be enabled by default, which should be okay,
> >>> imo. Thanks.
> >>>
> >>> Sent from iPhone
> >>>
> >>>> 在 2017年5月6日，上午12:02，Colm O hEigeartaigh <co...@apache.org> 写道：
> >>>>
> >>>> That's probably it. Why does the default transport not support UDP in
> >>> Kerby?
> >>>>
> >>>> Colm.
> >>>>
> >>>>> On Fri, May 5, 2017 at 4:54 PM, Li, Jiajia <ji...@intel.com>
> wrote:
> >>>>>
> >>>>> Are you sure add kdc_allow_udp = false in kdc.conf?
> >>>>>
> >>>>> Thanks
> >>>>> Jiajia
> >>>>>
> >>>>> -----Original Message-----
> >>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> >>>>> Sent: Friday, May 5, 2017 11:41 PM
> >>>>> To: Li, Jiajia <ji...@intel.com>
> >>>>> Cc: kerby@directory.apache.org; Zheng, Kai <ka...@intel.com>;
> >>> mailto:
> >>>>> m.c.delignie@xs4all.nl <m....@xs4all.nl>
> >>>>> Subject: Re: MIT Kerberos compatibility
> >>>>>
> >>>>> Sorry, it was my error, UDP was actually enabled there. But why am I
> >>> still
> >>>>> seeing that error message?
> >>>>>
> >>>>> Colm.
> >>>>>
> >>>>>> On Fri, May 5, 2017 at 4:39 PM, Li, Jiajia <ji...@intel.com>
> >>> wrote:
> >>>>>>
> >>>>>> Hi Colm,
> >>>>>> I also test the Kerby KDC with kerby kint and MIT kinit, and only
> >>>>>> listen the tcp port(disable udp), both got ticket successfully. But
> I
> >>>>>> don't get the error message. Both krb.conf and kdc.conf should set
> udp
> >>>>>> to be false, udp is enabled in default.
> >>>>>>
> >>>>>> Thanks
> >>>>>> Jiajia
> >>>>>>
> >>>>>> -----Original Message-----
> >>>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> >>>>>> Sent: Friday, May 5, 2017 11:34 PM
> >>>>>> To: kerby@directory.apache.org
> >>>>>> Cc: Zheng, Kai <ka...@intel.com>; mailto:m.c.delignie@xs4all.nl
> <
> >>>>>> m.c.delignie@xs4all.nl>
> >>>>>> Subject: Re: MIT Kerberos compatibility
> >>>>>>
> >>>>>> Hi Jiajia,
> >>>>>>
> >>>>>> If UDP is disabled and we don't use Netty, I can get a token
> >>>>>> successfully via kinit. However I then see an error message in the
> >>> Kerby
> >>>>> console:
> >>>>>>
> >>>>>> Exception in thread "Thread-1" java.lang.RuntimeException: Error
> >>>>>> occured while checking udp connections
> >>>>>> at
> >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> >>>>>> KdcNetwork.java:105)
> >>>>>> at
> >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> >>>>>> access$000(KdcNetwork.java:39)
> >>>>>> at
> >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> >>>>>> run(KdcNetwork.java:75)
> >>>>>> at java.lang.Thread.run(Thread.java:748)
> >>>>>> Caused by: java.nio.channels.ClosedChannelException
> >>>>>> at
> >>>>>> sun.nio.ch.DatagramChannelImpl.ensureOpen(
> >>> DatagramChannelImpl.java:320)
> >>>>>> at sun.nio.ch.DatagramChannelImpl.receive(
> >>>>>> DatagramChannelImpl.java:331)
> >>>>>> at
> >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> >>>>>> checkUdpMessage(KdcNetwork.java:132)
> >>>>>> at
> >>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> >>>>>> KdcNetwork.java:101)
> >>>>>>
> >>>>>> I'm not sure why we are seeing UDP errors when it's disabled?
> >>>>>>
> >>>>>> Colm.
> >>>>>>
> >>>>>>> On Fri, May 5, 2017 at 3:57 PM, Li, Jiajia <ji...@intel.com>
> >>> wrote:
> >>>>>>>
> >>>>>>> Hi Colm,
> >>>>>>> The shell client can't connect to kdc if the UDP is disabled.
> >>>>>>> We don't use Netty in default.
> >>>>>>> What's your test-cases? The same as the Marc's?
> >>>>>>>
> >>>>>>> Thanks
> >>>>>>> Jiajia
> >>>>>>>
> >>>>>>> -----Original Message-----
> >>>>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> >>>>>>> Sent: Friday, May 5, 2017 10:09 PM
> >>>>>>> To: kerby@directory.apache.org
> >>>>>>> Cc: Zheng, Kai <ka...@intel.com>; mailto:
> m.c.delignie@xs4all.nl
> >>>>>>> < m.c.delignie@xs4all.nl>
> >>>>>>> Subject: Re: MIT Kerberos compatibility
> >>>>>>>
> >>>>>>> Hi Jiajia,
> >>>>>>>
> >>>>>>> What are the issues if UDP is disabled and we don't use Netty? I
> >>>>>>> tried doing this with my own test-cases and it didn't work, so it
> >>>>>>> would be good to get this fixed soon.
> >>>>>>>
> >>>>>>> Colm.
> >>>>>>>
> >>>>>>> On Fri, May 5, 2017 at 2:46 PM, Li, Jiajia <ji...@intel.com>
> >>>>> wrote:
> >>>>>>>
> >>>>>>>> Hi Marc,
> >>>>>>>>>>> - your KRB5 tracing looks quite different. What OS and
> >>>>>>>>>>> mit-kerberos
> >>>>>>>> version did you use?
> >>>>>>>> I use mac os and the python version is 2.7.10
> >>>>>>>>
> >>>>>>>>>>> - your KRB5 tracing shows UDP comms between kerberos client and
> >>>>>>>>>>> KDC,
> >>>>>>>> despite the allowUDP = false setting
> >>>>>>>>>>> in my test. I did this setting because I get different
> >>>>>>>>>>> problems
> >>>>>>>> without it, see the additional logs below. So,
> >>>>>>>>>>> we must also be aware of networking problems at my side.
> >>>>>>>> I enable the UDP and use netty network, there are some issues if
> >>>>>>>> UDP disabled, you can create a JIRA for this and we can fix this
> >>>>>>>> issue in the next release version.
> >>>>>>>>
> >>>>>>>> The changes in my side as following:
> >>>>>>>>
> >>>>>>>> protected boolean allowUdp() {
> >>>>>>>> return true;
> >>>>>>>> }
> >>>>>>>> @Override
> >>>>>>>> protected void prepareKdc() throws KrbException {
> >>>>>>>> getKdcServer().setInnerKdcImpl(
> >>>>>>>> new NettyKdcServerImpl(getKdcServer().getKdcSetting()));
> >>>>>>>> super.prepareKdc();
> >>>>>>>> }
> >>>>>>>>
> >>>>>>>> Here is log of MitIssueTest:
> >>>>>>>> [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> >>>>>>>> [nioEventLoopGroup-2-1] INFO
> >>>>>>>> io.netty.handler.logging.LoggingHandler
> >>>>>>>> -
> >>>>>>>> [id: 0x2634fe6b] REGISTERED
> >>>>>>>> [nioEventLoopGroup-2-1] INFO
> >>>>>>>> io.netty.handler.logging.LoggingHandler
> >>>>>>>> -
> >>>>>>>> [id: 0x2634fe6b] BIND(0.0.0.0/0.0.0.0:53957)
> >>>>>>>> [nioEventLoopGroup-2-1] INFO
> >>>>>>>> io.netty.handler.logging.LoggingHandler -
> >>>>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] ACTIVE [main] INFO
> >>>>>>>> org.apache.kerby.kerberos.kdc.impl.NettyKdcServerImpl - Netty kdc
> >>>>>>>> server started.
> >>>>>>>> [nioEventLoopGroup-2-1] INFO
> >>>>>>>> io.netty.handler.logging.LoggingHandler
> >>>>>>>> -
> >>>>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] RECEIVED: [id:
> >>>>>>>> 0xdac7228b, /
> >>>>>>>> 127.0.0.1:53961 => /127.0.0.1:53957]
> >>>>>>>> [defaultEventExecutorGroup-4-1] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
> >>>>>>>> - AS_REQ ISSUE: authtime 1493991123792,drankye@TEST.COM for
> >>>>>>>> krbtgt/ TEST.COM@TEST.COM [main] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> DefaultInternalKrbClien
> >>>>>>>> t
> >>>>>>>> - Send to kdc success.
> >>>>>>>> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
> >>>>>>>> Storing the tgt to the credential cache file.
> >>>>>>>> [nioEventLoopGroup-5-1] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> >>>>>>>> - The preauth data is empty.
> >>>>>>>> [nioEventLoopGroup-5-1] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> >>>>>>>> - KRB error occurred while processing request:Additional
> >>>>>>>> pre-authentication required [nioEventLoopGroup-5-1] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
> >>>>>>>> - AS_REQ ISSUE: authtime
> >>>>>>>> 1493991123859,test-service/localhost@TEST.COM
> >>>>>>>> for krbtgt/TEST.COM@TEST.COM
> >>>>>>>> [nioEventLoopGroup-5-1] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.TgsRequest
> >>>>>>>> - TGS_REQ ISSUE: authtime 1493991142850,drankye for test-service/
> >>>>>>>> localhost@TEST.COM
> >>>>>>>>
> >>>>>>>> Thanks
> >>>>>>>> Jiajia
> >>>>>>>>
> >>>>>>>> -----Original Message-----
> >>>>>>>> From: Zheng, Kai
> >>>>>>>> Sent: Friday, May 5, 2017 7:46 PM
> >>>>>>>> To: kerby@directory.apache.org; Li, Jiajia <ji...@intel.com>
> >>>>>>>> Subject: RE: MIT Kerberos compatibility
> >>>>>>>>
> >>>>>>>> Hi Marc,
> >>>>>>>>
> >>>>>>>> Looks like this is quite environment related, could you fire an
> >>>>>>>> issue for this? I would suggest we target it to 1.1.0, which can
> >>>>>>>> be done in
> >>>>>>> June.
> >>>>>>>>
> >>>>>>>> Regards,
> >>>>>>>> Kai
> >>>>>>>>
> >>>>>>>> -----Original Message-----
> >>>>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> >>>>>>>> Sent: Friday, May 05, 2017 4:44 PM
> >>>>>>>> To: Li, Jiajia <ji...@intel.com>
> >>>>>>>> Cc: kerby@directory.apache.org
> >>>>>>>> Subject: Re: MIT Kerberos compatibility
> >>>>>>>>
> >>>>>>>> Hi Jiajia,
> >>>>>>>>
> >>>>>>>> Great to read that you made progress on this issue and to see a
> >>>>>>>> working config at your side. Below, I list my progress below (with
> >>>>>>>> trunk merged into my MitIssue branch), but I am afraid we are not
> >>>>>>>> done
> >>>>>>> yet.
> >>>>>>>>
> >>>>>>>> Things that stand out:
> >>>>>>>>
> >>>>>>>> - the kdc decoding error is solved, relative to the logs without
> >>>>>>>> your patch
> >>>>>>>>
> >>>>>>>> - your KRB5 tracing looks quite different. What OS and
> >>>>>>>> mit-kerberos version did you use?
> >>>>>>>>
> >>>>>>>> - your KRB5 tracing shows UDP comms between kerberos client and
> >>>>>>>> KDC, despite the allowUDP = false setting in my test. I did this
> >>>>>>>> setting because I get different problems without it, see the
> >>>>>>>> additional logs below. So, we must also be aware of networking
> >>>>> problems at my side.
> >>>>>>>>
> >>>>>>>> - the "Response was not from master KDC" msg is not relevant; it
> >>>>>>>> disappears if you manually add master_kdc to the realms section of
> >>>>>>>> the krb5.conf
> >>>>>>>>
> >>>>>>>> I have no idea how to proceed from here, so that is why I just
> >>>>>>>> document the status at my side and ask about your - apparently
> >>>>>>>> working -
> >>>>>>> config.
> >>>>>>>>
> >>>>>>>> Cheers, Marc
> >>>>>>>>
> >>>>>>>>
> >>>>>>>> KDC logging with allowUDP = false:
> >>>>>>>>
> >>>>>>>> [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> >>>>>>>> [pool-1-thread-1] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
> >>>>>> ISSUE:
> >>>>>>>> authtime 1493970789075,drankye@TEST.COM for
> >>>>>>>> krbtgt/TEST.COM@TEST.COM [main] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> DefaultInternalKrbClien
> >>>>>>>> t
> >>>>>>>> - Send to kdc success.
> >>>>>>>> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
> >>>>>>>> Storing the tgt to the credential cache file.
> >>>>>>>> [pool-1-thread-1] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The
> >>>>>>>> preauth data is empty.
> >>>>>>>> [pool-1-thread-1] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> >>>>>>>> - KRB error occurred while processing request:Additional
> >>>>>>>> pre-authentication required [pool-1-thread-1] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
> >>>>>> ISSUE:
> >>>>>>>> authtime 1493970789108,test-service/localhost@TEST.COM for
> krbtgt/
> >>>>>>>> TEST.COM@TEST.COM [pool-1-thread-1] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> >>>>>>>> - Found fast padata and starting to process it.
> >>>>>>>> [pool-1-thread-1] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found
> >>>>>>>> fast padata and starting to process it.
> >>>>>>>>
> >>>>>>>> Python script KRB5 tracing (MIT Kerberos 1.13.2 of Ubuntu Xenial)
> >>>>>>>> with allowUDP = false:
> >>>>>>>>
> >>>>>>>> $ .
> >>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/
> >>>>>>>> kerberos/kerb/server/MitIssueTest.sh
> >>>>>>>> [25281] 1493970797.298753: Retrieving drankye@TEST.COM from
> >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> >>>>> result:
> >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> >>>>>>>> [25281]
> >>>>>>>> 1493970797.298952: Retrieving drankye@TEST.COM from
> >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> >>>>> result:
> >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> >>>>>>>> [25281]
> >>>>>>>> 1493970797.299106: Retrieving drankye@TEST.COM from
> >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> >>>>> result:
> >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> >>>>>>>> [25281]
> >>>>>>>> 1493970797.299213: Retrieving drankye@TEST.COM from
> >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> >>>>> result:
> >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> >>>>>>>> [25281]
> >>>>>>>> 1493970797.299323: Retrieving drankye@TEST.COM from
> >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> >>>>> result:
> >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> >>>>>>>> [25281]
> >>>>>>>> 1493970797.299436: Retrieving drankye@TEST.COM from
> >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> >>>>> result:
> >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> >>>>>>>> [25281]
> >>>>>>>> 1493970797.299545: Retrieving drankye@TEST.COM from
> >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> >>>>> result:
> >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> >>>>>>>> [25281]
> >>>>>>>> 1493970797.299654: Retrieving drankye@TEST.COM from
> >>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> >>>>> result:
> >>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> >>>>>>>> kerberos.authGSSClientInit successful [25281] 1493970797.299922:
> >>>>>>>> Getting credentials drankye@TEST.COM -> test-service/localhost@
> >>>>>>>> using ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>>> [25281] 1493970797.299945: Retrieving drankye@TEST.COM ->
> >>>>>>>> test-service/localhost@ from
> >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>>> with result:
> >>>>>>>> -1765328243/Matching credential not found [25281]
> 1493970797.299959:
> >>>>>>>> Retrying drankye@TEST.COM -> test-service/localhost@TEST.COM with
> >>>>>>> result:
> >>>>>>>> -1765328243/Matching credential not found [25281]
> 1493970797.299962:
> >>>>>>>> Server has referral realm; starting with
> >>>>>>>> test-service/localhost@TEST.COM [25281]
> >>>>>>>> 1493970797.299975: Retrieving drankye@TEST.COM ->
> >>>>>>>> krbtgt/TEST.COM@TEST.COM from
> >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>> with result:
> >>>>>>>> 0/Success [25281] 1493970797.299979: Starting with TGT for client
> >>>>>> realm:
> >>>>>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [25281]
> >>>>>> 1493970797.299981:
> >>>>>>>> Requesting tickets for test-service/localhost@TEST.COM, referrals
> >>>>>>>> on [25281] 1493970797.299994: Generated subkey for TGS request:
> >>>>>>>> aes128-cts/1B9B [25281] 1493970797.300009: etypes requested in TGS
> >>>>>>> request:
> >>>>>>>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
> >>>>>>>> camellia256-cts [25281] 1493970797.300054: Encoding request body
> >>>>>>>> and padata into FAST request [25281] 1493970797.300080: Sending
> >>>>>>>> request
> >>>>>>>> (823 bytes) to TEST.COM [25281] 1493970797.300091: Resolving
> >>>>>>>> hostname localhost [25281]
> >>>>>>>> 1493970797.300136: Initiating TCP connection to stream
> >>>>>>>> 127.0.0.1:34319
> >>>>>>>> [25281] 1493970797.300191: Sending TCP request to stream
> >>>>>>>> 127.0.0.1:34319 [25281] 1493970797.303610: Received answer (125
> >>>>>>>> bytes) from stream
> >>>>>>>> 127.0.0.1:34319
> >>>>>>>> [25281] 1493970797.303618: Terminating TCP connection to stream
> >>>>>>>> 127.0.0.1:34319
> >>>>>>>> [25281] 1493970797.553126: Response was not from master KDC
> >>>>>>>> [25281]
> >>>>>>>> 1493970797.553198: TGS request result: -1765323383/Unknown code
> >>>>>>>> krcM
> >>>>>>>> 137 [25281] 1493970797.553234: Requesting tickets for
> >>>>>>>> test-service/ localhost@TEST.COM, referrals off [25281]
> >>>>> 1493970797.553273:
> >>>>>>>> Generated subkey for TGS request: aes128-cts/94C6 [25281]
> >>>>>> 1493970797.553323:
> >>>>>>>> etypes requested in TGS request: aes256-cts, aes128-cts,
> >>>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts [25281]
> >>>>>>>> 1493970797.553436: Encoding request body and padata into FAST
> >>>>>>>> request
> >>>>>>> [25281] 1493970797.553532:
> >>>>>>>> Sending request (823 bytes) to TEST.COM [25281]
> 1493970797.553567:
> >>>>>>>> Resolving hostname localhost [25281] 1493970797.553745: Initiating
> >>>>>>>> TCP connection to stream
> >>>>>>>> 127.0.0.1:34319
> >>>>>>>> [25281] 1493970797.553889: Sending TCP request to stream
> >>>>>>>> 127.0.0.1:34319 [25281] 1493970797.558297: Received answer (125
> >>>>>>>> bytes) from stream
> >>>>>>>> 127.0.0.1:34319
> >>>>>>>> [25281] 1493970797.558318: Terminating TCP connection to stream
> >>>>>>>> 127.0.0.1:34319
> >>>>>>>> [25281] 1493970797.561189: Response was not from master KDC
> >>>>>>>> [25281]
> >>>>>>>> 1493970797.561258: TGS request result: -1765323383/Unknown code
> >>>>>>>> krcM
> >>>>>>>> 137 ('First kerberos.authGSSClientStep not successful',
> >>>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide more
> >>>>>>>> information', 851968), ('Unknown code krcM 137', -1765323383)))
> >>>>>>>>
> >>>>>>>>
> >>>>>>>> KDC logging with allowUDP = true:
> >>>>>>>>
> >>>>>>>> [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> >>>>>>>> [pool-1-thread-1] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
> >>>>>> ISSUE:
> >>>>>>>> authtime 1493972505784,drankye@TEST.COM for
> >>>>>>>> krbtgt/TEST.COM@TEST.COM [main] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.
> DefaultInternalKrbClien
> >>>>>>>> t
> >>>>>>>> - Send to kdc success.
> >>>>>>>> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
> >>>>>>>> Storing the tgt to the credential cache file.
> >>>>>>>> [pool-1-thread-1] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The
> >>>>>>>> preauth data is empty.
> >>>>>>>> [pool-1-thread-1] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> >>>>>>>> - KRB error occurred while processing request:Additional
> >>>>>>>> pre-authentication required [pool-1-thread-2] INFO
> >>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
> >>>>>> ISSUE:
> >>>>>>>> authtime 1493972505948,test-service/localhost@TEST.COM for
> krbtgt/
> >>>>>>>> TEST.COM@TEST.COM Exception in thread "Thread-0"
> >>>>>>>> java.lang.RuntimeException: Error occured while checking udp
> >>>>>> connections
> >>>>>>>> at
> >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> >>>>>>>> KdcNetwork.java:105)
> >>>>>>>> at
> >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> >>>>>>>> access$000(KdcNetwork.java:39)
> >>>>>>>> at
> >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> >>>>>>>> run(KdcNetwork.java:75)
> >>>>>>>> at java.lang.Thread.run(Thread.java:748)
> >>>>>>>> Caused by: java.nio.channels.ClosedChannelException
> >>>>>>>> at
> >>>>>>>> sun.nio.ch.DatagramChannelImpl.ensureOpen(
> >>>>>> DatagramChannelImpl.java:320)
> >>>>>>>> at sun.nio.ch.DatagramChannelImpl.receive(
> >>>>>>>> DatagramChannelImpl.java:331)
> >>>>>>>> at
> >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> >>>>>>>> checkUdpMessage(KdcNetwork.java:132)
> >>>>>>>> at
> >>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> >>>>>>>> KdcNetwork.java:101)
> >>>>>>>> ... 3 more
> >>>>>>>>
> >>>>>>>>
> >>>>>>>> krb5.conf:
> >>>>>>>>
> >>>>>>>> [libdefaults]
> >>>>>>>> kdc_realm = TEST.COM
> >>>>>>>> default_realm = TEST.COM
> >>>>>>>> udp_preference_limit = 4096
> >>>>>>>> kdc_tcp_port = 37080
> >>>>>>>> kdc_udp_port = 36525
> >>>>>>>>
> >>>>>>>> [realms]
> >>>>>>>> TEST.COM = {
> >>>>>>>> kdc = localhost:36525
> >>>>>>>> }
> >>>>>>>>
> >>>>>>>> And port 36525 does not show up in `netstat -l` (while 37080 does)
> >>>>>>>>
> >>>>>>>>
> >>>>>>>> Op 04-05-17 om 14:55 schreef Li, Jiajia:
> >>>>>>>>> Hi Marc,
> >>>>>>>>> I try to run your test(through applying your patch in the trunk)
> >>>>>>>>> , I
> >>>>>>>> think it's success now. Could you take some time to check about
> it?
> >>>>>>>>> Here is the log:
> >>>>>>>>>
> >>>>>>>>> directory-kerby git:(trunk) ? .
> >>>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos
> >>>>>>>>> /k
> >>>>>>>>> er
> >>>>>>>>> b/
> >>>>>>>>> server/MitIssueTest.sh
> >>>>>>>>> kerberos.authGSSClientInit successful
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: entypes not
> >>>>>>>>> supported
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> >>>>>>>>> credential for krb5_ccache_conf_data/realm-config@X-CACHECONF:
> >>>>>>>>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> >>>>>>>>> credential for test-service/localhost@TEST.COM in cache
> >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> >>>>>>>>> credential for
> >>>>>>>>> krb5_ccache_conf_data/negative-cache/test-service\134/localhost\
> >>>>>>>>> 13
> >>>>>>>>> 4@
> >>>>>>>>> TE
> >>>>>>>>> ST.COM@X-CACHECONF: in cache
> >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> >>>>>>>>> credential for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF:
> >>>>>>>>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> >>>>>>>>> credential for krb5_ccache_conf_data/sitename@X-CACHECONF: in
> >>>>>>>>> cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> >>>>>>>>> credential for test-service/localhost@TEST.COM in cache
> >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> >>>>>>>>> des-cbc-md5-deprecated not supported
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> >>>>>>>>> des-cbc-md4-deprecated not supported
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> >>>>>>>>> des-cbc-crc-deprecated not supported
> >>>>>>>>> 2017-05-04T20:44:06 Trying to find service kdc for realm
> >>>>>>>>> TEST.COM flags 0
> >>>>>>>>> 2017-05-04T20:44:06 configuration file for realm TEST.COM found
> >>>>>>>>> 2017-05-04T20:44:06 submissing new requests to new host
> >>>>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
> >>>>>>>>> 2017-05-04T20:44:06 connecting to host: udp ::1:52534
> >>>>>>>>> (localhost)
> >>>>>> tid:
> >>>>>>>>> 00000001
> >>>>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
> >>>>>>>>> 2017-05-04T20:44:06 Queuing host in future (in 3s), its the 2
> >>>>>>>>> address on the same name: udp 127.0.0.1:52534 (localhost) tid:
> >>>>>>>>> 00000002
> >>>>>>>>> 2017-05-04T20:44:06 writing packet: udp ::1:52534 (localhost)
> tid:
> >>>>>>>>> 00000001
> >>>>>>>>> 2017-05-04T20:44:06 reading packet: udp ::1:52534 (localhost)
> tid:
> >>>>>>>>> 00000001
> >>>>>>>>> 2017-05-04T20:44:06 host completed: udp ::1:52534 (localhost)
> tid:
> >>>>>>>>> 00000001
> >>>>>>>>> 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0 hosts 1
> >>>>>>>>> packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814 tid: 00000002
> >>>>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/763641F3
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328353: Decrypt integrity
> >>>>>>>>> check failed for checksum type hmac-sha1-96-aes128, key type
> >>>>>>>>> aes128-cts-hmac-sha1-96
> >>>>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
> >>>>>>>>> 2017-05-04T20:44:06 krb5_get_credentials_with_flags: TEST.COM
> wc:
> >>>>>>>>> 0.050317
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> >>>>>>>>> credential for krb5_ccache_conf_data/realm-config@X-CACHECONF:
> >>>>>>>>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> >>>>>>>>> credential for
> >>>>>>>>> krb5_ccache_conf_data/time-offset/test-service\134/
> >>>>>> localhost\134@TEST.
> >>>>>>>>> COM@X-CACHECONF: in cache
> >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>>>> 2017-05-04T20:44:06 Setting up PFS for auth context
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> >>>>>>>>> des-cbc-md5-deprecated not supported
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> >>>>>>>>> des-cbc-md4-deprecated not supported
> >>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> >>>>>>>>> des-cbc-crc-deprecated not supported First
> >>>>>>>>> kerberos.authGSSClientStep successful
> >>>>>>>>>
> >>>>>>>>> Thanks
> >>>>>>>>> Jiajia
> >>>>>>>>>
> >>>>>>>>> -----Original Message-----
> >>>>>>>>> From: Zheng, Kai [mailto:kai.zheng@intel.com]
> >>>>>>>>> Sent: Wednesday, May 3, 2017 7:29 PM
> >>>>>>>>> To: kerby@directory.apache.org
> >>>>>>>>> Subject: RE: MIT Kerberos compatibility
> >>>>>>>>>
> >>>>>>>>> Hi Marc,
> >>>>>>>>>
> >>>>>>>>> In case you're not aware of this, please check out the latest
> >>>>>>>>> fix made
> >>>>>>>> by Jiajia. We thought your case may be different, but would be
> >>>>>>>> good to have a check before we can repeat/fix your case. Thanks.
> >>>>>>>>> https://issues.apache.org/jira/browse/DIRKRB-625
> >>>>>>>>>
> >>>>>>>>> Regards,
> >>>>>>>>> Kai
> >>>>>>>>>
> >>>>>>>>> -----Original Message-----
> >>>>>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> >>>>>>>>> Sent: Sunday, April 30, 2017 7:45 PM
> >>>>>>>>> To: kerby@directory.apache.org
> >>>>>>>>> Subject: Re: MIT Kerberos compatibility
> >>>>>>>>>
> >>>>>>>>> Hi Kai,
> >>>>>>>>>
> >>>>>>>>> The terminal output below is for the latest MIT Kerberos 1.15.1
> >>>>>>>>> (locally
> >>>>>>>> built on Ubuntu Xenial). Before that, I also tested with the
> >>>>>>>> default Xenial MIT Kerberos packages (1.13.2), with the same
> >>>>>>>> result. I did not try earlier MIT Kerberos versions.
> >>>>>>>>>
> >>>>>>>>> Marc
> >>>>>>>>>
> >>>>>>>>> Op 29-04-17 om 21:42 schreef Marc de Lignie:
> >>>>>>>>>> Hi Kai,
> >>>>>>>>>>
> >>>>>>>>>> Thanks for the response. I prepared a minimal config that
> >>>>>>>>>> reproduces my problem.
> >>>>>>>>>>
> >>>>>>>>>> You can fetch the branch/commit from:
> >>>>>>>>>> https://github.com/vtslab/directory-kerby/commits/MitIssue
> >>>>>>>>>>
> >>>>>>>>>> This is relative to RC2, but I also tried this on trunk for my
> >>>>>>>>>> actual project.
> >>>>>>>>>>
> >>>>>>>>>> This config produces the debug and error messages below.
> >>>>>>>>>>
> >>>>>>>>>> 1. For the terminal with the bash + python script $ klist
> >>>>>>>>>> Ticket
> >>>>>>>>>> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>>>>> Default principal: drankye@TEST.COM
> >>>>>>>>>>
> >>>>>>>>>> Valid starting Expires Service principal
> >>>>>>>>>> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> renew until 29-04-17 21:07:39
> >>>>>>>>>>
> >>>>>>>>>> $ .
> >>>>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerbero
> >>>>>>>>>> s/ ke rb / server/MitIssueTest.sh [15538] 1493491231.917606:
> >>>>>>>>>> Retrieving drankye@TEST.COM from
> >>>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> >>>>>>>>>> result:
> >>>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> >>>>>>>>>> [15538]
> >>>>>>>>>> 1493491231.917827: Retrieving drankye@TEST.COM from
> >>>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> >>>>>>> result:
> >>>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> >>>>>>>>>> kerberos.authGSSClientInit successful [15538] 1493491231.918185:
> >>>>>>>>>> Getting credentials drankye@TEST.COM -> test-service/localhost@
> >>>>>>>>>> using ccache
> >>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>>>>> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
> >>>>>>>>>> test-service/localhost@ from
> >>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with
> result:
> >>>>>>>>>> -1765328243/Matching credential not found (filename:
> >>>>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> >>>>>>>>>> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
> >>>>>>>>>> test-service/localhost@TEST.COM with result:
> >>>>>>>>>> -1765328243/Matching credential not found (filename:
> >>>>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> >>>>>>>>>> [15538] 1493491231.918229: Server has referral realm; starting
> >>>>>>>>>> with test-service/localhost@TEST.COM [15538] 1493491231.918278:
> >>>>>>>>>> Retrieving drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM from
> >>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with
> result:
> >>>>>>>>>> 0/Success
> >>>>>>>>>> [15538] 1493491231.918281: Starting with TGT for client realm:
> >>>>>>>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
> >>>>>>>>>> 1493491231.918301: Requesting tickets for
> >>>>>>>>>> test-service/localhost@TEST.COM, referrals on [15538]
> >>>>>>>>>> 1493491231.918326: Generated subkey for TGS request:
> >>>>>>>>>> aes128-cts/FA30
> >>>>>>>>>> [15538] 1493491231.918359: etypes requested in TGS request:
> >>>>>>>>>> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2,
> >>>>>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
> >>>>>>>>>> [15538]
> >>>>>> 1493491231.918484:
> >>>>>>>>>> Encoding request body and padata into FAST request [15538]
> >>>>>>>>>> 1493491231.918541: Sending request (836 bytes) to TEST.COM
> >>>>>>>>>> [15538]
> >>>>>>>>>> 1493491231.918597: Resolving hostname localhost [15538]
> >>>>>>>>>> 1493491231.918703: Initiating TCP connection to stream
> >>>>>>>>>> 127.0.0.1:44292
> >>>>>>>>>> [15538] 1493491231.918777: Sending TCP request to stream
> >>>>>>>>>> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error receiving
> >>>>>>>>>> from stream
> >>>>>>>>>> 127.0.0.1:44292: 104/Connection reset by peer [15538]
> >>>>>>>>>> 1493491231.922812: Terminating TCP connection to stream
> >>>>>>>>>> 127.0.0.1:44292
> >>>>>>>>>> [15538] 1493491231.922858: Sending initial UDP request to dgram
> >>>>>>>>>> 127.0.0.1:44292
> >>>>>>>>>> ('First kerberos.authGSSClientStep not successful',
> >>>>>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide
> >>>>>>>>>> more information', 851968), ("Cannot contact any KDC for realm
> >>>>>>>>>> 'TEST.COM'",
> >>>>>>>>>> -1765328228)))
> >>>>>>>>>>
> >>>>>>>>>> 2. For the terminal that runs mvn clean test
> >>>>>>>>>> -Dtest=MitIssueTest Running
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> >>>>>>>>>> 2017-04-29 21:07:39,182 DEBUG [main] backend.
> >>>>>> AbstractIdentityBackend:
> >>>>>>>>>> initialize called
> >>>>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
> >>>>>> AbstractIdentityBackend:
> >>>>>>>>>> getIdentity called, principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
> >>>>>> AbstractIdentityBackend:
> >>>>>>>>>> getIdentity failed, principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> >>>>>> AbstractIdentityBackend:
> >>>>>>>>>> addIdentity successful, principalName =
> >>>>>>>>>> krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> >>>>>> AbstractIdentityBackend:
> >>>>>>>>>> getIdentity called, principalName = kadmin/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> >>>>>> AbstractIdentityBackend:
> >>>>>>>>>> getIdentity failed, principalName = kadmin/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,213 DEBUG [main] backend.
> >>>>>> AbstractIdentityBackend:
> >>>>>>>>>> addIdentity successful, principalName =
> >>>>>>>>>> kadmin/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,216 DEBUG [main] backend.
> >>>>>> AbstractIdentityBackend:
> >>>>>>>>>> start called
> >>>>>>>>>> 2017-04-29 21:07:39,232 DEBUG [main] backend.
> >>>>>> AbstractIdentityBackend:
> >>>>>>>>>> addIdentity successful, principalName =
> >>>>>>>>>> test-service/localhost@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,425 DEBUG [main] backend.
> >>>>>> AbstractIdentityBackend:
> >>>>>>>>>> addIdentity successful, principalName = drankye@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1]
> >>>>> request.KdcRequest:
> >>>>>>>>>> Client entry is empty.
> >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>>>>> principalName = drankye@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>>>>> principalName = drankye@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
> >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
> >>>>>>>>>> disconnecting abnormally java.io.EOFException
> >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
> >>>>>>>>>> n(
> >>>>>>>> DefaultKdcHandler.java:46)
> >>>>>>>>>> at
> >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> >>>>>>>> ThreadPoolExecutor.java:1142)
> >>>>>>>>>> at
> >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> >>>>>>>> ThreadPoolExecutor.java:617)
> >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> >>>>>>>>>> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase:
> >>>>>>>>>> Storing the tgt to the credential cache file.
> >>>>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
> >>>>>> AbstractIdentityBackend:
> >>>>>>>>>> getIdentity called, principalName =
> >>>>>>>>>> test-service/localhost@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
> >>>>>> AbstractIdentityBackend:
> >>>>>>>>>> getIdentity successful, principalName =
> >>>>>>>>>> test-service/localhost@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1]
> >>>>> request.KdcRequest:
> >>>>>>>>>> Client entry is empty.
> >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1]
> >>>>> request.KdcRequest:
> >>>>>>>>>> The preauth data is empty.
> >>>>>>>>>> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1]
> server.KdcHandler:
> >>>>>>>>>> KRB error occurred while processing request:Additional
> >>>>>>>>>> pre-authentication required
> >>>>>>>>>> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
> >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
> >>>>>>>>>> disconnecting abnormally java.io.EOFException
> >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
> >>>>>>>>>> n(
> >>>>>>>> DefaultKdcHandler.java:46)
> >>>>>>>>>> at
> >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> >>>>>>>> ThreadPoolExecutor.java:1142)
> >>>>>>>>>> at
> >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> >>>>>>>> ThreadPoolExecutor.java:617)
> >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> >>>>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1]
> >>>>> request.KdcRequest:
> >>>>>>>>>> Client entry is empty.
> >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>>>>> principalName = test-service/localhost@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
> >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
> >>>>>>>>>> disconnecting abnormally java.io.EOFException
> >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
> >>>>>>>>>> n(
> >>>>>>>> DefaultKdcHandler.java:46)
> >>>>>>>>>> at
> >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> >>>>>>>> ThreadPoolExecutor.java:1142)
> >>>>>>>>>> at
> >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> >>>>>>>> ThreadPoolExecutor.java:617)
> >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> >>>>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> >>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>>>>> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1]
> >>>>> request.KdcRequest:
> >>>>>>>>>> Found fast padata and start to process it.
> >>>>>>>>>> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
> >>>>>>>>>> impl.DefaultKdcHandler: Error occured while processing request:
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
> >>>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> >>>>>>>> java:85)
> >>>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> >>>>>>>> java:70)
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFin
> >>>>>>>>>> dF
> >>>>>>>>>> as
> >>>>>>>>>> t(
> >>>>>>>> KdcRequest.java:208)
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.
> >>>>>>>> KdcRequest.process(KdcRequest.java:168)
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
> >>>>>>>> handleMessage(KdcHandler.java:115)
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
> >>>>>>>> handleMessage(DefaultKdcHandler.java:67)
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
> >>>>>>>>>> n(
> >>>>>>>> DefaultKdcHandler.java:52)
> >>>>>>>>>> at
> >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> >>>>>>>> ThreadPoolExecutor.java:1142)
> >>>>>>>>>> at
> >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> >>>>>>>> ThreadPoolExecutor.java:617)
> >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> >>>>>>>>>> Caused by: java.io.IOException: Unexpected item context [0]
> >>>>>>>>>> [tag=0xA0, off=0, len=3+207], expecting 0x30
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> >>>>>>>> Asn1Encodeable.java:210)
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> >>>>>>>> Asn1Encodeable.java:197)
> >>>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> >>>>>>>> java:83)
> >>>>>>>>>> ... 9 more
> >>>>>>>>>> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
> >>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
> >>>>>>>>>> disconnecting abnormally
> >>>>>>>>>> java.net.SocketException: Socket closed
> >>>>>>>>>> at java.net.SocketInputStream.socketRead0(Native Method)
> >>>>>>>>>> at java.net.SocketInputStream.socketRead(SocketInputStream.
> >>>>>>>> java:116)
> >>>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
> >>>>> 171)
> >>>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
> >>>>> 141)
> >>>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
> >>>>> 224)
> >>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:387)
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> >>>>>>>> receiveMessage(KrbTcpTransport.java:54)
> >>>>>>>>>> at
> >>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
> >>>>>>>>>> n(
> >>>>>>>> DefaultKdcHandler.java:46)
> >>>>>>>>>> at
> >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> >>>>>>>> ThreadPoolExecutor.java:1142)
> >>>>>>>>>> at
> >>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> >>>>>>>> ThreadPoolExecutor.java:617)
> >>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
> >>>>>>>>>>
> >>>>>>>>>> In a FreeIPA environment these python lines "just" work.
> >>>>>>>>>>
> >>>>>>>>>> Any suggestions are welcome!
> >>>>>>>>>>
> >>>>>>>>>> Marc
> >>>>>>>>>>
> >>>>>>>>>>
> >>>>>>>>> --
> >>>>>>>>> Marc de Lignie
> >>>>>>>>>
> >>>>>>>>
> >>>>>>>> --
> >>>>>>>> Marc de Lignie
> >>>>>>>>
> >>>>>>>>
> >>>>>>>
> >>>>>>>
> >>>>>>> --
> >>>>>>> Colm O hEigeartaigh
> >>>>>>>
> >>>>>>> Talend Community Coder
> >>>>>>> http://coders.talend.com
> >>>>>>>
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>> --
> >>>>>> Colm O hEigeartaigh
> >>>>>>
> >>>>>> Talend Community Coder
> >>>>>> http://coders.talend.com
> >>>>>>
> >>>>>
> >>>>>
> >>>>>
> >>>>> --
> >>>>> Colm O hEigeartaigh
> >>>>>
> >>>>> Talend Community Coder
> >>>>> http://coders.talend.com
> >>>>>
> >>>>
> >>>>
> >>>>
> >>>> --
> >>>> Colm O hEigeartaigh
> >>>>
> >>>> Talend Community Coder
> >>>> http://coders.talend.com
> >>>
> >>>
> >>
> >>
> >> --
> >> Colm O hEigeartaigh
> >>
> >> Talend Community Coder
> >> http://coders.talend.com
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
RE: MIT Kerberos compatibility
Posted by "Li, Jiajia" <ji...@intel.com>.
I have tested the new improvement committed by Kai, without exceptions and errors in my side.
Thanks
Jiajia
-----Original Message-----
From: Zheng, Kai [mailto:kai.zheng@intel.com]
Sent: Saturday, May 6, 2017 9:01 AM
To: kerby@directory.apache.org; coheigea@apache.org
Subject: Re: MIT Kerberos compatibility
I haven't repeated the issue but revisited the codes again and made improvements. Would you check it out? Thanks!
Sent from iPhone
> 在 2017年5月6日，上午6:28，Zheng, Kai <ka...@intel.com> 写道：
>
> Thanks colm for the clarification and it sounds an issue we need to address. I will investigate it soon.
>
> Sent from iPhone
>
>> 在 2017年5月6日，上午2:14，Colm O hEigeartaigh <co...@apache.org> 写道：
>>
>> Hi Kai,
>>
>> If I enable UDP with the default Transport, I can get a ticket fine
>> using kinit. However then the following error pops up in the window
>> I'm running Kerby in (as a test):
>>
>> Exception in thread "Thread-1" java.lang.RuntimeException: Error
>> occured while checking udp connections
>> at
>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(KdcNetwork.java:105)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.access$000(KdcNetwork.java:39)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.run(KdcNetwork.java:75)
>> at java.lang.Thread.run(Thread.java:748)
>> Caused by: java.nio.channels.ClosedChannelException
>> at
>> sun.nio.ch.DatagramChannelImpl.ensureOpen(DatagramChannelImpl.java:320)
>> at sun.nio.ch.DatagramChannelImpl.receive(DatagramChannelImpl.java:331)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.checkUdpMessage(KdcNetwork.java:132)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(KdcNetwork.ja
>> va:101)
>>
>> Colm.
>>
>>
>>> On Fri, May 5, 2017 at 5:56 PM, Zheng, Kai <ka...@intel.com> wrote:
>>>
>>> Colm, did you see udp problem now instead? I'm a little confused.
>>> Udp is sure supported but may not be enabled by default, which
>>> should be okay, imo. Thanks.
>>>
>>> Sent from iPhone
>>>
>>>> 在 2017年5月6日，上午12:02，Colm O hEigeartaigh <co...@apache.org> 写道：
>>>>
>>>> That's probably it. Why does the default transport not support UDP
>>>> in
>>> Kerby?
>>>>
>>>> Colm.
>>>>
>>>>> On Fri, May 5, 2017 at 4:54 PM, Li, Jiajia <ji...@intel.com> wrote:
>>>>>
>>>>> Are you sure add kdc_allow_udp = false in kdc.conf?
>>>>>
>>>>> Thanks
>>>>> Jiajia
>>>>>
>>>>> -----Original Message-----
>>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
>>>>> Sent: Friday, May 5, 2017 11:41 PM
>>>>> To: Li, Jiajia <ji...@intel.com>
>>>>> Cc: kerby@directory.apache.org; Zheng, Kai <ka...@intel.com>;
>>> mailto:
>>>>> m.c.delignie@xs4all.nl <m....@xs4all.nl>
>>>>> Subject: Re: MIT Kerberos compatibility
>>>>>
>>>>> Sorry, it was my error, UDP was actually enabled there. But why am
>>>>> I
>>> still
>>>>> seeing that error message?
>>>>>
>>>>> Colm.
>>>>>
>>>>>> On Fri, May 5, 2017 at 4:39 PM, Li, Jiajia <ji...@intel.com>
>>> wrote:
>>>>>>
>>>>>> Hi Colm,
>>>>>> I also test the Kerby KDC with kerby kint and MIT kinit, and only
>>>>>> listen the tcp port(disable udp), both got ticket successfully.
>>>>>> But I don't get the error message. Both krb.conf and kdc.conf
>>>>>> should set udp to be false, udp is enabled in default.
>>>>>>
>>>>>> Thanks
>>>>>> Jiajia
>>>>>>
>>>>>> -----Original Message-----
>>>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
>>>>>> Sent: Friday, May 5, 2017 11:34 PM
>>>>>> To: kerby@directory.apache.org
>>>>>> Cc: Zheng, Kai <ka...@intel.com>;
>>>>>> mailto:m.c.delignie@xs4all.nl < m.c.delignie@xs4all.nl>
>>>>>> Subject: Re: MIT Kerberos compatibility
>>>>>>
>>>>>> Hi Jiajia,
>>>>>>
>>>>>> If UDP is disabled and we don't use Netty, I can get a token
>>>>>> successfully via kinit. However I then see an error message in
>>>>>> the
>>> Kerby
>>>>> console:
>>>>>>
>>>>>> Exception in thread "Thread-1" java.lang.RuntimeException: Error
>>>>>> occured while checking udp connections at
>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
>>>>>> KdcNetwork.java:105)
>>>>>> at
>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
>>>>>> access$000(KdcNetwork.java:39)
>>>>>> at
>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
>>>>>> run(KdcNetwork.java:75)
>>>>>> at java.lang.Thread.run(Thread.java:748)
>>>>>> Caused by: java.nio.channels.ClosedChannelException
>>>>>> at
>>>>>> sun.nio.ch.DatagramChannelImpl.ensureOpen(
>>> DatagramChannelImpl.java:320)
>>>>>> at sun.nio.ch.DatagramChannelImpl.receive(
>>>>>> DatagramChannelImpl.java:331)
>>>>>> at
>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
>>>>>> checkUdpMessage(KdcNetwork.java:132)
>>>>>> at
>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
>>>>>> KdcNetwork.java:101)
>>>>>>
>>>>>> I'm not sure why we are seeing UDP errors when it's disabled?
>>>>>>
>>>>>> Colm.
>>>>>>
>>>>>>> On Fri, May 5, 2017 at 3:57 PM, Li, Jiajia <ji...@intel.com>
>>> wrote:
>>>>>>>
>>>>>>> Hi Colm,
>>>>>>> The shell client can't connect to kdc if the UDP is disabled.
>>>>>>> We don't use Netty in default.
>>>>>>> What's your test-cases? The same as the Marc's?
>>>>>>>
>>>>>>> Thanks
>>>>>>> Jiajia
>>>>>>>
>>>>>>> -----Original Message-----
>>>>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
>>>>>>> Sent: Friday, May 5, 2017 10:09 PM
>>>>>>> To: kerby@directory.apache.org
>>>>>>> Cc: Zheng, Kai <ka...@intel.com>;
>>>>>>> mailto:m.c.delignie@xs4all.nl < m.c.delignie@xs4all.nl>
>>>>>>> Subject: Re: MIT Kerberos compatibility
>>>>>>>
>>>>>>> Hi Jiajia,
>>>>>>>
>>>>>>> What are the issues if UDP is disabled and we don't use Netty? I
>>>>>>> tried doing this with my own test-cases and it didn't work, so
>>>>>>> it would be good to get this fixed soon.
>>>>>>>
>>>>>>> Colm.
>>>>>>>
>>>>>>> On Fri, May 5, 2017 at 2:46 PM, Li, Jiajia <ji...@intel.com>
>>>>> wrote:
>>>>>>>
>>>>>>>> Hi Marc,
>>>>>>>>>>> - your KRB5 tracing looks quite different. What OS and
>>>>>>>>>>> mit-kerberos
>>>>>>>> version did you use?
>>>>>>>> I use mac os and the python version is 2.7.10
>>>>>>>>
>>>>>>>>>>> - your KRB5 tracing shows UDP comms between kerberos client
>>>>>>>>>>> and KDC,
>>>>>>>> despite the allowUDP = false setting
>>>>>>>>>>> in my test. I did this setting because I get different
>>>>>>>>>>> problems
>>>>>>>> without it, see the additional logs below. So,
>>>>>>>>>>> we must also be aware of networking problems at my side.
>>>>>>>> I enable the UDP and use netty network, there are some issues
>>>>>>>> if UDP disabled, you can create a JIRA for this and we can fix
>>>>>>>> this issue in the next release version.
>>>>>>>>
>>>>>>>> The changes in my side as following:
>>>>>>>>
>>>>>>>> protected boolean allowUdp() {
>>>>>>>> return true;
>>>>>>>> }
>>>>>>>> @Override
>>>>>>>> protected void prepareKdc() throws KrbException {
>>>>>>>> getKdcServer().setInnerKdcImpl(
>>>>>>>> new
>>>>>>>> NettyKdcServerImpl(getKdcServer().getKdcSetting()));
>>>>>>>> super.prepareKdc();
>>>>>>>> }
>>>>>>>>
>>>>>>>> Here is log of MitIssueTest:
>>>>>>>> [INFO] Running
>>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
>>>>>>>> [nioEventLoopGroup-2-1] INFO
>>>>>>>> io.netty.handler.logging.LoggingHandler
>>>>>>>> -
>>>>>>>> [id: 0x2634fe6b] REGISTERED
>>>>>>>> [nioEventLoopGroup-2-1] INFO
>>>>>>>> io.netty.handler.logging.LoggingHandler
>>>>>>>> -
>>>>>>>> [id: 0x2634fe6b] BIND(0.0.0.0/0.0.0.0:53957)
>>>>>>>> [nioEventLoopGroup-2-1] INFO
>>>>>>>> io.netty.handler.logging.LoggingHandler -
>>>>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] ACTIVE [main] INFO
>>>>>>>> org.apache.kerby.kerberos.kdc.impl.NettyKdcServerImpl - Netty
>>>>>>>> kdc server started.
>>>>>>>> [nioEventLoopGroup-2-1] INFO
>>>>>>>> io.netty.handler.logging.LoggingHandler
>>>>>>>> -
>>>>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] RECEIVED: [id:
>>>>>>>> 0xdac7228b, /
>>>>>>>> 127.0.0.1:53961 => /127.0.0.1:53957]
>>>>>>>> [defaultEventExecutorGroup-4-1] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
>>>>>>>> - AS_REQ ISSUE: authtime 1493991123792,drankye@TEST.COM for
>>>>>>>> krbtgt/ TEST.COM@TEST.COM [main] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbCl
>>>>>>>> ien
>>>>>>>> t
>>>>>>>> - Send to kdc success.
>>>>>>>> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase
>>>>>>>> - Storing the tgt to the credential cache file.
>>>>>>>> [nioEventLoopGroup-5-1] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
>>>>>>>> - The preauth data is empty.
>>>>>>>> [nioEventLoopGroup-5-1] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
>>>>>>>> - KRB error occurred while processing request:Additional
>>>>>>>> pre-authentication required [nioEventLoopGroup-5-1] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
>>>>>>>> - AS_REQ ISSUE: authtime
>>>>>>>> 1493991123859,test-service/localhost@TEST.COM
>>>>>>>> for krbtgt/TEST.COM@TEST.COM
>>>>>>>> [nioEventLoopGroup-5-1] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.TgsRequest
>>>>>>>> - TGS_REQ ISSUE: authtime 1493991142850,drankye for
>>>>>>>> test-service/ localhost@TEST.COM
>>>>>>>>
>>>>>>>> Thanks
>>>>>>>> Jiajia
>>>>>>>>
>>>>>>>> -----Original Message-----
>>>>>>>> From: Zheng, Kai
>>>>>>>> Sent: Friday, May 5, 2017 7:46 PM
>>>>>>>> To: kerby@directory.apache.org; Li, Jiajia
>>>>>>>> <ji...@intel.com>
>>>>>>>> Subject: RE: MIT Kerberos compatibility
>>>>>>>>
>>>>>>>> Hi Marc,
>>>>>>>>
>>>>>>>> Looks like this is quite environment related, could you fire an
>>>>>>>> issue for this? I would suggest we target it to 1.1.0, which
>>>>>>>> can be done in
>>>>>>> June.
>>>>>>>>
>>>>>>>> Regards,
>>>>>>>> Kai
>>>>>>>>
>>>>>>>> -----Original Message-----
>>>>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
>>>>>>>> Sent: Friday, May 05, 2017 4:44 PM
>>>>>>>> To: Li, Jiajia <ji...@intel.com>
>>>>>>>> Cc: kerby@directory.apache.org
>>>>>>>> Subject: Re: MIT Kerberos compatibility
>>>>>>>>
>>>>>>>> Hi Jiajia,
>>>>>>>>
>>>>>>>> Great to read that you made progress on this issue and to see a
>>>>>>>> working config at your side. Below, I list my progress below
>>>>>>>> (with trunk merged into my MitIssue branch), but I am afraid we
>>>>>>>> are not done
>>>>>>> yet.
>>>>>>>>
>>>>>>>> Things that stand out:
>>>>>>>>
>>>>>>>> - the kdc decoding error is solved, relative to the logs
>>>>>>>> without your patch
>>>>>>>>
>>>>>>>> - your KRB5 tracing looks quite different. What OS and
>>>>>>>> mit-kerberos version did you use?
>>>>>>>>
>>>>>>>> - your KRB5 tracing shows UDP comms between kerberos client and
>>>>>>>> KDC, despite the allowUDP = false setting in my test. I did
>>>>>>>> this setting because I get different problems without it, see
>>>>>>>> the additional logs below. So, we must also be aware of
>>>>>>>> networking
>>>>> problems at my side.
>>>>>>>>
>>>>>>>> - the "Response was not from master KDC" msg is not relevant;
>>>>>>>> it disappears if you manually add master_kdc to the realms
>>>>>>>> section of the krb5.conf
>>>>>>>>
>>>>>>>> I have no idea how to proceed from here, so that is why I just
>>>>>>>> document the status at my side and ask about your - apparently
>>>>>>>> working -
>>>>>>> config.
>>>>>>>>
>>>>>>>> Cheers, Marc
>>>>>>>>
>>>>>>>>
>>>>>>>> KDC logging with allowUDP = false:
>>>>>>>>
>>>>>>>> [INFO] Running
>>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
>>>>>>>> [pool-1-thread-1] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
>>>>>>>> AS_REQ
>>>>>> ISSUE:
>>>>>>>> authtime 1493970789075,drankye@TEST.COM for
>>>>>>>> krbtgt/TEST.COM@TEST.COM [main] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbCl
>>>>>>>> ien
>>>>>>>> t
>>>>>>>> - Send to kdc success.
>>>>>>>> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase
>>>>>>>> - Storing the tgt to the credential cache file.
>>>>>>>> [pool-1-thread-1] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The
>>>>>>>> preauth data is empty.
>>>>>>>> [pool-1-thread-1] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
>>>>>>>> - KRB error occurred while processing request:Additional
>>>>>>>> pre-authentication required [pool-1-thread-1] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
>>>>>>>> AS_REQ
>>>>>> ISSUE:
>>>>>>>> authtime 1493970789108,test-service/localhost@TEST.COM for
>>>>>>>> krbtgt/ TEST.COM@TEST.COM [pool-1-thread-1] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
>>>>>>>> - Found fast padata and starting to process it.
>>>>>>>> [pool-1-thread-1] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest -
>>>>>>>> Found fast padata and starting to process it.
>>>>>>>>
>>>>>>>> Python script KRB5 tracing (MIT Kerberos 1.13.2 of Ubuntu
>>>>>>>> Xenial) with allowUDP = false:
>>>>>>>>
>>>>>>>> $ .
>>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/
>>>>>>>> kerberos/kerb/server/MitIssueTest.sh
>>>>>>>> [25281] 1493970797.298753: Retrieving drankye@TEST.COM from
>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>>> result:
>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>>> [25281]
>>>>>>>> 1493970797.298952: Retrieving drankye@TEST.COM from
>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>>> result:
>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>>> [25281]
>>>>>>>> 1493970797.299106: Retrieving drankye@TEST.COM from
>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>>> result:
>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>>> [25281]
>>>>>>>> 1493970797.299213: Retrieving drankye@TEST.COM from
>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>>> result:
>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>>> [25281]
>>>>>>>> 1493970797.299323: Retrieving drankye@TEST.COM from
>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>>> result:
>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>>> [25281]
>>>>>>>> 1493970797.299436: Retrieving drankye@TEST.COM from
>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>>> result:
>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>>> [25281]
>>>>>>>> 1493970797.299545: Retrieving drankye@TEST.COM from
>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>>> result:
>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>>> [25281]
>>>>>>>> 1493970797.299654: Retrieving drankye@TEST.COM from
>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>>> result:
>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>>> kerberos.authGSSClientInit successful [25281] 1493970797.299922:
>>>>>>>> Getting credentials drankye@TEST.COM -> test-service/localhost@
>>>>>>>> using ccache
>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>> [25281] 1493970797.299945: Retrieving drankye@TEST.COM ->
>>>>>>>> test-service/localhost@ from
>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>> with result:
>>>>>>>> -1765328243/Matching credential not found [25281] 1493970797.299959:
>>>>>>>> Retrying drankye@TEST.COM -> test-service/localhost@TEST.COM
>>>>>>>> with
>>>>>>> result:
>>>>>>>> -1765328243/Matching credential not found [25281] 1493970797.299962:
>>>>>>>> Server has referral realm; starting with
>>>>>>>> test-service/localhost@TEST.COM [25281]
>>>>>>>> 1493970797.299975: Retrieving drankye@TEST.COM ->
>>>>>>>> krbtgt/TEST.COM@TEST.COM from
>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>> with result:
>>>>>>>> 0/Success [25281] 1493970797.299979: Starting with TGT for
>>>>>>>> client
>>>>>> realm:
>>>>>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [25281]
>>>>>> 1493970797.299981:
>>>>>>>> Requesting tickets for test-service/localhost@TEST.COM,
>>>>>>>> referrals on [25281] 1493970797.299994: Generated subkey for TGS request:
>>>>>>>> aes128-cts/1B9B [25281] 1493970797.300009: etypes requested in
>>>>>>>> TGS
>>>>>>> request:
>>>>>>>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac,
>>>>>>>> camellia128-cts, camellia256-cts [25281] 1493970797.300054:
>>>>>>>> Encoding request body and padata into FAST request [25281]
>>>>>>>> 1493970797.300080: Sending request
>>>>>>>> (823 bytes) to TEST.COM [25281] 1493970797.300091: Resolving
>>>>>>>> hostname localhost [25281]
>>>>>>>> 1493970797.300136: Initiating TCP connection to stream
>>>>>>>> 127.0.0.1:34319
>>>>>>>> [25281] 1493970797.300191: Sending TCP request to stream
>>>>>>>> 127.0.0.1:34319 [25281] 1493970797.303610: Received answer (125
>>>>>>>> bytes) from stream
>>>>>>>> 127.0.0.1:34319
>>>>>>>> [25281] 1493970797.303618: Terminating TCP connection to stream
>>>>>>>> 127.0.0.1:34319
>>>>>>>> [25281] 1493970797.553126: Response was not from master KDC
>>>>>>>> [25281]
>>>>>>>> 1493970797.553198: TGS request result: -1765323383/Unknown code
>>>>>>>> krcM
>>>>>>>> 137 [25281] 1493970797.553234: Requesting tickets for
>>>>>>>> test-service/ localhost@TEST.COM, referrals off [25281]
>>>>> 1493970797.553273:
>>>>>>>> Generated subkey for TGS request: aes128-cts/94C6 [25281]
>>>>>> 1493970797.553323:
>>>>>>>> etypes requested in TGS request: aes256-cts, aes128-cts,
>>>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
>>>>>>>> [25281]
>>>>>>>> 1493970797.553436: Encoding request body and padata into FAST
>>>>>>>> request
>>>>>>> [25281] 1493970797.553532:
>>>>>>>> Sending request (823 bytes) to TEST.COM [25281] 1493970797.553567:
>>>>>>>> Resolving hostname localhost [25281] 1493970797.553745:
>>>>>>>> Initiating TCP connection to stream
>>>>>>>> 127.0.0.1:34319
>>>>>>>> [25281] 1493970797.553889: Sending TCP request to stream
>>>>>>>> 127.0.0.1:34319 [25281] 1493970797.558297: Received answer (125
>>>>>>>> bytes) from stream
>>>>>>>> 127.0.0.1:34319
>>>>>>>> [25281] 1493970797.558318: Terminating TCP connection to stream
>>>>>>>> 127.0.0.1:34319
>>>>>>>> [25281] 1493970797.561189: Response was not from master KDC
>>>>>>>> [25281]
>>>>>>>> 1493970797.561258: TGS request result: -1765323383/Unknown code
>>>>>>>> krcM
>>>>>>>> 137 ('First kerberos.authGSSClientStep not successful',
>>>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide
>>>>>>>> more information', 851968), ('Unknown code krcM 137',
>>>>>>>> -1765323383)))
>>>>>>>>
>>>>>>>>
>>>>>>>> KDC logging with allowUDP = true:
>>>>>>>>
>>>>>>>> [INFO] Running
>>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
>>>>>>>> [pool-1-thread-1] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
>>>>>>>> AS_REQ
>>>>>> ISSUE:
>>>>>>>> authtime 1493972505784,drankye@TEST.COM for
>>>>>>>> krbtgt/TEST.COM@TEST.COM [main] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbCl
>>>>>>>> ien
>>>>>>>> t
>>>>>>>> - Send to kdc success.
>>>>>>>> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase
>>>>>>>> - Storing the tgt to the credential cache file.
>>>>>>>> [pool-1-thread-1] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The
>>>>>>>> preauth data is empty.
>>>>>>>> [pool-1-thread-1] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
>>>>>>>> - KRB error occurred while processing request:Additional
>>>>>>>> pre-authentication required [pool-1-thread-2] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest -
>>>>>>>> AS_REQ
>>>>>> ISSUE:
>>>>>>>> authtime 1493972505948,test-service/localhost@TEST.COM for
>>>>>>>> krbtgt/ TEST.COM@TEST.COM Exception in thread "Thread-0"
>>>>>>>> java.lang.RuntimeException: Error occured while checking udp
>>>>>> connections
>>>>>>>> at
>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
>>>>>>>> KdcNetwork.java:105)
>>>>>>>> at
>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
>>>>>>>> access$000(KdcNetwork.java:39)
>>>>>>>> at
>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
>>>>>>>> run(KdcNetwork.java:75)
>>>>>>>> at java.lang.Thread.run(Thread.java:748)
>>>>>>>> Caused by: java.nio.channels.ClosedChannelException
>>>>>>>> at
>>>>>>>> sun.nio.ch.DatagramChannelImpl.ensureOpen(
>>>>>> DatagramChannelImpl.java:320)
>>>>>>>> at sun.nio.ch.DatagramChannelImpl.receive(
>>>>>>>> DatagramChannelImpl.java:331)
>>>>>>>> at
>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
>>>>>>>> checkUdpMessage(KdcNetwork.java:132)
>>>>>>>> at
>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
>>>>>>>> KdcNetwork.java:101)
>>>>>>>> ... 3 more
>>>>>>>>
>>>>>>>>
>>>>>>>> krb5.conf:
>>>>>>>>
>>>>>>>> [libdefaults]
>>>>>>>> kdc_realm = TEST.COM
>>>>>>>> default_realm = TEST.COM
>>>>>>>> udp_preference_limit = 4096
>>>>>>>> kdc_tcp_port = 37080
>>>>>>>> kdc_udp_port = 36525
>>>>>>>>
>>>>>>>> [realms]
>>>>>>>> TEST.COM = {
>>>>>>>> kdc = localhost:36525
>>>>>>>> }
>>>>>>>>
>>>>>>>> And port 36525 does not show up in `netstat -l` (while 37080
>>>>>>>> does)
>>>>>>>>
>>>>>>>>
>>>>>>>> Op 04-05-17 om 14:55 schreef Li, Jiajia:
>>>>>>>>> Hi Marc,
>>>>>>>>> I try to run your test(through applying your patch in the
>>>>>>>>> trunk) , I
>>>>>>>> think it's success now. Could you take some time to check about it?
>>>>>>>>> Here is the log:
>>>>>>>>>
>>>>>>>>> directory-kerby git:(trunk) ? .
>>>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerber
>>>>>>>>> os
>>>>>>>>> /k
>>>>>>>>> er
>>>>>>>>> b/
>>>>>>>>> server/MitIssueTest.sh
>>>>>>>>> kerberos.authGSSClientInit successful
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: entypes not
>>>>>>>>> supported
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>>>>> credential for krb5_ccache_conf_data/realm-config@X-CACHECONF:
>>>>>>>>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>>>>> credential for test-service/localhost@TEST.COM in cache
>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>>>>> credential for
>>>>>>>>> krb5_ccache_conf_data/negative-cache/test-service\134/localhos
>>>>>>>>> t\
>>>>>>>>> 13
>>>>>>>>> 4@
>>>>>>>>> TE
>>>>>>>>> ST.COM@X-CACHECONF: in cache
>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>>>>> credential for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF:
>>>>>>>>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>>>>> credential for krb5_ccache_conf_data/sitename@X-CACHECONF: in
>>>>>>>>> cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>>>>> credential for test-service/localhost@TEST.COM in cache
>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>>>>>>>> des-cbc-md5-deprecated not supported
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>>>>>>>> des-cbc-md4-deprecated not supported
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>>>>>>>> des-cbc-crc-deprecated not supported
>>>>>>>>> 2017-05-04T20:44:06 Trying to find service kdc for realm
>>>>>>>>> TEST.COM flags 0
>>>>>>>>> 2017-05-04T20:44:06 configuration file for realm TEST.COM
>>>>>>>>> found
>>>>>>>>> 2017-05-04T20:44:06 submissing new requests to new host
>>>>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
>>>>>>>>> 2017-05-04T20:44:06 connecting to host: udp ::1:52534
>>>>>>>>> (localhost)
>>>>>> tid:
>>>>>>>>> 00000001
>>>>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
>>>>>>>>> 2017-05-04T20:44:06 Queuing host in future (in 3s), its the 2
>>>>>>>>> address on the same name: udp 127.0.0.1:52534 (localhost) tid:
>>>>>>>>> 00000002
>>>>>>>>> 2017-05-04T20:44:06 writing packet: udp ::1:52534 (localhost) tid:
>>>>>>>>> 00000001
>>>>>>>>> 2017-05-04T20:44:06 reading packet: udp ::1:52534 (localhost) tid:
>>>>>>>>> 00000001
>>>>>>>>> 2017-05-04T20:44:06 host completed: udp ::1:52534 (localhost) tid:
>>>>>>>>> 00000001
>>>>>>>>> 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0 hosts
>>>>>>>>> 1 packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814 tid:
>>>>>>>>> 00000002
>>>>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/763641F3
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328353: Decrypt integrity
>>>>>>>>> check failed for checksum type hmac-sha1-96-aes128, key type
>>>>>>>>> aes128-cts-hmac-sha1-96
>>>>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
>>>>>>>>> 2017-05-04T20:44:06 krb5_get_credentials_with_flags: TEST.COM wc:
>>>>>>>>> 0.050317
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>>>>> credential for krb5_ccache_conf_data/realm-config@X-CACHECONF:
>>>>>>>>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>>>>> credential for
>>>>>>>>> krb5_ccache_conf_data/time-offset/test-service\134/
>>>>>> localhost\134@TEST.
>>>>>>>>> COM@X-CACHECONF: in cache
>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>>> 2017-05-04T20:44:06 Setting up PFS for auth context
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>>>>>>>> des-cbc-md5-deprecated not supported
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>>>>>>>> des-cbc-md4-deprecated not supported
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>>>>>>>> des-cbc-crc-deprecated not supported First
>>>>>>>>> kerberos.authGSSClientStep successful
>>>>>>>>>
>>>>>>>>> Thanks
>>>>>>>>> Jiajia
>>>>>>>>>
>>>>>>>>> -----Original Message-----
>>>>>>>>> From: Zheng, Kai [mailto:kai.zheng@intel.com]
>>>>>>>>> Sent: Wednesday, May 3, 2017 7:29 PM
>>>>>>>>> To: kerby@directory.apache.org
>>>>>>>>> Subject: RE: MIT Kerberos compatibility
>>>>>>>>>
>>>>>>>>> Hi Marc,
>>>>>>>>>
>>>>>>>>> In case you're not aware of this, please check out the latest
>>>>>>>>> fix made
>>>>>>>> by Jiajia. We thought your case may be different, but would be
>>>>>>>> good to have a check before we can repeat/fix your case. Thanks.
>>>>>>>>> https://issues.apache.org/jira/browse/DIRKRB-625
>>>>>>>>>
>>>>>>>>> Regards,
>>>>>>>>> Kai
>>>>>>>>>
>>>>>>>>> -----Original Message-----
>>>>>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
>>>>>>>>> Sent: Sunday, April 30, 2017 7:45 PM
>>>>>>>>> To: kerby@directory.apache.org
>>>>>>>>> Subject: Re: MIT Kerberos compatibility
>>>>>>>>>
>>>>>>>>> Hi Kai,
>>>>>>>>>
>>>>>>>>> The terminal output below is for the latest MIT Kerberos
>>>>>>>>> 1.15.1 (locally
>>>>>>>> built on Ubuntu Xenial). Before that, I also tested with the
>>>>>>>> default Xenial MIT Kerberos packages (1.13.2), with the same
>>>>>>>> result. I did not try earlier MIT Kerberos versions.
>>>>>>>>>
>>>>>>>>> Marc
>>>>>>>>>
>>>>>>>>> Op 29-04-17 om 21:42 schreef Marc de Lignie:
>>>>>>>>>> Hi Kai,
>>>>>>>>>>
>>>>>>>>>> Thanks for the response. I prepared a minimal config that
>>>>>>>>>> reproduces my problem.
>>>>>>>>>>
>>>>>>>>>> You can fetch the branch/commit from:
>>>>>>>>>> https://github.com/vtslab/directory-kerby/commits/MitIssue
>>>>>>>>>>
>>>>>>>>>> This is relative to RC2, but I also tried this on trunk for
>>>>>>>>>> my actual project.
>>>>>>>>>>
>>>>>>>>>> This config produces the debug and error messages below.
>>>>>>>>>>
>>>>>>>>>> 1. For the terminal with the bash + python script $ klist
>>>>>>>>>> Ticket
>>>>>>>>>> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>>>> Default principal: drankye@TEST.COM
>>>>>>>>>>
>>>>>>>>>> Valid starting Expires Service principal
>>>>>>>>>> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> renew until 29-04-17 21:07:39
>>>>>>>>>>
>>>>>>>>>> $ .
>>>>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerbe
>>>>>>>>>> ro s/ ke rb / server/MitIssueTest.sh [15538]
>>>>>>>>>> 1493491231.917606:
>>>>>>>>>> Retrieving drankye@TEST.COM from
>>>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
>>>>>>>>>> with
>>>>>>>>>> result:
>>>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
>>>>>>>>>> found [15538]
>>>>>>>>>> 1493491231.917827: Retrieving drankye@TEST.COM from
>>>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0)
>>>>>>>>>> with
>>>>>>> result:
>>>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not
>>>>>>>>>> found kerberos.authGSSClientInit successful [15538] 1493491231.918185:
>>>>>>>>>> Getting credentials drankye@TEST.COM ->
>>>>>>>>>> test-service/localhost@ using ccache
>>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>>>> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
>>>>>>>>>> test-service/localhost@ from
>>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>>>>>>>>>> -1765328243/Matching credential not found (filename:
>>>>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
>>>>>>>>>> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
>>>>>>>>>> test-service/localhost@TEST.COM with result:
>>>>>>>>>> -1765328243/Matching credential not found (filename:
>>>>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
>>>>>>>>>> [15538] 1493491231.918229: Server has referral realm;
>>>>>>>>>> starting with test-service/localhost@TEST.COM [15538] 1493491231.918278:
>>>>>>>>>> Retrieving drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM from
>>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>>>>>>>>>> 0/Success
>>>>>>>>>> [15538] 1493491231.918281: Starting with TGT for client realm:
>>>>>>>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
>>>>>>>>>> 1493491231.918301: Requesting tickets for
>>>>>>>>>> test-service/localhost@TEST.COM, referrals on [15538]
>>>>>>>>>> 1493491231.918326: Generated subkey for TGS request:
>>>>>>>>>> aes128-cts/FA30
>>>>>>>>>> [15538] 1493491231.918359: etypes requested in TGS request:
>>>>>>>>>> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2,
>>>>>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
>>>>>>>>>> [15538]
>>>>>> 1493491231.918484:
>>>>>>>>>> Encoding request body and padata into FAST request [15538]
>>>>>>>>>> 1493491231.918541: Sending request (836 bytes) to TEST.COM
>>>>>>>>>> [15538]
>>>>>>>>>> 1493491231.918597: Resolving hostname localhost [15538]
>>>>>>>>>> 1493491231.918703: Initiating TCP connection to stream
>>>>>>>>>> 127.0.0.1:44292
>>>>>>>>>> [15538] 1493491231.918777: Sending TCP request to stream
>>>>>>>>>> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error
>>>>>>>>>> receiving from stream
>>>>>>>>>> 127.0.0.1:44292: 104/Connection reset by peer [15538]
>>>>>>>>>> 1493491231.922812: Terminating TCP connection to stream
>>>>>>>>>> 127.0.0.1:44292
>>>>>>>>>> [15538] 1493491231.922858: Sending initial UDP request to
>>>>>>>>>> dgram
>>>>>>>>>> 127.0.0.1:44292
>>>>>>>>>> ('First kerberos.authGSSClientStep not successful',
>>>>>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide
>>>>>>>>>> more information', 851968), ("Cannot contact any KDC for
>>>>>>>>>> realm 'TEST.COM'",
>>>>>>>>>> -1765328228)))
>>>>>>>>>>
>>>>>>>>>> 2. For the terminal that runs mvn clean test
>>>>>>>>>> -Dtest=MitIssueTest Running
>>>>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
>>>>>>>>>> 2017-04-29 21:07:39,182 DEBUG [main] backend.
>>>>>> AbstractIdentityBackend:
>>>>>>>>>> initialize called
>>>>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
>>>>>> AbstractIdentityBackend:
>>>>>>>>>> getIdentity called, principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
>>>>>> AbstractIdentityBackend:
>>>>>>>>>> getIdentity failed, principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
>>>>>> AbstractIdentityBackend:
>>>>>>>>>> addIdentity successful, principalName =
>>>>>>>>>> krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
>>>>>> AbstractIdentityBackend:
>>>>>>>>>> getIdentity called, principalName = kadmin/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
>>>>>> AbstractIdentityBackend:
>>>>>>>>>> getIdentity failed, principalName = kadmin/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,213 DEBUG [main] backend.
>>>>>> AbstractIdentityBackend:
>>>>>>>>>> addIdentity successful, principalName =
>>>>>>>>>> kadmin/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,216 DEBUG [main] backend.
>>>>>> AbstractIdentityBackend:
>>>>>>>>>> start called
>>>>>>>>>> 2017-04-29 21:07:39,232 DEBUG [main] backend.
>>>>>> AbstractIdentityBackend:
>>>>>>>>>> addIdentity successful, principalName =
>>>>>>>>>> test-service/localhost@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,425 DEBUG [main] backend.
>>>>>> AbstractIdentityBackend:
>>>>>>>>>> addIdentity successful, principalName = drankye@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1]
>>>>> request.KdcRequest:
>>>>>>>>>> Client entry is empty.
>>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>>> principalName = drankye@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>>> principalName = drankye@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
>>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>>>>>>>>> disconnecting abnormally java.io.EOFException
>>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
>>>>>>>> receiveMessage(KrbTcpTransport.java:54)
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
>>>>>>>>>> ru
>>>>>>>>>> n(
>>>>>>>> DefaultKdcHandler.java:46)
>>>>>>>>>> at
>>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>>>>>>>> ThreadPoolExecutor.java:1142)
>>>>>>>>>> at
>>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>>>>>>>> ThreadPoolExecutor.java:617)
>>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
>>>>>>>>>> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase:
>>>>>>>>>> Storing the tgt to the credential cache file.
>>>>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
>>>>>> AbstractIdentityBackend:
>>>>>>>>>> getIdentity called, principalName =
>>>>>>>>>> test-service/localhost@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
>>>>>> AbstractIdentityBackend:
>>>>>>>>>> getIdentity successful, principalName =
>>>>>>>>>> test-service/localhost@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1]
>>>>> request.KdcRequest:
>>>>>>>>>> Client entry is empty.
>>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>>> principalName = test-service/localhost@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>>> principalName = test-service/localhost@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1]
>>>>> request.KdcRequest:
>>>>>>>>>> The preauth data is empty.
>>>>>>>>>> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1] server.KdcHandler:
>>>>>>>>>> KRB error occurred while processing request:Additional
>>>>>>>>>> pre-authentication required
>>>>>>>>>> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
>>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>>>>>>>>> disconnecting abnormally java.io.EOFException
>>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
>>>>>>>> receiveMessage(KrbTcpTransport.java:54)
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
>>>>>>>>>> ru
>>>>>>>>>> n(
>>>>>>>> DefaultKdcHandler.java:46)
>>>>>>>>>> at
>>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>>>>>>>> ThreadPoolExecutor.java:1142)
>>>>>>>>>> at
>>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>>>>>>>> ThreadPoolExecutor.java:617)
>>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
>>>>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1]
>>>>> request.KdcRequest:
>>>>>>>>>> Client entry is empty.
>>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>>> principalName = test-service/localhost@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>>> principalName = test-service/localhost@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
>>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>>>>>>>>> disconnecting abnormally java.io.EOFException
>>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
>>>>>>>> receiveMessage(KrbTcpTransport.java:54)
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
>>>>>>>>>> ru
>>>>>>>>>> n(
>>>>>>>> DefaultKdcHandler.java:46)
>>>>>>>>>> at
>>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>>>>>>>> ThreadPoolExecutor.java:1142)
>>>>>>>>>> at
>>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>>>>>>>> ThreadPoolExecutor.java:617)
>>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
>>>>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1]
>>>>> request.KdcRequest:
>>>>>>>>>> Found fast padata and start to process it.
>>>>>>>>>> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
>>>>>>>>>> impl.DefaultKdcHandler: Error occured while processing request:
>>>>>>>>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
>>>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
>>>>>>>> java:85)
>>>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
>>>>>>>> java:70)
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcF
>>>>>>>>>> in
>>>>>>>>>> dF
>>>>>>>>>> as
>>>>>>>>>> t(
>>>>>>>> KdcRequest.java:208)
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.
>>>>>>>> KdcRequest.process(KdcRequest.java:168)
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
>>>>>>>> handleMessage(KdcHandler.java:115)
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
>>>>>>>> handleMessage(DefaultKdcHandler.java:67)
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
>>>>>>>>>> ru
>>>>>>>>>> n(
>>>>>>>> DefaultKdcHandler.java:52)
>>>>>>>>>> at
>>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>>>>>>>> ThreadPoolExecutor.java:1142)
>>>>>>>>>> at
>>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>>>>>>>> ThreadPoolExecutor.java:617)
>>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
>>>>>>>>>> Caused by: java.io.IOException: Unexpected item context [0]
>>>>>>>>>> [tag=0xA0, off=0, len=3+207], expecting 0x30
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>>>>>>>> Asn1Encodeable.java:210)
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>>>>>>>> Asn1Encodeable.java:197)
>>>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
>>>>>>>> java:83)
>>>>>>>>>> ... 9 more
>>>>>>>>>> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
>>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>>>>>>>>> disconnecting abnormally
>>>>>>>>>> java.net.SocketException: Socket closed
>>>>>>>>>> at java.net.SocketInputStream.socketRead0(Native Method)
>>>>>>>>>> at java.net.SocketInputStream.socketRead(SocketInputStream.
>>>>>>>> java:116)
>>>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
>>>>> 171)
>>>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
>>>>> 141)
>>>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
>>>>> 224)
>>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:387)
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
>>>>>>>> receiveMessage(KrbTcpTransport.java:54)
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
>>>>>>>>>> ru
>>>>>>>>>> n(
>>>>>>>> DefaultKdcHandler.java:46)
>>>>>>>>>> at
>>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>>>>>>>> ThreadPoolExecutor.java:1142)
>>>>>>>>>> at
>>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>>>>>>>> ThreadPoolExecutor.java:617)
>>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
>>>>>>>>>>
>>>>>>>>>> In a FreeIPA environment these python lines "just" work.
>>>>>>>>>>
>>>>>>>>>> Any suggestions are welcome!
>>>>>>>>>>
>>>>>>>>>> Marc
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>> --
>>>>>>>>> Marc de Lignie
>>>>>>>>>
>>>>>>>>
>>>>>>>> --
>>>>>>>> Marc de Lignie
>>>>>>>>
>>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> --
>>>>>>> Colm O hEigeartaigh
>>>>>>>
>>>>>>> Talend Community Coder
>>>>>>> http://coders.talend.com
>>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>> --
>>>>>> Colm O hEigeartaigh
>>>>>>
>>>>>> Talend Community Coder
>>>>>> http://coders.talend.com
>>>>>>
>>>>>
>>>>>
>>>>>
>>>>> --
>>>>> Colm O hEigeartaigh
>>>>>
>>>>> Talend Community Coder
>>>>> http://coders.talend.com
>>>>>
>>>>
>>>>
>>>>
>>>> --
>>>> Colm O hEigeartaigh
>>>>
>>>> Talend Community Coder
>>>> http://coders.talend.com
>>>
>>>
>>
>>
>> --
>> Colm O hEigeartaigh
>>
>> Talend Community Coder
>> http://coders.talend.com
Re: MIT Kerberos compatibility
Posted by "Zheng, Kai" <ka...@intel.com>.
I haven't repeated the issue but revisited the codes again and made improvements. Would you check it out? Thanks!
Sent from iPhone
> 在 2017年5月6日，上午6:28，Zheng, Kai <ka...@intel.com> 写道：
>
> Thanks colm for the clarification and it sounds an issue we need to address. I will investigate it soon.
>
> Sent from iPhone
>
>> 在 2017年5月6日，上午2:14，Colm O hEigeartaigh <co...@apache.org> 写道：
>>
>> Hi Kai,
>>
>> If I enable UDP with the default Transport, I can get a ticket fine using
>> kinit. However then the following error pops up in the window I'm running
>> Kerby in (as a test):
>>
>> Exception in thread "Thread-1" java.lang.RuntimeException: Error occured
>> while checking udp connections
>> at
>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(KdcNetwork.java:105)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.access$000(KdcNetwork.java:39)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.run(KdcNetwork.java:75)
>> at java.lang.Thread.run(Thread.java:748)
>> Caused by: java.nio.channels.ClosedChannelException
>> at
>> sun.nio.ch.DatagramChannelImpl.ensureOpen(DatagramChannelImpl.java:320)
>> at sun.nio.ch.DatagramChannelImpl.receive(DatagramChannelImpl.java:331)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.checkUdpMessage(KdcNetwork.java:132)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(KdcNetwork.java:101)
>>
>> Colm.
>>
>>
>>> On Fri, May 5, 2017 at 5:56 PM, Zheng, Kai <ka...@intel.com> wrote:
>>>
>>> Colm, did you see udp problem now instead? I'm a little confused. Udp is
>>> sure supported but may not be enabled by default, which should be okay,
>>> imo. Thanks.
>>>
>>> Sent from iPhone
>>>
>>>> 在 2017年5月6日，上午12:02，Colm O hEigeartaigh <co...@apache.org> 写道：
>>>>
>>>> That's probably it. Why does the default transport not support UDP in
>>> Kerby?
>>>>
>>>> Colm.
>>>>
>>>>> On Fri, May 5, 2017 at 4:54 PM, Li, Jiajia <ji...@intel.com> wrote:
>>>>>
>>>>> Are you sure add kdc_allow_udp = false in kdc.conf?
>>>>>
>>>>> Thanks
>>>>> Jiajia
>>>>>
>>>>> -----Original Message-----
>>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
>>>>> Sent: Friday, May 5, 2017 11:41 PM
>>>>> To: Li, Jiajia <ji...@intel.com>
>>>>> Cc: kerby@directory.apache.org; Zheng, Kai <ka...@intel.com>;
>>> mailto:
>>>>> m.c.delignie@xs4all.nl <m....@xs4all.nl>
>>>>> Subject: Re: MIT Kerberos compatibility
>>>>>
>>>>> Sorry, it was my error, UDP was actually enabled there. But why am I
>>> still
>>>>> seeing that error message?
>>>>>
>>>>> Colm.
>>>>>
>>>>>> On Fri, May 5, 2017 at 4:39 PM, Li, Jiajia <ji...@intel.com>
>>> wrote:
>>>>>>
>>>>>> Hi Colm,
>>>>>> I also test the Kerby KDC with kerby kint and MIT kinit, and only
>>>>>> listen the tcp port(disable udp), both got ticket successfully. But I
>>>>>> don't get the error message. Both krb.conf and kdc.conf should set udp
>>>>>> to be false, udp is enabled in default.
>>>>>>
>>>>>> Thanks
>>>>>> Jiajia
>>>>>>
>>>>>> -----Original Message-----
>>>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
>>>>>> Sent: Friday, May 5, 2017 11:34 PM
>>>>>> To: kerby@directory.apache.org
>>>>>> Cc: Zheng, Kai <ka...@intel.com>; mailto:m.c.delignie@xs4all.nl <
>>>>>> m.c.delignie@xs4all.nl>
>>>>>> Subject: Re: MIT Kerberos compatibility
>>>>>>
>>>>>> Hi Jiajia,
>>>>>>
>>>>>> If UDP is disabled and we don't use Netty, I can get a token
>>>>>> successfully via kinit. However I then see an error message in the
>>> Kerby
>>>>> console:
>>>>>>
>>>>>> Exception in thread "Thread-1" java.lang.RuntimeException: Error
>>>>>> occured while checking udp connections
>>>>>> at
>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
>>>>>> KdcNetwork.java:105)
>>>>>> at
>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
>>>>>> access$000(KdcNetwork.java:39)
>>>>>> at
>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
>>>>>> run(KdcNetwork.java:75)
>>>>>> at java.lang.Thread.run(Thread.java:748)
>>>>>> Caused by: java.nio.channels.ClosedChannelException
>>>>>> at
>>>>>> sun.nio.ch.DatagramChannelImpl.ensureOpen(
>>> DatagramChannelImpl.java:320)
>>>>>> at sun.nio.ch.DatagramChannelImpl.receive(
>>>>>> DatagramChannelImpl.java:331)
>>>>>> at
>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
>>>>>> checkUdpMessage(KdcNetwork.java:132)
>>>>>> at
>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
>>>>>> KdcNetwork.java:101)
>>>>>>
>>>>>> I'm not sure why we are seeing UDP errors when it's disabled?
>>>>>>
>>>>>> Colm.
>>>>>>
>>>>>>> On Fri, May 5, 2017 at 3:57 PM, Li, Jiajia <ji...@intel.com>
>>> wrote:
>>>>>>>
>>>>>>> Hi Colm,
>>>>>>> The shell client can't connect to kdc if the UDP is disabled.
>>>>>>> We don't use Netty in default.
>>>>>>> What's your test-cases? The same as the Marc's?
>>>>>>>
>>>>>>> Thanks
>>>>>>> Jiajia
>>>>>>>
>>>>>>> -----Original Message-----
>>>>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
>>>>>>> Sent: Friday, May 5, 2017 10:09 PM
>>>>>>> To: kerby@directory.apache.org
>>>>>>> Cc: Zheng, Kai <ka...@intel.com>; mailto:m.c.delignie@xs4all.nl
>>>>>>> < m.c.delignie@xs4all.nl>
>>>>>>> Subject: Re: MIT Kerberos compatibility
>>>>>>>
>>>>>>> Hi Jiajia,
>>>>>>>
>>>>>>> What are the issues if UDP is disabled and we don't use Netty? I
>>>>>>> tried doing this with my own test-cases and it didn't work, so it
>>>>>>> would be good to get this fixed soon.
>>>>>>>
>>>>>>> Colm.
>>>>>>>
>>>>>>> On Fri, May 5, 2017 at 2:46 PM, Li, Jiajia <ji...@intel.com>
>>>>> wrote:
>>>>>>>
>>>>>>>> Hi Marc,
>>>>>>>>>>> - your KRB5 tracing looks quite different. What OS and
>>>>>>>>>>> mit-kerberos
>>>>>>>> version did you use?
>>>>>>>> I use mac os and the python version is 2.7.10
>>>>>>>>
>>>>>>>>>>> - your KRB5 tracing shows UDP comms between kerberos client and
>>>>>>>>>>> KDC,
>>>>>>>> despite the allowUDP = false setting
>>>>>>>>>>> in my test. I did this setting because I get different
>>>>>>>>>>> problems
>>>>>>>> without it, see the additional logs below. So,
>>>>>>>>>>> we must also be aware of networking problems at my side.
>>>>>>>> I enable the UDP and use netty network, there are some issues if
>>>>>>>> UDP disabled, you can create a JIRA for this and we can fix this
>>>>>>>> issue in the next release version.
>>>>>>>>
>>>>>>>> The changes in my side as following:
>>>>>>>>
>>>>>>>> protected boolean allowUdp() {
>>>>>>>> return true;
>>>>>>>> }
>>>>>>>> @Override
>>>>>>>> protected void prepareKdc() throws KrbException {
>>>>>>>> getKdcServer().setInnerKdcImpl(
>>>>>>>> new NettyKdcServerImpl(getKdcServer().getKdcSetting()));
>>>>>>>> super.prepareKdc();
>>>>>>>> }
>>>>>>>>
>>>>>>>> Here is log of MitIssueTest:
>>>>>>>> [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
>>>>>>>> [nioEventLoopGroup-2-1] INFO
>>>>>>>> io.netty.handler.logging.LoggingHandler
>>>>>>>> -
>>>>>>>> [id: 0x2634fe6b] REGISTERED
>>>>>>>> [nioEventLoopGroup-2-1] INFO
>>>>>>>> io.netty.handler.logging.LoggingHandler
>>>>>>>> -
>>>>>>>> [id: 0x2634fe6b] BIND(0.0.0.0/0.0.0.0:53957)
>>>>>>>> [nioEventLoopGroup-2-1] INFO
>>>>>>>> io.netty.handler.logging.LoggingHandler -
>>>>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] ACTIVE [main] INFO
>>>>>>>> org.apache.kerby.kerberos.kdc.impl.NettyKdcServerImpl - Netty kdc
>>>>>>>> server started.
>>>>>>>> [nioEventLoopGroup-2-1] INFO
>>>>>>>> io.netty.handler.logging.LoggingHandler
>>>>>>>> -
>>>>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] RECEIVED: [id:
>>>>>>>> 0xdac7228b, /
>>>>>>>> 127.0.0.1:53961 => /127.0.0.1:53957]
>>>>>>>> [defaultEventExecutorGroup-4-1] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
>>>>>>>> - AS_REQ ISSUE: authtime 1493991123792,drankye@TEST.COM for
>>>>>>>> krbtgt/ TEST.COM@TEST.COM [main] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClien
>>>>>>>> t
>>>>>>>> - Send to kdc success.
>>>>>>>> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
>>>>>>>> Storing the tgt to the credential cache file.
>>>>>>>> [nioEventLoopGroup-5-1] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
>>>>>>>> - The preauth data is empty.
>>>>>>>> [nioEventLoopGroup-5-1] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
>>>>>>>> - KRB error occurred while processing request:Additional
>>>>>>>> pre-authentication required [nioEventLoopGroup-5-1] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
>>>>>>>> - AS_REQ ISSUE: authtime
>>>>>>>> 1493991123859,test-service/localhost@TEST.COM
>>>>>>>> for krbtgt/TEST.COM@TEST.COM
>>>>>>>> [nioEventLoopGroup-5-1] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.TgsRequest
>>>>>>>> - TGS_REQ ISSUE: authtime 1493991142850,drankye for test-service/
>>>>>>>> localhost@TEST.COM
>>>>>>>>
>>>>>>>> Thanks
>>>>>>>> Jiajia
>>>>>>>>
>>>>>>>> -----Original Message-----
>>>>>>>> From: Zheng, Kai
>>>>>>>> Sent: Friday, May 5, 2017 7:46 PM
>>>>>>>> To: kerby@directory.apache.org; Li, Jiajia <ji...@intel.com>
>>>>>>>> Subject: RE: MIT Kerberos compatibility
>>>>>>>>
>>>>>>>> Hi Marc,
>>>>>>>>
>>>>>>>> Looks like this is quite environment related, could you fire an
>>>>>>>> issue for this? I would suggest we target it to 1.1.0, which can
>>>>>>>> be done in
>>>>>>> June.
>>>>>>>>
>>>>>>>> Regards,
>>>>>>>> Kai
>>>>>>>>
>>>>>>>> -----Original Message-----
>>>>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
>>>>>>>> Sent: Friday, May 05, 2017 4:44 PM
>>>>>>>> To: Li, Jiajia <ji...@intel.com>
>>>>>>>> Cc: kerby@directory.apache.org
>>>>>>>> Subject: Re: MIT Kerberos compatibility
>>>>>>>>
>>>>>>>> Hi Jiajia,
>>>>>>>>
>>>>>>>> Great to read that you made progress on this issue and to see a
>>>>>>>> working config at your side. Below, I list my progress below (with
>>>>>>>> trunk merged into my MitIssue branch), but I am afraid we are not
>>>>>>>> done
>>>>>>> yet.
>>>>>>>>
>>>>>>>> Things that stand out:
>>>>>>>>
>>>>>>>> - the kdc decoding error is solved, relative to the logs without
>>>>>>>> your patch
>>>>>>>>
>>>>>>>> - your KRB5 tracing looks quite different. What OS and
>>>>>>>> mit-kerberos version did you use?
>>>>>>>>
>>>>>>>> - your KRB5 tracing shows UDP comms between kerberos client and
>>>>>>>> KDC, despite the allowUDP = false setting in my test. I did this
>>>>>>>> setting because I get different problems without it, see the
>>>>>>>> additional logs below. So, we must also be aware of networking
>>>>> problems at my side.
>>>>>>>>
>>>>>>>> - the "Response was not from master KDC" msg is not relevant; it
>>>>>>>> disappears if you manually add master_kdc to the realms section of
>>>>>>>> the krb5.conf
>>>>>>>>
>>>>>>>> I have no idea how to proceed from here, so that is why I just
>>>>>>>> document the status at my side and ask about your - apparently
>>>>>>>> working -
>>>>>>> config.
>>>>>>>>
>>>>>>>> Cheers, Marc
>>>>>>>>
>>>>>>>>
>>>>>>>> KDC logging with allowUDP = false:
>>>>>>>>
>>>>>>>> [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
>>>>>>>> [pool-1-thread-1] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
>>>>>> ISSUE:
>>>>>>>> authtime 1493970789075,drankye@TEST.COM for
>>>>>>>> krbtgt/TEST.COM@TEST.COM [main] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClien
>>>>>>>> t
>>>>>>>> - Send to kdc success.
>>>>>>>> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
>>>>>>>> Storing the tgt to the credential cache file.
>>>>>>>> [pool-1-thread-1] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The
>>>>>>>> preauth data is empty.
>>>>>>>> [pool-1-thread-1] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
>>>>>>>> - KRB error occurred while processing request:Additional
>>>>>>>> pre-authentication required [pool-1-thread-1] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
>>>>>> ISSUE:
>>>>>>>> authtime 1493970789108,test-service/localhost@TEST.COM for krbtgt/
>>>>>>>> TEST.COM@TEST.COM [pool-1-thread-1] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
>>>>>>>> - Found fast padata and starting to process it.
>>>>>>>> [pool-1-thread-1] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found
>>>>>>>> fast padata and starting to process it.
>>>>>>>>
>>>>>>>> Python script KRB5 tracing (MIT Kerberos 1.13.2 of Ubuntu Xenial)
>>>>>>>> with allowUDP = false:
>>>>>>>>
>>>>>>>> $ .
>>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/
>>>>>>>> kerberos/kerb/server/MitIssueTest.sh
>>>>>>>> [25281] 1493970797.298753: Retrieving drankye@TEST.COM from
>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>>> result:
>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>>> [25281]
>>>>>>>> 1493970797.298952: Retrieving drankye@TEST.COM from
>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>>> result:
>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>>> [25281]
>>>>>>>> 1493970797.299106: Retrieving drankye@TEST.COM from
>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>>> result:
>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>>> [25281]
>>>>>>>> 1493970797.299213: Retrieving drankye@TEST.COM from
>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>>> result:
>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>>> [25281]
>>>>>>>> 1493970797.299323: Retrieving drankye@TEST.COM from
>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>>> result:
>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>>> [25281]
>>>>>>>> 1493970797.299436: Retrieving drankye@TEST.COM from
>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>>> result:
>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>>> [25281]
>>>>>>>> 1493970797.299545: Retrieving drankye@TEST.COM from
>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>>> result:
>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>>> [25281]
>>>>>>>> 1493970797.299654: Retrieving drankye@TEST.COM from
>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>>> result:
>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>>> kerberos.authGSSClientInit successful [25281] 1493970797.299922:
>>>>>>>> Getting credentials drankye@TEST.COM -> test-service/localhost@
>>>>>>>> using ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>> [25281] 1493970797.299945: Retrieving drankye@TEST.COM ->
>>>>>>>> test-service/localhost@ from
>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>> with result:
>>>>>>>> -1765328243/Matching credential not found [25281] 1493970797.299959:
>>>>>>>> Retrying drankye@TEST.COM -> test-service/localhost@TEST.COM with
>>>>>>> result:
>>>>>>>> -1765328243/Matching credential not found [25281] 1493970797.299962:
>>>>>>>> Server has referral realm; starting with
>>>>>>>> test-service/localhost@TEST.COM [25281]
>>>>>>>> 1493970797.299975: Retrieving drankye@TEST.COM ->
>>>>>>>> krbtgt/TEST.COM@TEST.COM from
>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>> with result:
>>>>>>>> 0/Success [25281] 1493970797.299979: Starting with TGT for client
>>>>>> realm:
>>>>>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [25281]
>>>>>> 1493970797.299981:
>>>>>>>> Requesting tickets for test-service/localhost@TEST.COM, referrals
>>>>>>>> on [25281] 1493970797.299994: Generated subkey for TGS request:
>>>>>>>> aes128-cts/1B9B [25281] 1493970797.300009: etypes requested in TGS
>>>>>>> request:
>>>>>>>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
>>>>>>>> camellia256-cts [25281] 1493970797.300054: Encoding request body
>>>>>>>> and padata into FAST request [25281] 1493970797.300080: Sending
>>>>>>>> request
>>>>>>>> (823 bytes) to TEST.COM [25281] 1493970797.300091: Resolving
>>>>>>>> hostname localhost [25281]
>>>>>>>> 1493970797.300136: Initiating TCP connection to stream
>>>>>>>> 127.0.0.1:34319
>>>>>>>> [25281] 1493970797.300191: Sending TCP request to stream
>>>>>>>> 127.0.0.1:34319 [25281] 1493970797.303610: Received answer (125
>>>>>>>> bytes) from stream
>>>>>>>> 127.0.0.1:34319
>>>>>>>> [25281] 1493970797.303618: Terminating TCP connection to stream
>>>>>>>> 127.0.0.1:34319
>>>>>>>> [25281] 1493970797.553126: Response was not from master KDC
>>>>>>>> [25281]
>>>>>>>> 1493970797.553198: TGS request result: -1765323383/Unknown code
>>>>>>>> krcM
>>>>>>>> 137 [25281] 1493970797.553234: Requesting tickets for
>>>>>>>> test-service/ localhost@TEST.COM, referrals off [25281]
>>>>> 1493970797.553273:
>>>>>>>> Generated subkey for TGS request: aes128-cts/94C6 [25281]
>>>>>> 1493970797.553323:
>>>>>>>> etypes requested in TGS request: aes256-cts, aes128-cts,
>>>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts [25281]
>>>>>>>> 1493970797.553436: Encoding request body and padata into FAST
>>>>>>>> request
>>>>>>> [25281] 1493970797.553532:
>>>>>>>> Sending request (823 bytes) to TEST.COM [25281] 1493970797.553567:
>>>>>>>> Resolving hostname localhost [25281] 1493970797.553745: Initiating
>>>>>>>> TCP connection to stream
>>>>>>>> 127.0.0.1:34319
>>>>>>>> [25281] 1493970797.553889: Sending TCP request to stream
>>>>>>>> 127.0.0.1:34319 [25281] 1493970797.558297: Received answer (125
>>>>>>>> bytes) from stream
>>>>>>>> 127.0.0.1:34319
>>>>>>>> [25281] 1493970797.558318: Terminating TCP connection to stream
>>>>>>>> 127.0.0.1:34319
>>>>>>>> [25281] 1493970797.561189: Response was not from master KDC
>>>>>>>> [25281]
>>>>>>>> 1493970797.561258: TGS request result: -1765323383/Unknown code
>>>>>>>> krcM
>>>>>>>> 137 ('First kerberos.authGSSClientStep not successful',
>>>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide more
>>>>>>>> information', 851968), ('Unknown code krcM 137', -1765323383)))
>>>>>>>>
>>>>>>>>
>>>>>>>> KDC logging with allowUDP = true:
>>>>>>>>
>>>>>>>> [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
>>>>>>>> [pool-1-thread-1] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
>>>>>> ISSUE:
>>>>>>>> authtime 1493972505784,drankye@TEST.COM for
>>>>>>>> krbtgt/TEST.COM@TEST.COM [main] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClien
>>>>>>>> t
>>>>>>>> - Send to kdc success.
>>>>>>>> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
>>>>>>>> Storing the tgt to the credential cache file.
>>>>>>>> [pool-1-thread-1] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The
>>>>>>>> preauth data is empty.
>>>>>>>> [pool-1-thread-1] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
>>>>>>>> - KRB error occurred while processing request:Additional
>>>>>>>> pre-authentication required [pool-1-thread-2] INFO
>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
>>>>>> ISSUE:
>>>>>>>> authtime 1493972505948,test-service/localhost@TEST.COM for krbtgt/
>>>>>>>> TEST.COM@TEST.COM Exception in thread "Thread-0"
>>>>>>>> java.lang.RuntimeException: Error occured while checking udp
>>>>>> connections
>>>>>>>> at
>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
>>>>>>>> KdcNetwork.java:105)
>>>>>>>> at
>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
>>>>>>>> access$000(KdcNetwork.java:39)
>>>>>>>> at
>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
>>>>>>>> run(KdcNetwork.java:75)
>>>>>>>> at java.lang.Thread.run(Thread.java:748)
>>>>>>>> Caused by: java.nio.channels.ClosedChannelException
>>>>>>>> at
>>>>>>>> sun.nio.ch.DatagramChannelImpl.ensureOpen(
>>>>>> DatagramChannelImpl.java:320)
>>>>>>>> at sun.nio.ch.DatagramChannelImpl.receive(
>>>>>>>> DatagramChannelImpl.java:331)
>>>>>>>> at
>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
>>>>>>>> checkUdpMessage(KdcNetwork.java:132)
>>>>>>>> at
>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
>>>>>>>> KdcNetwork.java:101)
>>>>>>>> ... 3 more
>>>>>>>>
>>>>>>>>
>>>>>>>> krb5.conf:
>>>>>>>>
>>>>>>>> [libdefaults]
>>>>>>>> kdc_realm = TEST.COM
>>>>>>>> default_realm = TEST.COM
>>>>>>>> udp_preference_limit = 4096
>>>>>>>> kdc_tcp_port = 37080
>>>>>>>> kdc_udp_port = 36525
>>>>>>>>
>>>>>>>> [realms]
>>>>>>>> TEST.COM = {
>>>>>>>> kdc = localhost:36525
>>>>>>>> }
>>>>>>>>
>>>>>>>> And port 36525 does not show up in `netstat -l` (while 37080 does)
>>>>>>>>
>>>>>>>>
>>>>>>>> Op 04-05-17 om 14:55 schreef Li, Jiajia:
>>>>>>>>> Hi Marc,
>>>>>>>>> I try to run your test(through applying your patch in the trunk)
>>>>>>>>> , I
>>>>>>>> think it's success now. Could you take some time to check about it?
>>>>>>>>> Here is the log:
>>>>>>>>>
>>>>>>>>> directory-kerby git:(trunk) ? .
>>>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos
>>>>>>>>> /k
>>>>>>>>> er
>>>>>>>>> b/
>>>>>>>>> server/MitIssueTest.sh
>>>>>>>>> kerberos.authGSSClientInit successful
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: entypes not
>>>>>>>>> supported
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>>>>> credential for krb5_ccache_conf_data/realm-config@X-CACHECONF:
>>>>>>>>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>>>>> credential for test-service/localhost@TEST.COM in cache
>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>>>>> credential for
>>>>>>>>> krb5_ccache_conf_data/negative-cache/test-service\134/localhost\
>>>>>>>>> 13
>>>>>>>>> 4@
>>>>>>>>> TE
>>>>>>>>> ST.COM@X-CACHECONF: in cache
>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>>>>> credential for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF:
>>>>>>>>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>>>>> credential for krb5_ccache_conf_data/sitename@X-CACHECONF: in
>>>>>>>>> cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>>>>> credential for test-service/localhost@TEST.COM in cache
>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>>>>>>>> des-cbc-md5-deprecated not supported
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>>>>>>>> des-cbc-md4-deprecated not supported
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>>>>>>>> des-cbc-crc-deprecated not supported
>>>>>>>>> 2017-05-04T20:44:06 Trying to find service kdc for realm
>>>>>>>>> TEST.COM flags 0
>>>>>>>>> 2017-05-04T20:44:06 configuration file for realm TEST.COM found
>>>>>>>>> 2017-05-04T20:44:06 submissing new requests to new host
>>>>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
>>>>>>>>> 2017-05-04T20:44:06 connecting to host: udp ::1:52534
>>>>>>>>> (localhost)
>>>>>> tid:
>>>>>>>>> 00000001
>>>>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
>>>>>>>>> 2017-05-04T20:44:06 Queuing host in future (in 3s), its the 2
>>>>>>>>> address on the same name: udp 127.0.0.1:52534 (localhost) tid:
>>>>>>>>> 00000002
>>>>>>>>> 2017-05-04T20:44:06 writing packet: udp ::1:52534 (localhost) tid:
>>>>>>>>> 00000001
>>>>>>>>> 2017-05-04T20:44:06 reading packet: udp ::1:52534 (localhost) tid:
>>>>>>>>> 00000001
>>>>>>>>> 2017-05-04T20:44:06 host completed: udp ::1:52534 (localhost) tid:
>>>>>>>>> 00000001
>>>>>>>>> 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0 hosts 1
>>>>>>>>> packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814 tid: 00000002
>>>>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/763641F3
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328353: Decrypt integrity
>>>>>>>>> check failed for checksum type hmac-sha1-96-aes128, key type
>>>>>>>>> aes128-cts-hmac-sha1-96
>>>>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
>>>>>>>>> 2017-05-04T20:44:06 krb5_get_credentials_with_flags: TEST.COM wc:
>>>>>>>>> 0.050317
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>>>>> credential for krb5_ccache_conf_data/realm-config@X-CACHECONF:
>>>>>>>>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>>>>> credential for
>>>>>>>>> krb5_ccache_conf_data/time-offset/test-service\134/
>>>>>> localhost\134@TEST.
>>>>>>>>> COM@X-CACHECONF: in cache
>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>>> 2017-05-04T20:44:06 Setting up PFS for auth context
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>>>>>>>> des-cbc-md5-deprecated not supported
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>>>>>>>> des-cbc-md4-deprecated not supported
>>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>>>>>>>> des-cbc-crc-deprecated not supported First
>>>>>>>>> kerberos.authGSSClientStep successful
>>>>>>>>>
>>>>>>>>> Thanks
>>>>>>>>> Jiajia
>>>>>>>>>
>>>>>>>>> -----Original Message-----
>>>>>>>>> From: Zheng, Kai [mailto:kai.zheng@intel.com]
>>>>>>>>> Sent: Wednesday, May 3, 2017 7:29 PM
>>>>>>>>> To: kerby@directory.apache.org
>>>>>>>>> Subject: RE: MIT Kerberos compatibility
>>>>>>>>>
>>>>>>>>> Hi Marc,
>>>>>>>>>
>>>>>>>>> In case you're not aware of this, please check out the latest
>>>>>>>>> fix made
>>>>>>>> by Jiajia. We thought your case may be different, but would be
>>>>>>>> good to have a check before we can repeat/fix your case. Thanks.
>>>>>>>>> https://issues.apache.org/jira/browse/DIRKRB-625
>>>>>>>>>
>>>>>>>>> Regards,
>>>>>>>>> Kai
>>>>>>>>>
>>>>>>>>> -----Original Message-----
>>>>>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
>>>>>>>>> Sent: Sunday, April 30, 2017 7:45 PM
>>>>>>>>> To: kerby@directory.apache.org
>>>>>>>>> Subject: Re: MIT Kerberos compatibility
>>>>>>>>>
>>>>>>>>> Hi Kai,
>>>>>>>>>
>>>>>>>>> The terminal output below is for the latest MIT Kerberos 1.15.1
>>>>>>>>> (locally
>>>>>>>> built on Ubuntu Xenial). Before that, I also tested with the
>>>>>>>> default Xenial MIT Kerberos packages (1.13.2), with the same
>>>>>>>> result. I did not try earlier MIT Kerberos versions.
>>>>>>>>>
>>>>>>>>> Marc
>>>>>>>>>
>>>>>>>>> Op 29-04-17 om 21:42 schreef Marc de Lignie:
>>>>>>>>>> Hi Kai,
>>>>>>>>>>
>>>>>>>>>> Thanks for the response. I prepared a minimal config that
>>>>>>>>>> reproduces my problem.
>>>>>>>>>>
>>>>>>>>>> You can fetch the branch/commit from:
>>>>>>>>>> https://github.com/vtslab/directory-kerby/commits/MitIssue
>>>>>>>>>>
>>>>>>>>>> This is relative to RC2, but I also tried this on trunk for my
>>>>>>>>>> actual project.
>>>>>>>>>>
>>>>>>>>>> This config produces the debug and error messages below.
>>>>>>>>>>
>>>>>>>>>> 1. For the terminal with the bash + python script $ klist
>>>>>>>>>> Ticket
>>>>>>>>>> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>>>> Default principal: drankye@TEST.COM
>>>>>>>>>>
>>>>>>>>>> Valid starting Expires Service principal
>>>>>>>>>> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> renew until 29-04-17 21:07:39
>>>>>>>>>>
>>>>>>>>>> $ .
>>>>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerbero
>>>>>>>>>> s/ ke rb / server/MitIssueTest.sh [15538] 1493491231.917606:
>>>>>>>>>> Retrieving drankye@TEST.COM from
>>>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>>>>>>>> result:
>>>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>>>>> [15538]
>>>>>>>>>> 1493491231.917827: Retrieving drankye@TEST.COM from
>>>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>>>>> result:
>>>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>>>>> kerberos.authGSSClientInit successful [15538] 1493491231.918185:
>>>>>>>>>> Getting credentials drankye@TEST.COM -> test-service/localhost@
>>>>>>>>>> using ccache
>>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>>>> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
>>>>>>>>>> test-service/localhost@ from
>>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>>>>>>>>>> -1765328243/Matching credential not found (filename:
>>>>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
>>>>>>>>>> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
>>>>>>>>>> test-service/localhost@TEST.COM with result:
>>>>>>>>>> -1765328243/Matching credential not found (filename:
>>>>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
>>>>>>>>>> [15538] 1493491231.918229: Server has referral realm; starting
>>>>>>>>>> with test-service/localhost@TEST.COM [15538] 1493491231.918278:
>>>>>>>>>> Retrieving drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM from
>>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>>>>>>>>>> 0/Success
>>>>>>>>>> [15538] 1493491231.918281: Starting with TGT for client realm:
>>>>>>>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
>>>>>>>>>> 1493491231.918301: Requesting tickets for
>>>>>>>>>> test-service/localhost@TEST.COM, referrals on [15538]
>>>>>>>>>> 1493491231.918326: Generated subkey for TGS request:
>>>>>>>>>> aes128-cts/FA30
>>>>>>>>>> [15538] 1493491231.918359: etypes requested in TGS request:
>>>>>>>>>> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2,
>>>>>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
>>>>>>>>>> [15538]
>>>>>> 1493491231.918484:
>>>>>>>>>> Encoding request body and padata into FAST request [15538]
>>>>>>>>>> 1493491231.918541: Sending request (836 bytes) to TEST.COM
>>>>>>>>>> [15538]
>>>>>>>>>> 1493491231.918597: Resolving hostname localhost [15538]
>>>>>>>>>> 1493491231.918703: Initiating TCP connection to stream
>>>>>>>>>> 127.0.0.1:44292
>>>>>>>>>> [15538] 1493491231.918777: Sending TCP request to stream
>>>>>>>>>> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error receiving
>>>>>>>>>> from stream
>>>>>>>>>> 127.0.0.1:44292: 104/Connection reset by peer [15538]
>>>>>>>>>> 1493491231.922812: Terminating TCP connection to stream
>>>>>>>>>> 127.0.0.1:44292
>>>>>>>>>> [15538] 1493491231.922858: Sending initial UDP request to dgram
>>>>>>>>>> 127.0.0.1:44292
>>>>>>>>>> ('First kerberos.authGSSClientStep not successful',
>>>>>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide
>>>>>>>>>> more information', 851968), ("Cannot contact any KDC for realm
>>>>>>>>>> 'TEST.COM'",
>>>>>>>>>> -1765328228)))
>>>>>>>>>>
>>>>>>>>>> 2. For the terminal that runs mvn clean test
>>>>>>>>>> -Dtest=MitIssueTest Running
>>>>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
>>>>>>>>>> 2017-04-29 21:07:39,182 DEBUG [main] backend.
>>>>>> AbstractIdentityBackend:
>>>>>>>>>> initialize called
>>>>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
>>>>>> AbstractIdentityBackend:
>>>>>>>>>> getIdentity called, principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
>>>>>> AbstractIdentityBackend:
>>>>>>>>>> getIdentity failed, principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
>>>>>> AbstractIdentityBackend:
>>>>>>>>>> addIdentity successful, principalName =
>>>>>>>>>> krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
>>>>>> AbstractIdentityBackend:
>>>>>>>>>> getIdentity called, principalName = kadmin/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
>>>>>> AbstractIdentityBackend:
>>>>>>>>>> getIdentity failed, principalName = kadmin/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,213 DEBUG [main] backend.
>>>>>> AbstractIdentityBackend:
>>>>>>>>>> addIdentity successful, principalName =
>>>>>>>>>> kadmin/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,216 DEBUG [main] backend.
>>>>>> AbstractIdentityBackend:
>>>>>>>>>> start called
>>>>>>>>>> 2017-04-29 21:07:39,232 DEBUG [main] backend.
>>>>>> AbstractIdentityBackend:
>>>>>>>>>> addIdentity successful, principalName =
>>>>>>>>>> test-service/localhost@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,425 DEBUG [main] backend.
>>>>>> AbstractIdentityBackend:
>>>>>>>>>> addIdentity successful, principalName = drankye@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1]
>>>>> request.KdcRequest:
>>>>>>>>>> Client entry is empty.
>>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>>> principalName = drankye@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>>> principalName = drankye@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
>>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>>>>>>>>> disconnecting abnormally java.io.EOFException
>>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
>>>>>>>> receiveMessage(KrbTcpTransport.java:54)
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
>>>>>>>>>> n(
>>>>>>>> DefaultKdcHandler.java:46)
>>>>>>>>>> at
>>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>>>>>>>> ThreadPoolExecutor.java:1142)
>>>>>>>>>> at
>>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>>>>>>>> ThreadPoolExecutor.java:617)
>>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
>>>>>>>>>> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase:
>>>>>>>>>> Storing the tgt to the credential cache file.
>>>>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
>>>>>> AbstractIdentityBackend:
>>>>>>>>>> getIdentity called, principalName =
>>>>>>>>>> test-service/localhost@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
>>>>>> AbstractIdentityBackend:
>>>>>>>>>> getIdentity successful, principalName =
>>>>>>>>>> test-service/localhost@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1]
>>>>> request.KdcRequest:
>>>>>>>>>> Client entry is empty.
>>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>>> principalName = test-service/localhost@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>>> principalName = test-service/localhost@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1]
>>>>> request.KdcRequest:
>>>>>>>>>> The preauth data is empty.
>>>>>>>>>> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1] server.KdcHandler:
>>>>>>>>>> KRB error occurred while processing request:Additional
>>>>>>>>>> pre-authentication required
>>>>>>>>>> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
>>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>>>>>>>>> disconnecting abnormally java.io.EOFException
>>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
>>>>>>>> receiveMessage(KrbTcpTransport.java:54)
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
>>>>>>>>>> n(
>>>>>>>> DefaultKdcHandler.java:46)
>>>>>>>>>> at
>>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>>>>>>>> ThreadPoolExecutor.java:1142)
>>>>>>>>>> at
>>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>>>>>>>> ThreadPoolExecutor.java:617)
>>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
>>>>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1]
>>>>> request.KdcRequest:
>>>>>>>>>> Client entry is empty.
>>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>>> principalName = test-service/localhost@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>>> principalName = test-service/localhost@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
>>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>>>>>>>>> disconnecting abnormally java.io.EOFException
>>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
>>>>>>>> receiveMessage(KrbTcpTransport.java:54)
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
>>>>>>>>>> n(
>>>>>>>> DefaultKdcHandler.java:46)
>>>>>>>>>> at
>>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>>>>>>>> ThreadPoolExecutor.java:1142)
>>>>>>>>>> at
>>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>>>>>>>> ThreadPoolExecutor.java:617)
>>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
>>>>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
>>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>>> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1]
>>>>> request.KdcRequest:
>>>>>>>>>> Found fast padata and start to process it.
>>>>>>>>>> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
>>>>>>>>>> impl.DefaultKdcHandler: Error occured while processing request:
>>>>>>>>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
>>>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
>>>>>>>> java:85)
>>>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
>>>>>>>> java:70)
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFin
>>>>>>>>>> dF
>>>>>>>>>> as
>>>>>>>>>> t(
>>>>>>>> KdcRequest.java:208)
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.
>>>>>>>> KdcRequest.process(KdcRequest.java:168)
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
>>>>>>>> handleMessage(KdcHandler.java:115)
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
>>>>>>>> handleMessage(DefaultKdcHandler.java:67)
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
>>>>>>>>>> n(
>>>>>>>> DefaultKdcHandler.java:52)
>>>>>>>>>> at
>>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>>>>>>>> ThreadPoolExecutor.java:1142)
>>>>>>>>>> at
>>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>>>>>>>> ThreadPoolExecutor.java:617)
>>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
>>>>>>>>>> Caused by: java.io.IOException: Unexpected item context [0]
>>>>>>>>>> [tag=0xA0, off=0, len=3+207], expecting 0x30
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>>>>>>>> Asn1Encodeable.java:210)
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>>>>>>>> Asn1Encodeable.java:197)
>>>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
>>>>>>>> java:83)
>>>>>>>>>> ... 9 more
>>>>>>>>>> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
>>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>>>>>>>>> disconnecting abnormally
>>>>>>>>>> java.net.SocketException: Socket closed
>>>>>>>>>> at java.net.SocketInputStream.socketRead0(Native Method)
>>>>>>>>>> at java.net.SocketInputStream.socketRead(SocketInputStream.
>>>>>>>> java:116)
>>>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
>>>>> 171)
>>>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
>>>>> 141)
>>>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
>>>>> 224)
>>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:387)
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
>>>>>>>> receiveMessage(KrbTcpTransport.java:54)
>>>>>>>>>> at
>>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
>>>>>>>>>> n(
>>>>>>>> DefaultKdcHandler.java:46)
>>>>>>>>>> at
>>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>>>>>>>> ThreadPoolExecutor.java:1142)
>>>>>>>>>> at
>>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>>>>>>>> ThreadPoolExecutor.java:617)
>>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
>>>>>>>>>>
>>>>>>>>>> In a FreeIPA environment these python lines "just" work.
>>>>>>>>>>
>>>>>>>>>> Any suggestions are welcome!
>>>>>>>>>>
>>>>>>>>>> Marc
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>> --
>>>>>>>>> Marc de Lignie
>>>>>>>>>
>>>>>>>>
>>>>>>>> --
>>>>>>>> Marc de Lignie
>>>>>>>>
>>>>>>>>
>>>>>>>
>>>>>>>
>>>>>>> --
>>>>>>> Colm O hEigeartaigh
>>>>>>>
>>>>>>> Talend Community Coder
>>>>>>> http://coders.talend.com
>>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>> --
>>>>>> Colm O hEigeartaigh
>>>>>>
>>>>>> Talend Community Coder
>>>>>> http://coders.talend.com
>>>>>>
>>>>>
>>>>>
>>>>>
>>>>> --
>>>>> Colm O hEigeartaigh
>>>>>
>>>>> Talend Community Coder
>>>>> http://coders.talend.com
>>>>>
>>>>
>>>>
>>>>
>>>> --
>>>> Colm O hEigeartaigh
>>>>
>>>> Talend Community Coder
>>>> http://coders.talend.com
>>>
>>>
>>
>>
>> --
>> Colm O hEigeartaigh
>>
>> Talend Community Coder
>> http://coders.talend.com
Re: MIT Kerberos compatibility
Posted by "Zheng, Kai" <ka...@intel.com>.
Thanks colm for the clarification and it sounds an issue we need to address. I will investigate it soon.
Sent from iPhone
> 在 2017年5月6日，上午2:14，Colm O hEigeartaigh <co...@apache.org> 写道：
>
> Hi Kai,
>
> If I enable UDP with the default Transport, I can get a ticket fine using
> kinit. However then the following error pops up in the window I'm running
> Kerby in (as a test):
>
> Exception in thread "Thread-1" java.lang.RuntimeException: Error occured
> while checking udp connections
> at
> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(KdcNetwork.java:105)
> at
> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.access$000(KdcNetwork.java:39)
> at
> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.run(KdcNetwork.java:75)
> at java.lang.Thread.run(Thread.java:748)
> Caused by: java.nio.channels.ClosedChannelException
> at
> sun.nio.ch.DatagramChannelImpl.ensureOpen(DatagramChannelImpl.java:320)
> at sun.nio.ch.DatagramChannelImpl.receive(DatagramChannelImpl.java:331)
> at
> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.checkUdpMessage(KdcNetwork.java:132)
> at
> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(KdcNetwork.java:101)
>
> Colm.
>
>
>> On Fri, May 5, 2017 at 5:56 PM, Zheng, Kai <ka...@intel.com> wrote:
>>
>> Colm, did you see udp problem now instead? I'm a little confused. Udp is
>> sure supported but may not be enabled by default, which should be okay,
>> imo. Thanks.
>>
>> Sent from iPhone
>>
>>> 在 2017年5月6日，上午12:02，Colm O hEigeartaigh <co...@apache.org> 写道：
>>>
>>> That's probably it. Why does the default transport not support UDP in
>> Kerby?
>>>
>>> Colm.
>>>
>>>> On Fri, May 5, 2017 at 4:54 PM, Li, Jiajia <ji...@intel.com> wrote:
>>>>
>>>> Are you sure add kdc_allow_udp = false in kdc.conf?
>>>>
>>>> Thanks
>>>> Jiajia
>>>>
>>>> -----Original Message-----
>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
>>>> Sent: Friday, May 5, 2017 11:41 PM
>>>> To: Li, Jiajia <ji...@intel.com>
>>>> Cc: kerby@directory.apache.org; Zheng, Kai <ka...@intel.com>;
>> mailto:
>>>> m.c.delignie@xs4all.nl <m....@xs4all.nl>
>>>> Subject: Re: MIT Kerberos compatibility
>>>>
>>>> Sorry, it was my error, UDP was actually enabled there. But why am I
>> still
>>>> seeing that error message?
>>>>
>>>> Colm.
>>>>
>>>>> On Fri, May 5, 2017 at 4:39 PM, Li, Jiajia <ji...@intel.com>
>> wrote:
>>>>>
>>>>> Hi Colm,
>>>>> I also test the Kerby KDC with kerby kint and MIT kinit, and only
>>>>> listen the tcp port(disable udp), both got ticket successfully. But I
>>>>> don't get the error message. Both krb.conf and kdc.conf should set udp
>>>>> to be false, udp is enabled in default.
>>>>>
>>>>> Thanks
>>>>> Jiajia
>>>>>
>>>>> -----Original Message-----
>>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
>>>>> Sent: Friday, May 5, 2017 11:34 PM
>>>>> To: kerby@directory.apache.org
>>>>> Cc: Zheng, Kai <ka...@intel.com>; mailto:m.c.delignie@xs4all.nl <
>>>>> m.c.delignie@xs4all.nl>
>>>>> Subject: Re: MIT Kerberos compatibility
>>>>>
>>>>> Hi Jiajia,
>>>>>
>>>>> If UDP is disabled and we don't use Netty, I can get a token
>>>>> successfully via kinit. However I then see an error message in the
>> Kerby
>>>> console:
>>>>>
>>>>> Exception in thread "Thread-1" java.lang.RuntimeException: Error
>>>>> occured while checking udp connections
>>>>> at
>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
>>>>> KdcNetwork.java:105)
>>>>> at
>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
>>>>> access$000(KdcNetwork.java:39)
>>>>> at
>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
>>>>> run(KdcNetwork.java:75)
>>>>> at java.lang.Thread.run(Thread.java:748)
>>>>> Caused by: java.nio.channels.ClosedChannelException
>>>>> at
>>>>> sun.nio.ch.DatagramChannelImpl.ensureOpen(
>> DatagramChannelImpl.java:320)
>>>>> at sun.nio.ch.DatagramChannelImpl.receive(
>>>>> DatagramChannelImpl.java:331)
>>>>> at
>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
>>>>> checkUdpMessage(KdcNetwork.java:132)
>>>>> at
>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
>>>>> KdcNetwork.java:101)
>>>>>
>>>>> I'm not sure why we are seeing UDP errors when it's disabled?
>>>>>
>>>>> Colm.
>>>>>
>>>>>> On Fri, May 5, 2017 at 3:57 PM, Li, Jiajia <ji...@intel.com>
>> wrote:
>>>>>>
>>>>>> Hi Colm,
>>>>>> The shell client can't connect to kdc if the UDP is disabled.
>>>>>> We don't use Netty in default.
>>>>>> What's your test-cases? The same as the Marc's?
>>>>>>
>>>>>> Thanks
>>>>>> Jiajia
>>>>>>
>>>>>> -----Original Message-----
>>>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
>>>>>> Sent: Friday, May 5, 2017 10:09 PM
>>>>>> To: kerby@directory.apache.org
>>>>>> Cc: Zheng, Kai <ka...@intel.com>; mailto:m.c.delignie@xs4all.nl
>>>>>> < m.c.delignie@xs4all.nl>
>>>>>> Subject: Re: MIT Kerberos compatibility
>>>>>>
>>>>>> Hi Jiajia,
>>>>>>
>>>>>> What are the issues if UDP is disabled and we don't use Netty? I
>>>>>> tried doing this with my own test-cases and it didn't work, so it
>>>>>> would be good to get this fixed soon.
>>>>>>
>>>>>> Colm.
>>>>>>
>>>>>> On Fri, May 5, 2017 at 2:46 PM, Li, Jiajia <ji...@intel.com>
>>>> wrote:
>>>>>>
>>>>>>> Hi Marc,
>>>>>>>>>> - your KRB5 tracing looks quite different. What OS and
>>>>>>>>>> mit-kerberos
>>>>>>> version did you use?
>>>>>>> I use mac os and the python version is 2.7.10
>>>>>>>
>>>>>>>>>> - your KRB5 tracing shows UDP comms between kerberos client and
>>>>>>>>>> KDC,
>>>>>>> despite the allowUDP = false setting
>>>>>>>>>> in my test. I did this setting because I get different
>>>>>>>>>> problems
>>>>>>> without it, see the additional logs below. So,
>>>>>>>>>> we must also be aware of networking problems at my side.
>>>>>>> I enable the UDP and use netty network, there are some issues if
>>>>>>> UDP disabled, you can create a JIRA for this and we can fix this
>>>>>>> issue in the next release version.
>>>>>>>
>>>>>>> The changes in my side as following:
>>>>>>>
>>>>>>> protected boolean allowUdp() {
>>>>>>> return true;
>>>>>>> }
>>>>>>> @Override
>>>>>>> protected void prepareKdc() throws KrbException {
>>>>>>> getKdcServer().setInnerKdcImpl(
>>>>>>> new NettyKdcServerImpl(getKdcServer().getKdcSetting()));
>>>>>>> super.prepareKdc();
>>>>>>> }
>>>>>>>
>>>>>>> Here is log of MitIssueTest:
>>>>>>> [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
>>>>>>> [nioEventLoopGroup-2-1] INFO
>>>>>>> io.netty.handler.logging.LoggingHandler
>>>>>>> -
>>>>>>> [id: 0x2634fe6b] REGISTERED
>>>>>>> [nioEventLoopGroup-2-1] INFO
>>>>>>> io.netty.handler.logging.LoggingHandler
>>>>>>> -
>>>>>>> [id: 0x2634fe6b] BIND(0.0.0.0/0.0.0.0:53957)
>>>>>>> [nioEventLoopGroup-2-1] INFO
>>>>>>> io.netty.handler.logging.LoggingHandler -
>>>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] ACTIVE [main] INFO
>>>>>>> org.apache.kerby.kerberos.kdc.impl.NettyKdcServerImpl - Netty kdc
>>>>>>> server started.
>>>>>>> [nioEventLoopGroup-2-1] INFO
>>>>>>> io.netty.handler.logging.LoggingHandler
>>>>>>> -
>>>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] RECEIVED: [id:
>>>>>>> 0xdac7228b, /
>>>>>>> 127.0.0.1:53961 => /127.0.0.1:53957]
>>>>>>> [defaultEventExecutorGroup-4-1] INFO
>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
>>>>>>> - AS_REQ ISSUE: authtime 1493991123792,drankye@TEST.COM for
>>>>>>> krbtgt/ TEST.COM@TEST.COM [main] INFO
>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClien
>>>>>>> t
>>>>>>> - Send to kdc success.
>>>>>>> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
>>>>>>> Storing the tgt to the credential cache file.
>>>>>>> [nioEventLoopGroup-5-1] INFO
>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
>>>>>>> - The preauth data is empty.
>>>>>>> [nioEventLoopGroup-5-1] INFO
>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
>>>>>>> - KRB error occurred while processing request:Additional
>>>>>>> pre-authentication required [nioEventLoopGroup-5-1] INFO
>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
>>>>>>> - AS_REQ ISSUE: authtime
>>>>>>> 1493991123859,test-service/localhost@TEST.COM
>>>>>>> for krbtgt/TEST.COM@TEST.COM
>>>>>>> [nioEventLoopGroup-5-1] INFO
>>>>>>> org.apache.kerby.kerberos.kerb.server.request.TgsRequest
>>>>>>> - TGS_REQ ISSUE: authtime 1493991142850,drankye for test-service/
>>>>>>> localhost@TEST.COM
>>>>>>>
>>>>>>> Thanks
>>>>>>> Jiajia
>>>>>>>
>>>>>>> -----Original Message-----
>>>>>>> From: Zheng, Kai
>>>>>>> Sent: Friday, May 5, 2017 7:46 PM
>>>>>>> To: kerby@directory.apache.org; Li, Jiajia <ji...@intel.com>
>>>>>>> Subject: RE: MIT Kerberos compatibility
>>>>>>>
>>>>>>> Hi Marc,
>>>>>>>
>>>>>>> Looks like this is quite environment related, could you fire an
>>>>>>> issue for this? I would suggest we target it to 1.1.0, which can
>>>>>>> be done in
>>>>>> June.
>>>>>>>
>>>>>>> Regards,
>>>>>>> Kai
>>>>>>>
>>>>>>> -----Original Message-----
>>>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
>>>>>>> Sent: Friday, May 05, 2017 4:44 PM
>>>>>>> To: Li, Jiajia <ji...@intel.com>
>>>>>>> Cc: kerby@directory.apache.org
>>>>>>> Subject: Re: MIT Kerberos compatibility
>>>>>>>
>>>>>>> Hi Jiajia,
>>>>>>>
>>>>>>> Great to read that you made progress on this issue and to see a
>>>>>>> working config at your side. Below, I list my progress below (with
>>>>>>> trunk merged into my MitIssue branch), but I am afraid we are not
>>>>>>> done
>>>>>> yet.
>>>>>>>
>>>>>>> Things that stand out:
>>>>>>>
>>>>>>> - the kdc decoding error is solved, relative to the logs without
>>>>>>> your patch
>>>>>>>
>>>>>>> - your KRB5 tracing looks quite different. What OS and
>>>>>>> mit-kerberos version did you use?
>>>>>>>
>>>>>>> - your KRB5 tracing shows UDP comms between kerberos client and
>>>>>>> KDC, despite the allowUDP = false setting in my test. I did this
>>>>>>> setting because I get different problems without it, see the
>>>>>>> additional logs below. So, we must also be aware of networking
>>>> problems at my side.
>>>>>>>
>>>>>>> - the "Response was not from master KDC" msg is not relevant; it
>>>>>>> disappears if you manually add master_kdc to the realms section of
>>>>>>> the krb5.conf
>>>>>>>
>>>>>>> I have no idea how to proceed from here, so that is why I just
>>>>>>> document the status at my side and ask about your - apparently
>>>>>>> working -
>>>>>> config.
>>>>>>>
>>>>>>> Cheers, Marc
>>>>>>>
>>>>>>>
>>>>>>> KDC logging with allowUDP = false:
>>>>>>>
>>>>>>> [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
>>>>>>> [pool-1-thread-1] INFO
>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
>>>>> ISSUE:
>>>>>>> authtime 1493970789075,drankye@TEST.COM for
>>>>>>> krbtgt/TEST.COM@TEST.COM [main] INFO
>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClien
>>>>>>> t
>>>>>>> - Send to kdc success.
>>>>>>> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
>>>>>>> Storing the tgt to the credential cache file.
>>>>>>> [pool-1-thread-1] INFO
>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The
>>>>>>> preauth data is empty.
>>>>>>> [pool-1-thread-1] INFO
>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
>>>>>>> - KRB error occurred while processing request:Additional
>>>>>>> pre-authentication required [pool-1-thread-1] INFO
>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
>>>>> ISSUE:
>>>>>>> authtime 1493970789108,test-service/localhost@TEST.COM for krbtgt/
>>>>>>> TEST.COM@TEST.COM [pool-1-thread-1] INFO
>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
>>>>>>> - Found fast padata and starting to process it.
>>>>>>> [pool-1-thread-1] INFO
>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found
>>>>>>> fast padata and starting to process it.
>>>>>>>
>>>>>>> Python script KRB5 tracing (MIT Kerberos 1.13.2 of Ubuntu Xenial)
>>>>>>> with allowUDP = false:
>>>>>>>
>>>>>>> $ .
>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/
>>>>>>> kerberos/kerb/server/MitIssueTest.sh
>>>>>>> [25281] 1493970797.298753: Retrieving drankye@TEST.COM from
>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>> result:
>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>> [25281]
>>>>>>> 1493970797.298952: Retrieving drankye@TEST.COM from
>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>> result:
>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>> [25281]
>>>>>>> 1493970797.299106: Retrieving drankye@TEST.COM from
>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>> result:
>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>> [25281]
>>>>>>> 1493970797.299213: Retrieving drankye@TEST.COM from
>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>> result:
>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>> [25281]
>>>>>>> 1493970797.299323: Retrieving drankye@TEST.COM from
>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>> result:
>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>> [25281]
>>>>>>> 1493970797.299436: Retrieving drankye@TEST.COM from
>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>> result:
>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>> [25281]
>>>>>>> 1493970797.299545: Retrieving drankye@TEST.COM from
>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>> result:
>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>> [25281]
>>>>>>> 1493970797.299654: Retrieving drankye@TEST.COM from
>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>> result:
>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>> kerberos.authGSSClientInit successful [25281] 1493970797.299922:
>>>>>>> Getting credentials drankye@TEST.COM -> test-service/localhost@
>>>>>>> using ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>> [25281] 1493970797.299945: Retrieving drankye@TEST.COM ->
>>>>>>> test-service/localhost@ from
>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>> with result:
>>>>>>> -1765328243/Matching credential not found [25281] 1493970797.299959:
>>>>>>> Retrying drankye@TEST.COM -> test-service/localhost@TEST.COM with
>>>>>> result:
>>>>>>> -1765328243/Matching credential not found [25281] 1493970797.299962:
>>>>>>> Server has referral realm; starting with
>>>>>>> test-service/localhost@TEST.COM [25281]
>>>>>>> 1493970797.299975: Retrieving drankye@TEST.COM ->
>>>>>>> krbtgt/TEST.COM@TEST.COM from
>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>> with result:
>>>>>>> 0/Success [25281] 1493970797.299979: Starting with TGT for client
>>>>> realm:
>>>>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [25281]
>>>>> 1493970797.299981:
>>>>>>> Requesting tickets for test-service/localhost@TEST.COM, referrals
>>>>>>> on [25281] 1493970797.299994: Generated subkey for TGS request:
>>>>>>> aes128-cts/1B9B [25281] 1493970797.300009: etypes requested in TGS
>>>>>> request:
>>>>>>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
>>>>>>> camellia256-cts [25281] 1493970797.300054: Encoding request body
>>>>>>> and padata into FAST request [25281] 1493970797.300080: Sending
>>>>>>> request
>>>>>>> (823 bytes) to TEST.COM [25281] 1493970797.300091: Resolving
>>>>>>> hostname localhost [25281]
>>>>>>> 1493970797.300136: Initiating TCP connection to stream
>>>>>>> 127.0.0.1:34319
>>>>>>> [25281] 1493970797.300191: Sending TCP request to stream
>>>>>>> 127.0.0.1:34319 [25281] 1493970797.303610: Received answer (125
>>>>>>> bytes) from stream
>>>>>>> 127.0.0.1:34319
>>>>>>> [25281] 1493970797.303618: Terminating TCP connection to stream
>>>>>>> 127.0.0.1:34319
>>>>>>> [25281] 1493970797.553126: Response was not from master KDC
>>>>>>> [25281]
>>>>>>> 1493970797.553198: TGS request result: -1765323383/Unknown code
>>>>>>> krcM
>>>>>>> 137 [25281] 1493970797.553234: Requesting tickets for
>>>>>>> test-service/ localhost@TEST.COM, referrals off [25281]
>>>> 1493970797.553273:
>>>>>>> Generated subkey for TGS request: aes128-cts/94C6 [25281]
>>>>> 1493970797.553323:
>>>>>>> etypes requested in TGS request: aes256-cts, aes128-cts,
>>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts [25281]
>>>>>>> 1493970797.553436: Encoding request body and padata into FAST
>>>>>>> request
>>>>>> [25281] 1493970797.553532:
>>>>>>> Sending request (823 bytes) to TEST.COM [25281] 1493970797.553567:
>>>>>>> Resolving hostname localhost [25281] 1493970797.553745: Initiating
>>>>>>> TCP connection to stream
>>>>>>> 127.0.0.1:34319
>>>>>>> [25281] 1493970797.553889: Sending TCP request to stream
>>>>>>> 127.0.0.1:34319 [25281] 1493970797.558297: Received answer (125
>>>>>>> bytes) from stream
>>>>>>> 127.0.0.1:34319
>>>>>>> [25281] 1493970797.558318: Terminating TCP connection to stream
>>>>>>> 127.0.0.1:34319
>>>>>>> [25281] 1493970797.561189: Response was not from master KDC
>>>>>>> [25281]
>>>>>>> 1493970797.561258: TGS request result: -1765323383/Unknown code
>>>>>>> krcM
>>>>>>> 137 ('First kerberos.authGSSClientStep not successful',
>>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide more
>>>>>>> information', 851968), ('Unknown code krcM 137', -1765323383)))
>>>>>>>
>>>>>>>
>>>>>>> KDC logging with allowUDP = true:
>>>>>>>
>>>>>>> [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
>>>>>>> [pool-1-thread-1] INFO
>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
>>>>> ISSUE:
>>>>>>> authtime 1493972505784,drankye@TEST.COM for
>>>>>>> krbtgt/TEST.COM@TEST.COM [main] INFO
>>>>>>> org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClien
>>>>>>> t
>>>>>>> - Send to kdc success.
>>>>>>> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
>>>>>>> Storing the tgt to the credential cache file.
>>>>>>> [pool-1-thread-1] INFO
>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The
>>>>>>> preauth data is empty.
>>>>>>> [pool-1-thread-1] INFO
>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
>>>>>>> - KRB error occurred while processing request:Additional
>>>>>>> pre-authentication required [pool-1-thread-2] INFO
>>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
>>>>> ISSUE:
>>>>>>> authtime 1493972505948,test-service/localhost@TEST.COM for krbtgt/
>>>>>>> TEST.COM@TEST.COM Exception in thread "Thread-0"
>>>>>>> java.lang.RuntimeException: Error occured while checking udp
>>>>> connections
>>>>>>> at
>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
>>>>>>> KdcNetwork.java:105)
>>>>>>> at
>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
>>>>>>> access$000(KdcNetwork.java:39)
>>>>>>> at
>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
>>>>>>> run(KdcNetwork.java:75)
>>>>>>> at java.lang.Thread.run(Thread.java:748)
>>>>>>> Caused by: java.nio.channels.ClosedChannelException
>>>>>>> at
>>>>>>> sun.nio.ch.DatagramChannelImpl.ensureOpen(
>>>>> DatagramChannelImpl.java:320)
>>>>>>> at sun.nio.ch.DatagramChannelImpl.receive(
>>>>>>> DatagramChannelImpl.java:331)
>>>>>>> at
>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
>>>>>>> checkUdpMessage(KdcNetwork.java:132)
>>>>>>> at
>>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
>>>>>>> KdcNetwork.java:101)
>>>>>>> ... 3 more
>>>>>>>
>>>>>>>
>>>>>>> krb5.conf:
>>>>>>>
>>>>>>> [libdefaults]
>>>>>>> kdc_realm = TEST.COM
>>>>>>> default_realm = TEST.COM
>>>>>>> udp_preference_limit = 4096
>>>>>>> kdc_tcp_port = 37080
>>>>>>> kdc_udp_port = 36525
>>>>>>>
>>>>>>> [realms]
>>>>>>> TEST.COM = {
>>>>>>> kdc = localhost:36525
>>>>>>> }
>>>>>>>
>>>>>>> And port 36525 does not show up in `netstat -l` (while 37080 does)
>>>>>>>
>>>>>>>
>>>>>>> Op 04-05-17 om 14:55 schreef Li, Jiajia:
>>>>>>>> Hi Marc,
>>>>>>>> I try to run your test(through applying your patch in the trunk)
>>>>>>>> , I
>>>>>>> think it's success now. Could you take some time to check about it?
>>>>>>>> Here is the log:
>>>>>>>>
>>>>>>>> directory-kerby git:(trunk) ? .
>>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos
>>>>>>>> /k
>>>>>>>> er
>>>>>>>> b/
>>>>>>>> server/MitIssueTest.sh
>>>>>>>> kerberos.authGSSClientInit successful
>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: entypes not
>>>>>>>> supported
>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>>>> credential for krb5_ccache_conf_data/realm-config@X-CACHECONF:
>>>>>>>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>>>> credential for test-service/localhost@TEST.COM in cache
>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>>>> credential for
>>>>>>>> krb5_ccache_conf_data/negative-cache/test-service\134/localhost\
>>>>>>>> 13
>>>>>>>> 4@
>>>>>>>> TE
>>>>>>>> ST.COM@X-CACHECONF: in cache
>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>>>> credential for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF:
>>>>>>>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>>>> credential for krb5_ccache_conf_data/sitename@X-CACHECONF: in
>>>>>>>> cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>>>> credential for test-service/localhost@TEST.COM in cache
>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>>>>>>> des-cbc-md5-deprecated not supported
>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>>>>>>> des-cbc-md4-deprecated not supported
>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>>>>>>> des-cbc-crc-deprecated not supported
>>>>>>>> 2017-05-04T20:44:06 Trying to find service kdc for realm
>>>>>>>> TEST.COM flags 0
>>>>>>>> 2017-05-04T20:44:06 configuration file for realm TEST.COM found
>>>>>>>> 2017-05-04T20:44:06 submissing new requests to new host
>>>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
>>>>>>>> 2017-05-04T20:44:06 connecting to host: udp ::1:52534
>>>>>>>> (localhost)
>>>>> tid:
>>>>>>>> 00000001
>>>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
>>>>>>>> 2017-05-04T20:44:06 Queuing host in future (in 3s), its the 2
>>>>>>>> address on the same name: udp 127.0.0.1:52534 (localhost) tid:
>>>>>>>> 00000002
>>>>>>>> 2017-05-04T20:44:06 writing packet: udp ::1:52534 (localhost) tid:
>>>>>>>> 00000001
>>>>>>>> 2017-05-04T20:44:06 reading packet: udp ::1:52534 (localhost) tid:
>>>>>>>> 00000001
>>>>>>>> 2017-05-04T20:44:06 host completed: udp ::1:52534 (localhost) tid:
>>>>>>>> 00000001
>>>>>>>> 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0 hosts 1
>>>>>>>> packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814 tid: 00000002
>>>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/763641F3
>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328353: Decrypt integrity
>>>>>>>> check failed for checksum type hmac-sha1-96-aes128, key type
>>>>>>>> aes128-cts-hmac-sha1-96
>>>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
>>>>>>>> 2017-05-04T20:44:06 krb5_get_credentials_with_flags: TEST.COM wc:
>>>>>>>> 0.050317
>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>>>> credential for krb5_ccache_conf_data/realm-config@X-CACHECONF:
>>>>>>>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>>>> credential for
>>>>>>>> krb5_ccache_conf_data/time-offset/test-service\134/
>>>>> localhost\134@TEST.
>>>>>>>> COM@X-CACHECONF: in cache
>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>> 2017-05-04T20:44:06 Setting up PFS for auth context
>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>>>>>>> des-cbc-md5-deprecated not supported
>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>>>>>>> des-cbc-md4-deprecated not supported
>>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>>>>>>> des-cbc-crc-deprecated not supported First
>>>>>>>> kerberos.authGSSClientStep successful
>>>>>>>>
>>>>>>>> Thanks
>>>>>>>> Jiajia
>>>>>>>>
>>>>>>>> -----Original Message-----
>>>>>>>> From: Zheng, Kai [mailto:kai.zheng@intel.com]
>>>>>>>> Sent: Wednesday, May 3, 2017 7:29 PM
>>>>>>>> To: kerby@directory.apache.org
>>>>>>>> Subject: RE: MIT Kerberos compatibility
>>>>>>>>
>>>>>>>> Hi Marc,
>>>>>>>>
>>>>>>>> In case you're not aware of this, please check out the latest
>>>>>>>> fix made
>>>>>>> by Jiajia. We thought your case may be different, but would be
>>>>>>> good to have a check before we can repeat/fix your case. Thanks.
>>>>>>>> https://issues.apache.org/jira/browse/DIRKRB-625
>>>>>>>>
>>>>>>>> Regards,
>>>>>>>> Kai
>>>>>>>>
>>>>>>>> -----Original Message-----
>>>>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
>>>>>>>> Sent: Sunday, April 30, 2017 7:45 PM
>>>>>>>> To: kerby@directory.apache.org
>>>>>>>> Subject: Re: MIT Kerberos compatibility
>>>>>>>>
>>>>>>>> Hi Kai,
>>>>>>>>
>>>>>>>> The terminal output below is for the latest MIT Kerberos 1.15.1
>>>>>>>> (locally
>>>>>>> built on Ubuntu Xenial). Before that, I also tested with the
>>>>>>> default Xenial MIT Kerberos packages (1.13.2), with the same
>>>>>>> result. I did not try earlier MIT Kerberos versions.
>>>>>>>>
>>>>>>>> Marc
>>>>>>>>
>>>>>>>> Op 29-04-17 om 21:42 schreef Marc de Lignie:
>>>>>>>>> Hi Kai,
>>>>>>>>>
>>>>>>>>> Thanks for the response. I prepared a minimal config that
>>>>>>>>> reproduces my problem.
>>>>>>>>>
>>>>>>>>> You can fetch the branch/commit from:
>>>>>>>>> https://github.com/vtslab/directory-kerby/commits/MitIssue
>>>>>>>>>
>>>>>>>>> This is relative to RC2, but I also tried this on trunk for my
>>>>>>>>> actual project.
>>>>>>>>>
>>>>>>>>> This config produces the debug and error messages below.
>>>>>>>>>
>>>>>>>>> 1. For the terminal with the bash + python script $ klist
>>>>>>>>> Ticket
>>>>>>>>> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>>> Default principal: drankye@TEST.COM
>>>>>>>>>
>>>>>>>>> Valid starting Expires Service principal
>>>>>>>>> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/TEST.COM@TEST.COM
>>>>>>>>> renew until 29-04-17 21:07:39
>>>>>>>>>
>>>>>>>>> $ .
>>>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerbero
>>>>>>>>> s/ ke rb / server/MitIssueTest.sh [15538] 1493491231.917606:
>>>>>>>>> Retrieving drankye@TEST.COM from
>>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>>>>>>> result:
>>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>>>> [15538]
>>>>>>>>> 1493491231.917827: Retrieving drankye@TEST.COM from
>>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>>>> result:
>>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>>>> kerberos.authGSSClientInit successful [15538] 1493491231.918185:
>>>>>>>>> Getting credentials drankye@TEST.COM -> test-service/localhost@
>>>>>>>>> using ccache
>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>>>> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
>>>>>>>>> test-service/localhost@ from
>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>>>>>>>>> -1765328243/Matching credential not found (filename:
>>>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
>>>>>>>>> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
>>>>>>>>> test-service/localhost@TEST.COM with result:
>>>>>>>>> -1765328243/Matching credential not found (filename:
>>>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
>>>>>>>>> [15538] 1493491231.918229: Server has referral realm; starting
>>>>>>>>> with test-service/localhost@TEST.COM [15538] 1493491231.918278:
>>>>>>>>> Retrieving drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM from
>>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>>>>>>>>> 0/Success
>>>>>>>>> [15538] 1493491231.918281: Starting with TGT for client realm:
>>>>>>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
>>>>>>>>> 1493491231.918301: Requesting tickets for
>>>>>>>>> test-service/localhost@TEST.COM, referrals on [15538]
>>>>>>>>> 1493491231.918326: Generated subkey for TGS request:
>>>>>>>>> aes128-cts/FA30
>>>>>>>>> [15538] 1493491231.918359: etypes requested in TGS request:
>>>>>>>>> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2,
>>>>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
>>>>>>>>> [15538]
>>>>> 1493491231.918484:
>>>>>>>>> Encoding request body and padata into FAST request [15538]
>>>>>>>>> 1493491231.918541: Sending request (836 bytes) to TEST.COM
>>>>>>>>> [15538]
>>>>>>>>> 1493491231.918597: Resolving hostname localhost [15538]
>>>>>>>>> 1493491231.918703: Initiating TCP connection to stream
>>>>>>>>> 127.0.0.1:44292
>>>>>>>>> [15538] 1493491231.918777: Sending TCP request to stream
>>>>>>>>> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error receiving
>>>>>>>>> from stream
>>>>>>>>> 127.0.0.1:44292: 104/Connection reset by peer [15538]
>>>>>>>>> 1493491231.922812: Terminating TCP connection to stream
>>>>>>>>> 127.0.0.1:44292
>>>>>>>>> [15538] 1493491231.922858: Sending initial UDP request to dgram
>>>>>>>>> 127.0.0.1:44292
>>>>>>>>> ('First kerberos.authGSSClientStep not successful',
>>>>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide
>>>>>>>>> more information', 851968), ("Cannot contact any KDC for realm
>>>>>>>>> 'TEST.COM'",
>>>>>>>>> -1765328228)))
>>>>>>>>>
>>>>>>>>> 2. For the terminal that runs mvn clean test
>>>>>>>>> -Dtest=MitIssueTest Running
>>>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
>>>>>>>>> 2017-04-29 21:07:39,182 DEBUG [main] backend.
>>>>> AbstractIdentityBackend:
>>>>>>>>> initialize called
>>>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
>>>>> AbstractIdentityBackend:
>>>>>>>>> getIdentity called, principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
>>>>> AbstractIdentityBackend:
>>>>>>>>> getIdentity failed, principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
>>>>> AbstractIdentityBackend:
>>>>>>>>> addIdentity successful, principalName =
>>>>>>>>> krbtgt/TEST.COM@TEST.COM
>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
>>>>> AbstractIdentityBackend:
>>>>>>>>> getIdentity called, principalName = kadmin/TEST.COM@TEST.COM
>>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
>>>>> AbstractIdentityBackend:
>>>>>>>>> getIdentity failed, principalName = kadmin/TEST.COM@TEST.COM
>>>>>>>>> 2017-04-29 21:07:39,213 DEBUG [main] backend.
>>>>> AbstractIdentityBackend:
>>>>>>>>> addIdentity successful, principalName =
>>>>>>>>> kadmin/TEST.COM@TEST.COM
>>>>>>>>> 2017-04-29 21:07:39,216 DEBUG [main] backend.
>>>>> AbstractIdentityBackend:
>>>>>>>>> start called
>>>>>>>>> 2017-04-29 21:07:39,232 DEBUG [main] backend.
>>>>> AbstractIdentityBackend:
>>>>>>>>> addIdentity successful, principalName =
>>>>>>>>> test-service/localhost@TEST.COM
>>>>>>>>> 2017-04-29 21:07:39,425 DEBUG [main] backend.
>>>>> AbstractIdentityBackend:
>>>>>>>>> addIdentity successful, principalName = drankye@TEST.COM
>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1]
>>>> request.KdcRequest:
>>>>>>>>> Client entry is empty.
>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>> principalName = drankye@TEST.COM
>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>> principalName = drankye@TEST.COM
>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>>>>>>>> disconnecting abnormally java.io.EOFException
>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>>>>>>>>> at
>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
>>>>>>> receiveMessage(KrbTcpTransport.java:54)
>>>>>>>>> at
>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
>>>>>>>>> n(
>>>>>>> DefaultKdcHandler.java:46)
>>>>>>>>> at
>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>>>>>>> ThreadPoolExecutor.java:1142)
>>>>>>>>> at
>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>>>>>>> ThreadPoolExecutor.java:617)
>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
>>>>>>>>> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase:
>>>>>>>>> Storing the tgt to the credential cache file.
>>>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
>>>>> AbstractIdentityBackend:
>>>>>>>>> getIdentity called, principalName =
>>>>>>>>> test-service/localhost@TEST.COM
>>>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
>>>>> AbstractIdentityBackend:
>>>>>>>>> getIdentity successful, principalName =
>>>>>>>>> test-service/localhost@TEST.COM
>>>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1]
>>>> request.KdcRequest:
>>>>>>>>> Client entry is empty.
>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>> principalName = test-service/localhost@TEST.COM
>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>> principalName = test-service/localhost@TEST.COM
>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1]
>>>> request.KdcRequest:
>>>>>>>>> The preauth data is empty.
>>>>>>>>> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1] server.KdcHandler:
>>>>>>>>> KRB error occurred while processing request:Additional
>>>>>>>>> pre-authentication required
>>>>>>>>> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>>>>>>>> disconnecting abnormally java.io.EOFException
>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>>>>>>>>> at
>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
>>>>>>> receiveMessage(KrbTcpTransport.java:54)
>>>>>>>>> at
>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
>>>>>>>>> n(
>>>>>>> DefaultKdcHandler.java:46)
>>>>>>>>> at
>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>>>>>>> ThreadPoolExecutor.java:1142)
>>>>>>>>> at
>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>>>>>>> ThreadPoolExecutor.java:617)
>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
>>>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1]
>>>> request.KdcRequest:
>>>>>>>>> Client entry is empty.
>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>> principalName = test-service/localhost@TEST.COM
>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>> principalName = test-service/localhost@TEST.COM
>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>>>>>>>> disconnecting abnormally java.io.EOFException
>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>>>>>>>>> at
>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
>>>>>>> receiveMessage(KrbTcpTransport.java:54)
>>>>>>>>> at
>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
>>>>>>>>> n(
>>>>>>> DefaultKdcHandler.java:46)
>>>>>>>>> at
>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>>>>>>> ThreadPoolExecutor.java:1142)
>>>>>>>>> at
>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>>>>>>> ThreadPoolExecutor.java:617)
>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
>>>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
>>>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
>>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>>>> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1]
>>>> request.KdcRequest:
>>>>>>>>> Found fast padata and start to process it.
>>>>>>>>> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
>>>>>>>>> impl.DefaultKdcHandler: Error occured while processing request:
>>>>>>>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
>>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
>>>>>>> java:85)
>>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
>>>>>>> java:70)
>>>>>>>>> at
>>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFin
>>>>>>>>> dF
>>>>>>>>> as
>>>>>>>>> t(
>>>>>>> KdcRequest.java:208)
>>>>>>>>> at
>>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.
>>>>>>> KdcRequest.process(KdcRequest.java:168)
>>>>>>>>> at
>>>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
>>>>>>> handleMessage(KdcHandler.java:115)
>>>>>>>>> at
>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
>>>>>>> handleMessage(DefaultKdcHandler.java:67)
>>>>>>>>> at
>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
>>>>>>>>> n(
>>>>>>> DefaultKdcHandler.java:52)
>>>>>>>>> at
>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>>>>>>> ThreadPoolExecutor.java:1142)
>>>>>>>>> at
>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>>>>>>> ThreadPoolExecutor.java:617)
>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
>>>>>>>>> Caused by: java.io.IOException: Unexpected item context [0]
>>>>>>>>> [tag=0xA0, off=0, len=3+207], expecting 0x30
>>>>>>>>> at
>>>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>>>>>>> Asn1Encodeable.java:210)
>>>>>>>>> at
>>>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>>>>>>> Asn1Encodeable.java:197)
>>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
>>>>>>> java:83)
>>>>>>>>> ... 9 more
>>>>>>>>> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
>>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>>>>>>>> disconnecting abnormally
>>>>>>>>> java.net.SocketException: Socket closed
>>>>>>>>> at java.net.SocketInputStream.socketRead0(Native Method)
>>>>>>>>> at java.net.SocketInputStream.socketRead(SocketInputStream.
>>>>>>> java:116)
>>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
>>>> 171)
>>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
>>>> 141)
>>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
>>>> 224)
>>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:387)
>>>>>>>>> at
>>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
>>>>>>> receiveMessage(KrbTcpTransport.java:54)
>>>>>>>>> at
>>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
>>>>>>>>> n(
>>>>>>> DefaultKdcHandler.java:46)
>>>>>>>>> at
>>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>>>>>>> ThreadPoolExecutor.java:1142)
>>>>>>>>> at
>>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>>>>>>> ThreadPoolExecutor.java:617)
>>>>>>>>> at java.lang.Thread.run(Thread.java:748)
>>>>>>>>>
>>>>>>>>> In a FreeIPA environment these python lines "just" work.
>>>>>>>>>
>>>>>>>>> Any suggestions are welcome!
>>>>>>>>>
>>>>>>>>> Marc
>>>>>>>>>
>>>>>>>>>
>>>>>>>> --
>>>>>>>> Marc de Lignie
>>>>>>>>
>>>>>>>
>>>>>>> --
>>>>>>> Marc de Lignie
>>>>>>>
>>>>>>>
>>>>>>
>>>>>>
>>>>>> --
>>>>>> Colm O hEigeartaigh
>>>>>>
>>>>>> Talend Community Coder
>>>>>> http://coders.talend.com
>>>>>>
>>>>>
>>>>>
>>>>>
>>>>> --
>>>>> Colm O hEigeartaigh
>>>>>
>>>>> Talend Community Coder
>>>>> http://coders.talend.com
>>>>>
>>>>
>>>>
>>>>
>>>> --
>>>> Colm O hEigeartaigh
>>>>
>>>> Talend Community Coder
>>>> http://coders.talend.com
>>>>
>>>
>>>
>>>
>>> --
>>> Colm O hEigeartaigh
>>>
>>> Talend Community Coder
>>> http://coders.talend.com
>>
>>
>
>
> --
> Colm O hEigeartaigh
>
> Talend Community Coder
> http://coders.talend.com
Re: MIT Kerberos compatibility
Posted by Colm O hEigeartaigh <co...@apache.org>.
Hi Kai,
If I enable UDP with the default Transport, I can get a ticket fine using
kinit. However then the following error pops up in the window I'm running
Kerby in (as a test):
Exception in thread "Thread-1" java.lang.RuntimeException: Error occured
while checking udp connections
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(KdcNetwork.java:105)
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork.access$000(KdcNetwork.java:39)
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.run(KdcNetwork.java:75)
at java.lang.Thread.run(Thread.java:748)
Caused by: java.nio.channels.ClosedChannelException
at
sun.nio.ch.DatagramChannelImpl.ensureOpen(DatagramChannelImpl.java:320)
at sun.nio.ch.DatagramChannelImpl.receive(DatagramChannelImpl.java:331)
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork.checkUdpMessage(KdcNetwork.java:132)
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(KdcNetwork.java:101)
Colm.
On Fri, May 5, 2017 at 5:56 PM, Zheng, Kai <ka...@intel.com> wrote:
> Colm, did you see udp problem now instead? I'm a little confused. Udp is
> sure supported but may not be enabled by default, which should be okay,
> imo. Thanks.
>
> Sent from iPhone
>
> > 在 2017年5月6日，上午12:02，Colm O hEigeartaigh <co...@apache.org> 写道：
> >
> > That's probably it. Why does the default transport not support UDP in
> Kerby?
> >
> > Colm.
> >
> >> On Fri, May 5, 2017 at 4:54 PM, Li, Jiajia <ji...@intel.com> wrote:
> >>
> >> Are you sure add kdc_allow_udp = false in kdc.conf?
> >>
> >> Thanks
> >> Jiajia
> >>
> >> -----Original Message-----
> >> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> >> Sent: Friday, May 5, 2017 11:41 PM
> >> To: Li, Jiajia <ji...@intel.com>
> >> Cc: kerby@directory.apache.org; Zheng, Kai <ka...@intel.com>;
> mailto:
> >> m.c.delignie@xs4all.nl <m....@xs4all.nl>
> >> Subject: Re: MIT Kerberos compatibility
> >>
> >> Sorry, it was my error, UDP was actually enabled there. But why am I
> still
> >> seeing that error message?
> >>
> >> Colm.
> >>
> >>> On Fri, May 5, 2017 at 4:39 PM, Li, Jiajia <ji...@intel.com>
> wrote:
> >>>
> >>> Hi Colm,
> >>> I also test the Kerby KDC with kerby kint and MIT kinit, and only
> >>> listen the tcp port(disable udp), both got ticket successfully. But I
> >>> don't get the error message. Both krb.conf and kdc.conf should set udp
> >>> to be false, udp is enabled in default.
> >>>
> >>> Thanks
> >>> Jiajia
> >>>
> >>> -----Original Message-----
> >>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> >>> Sent: Friday, May 5, 2017 11:34 PM
> >>> To: kerby@directory.apache.org
> >>> Cc: Zheng, Kai <ka...@intel.com>; mailto:m.c.delignie@xs4all.nl <
> >>> m.c.delignie@xs4all.nl>
> >>> Subject: Re: MIT Kerberos compatibility
> >>>
> >>> Hi Jiajia,
> >>>
> >>> If UDP is disabled and we don't use Netty, I can get a token
> >>> successfully via kinit. However I then see an error message in the
> Kerby
> >> console:
> >>>
> >>> Exception in thread "Thread-1" java.lang.RuntimeException: Error
> >>> occured while checking udp connections
> >>> at
> >>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> >>> KdcNetwork.java:105)
> >>> at
> >>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> >>> access$000(KdcNetwork.java:39)
> >>> at
> >>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> >>> run(KdcNetwork.java:75)
> >>> at java.lang.Thread.run(Thread.java:748)
> >>> Caused by: java.nio.channels.ClosedChannelException
> >>> at
> >>> sun.nio.ch.DatagramChannelImpl.ensureOpen(
> DatagramChannelImpl.java:320)
> >>> at sun.nio.ch.DatagramChannelImpl.receive(
> >>> DatagramChannelImpl.java:331)
> >>> at
> >>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> >>> checkUdpMessage(KdcNetwork.java:132)
> >>> at
> >>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> >>> KdcNetwork.java:101)
> >>>
> >>> I'm not sure why we are seeing UDP errors when it's disabled?
> >>>
> >>> Colm.
> >>>
> >>>> On Fri, May 5, 2017 at 3:57 PM, Li, Jiajia <ji...@intel.com>
> wrote:
> >>>>
> >>>> Hi Colm,
> >>>> The shell client can't connect to kdc if the UDP is disabled.
> >>>> We don't use Netty in default.
> >>>> What's your test-cases? The same as the Marc's?
> >>>>
> >>>> Thanks
> >>>> Jiajia
> >>>>
> >>>> -----Original Message-----
> >>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> >>>> Sent: Friday, May 5, 2017 10:09 PM
> >>>> To: kerby@directory.apache.org
> >>>> Cc: Zheng, Kai <ka...@intel.com>; mailto:m.c.delignie@xs4all.nl
> >>>> < m.c.delignie@xs4all.nl>
> >>>> Subject: Re: MIT Kerberos compatibility
> >>>>
> >>>> Hi Jiajia,
> >>>>
> >>>> What are the issues if UDP is disabled and we don't use Netty? I
> >>>> tried doing this with my own test-cases and it didn't work, so it
> >>>> would be good to get this fixed soon.
> >>>>
> >>>> Colm.
> >>>>
> >>>> On Fri, May 5, 2017 at 2:46 PM, Li, Jiajia <ji...@intel.com>
> >> wrote:
> >>>>
> >>>>> Hi Marc,
> >>>>>>>> - your KRB5 tracing looks quite different. What OS and
> >>>>>>>> mit-kerberos
> >>>>> version did you use?
> >>>>> I use mac os and the python version is 2.7.10
> >>>>>
> >>>>>>>> - your KRB5 tracing shows UDP comms between kerberos client and
> >>>>>>>> KDC,
> >>>>> despite the allowUDP = false setting
> >>>>>>>> in my test. I did this setting because I get different
> >>>>>>>> problems
> >>>>> without it, see the additional logs below. So,
> >>>>>>>> we must also be aware of networking problems at my side.
> >>>>> I enable the UDP and use netty network, there are some issues if
> >>>>> UDP disabled, you can create a JIRA for this and we can fix this
> >>>>> issue in the next release version.
> >>>>>
> >>>>> The changes in my side as following:
> >>>>>
> >>>>> protected boolean allowUdp() {
> >>>>> return true;
> >>>>> }
> >>>>> @Override
> >>>>> protected void prepareKdc() throws KrbException {
> >>>>> getKdcServer().setInnerKdcImpl(
> >>>>> new NettyKdcServerImpl(getKdcServer().getKdcSetting()));
> >>>>> super.prepareKdc();
> >>>>> }
> >>>>>
> >>>>> Here is log of MitIssueTest:
> >>>>> [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> >>>>> [nioEventLoopGroup-2-1] INFO
> >>>>> io.netty.handler.logging.LoggingHandler
> >>>>> -
> >>>>> [id: 0x2634fe6b] REGISTERED
> >>>>> [nioEventLoopGroup-2-1] INFO
> >>>>> io.netty.handler.logging.LoggingHandler
> >>>>> -
> >>>>> [id: 0x2634fe6b] BIND(0.0.0.0/0.0.0.0:53957)
> >>>>> [nioEventLoopGroup-2-1] INFO
> >>>>> io.netty.handler.logging.LoggingHandler -
> >>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] ACTIVE [main] INFO
> >>>>> org.apache.kerby.kerberos.kdc.impl.NettyKdcServerImpl - Netty kdc
> >>>>> server started.
> >>>>> [nioEventLoopGroup-2-1] INFO
> >>>>> io.netty.handler.logging.LoggingHandler
> >>>>> -
> >>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] RECEIVED: [id:
> >>>>> 0xdac7228b, /
> >>>>> 127.0.0.1:53961 => /127.0.0.1:53957]
> >>>>> [defaultEventExecutorGroup-4-1] INFO
> >>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
> >>>>> - AS_REQ ISSUE: authtime 1493991123792,drankye@TEST.COM for
> >>>>> krbtgt/ TEST.COM@TEST.COM [main] INFO
> >>>>> org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClien
> >>>>> t
> >>>>> - Send to kdc success.
> >>>>> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
> >>>>> Storing the tgt to the credential cache file.
> >>>>> [nioEventLoopGroup-5-1] INFO
> >>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> >>>>> - The preauth data is empty.
> >>>>> [nioEventLoopGroup-5-1] INFO
> >>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> >>>>> - KRB error occurred while processing request:Additional
> >>>>> pre-authentication required [nioEventLoopGroup-5-1] INFO
> >>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
> >>>>> - AS_REQ ISSUE: authtime
> >>>>> 1493991123859,test-service/localhost@TEST.COM
> >>>>> for krbtgt/TEST.COM@TEST.COM
> >>>>> [nioEventLoopGroup-5-1] INFO
> >>>>> org.apache.kerby.kerberos.kerb.server.request.TgsRequest
> >>>>> - TGS_REQ ISSUE: authtime 1493991142850,drankye for test-service/
> >>>>> localhost@TEST.COM
> >>>>>
> >>>>> Thanks
> >>>>> Jiajia
> >>>>>
> >>>>> -----Original Message-----
> >>>>> From: Zheng, Kai
> >>>>> Sent: Friday, May 5, 2017 7:46 PM
> >>>>> To: kerby@directory.apache.org; Li, Jiajia <ji...@intel.com>
> >>>>> Subject: RE: MIT Kerberos compatibility
> >>>>>
> >>>>> Hi Marc,
> >>>>>
> >>>>> Looks like this is quite environment related, could you fire an
> >>>>> issue for this? I would suggest we target it to 1.1.0, which can
> >>>>> be done in
> >>>> June.
> >>>>>
> >>>>> Regards,
> >>>>> Kai
> >>>>>
> >>>>> -----Original Message-----
> >>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> >>>>> Sent: Friday, May 05, 2017 4:44 PM
> >>>>> To: Li, Jiajia <ji...@intel.com>
> >>>>> Cc: kerby@directory.apache.org
> >>>>> Subject: Re: MIT Kerberos compatibility
> >>>>>
> >>>>> Hi Jiajia,
> >>>>>
> >>>>> Great to read that you made progress on this issue and to see a
> >>>>> working config at your side. Below, I list my progress below (with
> >>>>> trunk merged into my MitIssue branch), but I am afraid we are not
> >>>>> done
> >>>> yet.
> >>>>>
> >>>>> Things that stand out:
> >>>>>
> >>>>> - the kdc decoding error is solved, relative to the logs without
> >>>>> your patch
> >>>>>
> >>>>> - your KRB5 tracing looks quite different. What OS and
> >>>>> mit-kerberos version did you use?
> >>>>>
> >>>>> - your KRB5 tracing shows UDP comms between kerberos client and
> >>>>> KDC, despite the allowUDP = false setting in my test. I did this
> >>>>> setting because I get different problems without it, see the
> >>>>> additional logs below. So, we must also be aware of networking
> >> problems at my side.
> >>>>>
> >>>>> - the "Response was not from master KDC" msg is not relevant; it
> >>>>> disappears if you manually add master_kdc to the realms section of
> >>>>> the krb5.conf
> >>>>>
> >>>>> I have no idea how to proceed from here, so that is why I just
> >>>>> document the status at my side and ask about your - apparently
> >>>>> working -
> >>>> config.
> >>>>>
> >>>>> Cheers, Marc
> >>>>>
> >>>>>
> >>>>> KDC logging with allowUDP = false:
> >>>>>
> >>>>> [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> >>>>> [pool-1-thread-1] INFO
> >>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
> >>> ISSUE:
> >>>>> authtime 1493970789075,drankye@TEST.COM for
> >>>>> krbtgt/TEST.COM@TEST.COM [main] INFO
> >>>>> org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClien
> >>>>> t
> >>>>> - Send to kdc success.
> >>>>> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
> >>>>> Storing the tgt to the credential cache file.
> >>>>> [pool-1-thread-1] INFO
> >>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The
> >>>>> preauth data is empty.
> >>>>> [pool-1-thread-1] INFO
> >>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> >>>>> - KRB error occurred while processing request:Additional
> >>>>> pre-authentication required [pool-1-thread-1] INFO
> >>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
> >>> ISSUE:
> >>>>> authtime 1493970789108,test-service/localhost@TEST.COM for krbtgt/
> >>>>> TEST.COM@TEST.COM [pool-1-thread-1] INFO
> >>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> >>>>> - Found fast padata and starting to process it.
> >>>>> [pool-1-thread-1] INFO
> >>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found
> >>>>> fast padata and starting to process it.
> >>>>>
> >>>>> Python script KRB5 tracing (MIT Kerberos 1.13.2 of Ubuntu Xenial)
> >>>>> with allowUDP = false:
> >>>>>
> >>>>> $ .
> >>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/
> >>>>> kerberos/kerb/server/MitIssueTest.sh
> >>>>> [25281] 1493970797.298753: Retrieving drankye@TEST.COM from
> >>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> >> result:
> >>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> >>>>> [25281]
> >>>>> 1493970797.298952: Retrieving drankye@TEST.COM from
> >>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> >> result:
> >>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> >>>>> [25281]
> >>>>> 1493970797.299106: Retrieving drankye@TEST.COM from
> >>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> >> result:
> >>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> >>>>> [25281]
> >>>>> 1493970797.299213: Retrieving drankye@TEST.COM from
> >>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> >> result:
> >>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> >>>>> [25281]
> >>>>> 1493970797.299323: Retrieving drankye@TEST.COM from
> >>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> >> result:
> >>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> >>>>> [25281]
> >>>>> 1493970797.299436: Retrieving drankye@TEST.COM from
> >>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> >> result:
> >>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> >>>>> [25281]
> >>>>> 1493970797.299545: Retrieving drankye@TEST.COM from
> >>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> >> result:
> >>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> >>>>> [25281]
> >>>>> 1493970797.299654: Retrieving drankye@TEST.COM from
> >>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> >> result:
> >>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> >>>>> kerberos.authGSSClientInit successful [25281] 1493970797.299922:
> >>>>> Getting credentials drankye@TEST.COM -> test-service/localhost@
> >>>>> using ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>> [25281] 1493970797.299945: Retrieving drankye@TEST.COM ->
> >>>>> test-service/localhost@ from
> >>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>> with result:
> >>>>> -1765328243/Matching credential not found [25281] 1493970797.299959:
> >>>>> Retrying drankye@TEST.COM -> test-service/localhost@TEST.COM with
> >>>> result:
> >>>>> -1765328243/Matching credential not found [25281] 1493970797.299962:
> >>>>> Server has referral realm; starting with
> >>>>> test-service/localhost@TEST.COM [25281]
> >>>>> 1493970797.299975: Retrieving drankye@TEST.COM ->
> >>>>> krbtgt/TEST.COM@TEST.COM from
> >>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>> with result:
> >>>>> 0/Success [25281] 1493970797.299979: Starting with TGT for client
> >>> realm:
> >>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [25281]
> >>> 1493970797.299981:
> >>>>> Requesting tickets for test-service/localhost@TEST.COM, referrals
> >>>>> on [25281] 1493970797.299994: Generated subkey for TGS request:
> >>>>> aes128-cts/1B9B [25281] 1493970797.300009: etypes requested in TGS
> >>>> request:
> >>>>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
> >>>>> camellia256-cts [25281] 1493970797.300054: Encoding request body
> >>>>> and padata into FAST request [25281] 1493970797.300080: Sending
> >>>>> request
> >>>>> (823 bytes) to TEST.COM [25281] 1493970797.300091: Resolving
> >>>>> hostname localhost [25281]
> >>>>> 1493970797.300136: Initiating TCP connection to stream
> >>>>> 127.0.0.1:34319
> >>>>> [25281] 1493970797.300191: Sending TCP request to stream
> >>>>> 127.0.0.1:34319 [25281] 1493970797.303610: Received answer (125
> >>>>> bytes) from stream
> >>>>> 127.0.0.1:34319
> >>>>> [25281] 1493970797.303618: Terminating TCP connection to stream
> >>>>> 127.0.0.1:34319
> >>>>> [25281] 1493970797.553126: Response was not from master KDC
> >>>>> [25281]
> >>>>> 1493970797.553198: TGS request result: -1765323383/Unknown code
> >>>>> krcM
> >>>>> 137 [25281] 1493970797.553234: Requesting tickets for
> >>>>> test-service/ localhost@TEST.COM, referrals off [25281]
> >> 1493970797.553273:
> >>>>> Generated subkey for TGS request: aes128-cts/94C6 [25281]
> >>> 1493970797.553323:
> >>>>> etypes requested in TGS request: aes256-cts, aes128-cts,
> >>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts [25281]
> >>>>> 1493970797.553436: Encoding request body and padata into FAST
> >>>>> request
> >>>> [25281] 1493970797.553532:
> >>>>> Sending request (823 bytes) to TEST.COM [25281] 1493970797.553567:
> >>>>> Resolving hostname localhost [25281] 1493970797.553745: Initiating
> >>>>> TCP connection to stream
> >>>>> 127.0.0.1:34319
> >>>>> [25281] 1493970797.553889: Sending TCP request to stream
> >>>>> 127.0.0.1:34319 [25281] 1493970797.558297: Received answer (125
> >>>>> bytes) from stream
> >>>>> 127.0.0.1:34319
> >>>>> [25281] 1493970797.558318: Terminating TCP connection to stream
> >>>>> 127.0.0.1:34319
> >>>>> [25281] 1493970797.561189: Response was not from master KDC
> >>>>> [25281]
> >>>>> 1493970797.561258: TGS request result: -1765323383/Unknown code
> >>>>> krcM
> >>>>> 137 ('First kerberos.authGSSClientStep not successful',
> >>>>> GSSError(('Unspecified GSS failure. Minor code may provide more
> >>>>> information', 851968), ('Unknown code krcM 137', -1765323383)))
> >>>>>
> >>>>>
> >>>>> KDC logging with allowUDP = true:
> >>>>>
> >>>>> [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> >>>>> [pool-1-thread-1] INFO
> >>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
> >>> ISSUE:
> >>>>> authtime 1493972505784,drankye@TEST.COM for
> >>>>> krbtgt/TEST.COM@TEST.COM [main] INFO
> >>>>> org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClien
> >>>>> t
> >>>>> - Send to kdc success.
> >>>>> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
> >>>>> Storing the tgt to the credential cache file.
> >>>>> [pool-1-thread-1] INFO
> >>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The
> >>>>> preauth data is empty.
> >>>>> [pool-1-thread-1] INFO
> >>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
> >>>>> - KRB error occurred while processing request:Additional
> >>>>> pre-authentication required [pool-1-thread-2] INFO
> >>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
> >>> ISSUE:
> >>>>> authtime 1493972505948,test-service/localhost@TEST.COM for krbtgt/
> >>>>> TEST.COM@TEST.COM Exception in thread "Thread-0"
> >>>>> java.lang.RuntimeException: Error occured while checking udp
> >>> connections
> >>>>> at
> >>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> >>>>> KdcNetwork.java:105)
> >>>>> at
> >>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> >>>>> access$000(KdcNetwork.java:39)
> >>>>> at
> >>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> >>>>> run(KdcNetwork.java:75)
> >>>>> at java.lang.Thread.run(Thread.java:748)
> >>>>> Caused by: java.nio.channels.ClosedChannelException
> >>>>> at
> >>>>> sun.nio.ch.DatagramChannelImpl.ensureOpen(
> >>> DatagramChannelImpl.java:320)
> >>>>> at sun.nio.ch.DatagramChannelImpl.receive(
> >>>>> DatagramChannelImpl.java:331)
> >>>>> at
> >>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> >>>>> checkUdpMessage(KdcNetwork.java:132)
> >>>>> at
> >>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> >>>>> KdcNetwork.java:101)
> >>>>> ... 3 more
> >>>>>
> >>>>>
> >>>>> krb5.conf:
> >>>>>
> >>>>> [libdefaults]
> >>>>> kdc_realm = TEST.COM
> >>>>> default_realm = TEST.COM
> >>>>> udp_preference_limit = 4096
> >>>>> kdc_tcp_port = 37080
> >>>>> kdc_udp_port = 36525
> >>>>>
> >>>>> [realms]
> >>>>> TEST.COM = {
> >>>>> kdc = localhost:36525
> >>>>> }
> >>>>>
> >>>>> And port 36525 does not show up in `netstat -l` (while 37080 does)
> >>>>>
> >>>>>
> >>>>> Op 04-05-17 om 14:55 schreef Li, Jiajia:
> >>>>>> Hi Marc,
> >>>>>> I try to run your test(through applying your patch in the trunk)
> >>>>>> , I
> >>>>> think it's success now. Could you take some time to check about it?
> >>>>>> Here is the log:
> >>>>>>
> >>>>>> directory-kerby git:(trunk) ? .
> >>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos
> >>>>>> /k
> >>>>>> er
> >>>>>> b/
> >>>>>> server/MitIssueTest.sh
> >>>>>> kerberos.authGSSClientInit successful
> >>>>>> 2017-05-04T20:44:06 set-error: -1765328234: entypes not
> >>>>>> supported
> >>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> >>>>>> credential for krb5_ccache_conf_data/realm-config@X-CACHECONF:
> >>>>>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> >>>>>> credential for test-service/localhost@TEST.COM in cache
> >>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> >>>>>> credential for
> >>>>>> krb5_ccache_conf_data/negative-cache/test-service\134/localhost\
> >>>>>> 13
> >>>>>> 4@
> >>>>>> TE
> >>>>>> ST.COM@X-CACHECONF: in cache
> >>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> >>>>>> credential for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF:
> >>>>>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> >>>>>> credential for krb5_ccache_conf_data/sitename@X-CACHECONF: in
> >>>>>> cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> >>>>>> credential for test-service/localhost@TEST.COM in cache
> >>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> >>>>>> des-cbc-md5-deprecated not supported
> >>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> >>>>>> des-cbc-md4-deprecated not supported
> >>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> >>>>>> des-cbc-crc-deprecated not supported
> >>>>>> 2017-05-04T20:44:06 Trying to find service kdc for realm
> >>>>>> TEST.COM flags 0
> >>>>>> 2017-05-04T20:44:06 configuration file for realm TEST.COM found
> >>>>>> 2017-05-04T20:44:06 submissing new requests to new host
> >>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
> >>>>>> 2017-05-04T20:44:06 connecting to host: udp ::1:52534
> >>>>>> (localhost)
> >>> tid:
> >>>>>> 00000001
> >>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
> >>>>>> 2017-05-04T20:44:06 Queuing host in future (in 3s), its the 2
> >>>>>> address on the same name: udp 127.0.0.1:52534 (localhost) tid:
> >>>>>> 00000002
> >>>>>> 2017-05-04T20:44:06 writing packet: udp ::1:52534 (localhost) tid:
> >>>>>> 00000001
> >>>>>> 2017-05-04T20:44:06 reading packet: udp ::1:52534 (localhost) tid:
> >>>>>> 00000001
> >>>>>> 2017-05-04T20:44:06 host completed: udp ::1:52534 (localhost) tid:
> >>>>>> 00000001
> >>>>>> 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0 hosts 1
> >>>>>> packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814 tid: 00000002
> >>>>>> 2017-05-04T20:44:06 tkt: extract key 17/763641F3
> >>>>>> 2017-05-04T20:44:06 set-error: -1765328353: Decrypt integrity
> >>>>>> check failed for checksum type hmac-sha1-96-aes128, key type
> >>>>>> aes128-cts-hmac-sha1-96
> >>>>>> 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
> >>>>>> 2017-05-04T20:44:06 krb5_get_credentials_with_flags: TEST.COM wc:
> >>>>>> 0.050317
> >>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> >>>>>> credential for krb5_ccache_conf_data/realm-config@X-CACHECONF:
> >>>>>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> >>>>>> credential for
> >>>>>> krb5_ccache_conf_data/time-offset/test-service\134/
> >>> localhost\134@TEST.
> >>>>>> COM@X-CACHECONF: in cache
> >>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>> 2017-05-04T20:44:06 Setting up PFS for auth context
> >>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> >>>>>> des-cbc-md5-deprecated not supported
> >>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> >>>>>> des-cbc-md4-deprecated not supported
> >>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> >>>>>> des-cbc-crc-deprecated not supported First
> >>>>>> kerberos.authGSSClientStep successful
> >>>>>>
> >>>>>> Thanks
> >>>>>> Jiajia
> >>>>>>
> >>>>>> -----Original Message-----
> >>>>>> From: Zheng, Kai [mailto:kai.zheng@intel.com]
> >>>>>> Sent: Wednesday, May 3, 2017 7:29 PM
> >>>>>> To: kerby@directory.apache.org
> >>>>>> Subject: RE: MIT Kerberos compatibility
> >>>>>>
> >>>>>> Hi Marc,
> >>>>>>
> >>>>>> In case you're not aware of this, please check out the latest
> >>>>>> fix made
> >>>>> by Jiajia. We thought your case may be different, but would be
> >>>>> good to have a check before we can repeat/fix your case. Thanks.
> >>>>>> https://issues.apache.org/jira/browse/DIRKRB-625
> >>>>>>
> >>>>>> Regards,
> >>>>>> Kai
> >>>>>>
> >>>>>> -----Original Message-----
> >>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> >>>>>> Sent: Sunday, April 30, 2017 7:45 PM
> >>>>>> To: kerby@directory.apache.org
> >>>>>> Subject: Re: MIT Kerberos compatibility
> >>>>>>
> >>>>>> Hi Kai,
> >>>>>>
> >>>>>> The terminal output below is for the latest MIT Kerberos 1.15.1
> >>>>>> (locally
> >>>>> built on Ubuntu Xenial). Before that, I also tested with the
> >>>>> default Xenial MIT Kerberos packages (1.13.2), with the same
> >>>>> result. I did not try earlier MIT Kerberos versions.
> >>>>>>
> >>>>>> Marc
> >>>>>>
> >>>>>> Op 29-04-17 om 21:42 schreef Marc de Lignie:
> >>>>>>> Hi Kai,
> >>>>>>>
> >>>>>>> Thanks for the response. I prepared a minimal config that
> >>>>>>> reproduces my problem.
> >>>>>>>
> >>>>>>> You can fetch the branch/commit from:
> >>>>>>> https://github.com/vtslab/directory-kerby/commits/MitIssue
> >>>>>>>
> >>>>>>> This is relative to RC2, but I also tried this on trunk for my
> >>>>>>> actual project.
> >>>>>>>
> >>>>>>> This config produces the debug and error messages below.
> >>>>>>>
> >>>>>>> 1. For the terminal with the bash + python script $ klist
> >>>>>>> Ticket
> >>>>>>> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>> Default principal: drankye@TEST.COM
> >>>>>>>
> >>>>>>> Valid starting Expires Service principal
> >>>>>>> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/TEST.COM@TEST.COM
> >>>>>>> renew until 29-04-17 21:07:39
> >>>>>>>
> >>>>>>> $ .
> >>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerbero
> >>>>>>> s/ ke rb / server/MitIssueTest.sh [15538] 1493491231.917606:
> >>>>>>> Retrieving drankye@TEST.COM from
> >>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> >>>>>>> result:
> >>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> >>>>>>> [15538]
> >>>>>>> 1493491231.917827: Retrieving drankye@TEST.COM from
> >>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> >>>> result:
> >>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> >>>>>>> kerberos.authGSSClientInit successful [15538] 1493491231.918185:
> >>>>>>> Getting credentials drankye@TEST.COM -> test-service/localhost@
> >>>>>>> using ccache
> >>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >>>>>>> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
> >>>>>>> test-service/localhost@ from
> >>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
> >>>>>>> -1765328243/Matching credential not found (filename:
> >>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> >>>>>>> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
> >>>>>>> test-service/localhost@TEST.COM with result:
> >>>>>>> -1765328243/Matching credential not found (filename:
> >>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> >>>>>>> [15538] 1493491231.918229: Server has referral realm; starting
> >>>>>>> with test-service/localhost@TEST.COM [15538] 1493491231.918278:
> >>>>>>> Retrieving drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM from
> >>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
> >>>>>>> 0/Success
> >>>>>>> [15538] 1493491231.918281: Starting with TGT for client realm:
> >>>>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
> >>>>>>> 1493491231.918301: Requesting tickets for
> >>>>>>> test-service/localhost@TEST.COM, referrals on [15538]
> >>>>>>> 1493491231.918326: Generated subkey for TGS request:
> >>>>>>> aes128-cts/FA30
> >>>>>>> [15538] 1493491231.918359: etypes requested in TGS request:
> >>>>>>> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2,
> >>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
> >>>>>>> [15538]
> >>> 1493491231.918484:
> >>>>>>> Encoding request body and padata into FAST request [15538]
> >>>>>>> 1493491231.918541: Sending request (836 bytes) to TEST.COM
> >>>>>>> [15538]
> >>>>>>> 1493491231.918597: Resolving hostname localhost [15538]
> >>>>>>> 1493491231.918703: Initiating TCP connection to stream
> >>>>>>> 127.0.0.1:44292
> >>>>>>> [15538] 1493491231.918777: Sending TCP request to stream
> >>>>>>> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error receiving
> >>>>>>> from stream
> >>>>>>> 127.0.0.1:44292: 104/Connection reset by peer [15538]
> >>>>>>> 1493491231.922812: Terminating TCP connection to stream
> >>>>>>> 127.0.0.1:44292
> >>>>>>> [15538] 1493491231.922858: Sending initial UDP request to dgram
> >>>>>>> 127.0.0.1:44292
> >>>>>>> ('First kerberos.authGSSClientStep not successful',
> >>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide
> >>>>>>> more information', 851968), ("Cannot contact any KDC for realm
> >>>>>>> 'TEST.COM'",
> >>>>>>> -1765328228)))
> >>>>>>>
> >>>>>>> 2. For the terminal that runs mvn clean test
> >>>>>>> -Dtest=MitIssueTest Running
> >>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> >>>>>>> 2017-04-29 21:07:39,182 DEBUG [main] backend.
> >>> AbstractIdentityBackend:
> >>>>>>> initialize called
> >>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
> >>> AbstractIdentityBackend:
> >>>>>>> getIdentity called, principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
> >>> AbstractIdentityBackend:
> >>>>>>> getIdentity failed, principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> >>> AbstractIdentityBackend:
> >>>>>>> addIdentity successful, principalName =
> >>>>>>> krbtgt/TEST.COM@TEST.COM
> >>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> >>> AbstractIdentityBackend:
> >>>>>>> getIdentity called, principalName = kadmin/TEST.COM@TEST.COM
> >>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> >>> AbstractIdentityBackend:
> >>>>>>> getIdentity failed, principalName = kadmin/TEST.COM@TEST.COM
> >>>>>>> 2017-04-29 21:07:39,213 DEBUG [main] backend.
> >>> AbstractIdentityBackend:
> >>>>>>> addIdentity successful, principalName =
> >>>>>>> kadmin/TEST.COM@TEST.COM
> >>>>>>> 2017-04-29 21:07:39,216 DEBUG [main] backend.
> >>> AbstractIdentityBackend:
> >>>>>>> start called
> >>>>>>> 2017-04-29 21:07:39,232 DEBUG [main] backend.
> >>> AbstractIdentityBackend:
> >>>>>>> addIdentity successful, principalName =
> >>>>>>> test-service/localhost@TEST.COM
> >>>>>>> 2017-04-29 21:07:39,425 DEBUG [main] backend.
> >>> AbstractIdentityBackend:
> >>>>>>> addIdentity successful, principalName = drankye@TEST.COM
> >>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1]
> >> request.KdcRequest:
> >>>>>>> Client entry is empty.
> >>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>> principalName = drankye@TEST.COM
> >>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>> principalName = drankye@TEST.COM
> >>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
> >>>>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
> >>>>>>> disconnecting abnormally java.io.EOFException
> >>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> >>>>>>> at
> >>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> >>>>> receiveMessage(KrbTcpTransport.java:54)
> >>>>>>> at
> >>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
> >>>>>>> n(
> >>>>> DefaultKdcHandler.java:46)
> >>>>>>> at
> >>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> >>>>> ThreadPoolExecutor.java:1142)
> >>>>>>> at
> >>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> >>>>> ThreadPoolExecutor.java:617)
> >>>>>>> at java.lang.Thread.run(Thread.java:748)
> >>>>>>> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase:
> >>>>>>> Storing the tgt to the credential cache file.
> >>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
> >>> AbstractIdentityBackend:
> >>>>>>> getIdentity called, principalName =
> >>>>>>> test-service/localhost@TEST.COM
> >>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
> >>> AbstractIdentityBackend:
> >>>>>>> getIdentity successful, principalName =
> >>>>>>> test-service/localhost@TEST.COM
> >>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> >>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> >>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1]
> >> request.KdcRequest:
> >>>>>>> Client entry is empty.
> >>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> >>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>> principalName = test-service/localhost@TEST.COM
> >>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> >>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>> principalName = test-service/localhost@TEST.COM
> >>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> >>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> >>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1]
> >> request.KdcRequest:
> >>>>>>> The preauth data is empty.
> >>>>>>> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1] server.KdcHandler:
> >>>>>>> KRB error occurred while processing request:Additional
> >>>>>>> pre-authentication required
> >>>>>>> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
> >>>>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
> >>>>>>> disconnecting abnormally java.io.EOFException
> >>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> >>>>>>> at
> >>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> >>>>> receiveMessage(KrbTcpTransport.java:54)
> >>>>>>> at
> >>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
> >>>>>>> n(
> >>>>> DefaultKdcHandler.java:46)
> >>>>>>> at
> >>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> >>>>> ThreadPoolExecutor.java:1142)
> >>>>>>> at
> >>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> >>>>> ThreadPoolExecutor.java:617)
> >>>>>>> at java.lang.Thread.run(Thread.java:748)
> >>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> >>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> >>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1]
> >> request.KdcRequest:
> >>>>>>> Client entry is empty.
> >>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> >>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>> principalName = test-service/localhost@TEST.COM
> >>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> >>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>> principalName = test-service/localhost@TEST.COM
> >>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> >>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> >>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
> >>>>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
> >>>>>>> disconnecting abnormally java.io.EOFException
> >>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> >>>>>>> at
> >>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> >>>>> receiveMessage(KrbTcpTransport.java:54)
> >>>>>>> at
> >>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
> >>>>>>> n(
> >>>>> DefaultKdcHandler.java:46)
> >>>>>>> at
> >>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> >>>>> ThreadPoolExecutor.java:1142)
> >>>>>>> at
> >>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> >>>>> ThreadPoolExecutor.java:617)
> >>>>>>> at java.lang.Thread.run(Thread.java:748)
> >>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> >>>>>>> backend.AbstractIdentityBackend: getIdentity called,
> >>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> >>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
> >>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
> >>>>>>> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1]
> >> request.KdcRequest:
> >>>>>>> Found fast padata and start to process it.
> >>>>>>> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
> >>>>>>> impl.DefaultKdcHandler: Error occured while processing request:
> >>>>>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
> >>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> >>>>> java:85)
> >>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> >>>>> java:70)
> >>>>>>> at
> >>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFin
> >>>>>>> dF
> >>>>>>> as
> >>>>>>> t(
> >>>>> KdcRequest.java:208)
> >>>>>>> at
> >>>>>>> org.apache.kerby.kerberos.kerb.server.request.
> >>>>> KdcRequest.process(KdcRequest.java:168)
> >>>>>>> at
> >>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
> >>>>> handleMessage(KdcHandler.java:115)
> >>>>>>> at
> >>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
> >>>>> handleMessage(DefaultKdcHandler.java:67)
> >>>>>>> at
> >>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
> >>>>>>> n(
> >>>>> DefaultKdcHandler.java:52)
> >>>>>>> at
> >>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> >>>>> ThreadPoolExecutor.java:1142)
> >>>>>>> at
> >>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> >>>>> ThreadPoolExecutor.java:617)
> >>>>>>> at java.lang.Thread.run(Thread.java:748)
> >>>>>>> Caused by: java.io.IOException: Unexpected item context [0]
> >>>>>>> [tag=0xA0, off=0, len=3+207], expecting 0x30
> >>>>>>> at
> >>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> >>>>> Asn1Encodeable.java:210)
> >>>>>>> at
> >>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> >>>>> Asn1Encodeable.java:197)
> >>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> >>>>> java:83)
> >>>>>>> ... 9 more
> >>>>>>> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
> >>>>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
> >>>>>>> disconnecting abnormally
> >>>>>>> java.net.SocketException: Socket closed
> >>>>>>> at java.net.SocketInputStream.socketRead0(Native Method)
> >>>>>>> at java.net.SocketInputStream.socketRead(SocketInputStream.
> >>>>> java:116)
> >>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
> >> 171)
> >>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
> >> 141)
> >>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
> >> 224)
> >>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:387)
> >>>>>>> at
> >>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> >>>>> receiveMessage(KrbTcpTransport.java:54)
> >>>>>>> at
> >>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
> >>>>>>> n(
> >>>>> DefaultKdcHandler.java:46)
> >>>>>>> at
> >>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> >>>>> ThreadPoolExecutor.java:1142)
> >>>>>>> at
> >>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> >>>>> ThreadPoolExecutor.java:617)
> >>>>>>> at java.lang.Thread.run(Thread.java:748)
> >>>>>>>
> >>>>>>> In a FreeIPA environment these python lines "just" work.
> >>>>>>>
> >>>>>>> Any suggestions are welcome!
> >>>>>>>
> >>>>>>> Marc
> >>>>>>>
> >>>>>>>
> >>>>>> --
> >>>>>> Marc de Lignie
> >>>>>>
> >>>>>
> >>>>> --
> >>>>> Marc de Lignie
> >>>>>
> >>>>>
> >>>>
> >>>>
> >>>> --
> >>>> Colm O hEigeartaigh
> >>>>
> >>>> Talend Community Coder
> >>>> http://coders.talend.com
> >>>>
> >>>
> >>>
> >>>
> >>> --
> >>> Colm O hEigeartaigh
> >>>
> >>> Talend Community Coder
> >>> http://coders.talend.com
> >>>
> >>
> >>
> >>
> >> --
> >> Colm O hEigeartaigh
> >>
> >> Talend Community Coder
> >> http://coders.talend.com
> >>
> >
> >
> >
> > --
> > Colm O hEigeartaigh
> >
> > Talend Community Coder
> > http://coders.talend.com
>
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
Re: MIT Kerberos compatibility
Posted by "Zheng, Kai" <ka...@intel.com>.
Colm, did you see udp problem now instead? I'm a little confused. Udp is sure supported but may not be enabled by default, which should be okay, imo. Thanks.
Sent from iPhone
> 在 2017年5月6日，上午12:02，Colm O hEigeartaigh <co...@apache.org> 写道：
>
> That's probably it. Why does the default transport not support UDP in Kerby?
>
> Colm.
>
>> On Fri, May 5, 2017 at 4:54 PM, Li, Jiajia <ji...@intel.com> wrote:
>>
>> Are you sure add kdc_allow_udp = false in kdc.conf?
>>
>> Thanks
>> Jiajia
>>
>> -----Original Message-----
>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
>> Sent: Friday, May 5, 2017 11:41 PM
>> To: Li, Jiajia <ji...@intel.com>
>> Cc: kerby@directory.apache.org; Zheng, Kai <ka...@intel.com>; mailto:
>> m.c.delignie@xs4all.nl <m....@xs4all.nl>
>> Subject: Re: MIT Kerberos compatibility
>>
>> Sorry, it was my error, UDP was actually enabled there. But why am I still
>> seeing that error message?
>>
>> Colm.
>>
>>> On Fri, May 5, 2017 at 4:39 PM, Li, Jiajia <ji...@intel.com> wrote:
>>>
>>> Hi Colm,
>>> I also test the Kerby KDC with kerby kint and MIT kinit, and only
>>> listen the tcp port(disable udp), both got ticket successfully. But I
>>> don't get the error message. Both krb.conf and kdc.conf should set udp
>>> to be false, udp is enabled in default.
>>>
>>> Thanks
>>> Jiajia
>>>
>>> -----Original Message-----
>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
>>> Sent: Friday, May 5, 2017 11:34 PM
>>> To: kerby@directory.apache.org
>>> Cc: Zheng, Kai <ka...@intel.com>; mailto:m.c.delignie@xs4all.nl <
>>> m.c.delignie@xs4all.nl>
>>> Subject: Re: MIT Kerberos compatibility
>>>
>>> Hi Jiajia,
>>>
>>> If UDP is disabled and we don't use Netty, I can get a token
>>> successfully via kinit. However I then see an error message in the Kerby
>> console:
>>>
>>> Exception in thread "Thread-1" java.lang.RuntimeException: Error
>>> occured while checking udp connections
>>> at
>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
>>> KdcNetwork.java:105)
>>> at
>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
>>> access$000(KdcNetwork.java:39)
>>> at
>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
>>> run(KdcNetwork.java:75)
>>> at java.lang.Thread.run(Thread.java:748)
>>> Caused by: java.nio.channels.ClosedChannelException
>>> at
>>> sun.nio.ch.DatagramChannelImpl.ensureOpen(DatagramChannelImpl.java:320)
>>> at sun.nio.ch.DatagramChannelImpl.receive(
>>> DatagramChannelImpl.java:331)
>>> at
>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
>>> checkUdpMessage(KdcNetwork.java:132)
>>> at
>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
>>> KdcNetwork.java:101)
>>>
>>> I'm not sure why we are seeing UDP errors when it's disabled?
>>>
>>> Colm.
>>>
>>>> On Fri, May 5, 2017 at 3:57 PM, Li, Jiajia <ji...@intel.com> wrote:
>>>>
>>>> Hi Colm,
>>>> The shell client can't connect to kdc if the UDP is disabled.
>>>> We don't use Netty in default.
>>>> What's your test-cases? The same as the Marc's?
>>>>
>>>> Thanks
>>>> Jiajia
>>>>
>>>> -----Original Message-----
>>>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
>>>> Sent: Friday, May 5, 2017 10:09 PM
>>>> To: kerby@directory.apache.org
>>>> Cc: Zheng, Kai <ka...@intel.com>; mailto:m.c.delignie@xs4all.nl
>>>> < m.c.delignie@xs4all.nl>
>>>> Subject: Re: MIT Kerberos compatibility
>>>>
>>>> Hi Jiajia,
>>>>
>>>> What are the issues if UDP is disabled and we don't use Netty? I
>>>> tried doing this with my own test-cases and it didn't work, so it
>>>> would be good to get this fixed soon.
>>>>
>>>> Colm.
>>>>
>>>> On Fri, May 5, 2017 at 2:46 PM, Li, Jiajia <ji...@intel.com>
>> wrote:
>>>>
>>>>> Hi Marc,
>>>>>>>> - your KRB5 tracing looks quite different. What OS and
>>>>>>>> mit-kerberos
>>>>> version did you use?
>>>>> I use mac os and the python version is 2.7.10
>>>>>
>>>>>>>> - your KRB5 tracing shows UDP comms between kerberos client and
>>>>>>>> KDC,
>>>>> despite the allowUDP = false setting
>>>>>>>> in my test. I did this setting because I get different
>>>>>>>> problems
>>>>> without it, see the additional logs below. So,
>>>>>>>> we must also be aware of networking problems at my side.
>>>>> I enable the UDP and use netty network, there are some issues if
>>>>> UDP disabled, you can create a JIRA for this and we can fix this
>>>>> issue in the next release version.
>>>>>
>>>>> The changes in my side as following:
>>>>>
>>>>> protected boolean allowUdp() {
>>>>> return true;
>>>>> }
>>>>> @Override
>>>>> protected void prepareKdc() throws KrbException {
>>>>> getKdcServer().setInnerKdcImpl(
>>>>> new NettyKdcServerImpl(getKdcServer().getKdcSetting()));
>>>>> super.prepareKdc();
>>>>> }
>>>>>
>>>>> Here is log of MitIssueTest:
>>>>> [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
>>>>> [nioEventLoopGroup-2-1] INFO
>>>>> io.netty.handler.logging.LoggingHandler
>>>>> -
>>>>> [id: 0x2634fe6b] REGISTERED
>>>>> [nioEventLoopGroup-2-1] INFO
>>>>> io.netty.handler.logging.LoggingHandler
>>>>> -
>>>>> [id: 0x2634fe6b] BIND(0.0.0.0/0.0.0.0:53957)
>>>>> [nioEventLoopGroup-2-1] INFO
>>>>> io.netty.handler.logging.LoggingHandler -
>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] ACTIVE [main] INFO
>>>>> org.apache.kerby.kerberos.kdc.impl.NettyKdcServerImpl - Netty kdc
>>>>> server started.
>>>>> [nioEventLoopGroup-2-1] INFO
>>>>> io.netty.handler.logging.LoggingHandler
>>>>> -
>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] RECEIVED: [id:
>>>>> 0xdac7228b, /
>>>>> 127.0.0.1:53961 => /127.0.0.1:53957]
>>>>> [defaultEventExecutorGroup-4-1] INFO
>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
>>>>> - AS_REQ ISSUE: authtime 1493991123792,drankye@TEST.COM for
>>>>> krbtgt/ TEST.COM@TEST.COM [main] INFO
>>>>> org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClien
>>>>> t
>>>>> - Send to kdc success.
>>>>> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
>>>>> Storing the tgt to the credential cache file.
>>>>> [nioEventLoopGroup-5-1] INFO
>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
>>>>> - The preauth data is empty.
>>>>> [nioEventLoopGroup-5-1] INFO
>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
>>>>> - KRB error occurred while processing request:Additional
>>>>> pre-authentication required [nioEventLoopGroup-5-1] INFO
>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest
>>>>> - AS_REQ ISSUE: authtime
>>>>> 1493991123859,test-service/localhost@TEST.COM
>>>>> for krbtgt/TEST.COM@TEST.COM
>>>>> [nioEventLoopGroup-5-1] INFO
>>>>> org.apache.kerby.kerberos.kerb.server.request.TgsRequest
>>>>> - TGS_REQ ISSUE: authtime 1493991142850,drankye for test-service/
>>>>> localhost@TEST.COM
>>>>>
>>>>> Thanks
>>>>> Jiajia
>>>>>
>>>>> -----Original Message-----
>>>>> From: Zheng, Kai
>>>>> Sent: Friday, May 5, 2017 7:46 PM
>>>>> To: kerby@directory.apache.org; Li, Jiajia <ji...@intel.com>
>>>>> Subject: RE: MIT Kerberos compatibility
>>>>>
>>>>> Hi Marc,
>>>>>
>>>>> Looks like this is quite environment related, could you fire an
>>>>> issue for this? I would suggest we target it to 1.1.0, which can
>>>>> be done in
>>>> June.
>>>>>
>>>>> Regards,
>>>>> Kai
>>>>>
>>>>> -----Original Message-----
>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
>>>>> Sent: Friday, May 05, 2017 4:44 PM
>>>>> To: Li, Jiajia <ji...@intel.com>
>>>>> Cc: kerby@directory.apache.org
>>>>> Subject: Re: MIT Kerberos compatibility
>>>>>
>>>>> Hi Jiajia,
>>>>>
>>>>> Great to read that you made progress on this issue and to see a
>>>>> working config at your side. Below, I list my progress below (with
>>>>> trunk merged into my MitIssue branch), but I am afraid we are not
>>>>> done
>>>> yet.
>>>>>
>>>>> Things that stand out:
>>>>>
>>>>> - the kdc decoding error is solved, relative to the logs without
>>>>> your patch
>>>>>
>>>>> - your KRB5 tracing looks quite different. What OS and
>>>>> mit-kerberos version did you use?
>>>>>
>>>>> - your KRB5 tracing shows UDP comms between kerberos client and
>>>>> KDC, despite the allowUDP = false setting in my test. I did this
>>>>> setting because I get different problems without it, see the
>>>>> additional logs below. So, we must also be aware of networking
>> problems at my side.
>>>>>
>>>>> - the "Response was not from master KDC" msg is not relevant; it
>>>>> disappears if you manually add master_kdc to the realms section of
>>>>> the krb5.conf
>>>>>
>>>>> I have no idea how to proceed from here, so that is why I just
>>>>> document the status at my side and ask about your - apparently
>>>>> working -
>>>> config.
>>>>>
>>>>> Cheers, Marc
>>>>>
>>>>>
>>>>> KDC logging with allowUDP = false:
>>>>>
>>>>> [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
>>>>> [pool-1-thread-1] INFO
>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
>>> ISSUE:
>>>>> authtime 1493970789075,drankye@TEST.COM for
>>>>> krbtgt/TEST.COM@TEST.COM [main] INFO
>>>>> org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClien
>>>>> t
>>>>> - Send to kdc success.
>>>>> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
>>>>> Storing the tgt to the credential cache file.
>>>>> [pool-1-thread-1] INFO
>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The
>>>>> preauth data is empty.
>>>>> [pool-1-thread-1] INFO
>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
>>>>> - KRB error occurred while processing request:Additional
>>>>> pre-authentication required [pool-1-thread-1] INFO
>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
>>> ISSUE:
>>>>> authtime 1493970789108,test-service/localhost@TEST.COM for krbtgt/
>>>>> TEST.COM@TEST.COM [pool-1-thread-1] INFO
>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
>>>>> - Found fast padata and starting to process it.
>>>>> [pool-1-thread-1] INFO
>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found
>>>>> fast padata and starting to process it.
>>>>>
>>>>> Python script KRB5 tracing (MIT Kerberos 1.13.2 of Ubuntu Xenial)
>>>>> with allowUDP = false:
>>>>>
>>>>> $ .
>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/
>>>>> kerberos/kerb/server/MitIssueTest.sh
>>>>> [25281] 1493970797.298753: Retrieving drankye@TEST.COM from
>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>> result:
>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>> [25281]
>>>>> 1493970797.298952: Retrieving drankye@TEST.COM from
>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>> result:
>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>> [25281]
>>>>> 1493970797.299106: Retrieving drankye@TEST.COM from
>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>> result:
>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>> [25281]
>>>>> 1493970797.299213: Retrieving drankye@TEST.COM from
>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>> result:
>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>> [25281]
>>>>> 1493970797.299323: Retrieving drankye@TEST.COM from
>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>> result:
>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>> [25281]
>>>>> 1493970797.299436: Retrieving drankye@TEST.COM from
>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>> result:
>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>> [25281]
>>>>> 1493970797.299545: Retrieving drankye@TEST.COM from
>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>> result:
>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>> [25281]
>>>>> 1493970797.299654: Retrieving drankye@TEST.COM from
>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>> result:
>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>> kerberos.authGSSClientInit successful [25281] 1493970797.299922:
>>>>> Getting credentials drankye@TEST.COM -> test-service/localhost@
>>>>> using ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>> [25281] 1493970797.299945: Retrieving drankye@TEST.COM ->
>>>>> test-service/localhost@ from
>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>> with result:
>>>>> -1765328243/Matching credential not found [25281] 1493970797.299959:
>>>>> Retrying drankye@TEST.COM -> test-service/localhost@TEST.COM with
>>>> result:
>>>>> -1765328243/Matching credential not found [25281] 1493970797.299962:
>>>>> Server has referral realm; starting with
>>>>> test-service/localhost@TEST.COM [25281]
>>>>> 1493970797.299975: Retrieving drankye@TEST.COM ->
>>>>> krbtgt/TEST.COM@TEST.COM from
>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>> with result:
>>>>> 0/Success [25281] 1493970797.299979: Starting with TGT for client
>>> realm:
>>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [25281]
>>> 1493970797.299981:
>>>>> Requesting tickets for test-service/localhost@TEST.COM, referrals
>>>>> on [25281] 1493970797.299994: Generated subkey for TGS request:
>>>>> aes128-cts/1B9B [25281] 1493970797.300009: etypes requested in TGS
>>>> request:
>>>>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
>>>>> camellia256-cts [25281] 1493970797.300054: Encoding request body
>>>>> and padata into FAST request [25281] 1493970797.300080: Sending
>>>>> request
>>>>> (823 bytes) to TEST.COM [25281] 1493970797.300091: Resolving
>>>>> hostname localhost [25281]
>>>>> 1493970797.300136: Initiating TCP connection to stream
>>>>> 127.0.0.1:34319
>>>>> [25281] 1493970797.300191: Sending TCP request to stream
>>>>> 127.0.0.1:34319 [25281] 1493970797.303610: Received answer (125
>>>>> bytes) from stream
>>>>> 127.0.0.1:34319
>>>>> [25281] 1493970797.303618: Terminating TCP connection to stream
>>>>> 127.0.0.1:34319
>>>>> [25281] 1493970797.553126: Response was not from master KDC
>>>>> [25281]
>>>>> 1493970797.553198: TGS request result: -1765323383/Unknown code
>>>>> krcM
>>>>> 137 [25281] 1493970797.553234: Requesting tickets for
>>>>> test-service/ localhost@TEST.COM, referrals off [25281]
>> 1493970797.553273:
>>>>> Generated subkey for TGS request: aes128-cts/94C6 [25281]
>>> 1493970797.553323:
>>>>> etypes requested in TGS request: aes256-cts, aes128-cts,
>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts [25281]
>>>>> 1493970797.553436: Encoding request body and padata into FAST
>>>>> request
>>>> [25281] 1493970797.553532:
>>>>> Sending request (823 bytes) to TEST.COM [25281] 1493970797.553567:
>>>>> Resolving hostname localhost [25281] 1493970797.553745: Initiating
>>>>> TCP connection to stream
>>>>> 127.0.0.1:34319
>>>>> [25281] 1493970797.553889: Sending TCP request to stream
>>>>> 127.0.0.1:34319 [25281] 1493970797.558297: Received answer (125
>>>>> bytes) from stream
>>>>> 127.0.0.1:34319
>>>>> [25281] 1493970797.558318: Terminating TCP connection to stream
>>>>> 127.0.0.1:34319
>>>>> [25281] 1493970797.561189: Response was not from master KDC
>>>>> [25281]
>>>>> 1493970797.561258: TGS request result: -1765323383/Unknown code
>>>>> krcM
>>>>> 137 ('First kerberos.authGSSClientStep not successful',
>>>>> GSSError(('Unspecified GSS failure. Minor code may provide more
>>>>> information', 851968), ('Unknown code krcM 137', -1765323383)))
>>>>>
>>>>>
>>>>> KDC logging with allowUDP = true:
>>>>>
>>>>> [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
>>>>> [pool-1-thread-1] INFO
>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
>>> ISSUE:
>>>>> authtime 1493972505784,drankye@TEST.COM for
>>>>> krbtgt/TEST.COM@TEST.COM [main] INFO
>>>>> org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClien
>>>>> t
>>>>> - Send to kdc success.
>>>>> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
>>>>> Storing the tgt to the credential cache file.
>>>>> [pool-1-thread-1] INFO
>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The
>>>>> preauth data is empty.
>>>>> [pool-1-thread-1] INFO
>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler
>>>>> - KRB error occurred while processing request:Additional
>>>>> pre-authentication required [pool-1-thread-2] INFO
>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
>>> ISSUE:
>>>>> authtime 1493972505948,test-service/localhost@TEST.COM for krbtgt/
>>>>> TEST.COM@TEST.COM Exception in thread "Thread-0"
>>>>> java.lang.RuntimeException: Error occured while checking udp
>>> connections
>>>>> at
>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
>>>>> KdcNetwork.java:105)
>>>>> at
>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
>>>>> access$000(KdcNetwork.java:39)
>>>>> at
>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
>>>>> run(KdcNetwork.java:75)
>>>>> at java.lang.Thread.run(Thread.java:748)
>>>>> Caused by: java.nio.channels.ClosedChannelException
>>>>> at
>>>>> sun.nio.ch.DatagramChannelImpl.ensureOpen(
>>> DatagramChannelImpl.java:320)
>>>>> at sun.nio.ch.DatagramChannelImpl.receive(
>>>>> DatagramChannelImpl.java:331)
>>>>> at
>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
>>>>> checkUdpMessage(KdcNetwork.java:132)
>>>>> at
>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
>>>>> KdcNetwork.java:101)
>>>>> ... 3 more
>>>>>
>>>>>
>>>>> krb5.conf:
>>>>>
>>>>> [libdefaults]
>>>>> kdc_realm = TEST.COM
>>>>> default_realm = TEST.COM
>>>>> udp_preference_limit = 4096
>>>>> kdc_tcp_port = 37080
>>>>> kdc_udp_port = 36525
>>>>>
>>>>> [realms]
>>>>> TEST.COM = {
>>>>> kdc = localhost:36525
>>>>> }
>>>>>
>>>>> And port 36525 does not show up in `netstat -l` (while 37080 does)
>>>>>
>>>>>
>>>>> Op 04-05-17 om 14:55 schreef Li, Jiajia:
>>>>>> Hi Marc,
>>>>>> I try to run your test(through applying your patch in the trunk)
>>>>>> , I
>>>>> think it's success now. Could you take some time to check about it?
>>>>>> Here is the log:
>>>>>>
>>>>>> directory-kerby git:(trunk) ? .
>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos
>>>>>> /k
>>>>>> er
>>>>>> b/
>>>>>> server/MitIssueTest.sh
>>>>>> kerberos.authGSSClientInit successful
>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: entypes not
>>>>>> supported
>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>> credential for krb5_ccache_conf_data/realm-config@X-CACHECONF:
>>>>>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>> credential for test-service/localhost@TEST.COM in cache
>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>> credential for
>>>>>> krb5_ccache_conf_data/negative-cache/test-service\134/localhost\
>>>>>> 13
>>>>>> 4@
>>>>>> TE
>>>>>> ST.COM@X-CACHECONF: in cache
>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>> credential for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF:
>>>>>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>> credential for krb5_ccache_conf_data/sitename@X-CACHECONF: in
>>>>>> cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>> credential for test-service/localhost@TEST.COM in cache
>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>>>>> des-cbc-md5-deprecated not supported
>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>>>>> des-cbc-md4-deprecated not supported
>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>>>>> des-cbc-crc-deprecated not supported
>>>>>> 2017-05-04T20:44:06 Trying to find service kdc for realm
>>>>>> TEST.COM flags 0
>>>>>> 2017-05-04T20:44:06 configuration file for realm TEST.COM found
>>>>>> 2017-05-04T20:44:06 submissing new requests to new host
>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
>>>>>> 2017-05-04T20:44:06 connecting to host: udp ::1:52534
>>>>>> (localhost)
>>> tid:
>>>>>> 00000001
>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
>>>>>> 2017-05-04T20:44:06 Queuing host in future (in 3s), its the 2
>>>>>> address on the same name: udp 127.0.0.1:52534 (localhost) tid:
>>>>>> 00000002
>>>>>> 2017-05-04T20:44:06 writing packet: udp ::1:52534 (localhost) tid:
>>>>>> 00000001
>>>>>> 2017-05-04T20:44:06 reading packet: udp ::1:52534 (localhost) tid:
>>>>>> 00000001
>>>>>> 2017-05-04T20:44:06 host completed: udp ::1:52534 (localhost) tid:
>>>>>> 00000001
>>>>>> 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0 hosts 1
>>>>>> packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814 tid: 00000002
>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/763641F3
>>>>>> 2017-05-04T20:44:06 set-error: -1765328353: Decrypt integrity
>>>>>> check failed for checksum type hmac-sha1-96-aes128, key type
>>>>>> aes128-cts-hmac-sha1-96
>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
>>>>>> 2017-05-04T20:44:06 krb5_get_credentials_with_flags: TEST.COM wc:
>>>>>> 0.050317
>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>> credential for krb5_ccache_conf_data/realm-config@X-CACHECONF:
>>>>>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find
>>>>>> credential for
>>>>>> krb5_ccache_conf_data/time-offset/test-service\134/
>>> localhost\134@TEST.
>>>>>> COM@X-CACHECONF: in cache
>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>> 2017-05-04T20:44:06 Setting up PFS for auth context
>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>>>>> des-cbc-md5-deprecated not supported
>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>>>>> des-cbc-md4-deprecated not supported
>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>>>>> des-cbc-crc-deprecated not supported First
>>>>>> kerberos.authGSSClientStep successful
>>>>>>
>>>>>> Thanks
>>>>>> Jiajia
>>>>>>
>>>>>> -----Original Message-----
>>>>>> From: Zheng, Kai [mailto:kai.zheng@intel.com]
>>>>>> Sent: Wednesday, May 3, 2017 7:29 PM
>>>>>> To: kerby@directory.apache.org
>>>>>> Subject: RE: MIT Kerberos compatibility
>>>>>>
>>>>>> Hi Marc,
>>>>>>
>>>>>> In case you're not aware of this, please check out the latest
>>>>>> fix made
>>>>> by Jiajia. We thought your case may be different, but would be
>>>>> good to have a check before we can repeat/fix your case. Thanks.
>>>>>> https://issues.apache.org/jira/browse/DIRKRB-625
>>>>>>
>>>>>> Regards,
>>>>>> Kai
>>>>>>
>>>>>> -----Original Message-----
>>>>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
>>>>>> Sent: Sunday, April 30, 2017 7:45 PM
>>>>>> To: kerby@directory.apache.org
>>>>>> Subject: Re: MIT Kerberos compatibility
>>>>>>
>>>>>> Hi Kai,
>>>>>>
>>>>>> The terminal output below is for the latest MIT Kerberos 1.15.1
>>>>>> (locally
>>>>> built on Ubuntu Xenial). Before that, I also tested with the
>>>>> default Xenial MIT Kerberos packages (1.13.2), with the same
>>>>> result. I did not try earlier MIT Kerberos versions.
>>>>>>
>>>>>> Marc
>>>>>>
>>>>>> Op 29-04-17 om 21:42 schreef Marc de Lignie:
>>>>>>> Hi Kai,
>>>>>>>
>>>>>>> Thanks for the response. I prepared a minimal config that
>>>>>>> reproduces my problem.
>>>>>>>
>>>>>>> You can fetch the branch/commit from:
>>>>>>> https://github.com/vtslab/directory-kerby/commits/MitIssue
>>>>>>>
>>>>>>> This is relative to RC2, but I also tried this on trunk for my
>>>>>>> actual project.
>>>>>>>
>>>>>>> This config produces the debug and error messages below.
>>>>>>>
>>>>>>> 1. For the terminal with the bash + python script $ klist
>>>>>>> Ticket
>>>>>>> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>> Default principal: drankye@TEST.COM
>>>>>>>
>>>>>>> Valid starting Expires Service principal
>>>>>>> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/TEST.COM@TEST.COM
>>>>>>> renew until 29-04-17 21:07:39
>>>>>>>
>>>>>>> $ .
>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerbero
>>>>>>> s/ ke rb / server/MitIssueTest.sh [15538] 1493491231.917606:
>>>>>>> Retrieving drankye@TEST.COM from
>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>>>>> result:
>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>> [15538]
>>>>>>> 1493491231.917827: Retrieving drankye@TEST.COM from
>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
>>>> result:
>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>>>>> kerberos.authGSSClientInit successful [15538] 1493491231.918185:
>>>>>>> Getting credentials drankye@TEST.COM -> test-service/localhost@
>>>>>>> using ccache
>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>>>>> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
>>>>>>> test-service/localhost@ from
>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>>>>>>> -1765328243/Matching credential not found (filename:
>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
>>>>>>> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
>>>>>>> test-service/localhost@TEST.COM with result:
>>>>>>> -1765328243/Matching credential not found (filename:
>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
>>>>>>> [15538] 1493491231.918229: Server has referral realm; starting
>>>>>>> with test-service/localhost@TEST.COM [15538] 1493491231.918278:
>>>>>>> Retrieving drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM from
>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>>>>>>> 0/Success
>>>>>>> [15538] 1493491231.918281: Starting with TGT for client realm:
>>>>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
>>>>>>> 1493491231.918301: Requesting tickets for
>>>>>>> test-service/localhost@TEST.COM, referrals on [15538]
>>>>>>> 1493491231.918326: Generated subkey for TGS request:
>>>>>>> aes128-cts/FA30
>>>>>>> [15538] 1493491231.918359: etypes requested in TGS request:
>>>>>>> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2,
>>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
>>>>>>> [15538]
>>> 1493491231.918484:
>>>>>>> Encoding request body and padata into FAST request [15538]
>>>>>>> 1493491231.918541: Sending request (836 bytes) to TEST.COM
>>>>>>> [15538]
>>>>>>> 1493491231.918597: Resolving hostname localhost [15538]
>>>>>>> 1493491231.918703: Initiating TCP connection to stream
>>>>>>> 127.0.0.1:44292
>>>>>>> [15538] 1493491231.918777: Sending TCP request to stream
>>>>>>> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error receiving
>>>>>>> from stream
>>>>>>> 127.0.0.1:44292: 104/Connection reset by peer [15538]
>>>>>>> 1493491231.922812: Terminating TCP connection to stream
>>>>>>> 127.0.0.1:44292
>>>>>>> [15538] 1493491231.922858: Sending initial UDP request to dgram
>>>>>>> 127.0.0.1:44292
>>>>>>> ('First kerberos.authGSSClientStep not successful',
>>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide
>>>>>>> more information', 851968), ("Cannot contact any KDC for realm
>>>>>>> 'TEST.COM'",
>>>>>>> -1765328228)))
>>>>>>>
>>>>>>> 2. For the terminal that runs mvn clean test
>>>>>>> -Dtest=MitIssueTest Running
>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest
>>>>>>> 2017-04-29 21:07:39,182 DEBUG [main] backend.
>>> AbstractIdentityBackend:
>>>>>>> initialize called
>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
>>> AbstractIdentityBackend:
>>>>>>> getIdentity called, principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.
>>> AbstractIdentityBackend:
>>>>>>> getIdentity failed, principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
>>> AbstractIdentityBackend:
>>>>>>> addIdentity successful, principalName =
>>>>>>> krbtgt/TEST.COM@TEST.COM
>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
>>> AbstractIdentityBackend:
>>>>>>> getIdentity called, principalName = kadmin/TEST.COM@TEST.COM
>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.
>>> AbstractIdentityBackend:
>>>>>>> getIdentity failed, principalName = kadmin/TEST.COM@TEST.COM
>>>>>>> 2017-04-29 21:07:39,213 DEBUG [main] backend.
>>> AbstractIdentityBackend:
>>>>>>> addIdentity successful, principalName =
>>>>>>> kadmin/TEST.COM@TEST.COM
>>>>>>> 2017-04-29 21:07:39,216 DEBUG [main] backend.
>>> AbstractIdentityBackend:
>>>>>>> start called
>>>>>>> 2017-04-29 21:07:39,232 DEBUG [main] backend.
>>> AbstractIdentityBackend:
>>>>>>> addIdentity successful, principalName =
>>>>>>> test-service/localhost@TEST.COM
>>>>>>> 2017-04-29 21:07:39,425 DEBUG [main] backend.
>>> AbstractIdentityBackend:
>>>>>>> addIdentity successful, principalName = drankye@TEST.COM
>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1]
>> request.KdcRequest:
>>>>>>> Client entry is empty.
>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>> principalName = drankye@TEST.COM
>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>> principalName = drankye@TEST.COM
>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
>>>>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>>>>>> disconnecting abnormally java.io.EOFException
>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>>>>>>> at
>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
>>>>> receiveMessage(KrbTcpTransport.java:54)
>>>>>>> at
>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
>>>>>>> n(
>>>>> DefaultKdcHandler.java:46)
>>>>>>> at
>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>>>>> ThreadPoolExecutor.java:1142)
>>>>>>> at
>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>>>>> ThreadPoolExecutor.java:617)
>>>>>>> at java.lang.Thread.run(Thread.java:748)
>>>>>>> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase:
>>>>>>> Storing the tgt to the credential cache file.
>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
>>> AbstractIdentityBackend:
>>>>>>> getIdentity called, principalName =
>>>>>>> test-service/localhost@TEST.COM
>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.
>>> AbstractIdentityBackend:
>>>>>>> getIdentity successful, principalName =
>>>>>>> test-service/localhost@TEST.COM
>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1]
>> request.KdcRequest:
>>>>>>> Client entry is empty.
>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>> principalName = test-service/localhost@TEST.COM
>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>> principalName = test-service/localhost@TEST.COM
>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1]
>> request.KdcRequest:
>>>>>>> The preauth data is empty.
>>>>>>> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1] server.KdcHandler:
>>>>>>> KRB error occurred while processing request:Additional
>>>>>>> pre-authentication required
>>>>>>> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
>>>>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>>>>>> disconnecting abnormally java.io.EOFException
>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>>>>>>> at
>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
>>>>> receiveMessage(KrbTcpTransport.java:54)
>>>>>>> at
>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
>>>>>>> n(
>>>>> DefaultKdcHandler.java:46)
>>>>>>> at
>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>>>>> ThreadPoolExecutor.java:1142)
>>>>>>> at
>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>>>>> ThreadPoolExecutor.java:617)
>>>>>>> at java.lang.Thread.run(Thread.java:748)
>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1]
>> request.KdcRequest:
>>>>>>> Client entry is empty.
>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>> principalName = test-service/localhost@TEST.COM
>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>> principalName = test-service/localhost@TEST.COM
>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
>>>>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>>>>>> disconnecting abnormally java.io.EOFException
>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>>>>>>> at
>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
>>>>> receiveMessage(KrbTcpTransport.java:54)
>>>>>>> at
>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
>>>>>>> n(
>>>>> DefaultKdcHandler.java:46)
>>>>>>> at
>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>>>>> ThreadPoolExecutor.java:1142)
>>>>>>> at
>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>>>>> ThreadPoolExecutor.java:617)
>>>>>>> at java.lang.Thread.run(Thread.java:748)
>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
>>>>>>> backend.AbstractIdentityBackend: getIdentity called,
>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
>>>>>>> backend.AbstractIdentityBackend: getIdentity successful,
>>>>>>> principalName = krbtgt/TEST.COM@TEST.COM
>>>>>>> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1]
>> request.KdcRequest:
>>>>>>> Found fast padata and start to process it.
>>>>>>> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
>>>>>>> impl.DefaultKdcHandler: Error occured while processing request:
>>>>>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
>>>>> java:85)
>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
>>>>> java:70)
>>>>>>> at
>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFin
>>>>>>> dF
>>>>>>> as
>>>>>>> t(
>>>>> KdcRequest.java:208)
>>>>>>> at
>>>>>>> org.apache.kerby.kerberos.kerb.server.request.
>>>>> KdcRequest.process(KdcRequest.java:168)
>>>>>>> at
>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
>>>>> handleMessage(KdcHandler.java:115)
>>>>>>> at
>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
>>>>> handleMessage(DefaultKdcHandler.java:67)
>>>>>>> at
>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
>>>>>>> n(
>>>>> DefaultKdcHandler.java:52)
>>>>>>> at
>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>>>>> ThreadPoolExecutor.java:1142)
>>>>>>> at
>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>>>>> ThreadPoolExecutor.java:617)
>>>>>>> at java.lang.Thread.run(Thread.java:748)
>>>>>>> Caused by: java.io.IOException: Unexpected item context [0]
>>>>>>> [tag=0xA0, off=0, len=3+207], expecting 0x30
>>>>>>> at
>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>>>>> Asn1Encodeable.java:210)
>>>>>>> at
>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>>>>> Asn1Encodeable.java:197)
>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
>>>>> java:83)
>>>>>>> ... 9 more
>>>>>>> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
>>>>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>>>>>> disconnecting abnormally
>>>>>>> java.net.SocketException: Socket closed
>>>>>>> at java.net.SocketInputStream.socketRead0(Native Method)
>>>>>>> at java.net.SocketInputStream.socketRead(SocketInputStream.
>>>>> java:116)
>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
>> 171)
>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
>> 141)
>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java:
>> 224)
>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:387)
>>>>>>> at
>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
>>>>> receiveMessage(KrbTcpTransport.java:54)
>>>>>>> at
>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
>>>>>>> n(
>>>>> DefaultKdcHandler.java:46)
>>>>>>> at
>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>>>>> ThreadPoolExecutor.java:1142)
>>>>>>> at
>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>>>>> ThreadPoolExecutor.java:617)
>>>>>>> at java.lang.Thread.run(Thread.java:748)
>>>>>>>
>>>>>>> In a FreeIPA environment these python lines "just" work.
>>>>>>>
>>>>>>> Any suggestions are welcome!
>>>>>>>
>>>>>>> Marc
>>>>>>>
>>>>>>>
>>>>>> --
>>>>>> Marc de Lignie
>>>>>>
>>>>>
>>>>> --
>>>>> Marc de Lignie
>>>>>
>>>>>
>>>>
>>>>
>>>> --
>>>> Colm O hEigeartaigh
>>>>
>>>> Talend Community Coder
>>>> http://coders.talend.com
>>>>
>>>
>>>
>>>
>>> --
>>> Colm O hEigeartaigh
>>>
>>> Talend Community Coder
>>> http://coders.talend.com
>>>
>>
>>
>>
>> --
>> Colm O hEigeartaigh
>>
>> Talend Community Coder
>> http://coders.talend.com
>>
>
>
>
> --
> Colm O hEigeartaigh
>
> Talend Community Coder
> http://coders.talend.com
Re: MIT Kerberos compatibility
Posted by Colm O hEigeartaigh <co...@apache.org>.
That's probably it. Why does the default transport not support UDP in Kerby?
Colm.
On Fri, May 5, 2017 at 4:54 PM, Li, Jiajia <ji...@intel.com> wrote:
> Are you sure add kdc_allow_udp = false in kdc.conf?
>
> Thanks
> Jiajia
>
> -----Original Message-----
> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> Sent: Friday, May 5, 2017 11:41 PM
> To: Li, Jiajia <ji...@intel.com>
> Cc: kerby@directory.apache.org; Zheng, Kai <ka...@intel.com>; mailto:
> m.c.delignie@xs4all.nl <m....@xs4all.nl>
> Subject: Re: MIT Kerberos compatibility
>
> Sorry, it was my error, UDP was actually enabled there. But why am I still
> seeing that error message?
>
> Colm.
>
> On Fri, May 5, 2017 at 4:39 PM, Li, Jiajia <ji...@intel.com> wrote:
>
> > Hi Colm,
> > I also test the Kerby KDC with kerby kint and MIT kinit, and only
> > listen the tcp port(disable udp), both got ticket successfully. But I
> > don't get the error message. Both krb.conf and kdc.conf should set udp
> > to be false, udp is enabled in default.
> >
> > Thanks
> > Jiajia
> >
> > -----Original Message-----
> > From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > Sent: Friday, May 5, 2017 11:34 PM
> > To: kerby@directory.apache.org
> > Cc: Zheng, Kai <ka...@intel.com>; mailto:m.c.delignie@xs4all.nl <
> > m.c.delignie@xs4all.nl>
> > Subject: Re: MIT Kerberos compatibility
> >
> > Hi Jiajia,
> >
> > If UDP is disabled and we don't use Netty, I can get a token
> > successfully via kinit. However I then see an error message in the Kerby
> console:
> >
> > Exception in thread "Thread-1" java.lang.RuntimeException: Error
> > occured while checking udp connections
> > at
> > org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > KdcNetwork.java:105)
> > at
> > org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > access$000(KdcNetwork.java:39)
> > at
> > org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > run(KdcNetwork.java:75)
> > at java.lang.Thread.run(Thread.java:748)
> > Caused by: java.nio.channels.ClosedChannelException
> > at
> > sun.nio.ch.DatagramChannelImpl.ensureOpen(DatagramChannelImpl.java:320)
> > at sun.nio.ch.DatagramChannelImpl.receive(
> > DatagramChannelImpl.java:331)
> > at
> > org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > checkUdpMessage(KdcNetwork.java:132)
> > at
> > org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > KdcNetwork.java:101)
> >
> > I'm not sure why we are seeing UDP errors when it's disabled?
> >
> > Colm.
> >
> > On Fri, May 5, 2017 at 3:57 PM, Li, Jiajia <ji...@intel.com> wrote:
> >
> > > Hi Colm,
> > > The shell client can't connect to kdc if the UDP is disabled.
> > > We don't use Netty in default.
> > > What's your test-cases? The same as the Marc's?
> > >
> > > Thanks
> > > Jiajia
> > >
> > > -----Original Message-----
> > > From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > > Sent: Friday, May 5, 2017 10:09 PM
> > > To: kerby@directory.apache.org
> > > Cc: Zheng, Kai <ka...@intel.com>; mailto:m.c.delignie@xs4all.nl
> > > < m.c.delignie@xs4all.nl>
> > > Subject: Re: MIT Kerberos compatibility
> > >
> > > Hi Jiajia,
> > >
> > > What are the issues if UDP is disabled and we don't use Netty? I
> > > tried doing this with my own test-cases and it didn't work, so it
> > > would be good to get this fixed soon.
> > >
> > > Colm.
> > >
> > > On Fri, May 5, 2017 at 2:46 PM, Li, Jiajia <ji...@intel.com>
> wrote:
> > >
> > > > Hi Marc,
> > > > >>> - your KRB5 tracing looks quite different. What OS and
> > > > >>> mit-kerberos
> > > > version did you use?
> > > > I use mac os and the python version is 2.7.10
> > > >
> > > > >>>- your KRB5 tracing shows UDP comms between kerberos client and
> > > > >>>KDC,
> > > > despite the allowUDP = false setting
> > > > >>> in my test. I did this setting because I get different
> > > > >>> problems
> > > > without it, see the additional logs below. So,
> > > > >>>we must also be aware of networking problems at my side.
> > > > I enable the UDP and use netty network, there are some issues if
> > > > UDP disabled, you can create a JIRA for this and we can fix this
> > > > issue in the next release version.
> > > >
> > > > The changes in my side as following:
> > > >
> > > > protected boolean allowUdp() {
> > > > return true;
> > > > }
> > > > @Override
> > > > protected void prepareKdc() throws KrbException {
> > > > getKdcServer().setInnerKdcImpl(
> > > > new NettyKdcServerImpl(getKdcServer().getKdcSetting()));
> > > > super.prepareKdc();
> > > > }
> > > >
> > > > Here is log of MitIssueTest:
> > > > [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > > > [nioEventLoopGroup-2-1] INFO
> > > > io.netty.handler.logging.LoggingHandler
> > > > -
> > > > [id: 0x2634fe6b] REGISTERED
> > > > [nioEventLoopGroup-2-1] INFO
> > > > io.netty.handler.logging.LoggingHandler
> > > > -
> > > > [id: 0x2634fe6b] BIND(0.0.0.0/0.0.0.0:53957)
> > > > [nioEventLoopGroup-2-1] INFO
> > > > io.netty.handler.logging.LoggingHandler -
> > > > [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] ACTIVE [main] INFO
> > > > org.apache.kerby.kerberos.kdc.impl.NettyKdcServerImpl - Netty kdc
> > > > server started.
> > > > [nioEventLoopGroup-2-1] INFO
> > > > io.netty.handler.logging.LoggingHandler
> > > > -
> > > > [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] RECEIVED: [id:
> > > > 0xdac7228b, /
> > > > 127.0.0.1:53961 => /127.0.0.1:53957]
> > > > [defaultEventExecutorGroup-4-1] INFO
> > > > org.apache.kerby.kerberos.kerb.server.request.AsRequest
> > > > - AS_REQ ISSUE: authtime 1493991123792,drankye@TEST.COM for
> > > > krbtgt/ TEST.COM@TEST.COM [main] INFO
> > > > org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClien
> > > > t
> > > > - Send to kdc success.
> > > > [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
> > > > Storing the tgt to the credential cache file.
> > > > [nioEventLoopGroup-5-1] INFO
> > > > org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> > > > - The preauth data is empty.
> > > > [nioEventLoopGroup-5-1] INFO
> > > > org.apache.kerby.kerberos.kerb.server.KdcHandler
> > > > - KRB error occurred while processing request:Additional
> > > > pre-authentication required [nioEventLoopGroup-5-1] INFO
> > > > org.apache.kerby.kerberos.kerb.server.request.AsRequest
> > > > - AS_REQ ISSUE: authtime
> > > > 1493991123859,test-service/localhost@TEST.COM
> > > > for krbtgt/TEST.COM@TEST.COM
> > > > [nioEventLoopGroup-5-1] INFO
> > > > org.apache.kerby.kerberos.kerb.server.request.TgsRequest
> > > > - TGS_REQ ISSUE: authtime 1493991142850,drankye for test-service/
> > > > localhost@TEST.COM
> > > >
> > > > Thanks
> > > > Jiajia
> > > >
> > > > -----Original Message-----
> > > > From: Zheng, Kai
> > > > Sent: Friday, May 5, 2017 7:46 PM
> > > > To: kerby@directory.apache.org; Li, Jiajia <ji...@intel.com>
> > > > Subject: RE: MIT Kerberos compatibility
> > > >
> > > > Hi Marc,
> > > >
> > > > Looks like this is quite environment related, could you fire an
> > > > issue for this? I would suggest we target it to 1.1.0, which can
> > > > be done in
> > > June.
> > > >
> > > > Regards,
> > > > Kai
> > > >
> > > > -----Original Message-----
> > > > From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> > > > Sent: Friday, May 05, 2017 4:44 PM
> > > > To: Li, Jiajia <ji...@intel.com>
> > > > Cc: kerby@directory.apache.org
> > > > Subject: Re: MIT Kerberos compatibility
> > > >
> > > > Hi Jiajia,
> > > >
> > > > Great to read that you made progress on this issue and to see a
> > > > working config at your side. Below, I list my progress below (with
> > > > trunk merged into my MitIssue branch), but I am afraid we are not
> > > > done
> > > yet.
> > > >
> > > > Things that stand out:
> > > >
> > > > - the kdc decoding error is solved, relative to the logs without
> > > > your patch
> > > >
> > > > - your KRB5 tracing looks quite different. What OS and
> > > > mit-kerberos version did you use?
> > > >
> > > > - your KRB5 tracing shows UDP comms between kerberos client and
> > > > KDC, despite the allowUDP = false setting in my test. I did this
> > > > setting because I get different problems without it, see the
> > > > additional logs below. So, we must also be aware of networking
> problems at my side.
> > > >
> > > > - the "Response was not from master KDC" msg is not relevant; it
> > > > disappears if you manually add master_kdc to the realms section of
> > > > the krb5.conf
> > > >
> > > > I have no idea how to proceed from here, so that is why I just
> > > > document the status at my side and ask about your - apparently
> > > > working -
> > > config.
> > > >
> > > > Cheers, Marc
> > > >
> > > >
> > > > KDC logging with allowUDP = false:
> > > >
> > > > [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > > > [pool-1-thread-1] INFO
> > > > org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
> > ISSUE:
> > > > authtime 1493970789075,drankye@TEST.COM for
> > > > krbtgt/TEST.COM@TEST.COM [main] INFO
> > > > org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClien
> > > > t
> > > > - Send to kdc success.
> > > > [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
> > > > Storing the tgt to the credential cache file.
> > > > [pool-1-thread-1] INFO
> > > > org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The
> > > > preauth data is empty.
> > > > [pool-1-thread-1] INFO
> > > > org.apache.kerby.kerberos.kerb.server.KdcHandler
> > > > - KRB error occurred while processing request:Additional
> > > > pre-authentication required [pool-1-thread-1] INFO
> > > > org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
> > ISSUE:
> > > > authtime 1493970789108,test-service/localhost@TEST.COM for krbtgt/
> > > > TEST.COM@TEST.COM [pool-1-thread-1] INFO
> > > > org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> > > > - Found fast padata and starting to process it.
> > > > [pool-1-thread-1] INFO
> > > > org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found
> > > > fast padata and starting to process it.
> > > >
> > > > Python script KRB5 tracing (MIT Kerberos 1.13.2 of Ubuntu Xenial)
> > > > with allowUDP = false:
> > > >
> > > > $ .
> > > > kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/
> > > > kerberos/kerb/server/MitIssueTest.sh
> > > > [25281] 1493970797.298753: Retrieving drankye@TEST.COM from
> > > > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> result:
> > > > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > > [25281]
> > > > 1493970797.298952: Retrieving drankye@TEST.COM from
> > > > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> result:
> > > > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > > [25281]
> > > > 1493970797.299106: Retrieving drankye@TEST.COM from
> > > > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> result:
> > > > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > > [25281]
> > > > 1493970797.299213: Retrieving drankye@TEST.COM from
> > > > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> result:
> > > > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > > [25281]
> > > > 1493970797.299323: Retrieving drankye@TEST.COM from
> > > > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> result:
> > > > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > > [25281]
> > > > 1493970797.299436: Retrieving drankye@TEST.COM from
> > > > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> result:
> > > > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > > [25281]
> > > > 1493970797.299545: Retrieving drankye@TEST.COM from
> > > > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> result:
> > > > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > > [25281]
> > > > 1493970797.299654: Retrieving drankye@TEST.COM from
> > > > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> result:
> > > > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > > kerberos.authGSSClientInit successful [25281] 1493970797.299922:
> > > > Getting credentials drankye@TEST.COM -> test-service/localhost@
> > > > using ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > [25281] 1493970797.299945: Retrieving drankye@TEST.COM ->
> > > > test-service/localhost@ from
> > > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > with result:
> > > > -1765328243/Matching credential not found [25281] 1493970797.299959:
> > > > Retrying drankye@TEST.COM -> test-service/localhost@TEST.COM with
> > > result:
> > > > -1765328243/Matching credential not found [25281] 1493970797.299962:
> > > > Server has referral realm; starting with
> > > > test-service/localhost@TEST.COM [25281]
> > > > 1493970797.299975: Retrieving drankye@TEST.COM ->
> > > > krbtgt/TEST.COM@TEST.COM from
> > > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > with result:
> > > > 0/Success [25281] 1493970797.299979: Starting with TGT for client
> > realm:
> > > > drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [25281]
> > 1493970797.299981:
> > > > Requesting tickets for test-service/localhost@TEST.COM, referrals
> > > > on [25281] 1493970797.299994: Generated subkey for TGS request:
> > > > aes128-cts/1B9B [25281] 1493970797.300009: etypes requested in TGS
> > > request:
> > > > aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
> > > > camellia256-cts [25281] 1493970797.300054: Encoding request body
> > > > and padata into FAST request [25281] 1493970797.300080: Sending
> > > > request
> > > > (823 bytes) to TEST.COM [25281] 1493970797.300091: Resolving
> > > > hostname localhost [25281]
> > > > 1493970797.300136: Initiating TCP connection to stream
> > > > 127.0.0.1:34319
> > > > [25281] 1493970797.300191: Sending TCP request to stream
> > > > 127.0.0.1:34319 [25281] 1493970797.303610: Received answer (125
> > > > bytes) from stream
> > > > 127.0.0.1:34319
> > > > [25281] 1493970797.303618: Terminating TCP connection to stream
> > > > 127.0.0.1:34319
> > > > [25281] 1493970797.553126: Response was not from master KDC
> > > > [25281]
> > > > 1493970797.553198: TGS request result: -1765323383/Unknown code
> > > > krcM
> > > > 137 [25281] 1493970797.553234: Requesting tickets for
> > > > test-service/ localhost@TEST.COM, referrals off [25281]
> 1493970797.553273:
> > > > Generated subkey for TGS request: aes128-cts/94C6 [25281]
> > 1493970797.553323:
> > > > etypes requested in TGS request: aes256-cts, aes128-cts,
> > > > des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts [25281]
> > > > 1493970797.553436: Encoding request body and padata into FAST
> > > > request
> > > [25281] 1493970797.553532:
> > > > Sending request (823 bytes) to TEST.COM [25281] 1493970797.553567:
> > > > Resolving hostname localhost [25281] 1493970797.553745: Initiating
> > > > TCP connection to stream
> > > > 127.0.0.1:34319
> > > > [25281] 1493970797.553889: Sending TCP request to stream
> > > > 127.0.0.1:34319 [25281] 1493970797.558297: Received answer (125
> > > > bytes) from stream
> > > > 127.0.0.1:34319
> > > > [25281] 1493970797.558318: Terminating TCP connection to stream
> > > > 127.0.0.1:34319
> > > > [25281] 1493970797.561189: Response was not from master KDC
> > > > [25281]
> > > > 1493970797.561258: TGS request result: -1765323383/Unknown code
> > > > krcM
> > > > 137 ('First kerberos.authGSSClientStep not successful',
> > > > GSSError(('Unspecified GSS failure. Minor code may provide more
> > > > information', 851968), ('Unknown code krcM 137', -1765323383)))
> > > >
> > > >
> > > > KDC logging with allowUDP = true:
> > > >
> > > > [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > > > [pool-1-thread-1] INFO
> > > > org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
> > ISSUE:
> > > > authtime 1493972505784,drankye@TEST.COM for
> > > > krbtgt/TEST.COM@TEST.COM [main] INFO
> > > > org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClien
> > > > t
> > > > - Send to kdc success.
> > > > [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
> > > > Storing the tgt to the credential cache file.
> > > > [pool-1-thread-1] INFO
> > > > org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The
> > > > preauth data is empty.
> > > > [pool-1-thread-1] INFO
> > > > org.apache.kerby.kerberos.kerb.server.KdcHandler
> > > > - KRB error occurred while processing request:Additional
> > > > pre-authentication required [pool-1-thread-2] INFO
> > > > org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
> > ISSUE:
> > > > authtime 1493972505948,test-service/localhost@TEST.COM for krbtgt/
> > > > TEST.COM@TEST.COM Exception in thread "Thread-0"
> > > > java.lang.RuntimeException: Error occured while checking udp
> > connections
> > > > at
> > > > org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > > KdcNetwork.java:105)
> > > > at
> > > > org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > > access$000(KdcNetwork.java:39)
> > > > at
> > > > org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > > > run(KdcNetwork.java:75)
> > > > at java.lang.Thread.run(Thread.java:748)
> > > > Caused by: java.nio.channels.ClosedChannelException
> > > > at
> > > > sun.nio.ch.DatagramChannelImpl.ensureOpen(
> > DatagramChannelImpl.java:320)
> > > > at sun.nio.ch.DatagramChannelImpl.receive(
> > > > DatagramChannelImpl.java:331)
> > > > at
> > > > org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > > checkUdpMessage(KdcNetwork.java:132)
> > > > at
> > > > org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > > KdcNetwork.java:101)
> > > > ... 3 more
> > > >
> > > >
> > > > krb5.conf:
> > > >
> > > > [libdefaults]
> > > > kdc_realm = TEST.COM
> > > > default_realm = TEST.COM
> > > > udp_preference_limit = 4096
> > > > kdc_tcp_port = 37080
> > > > kdc_udp_port = 36525
> > > >
> > > > [realms]
> > > > TEST.COM = {
> > > > kdc = localhost:36525
> > > > }
> > > >
> > > > And port 36525 does not show up in `netstat -l` (while 37080 does)
> > > >
> > > >
> > > > Op 04-05-17 om 14:55 schreef Li, Jiajia:
> > > > > Hi Marc,
> > > > > I try to run your test(through applying your patch in the trunk)
> > > > > , I
> > > > think it's success now. Could you take some time to check about it?
> > > > > Here is the log:
> > > > >
> > > > > directory-kerby git:(trunk) ✗ .
> > > > > kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos
> > > > > /k
> > > > > er
> > > > > b/
> > > > > server/MitIssueTest.sh
> > > > > kerberos.authGSSClientInit successful
> > > > > 2017-05-04T20:44:06 set-error: -1765328234: entypes not
> > > > > supported
> > > > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > > credential for krb5_ccache_conf_data/realm-config@X-CACHECONF:
> > > > > in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > > credential for test-service/localhost@TEST.COM in cache
> > > > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > > credential for
> > > > > krb5_ccache_conf_data/negative-cache/test-service\134/localhost\
> > > > > 13
> > > > > 4@
> > > > > TE
> > > > > ST.COM@X-CACHECONF: in cache
> > > > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > > credential for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF:
> > > > > in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > > credential for krb5_ccache_conf_data/sitename@X-CACHECONF: in
> > > > > cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > > credential for test-service/localhost@TEST.COM in cache
> > > > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > > > des-cbc-md5-deprecated not supported
> > > > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > > > des-cbc-md4-deprecated not supported
> > > > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > > > des-cbc-crc-deprecated not supported
> > > > > 2017-05-04T20:44:06 Trying to find service kdc for realm
> > > > > TEST.COM flags 0
> > > > > 2017-05-04T20:44:06 configuration file for realm TEST.COM found
> > > > > 2017-05-04T20:44:06 submissing new requests to new host
> > > > > 2017-05-04T20:44:06 host_create: setting hostname localhost
> > > > > 2017-05-04T20:44:06 connecting to host: udp ::1:52534
> > > > > (localhost)
> > tid:
> > > > > 00000001
> > > > > 2017-05-04T20:44:06 host_create: setting hostname localhost
> > > > > 2017-05-04T20:44:06 Queuing host in future (in 3s), its the 2
> > > > > address on the same name: udp 127.0.0.1:52534 (localhost) tid:
> > > > > 00000002
> > > > > 2017-05-04T20:44:06 writing packet: udp ::1:52534 (localhost) tid:
> > > > > 00000001
> > > > > 2017-05-04T20:44:06 reading packet: udp ::1:52534 (localhost) tid:
> > > > > 00000001
> > > > > 2017-05-04T20:44:06 host completed: udp ::1:52534 (localhost) tid:
> > > > > 00000001
> > > > > 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0 hosts 1
> > > > > packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814 tid: 00000002
> > > > > 2017-05-04T20:44:06 tkt: extract key 17/763641F3
> > > > > 2017-05-04T20:44:06 set-error: -1765328353: Decrypt integrity
> > > > > check failed for checksum type hmac-sha1-96-aes128, key type
> > > > > aes128-cts-hmac-sha1-96
> > > > > 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
> > > > > 2017-05-04T20:44:06 krb5_get_credentials_with_flags: TEST.COM wc:
> > > > > 0.050317
> > > > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > > credential for krb5_ccache_conf_data/realm-config@X-CACHECONF:
> > > > > in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > > credential for
> > > > > krb5_ccache_conf_data/time-offset/test-service\134/
> > localhost\134@TEST.
> > > > > COM@X-CACHECONF: in cache
> > > > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > > 2017-05-04T20:44:06 Setting up PFS for auth context
> > > > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > > > des-cbc-md5-deprecated not supported
> > > > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > > > des-cbc-md4-deprecated not supported
> > > > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > > > des-cbc-crc-deprecated not supported First
> > > > > kerberos.authGSSClientStep successful
> > > > >
> > > > > Thanks
> > > > > Jiajia
> > > > >
> > > > > -----Original Message-----
> > > > > From: Zheng, Kai [mailto:kai.zheng@intel.com]
> > > > > Sent: Wednesday, May 3, 2017 7:29 PM
> > > > > To: kerby@directory.apache.org
> > > > > Subject: RE: MIT Kerberos compatibility
> > > > >
> > > > > Hi Marc,
> > > > >
> > > > > In case you're not aware of this, please check out the latest
> > > > > fix made
> > > > by Jiajia. We thought your case may be different, but would be
> > > > good to have a check before we can repeat/fix your case. Thanks.
> > > > > https://issues.apache.org/jira/browse/DIRKRB-625
> > > > >
> > > > > Regards,
> > > > > Kai
> > > > >
> > > > > -----Original Message-----
> > > > > From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> > > > > Sent: Sunday, April 30, 2017 7:45 PM
> > > > > To: kerby@directory.apache.org
> > > > > Subject: Re: MIT Kerberos compatibility
> > > > >
> > > > > Hi Kai,
> > > > >
> > > > > The terminal output below is for the latest MIT Kerberos 1.15.1
> > > > > (locally
> > > > built on Ubuntu Xenial). Before that, I also tested with the
> > > > default Xenial MIT Kerberos packages (1.13.2), with the same
> > > > result. I did not try earlier MIT Kerberos versions.
> > > > >
> > > > > Marc
> > > > >
> > > > > Op 29-04-17 om 21:42 schreef Marc de Lignie:
> > > > >> Hi Kai,
> > > > >>
> > > > >> Thanks for the response. I prepared a minimal config that
> > > > >> reproduces my problem.
> > > > >>
> > > > >> You can fetch the branch/commit from:
> > > > >> https://github.com/vtslab/directory-kerby/commits/MitIssue
> > > > >>
> > > > >> This is relative to RC2, but I also tried this on trunk for my
> > > > >> actual project.
> > > > >>
> > > > >> This config produces the debug and error messages below.
> > > > >>
> > > > >> 1. For the terminal with the bash + python script $ klist
> > > > >> Ticket
> > > > >> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > >> Default principal: drankye@TEST.COM
> > > > >>
> > > > >> Valid starting Expires Service principal
> > > > >> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/TEST.COM@TEST.COM
> > > > >> renew until 29-04-17 21:07:39
> > > > >>
> > > > >> $ .
> > > > >> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerbero
> > > > >> s/ ke rb / server/MitIssueTest.sh [15538] 1493491231.917606:
> > > > >> Retrieving drankye@TEST.COM from
> > > > >> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> > > > >> result:
> > > > >> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > > >> [15538]
> > > > >> 1493491231.917827: Retrieving drankye@TEST.COM from
> > > > >> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> > > result:
> > > > >> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > > >> kerberos.authGSSClientInit successful [15538] 1493491231.918185:
> > > > >> Getting credentials drankye@TEST.COM -> test-service/localhost@
> > > > >> using ccache
> > > > >> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > >> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
> > > > >> test-service/localhost@ from
> > > > >> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
> > > > >> -1765328243/Matching credential not found (filename:
> > > > >> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> > > > >> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
> > > > >> test-service/localhost@TEST.COM with result:
> > > > >> -1765328243/Matching credential not found (filename:
> > > > >> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> > > > >> [15538] 1493491231.918229: Server has referral realm; starting
> > > > >> with test-service/localhost@TEST.COM [15538] 1493491231.918278:
> > > > >> Retrieving drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM from
> > > > >> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
> > > > >> 0/Success
> > > > >> [15538] 1493491231.918281: Starting with TGT for client realm:
> > > > >> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
> > > > >> 1493491231.918301: Requesting tickets for
> > > > >> test-service/localhost@TEST.COM, referrals on [15538]
> > > > >> 1493491231.918326: Generated subkey for TGS request:
> > > > >> aes128-cts/FA30
> > > > >> [15538] 1493491231.918359: etypes requested in TGS request:
> > > > >> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2,
> > > > >> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
> > > > >> [15538]
> > 1493491231.918484:
> > > > >> Encoding request body and padata into FAST request [15538]
> > > > >> 1493491231.918541: Sending request (836 bytes) to TEST.COM
> > > > >> [15538]
> > > > >> 1493491231.918597: Resolving hostname localhost [15538]
> > > > >> 1493491231.918703: Initiating TCP connection to stream
> > > > >> 127.0.0.1:44292
> > > > >> [15538] 1493491231.918777: Sending TCP request to stream
> > > > >> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error receiving
> > > > >> from stream
> > > > >> 127.0.0.1:44292: 104/Connection reset by peer [15538]
> > > > >> 1493491231.922812: Terminating TCP connection to stream
> > > > >> 127.0.0.1:44292
> > > > >> [15538] 1493491231.922858: Sending initial UDP request to dgram
> > > > >> 127.0.0.1:44292
> > > > >> ('First kerberos.authGSSClientStep not successful',
> > > > >> GSSError(('Unspecified GSS failure. Minor code may provide
> > > > >> more information', 851968), ("Cannot contact any KDC for realm
> > > > >> 'TEST.COM'",
> > > > >> -1765328228)))
> > > > >>
> > > > >> 2. For the terminal that runs mvn clean test
> > > > >> -Dtest=MitIssueTest Running
> > > > >> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > > > >> 2017-04-29 21:07:39,182 DEBUG [main] backend.
> > AbstractIdentityBackend:
> > > > >> initialize called
> > > > >> 2017-04-29 21:07:39,195 DEBUG [main] backend.
> > AbstractIdentityBackend:
> > > > >> getIdentity called, principalName = krbtgt/TEST.COM@TEST.COM
> > > > >> 2017-04-29 21:07:39,195 DEBUG [main] backend.
> > AbstractIdentityBackend:
> > > > >> getIdentity failed, principalName = krbtgt/TEST.COM@TEST.COM
> > > > >> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> > AbstractIdentityBackend:
> > > > >> addIdentity successful, principalName =
> > > > >> krbtgt/TEST.COM@TEST.COM
> > > > >> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> > AbstractIdentityBackend:
> > > > >> getIdentity called, principalName = kadmin/TEST.COM@TEST.COM
> > > > >> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> > AbstractIdentityBackend:
> > > > >> getIdentity failed, principalName = kadmin/TEST.COM@TEST.COM
> > > > >> 2017-04-29 21:07:39,213 DEBUG [main] backend.
> > AbstractIdentityBackend:
> > > > >> addIdentity successful, principalName =
> > > > >> kadmin/TEST.COM@TEST.COM
> > > > >> 2017-04-29 21:07:39,216 DEBUG [main] backend.
> > AbstractIdentityBackend:
> > > > >> start called
> > > > >> 2017-04-29 21:07:39,232 DEBUG [main] backend.
> > AbstractIdentityBackend:
> > > > >> addIdentity successful, principalName =
> > > > >> test-service/localhost@TEST.COM
> > > > >> 2017-04-29 21:07:39,425 DEBUG [main] backend.
> > AbstractIdentityBackend:
> > > > >> addIdentity successful, principalName = drankye@TEST.COM
> > > > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > > >> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1]
> request.KdcRequest:
> > > > >> Client entry is empty.
> > > > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > > >> principalName = drankye@TEST.COM
> > > > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > > >> principalName = drankye@TEST.COM
> > > > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > > >> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
> > > > >> impl.DefaultKdcHandler: Transport or decoding error occurred,
> > > > >> disconnecting abnormally java.io.EOFException
> > > > >> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> > > > >> at
> > > > >> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > > > receiveMessage(KrbTcpTransport.java:54)
> > > > >> at
> > > > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
> > > > >> n(
> > > > DefaultKdcHandler.java:46)
> > > > >> at
> > > > >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > > ThreadPoolExecutor.java:1142)
> > > > >> at
> > > > >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > > ThreadPoolExecutor.java:617)
> > > > >> at java.lang.Thread.run(Thread.java:748)
> > > > >> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase:
> > > > >> Storing the tgt to the credential cache file.
> > > > >> 2017-04-29 21:07:39,491 DEBUG [main] backend.
> > AbstractIdentityBackend:
> > > > >> getIdentity called, principalName =
> > > > >> test-service/localhost@TEST.COM
> > > > >> 2017-04-29 21:07:39,491 DEBUG [main] backend.
> > AbstractIdentityBackend:
> > > > >> getIdentity successful, principalName =
> > > > >> test-service/localhost@TEST.COM
> > > > >> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> > > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > > >> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> > > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > > >> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1]
> request.KdcRequest:
> > > > >> Client entry is empty.
> > > > >> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > > >> principalName = test-service/localhost@TEST.COM
> > > > >> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > > >> principalName = test-service/localhost@TEST.COM
> > > > >> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > > >> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > > >> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1]
> request.KdcRequest:
> > > > >> The preauth data is empty.
> > > > >> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1] server.KdcHandler:
> > > > >> KRB error occurred while processing request:Additional
> > > > >> pre-authentication required
> > > > >> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
> > > > >> impl.DefaultKdcHandler: Transport or decoding error occurred,
> > > > >> disconnecting abnormally java.io.EOFException
> > > > >> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> > > > >> at
> > > > >> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > > > receiveMessage(KrbTcpTransport.java:54)
> > > > >> at
> > > > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
> > > > >> n(
> > > > DefaultKdcHandler.java:46)
> > > > >> at
> > > > >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > > ThreadPoolExecutor.java:1142)
> > > > >> at
> > > > >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > > ThreadPoolExecutor.java:617)
> > > > >> at java.lang.Thread.run(Thread.java:748)
> > > > >> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> > > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > > >> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> > > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > > >> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1]
> request.KdcRequest:
> > > > >> Client entry is empty.
> > > > >> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > > >> principalName = test-service/localhost@TEST.COM
> > > > >> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > > >> principalName = test-service/localhost@TEST.COM
> > > > >> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > > >> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > > >> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
> > > > >> impl.DefaultKdcHandler: Transport or decoding error occurred,
> > > > >> disconnecting abnormally java.io.EOFException
> > > > >> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> > > > >> at
> > > > >> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > > > receiveMessage(KrbTcpTransport.java:54)
> > > > >> at
> > > > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
> > > > >> n(
> > > > DefaultKdcHandler.java:46)
> > > > >> at
> > > > >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > > ThreadPoolExecutor.java:1142)
> > > > >> at
> > > > >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > > ThreadPoolExecutor.java:617)
> > > > >> at java.lang.Thread.run(Thread.java:748)
> > > > >> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> > > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > > >> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> > > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > > >> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1]
> request.KdcRequest:
> > > > >> Found fast padata and start to process it.
> > > > >> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
> > > > >> impl.DefaultKdcHandler: Error occured while processing request:
> > > > >> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
> > > > >> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> > > > java:85)
> > > > >> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> > > > java:70)
> > > > >> at
> > > > >> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFin
> > > > >> dF
> > > > >> as
> > > > >> t(
> > > > KdcRequest.java:208)
> > > > >> at
> > > > >> org.apache.kerby.kerberos.kerb.server.request.
> > > > KdcRequest.process(KdcRequest.java:168)
> > > > >> at
> > > > >> org.apache.kerby.kerberos.kerb.server.KdcHandler.
> > > > handleMessage(KdcHandler.java:115)
> > > > >> at
> > > > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
> > > > handleMessage(DefaultKdcHandler.java:67)
> > > > >> at
> > > > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
> > > > >> n(
> > > > DefaultKdcHandler.java:52)
> > > > >> at
> > > > >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > > ThreadPoolExecutor.java:1142)
> > > > >> at
> > > > >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > > ThreadPoolExecutor.java:617)
> > > > >> at java.lang.Thread.run(Thread.java:748)
> > > > >> Caused by: java.io.IOException: Unexpected item context [0]
> > > > >> [tag=0xA0, off=0, len=3+207], expecting 0x30
> > > > >> at
> > > > >> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > > > Asn1Encodeable.java:210)
> > > > >> at
> > > > >> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > > > Asn1Encodeable.java:197)
> > > > >> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> > > > java:83)
> > > > >> ... 9 more
> > > > >> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
> > > > >> impl.DefaultKdcHandler: Transport or decoding error occurred,
> > > > >> disconnecting abnormally
> > > > >> java.net.SocketException: Socket closed
> > > > >> at java.net.SocketInputStream.socketRead0(Native Method)
> > > > >> at java.net.SocketInputStream.socketRead(SocketInputStream.
> > > > java:116)
> > > > >> at java.net.SocketInputStream.read(SocketInputStream.java:
> 171)
> > > > >> at java.net.SocketInputStream.read(SocketInputStream.java:
> 141)
> > > > >> at java.net.SocketInputStream.read(SocketInputStream.java:
> 224)
> > > > >> at java.io.DataInputStream.readInt(DataInputStream.java:387)
> > > > >> at
> > > > >> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > > > receiveMessage(KrbTcpTransport.java:54)
> > > > >> at
> > > > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
> > > > >> n(
> > > > DefaultKdcHandler.java:46)
> > > > >> at
> > > > >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > > ThreadPoolExecutor.java:1142)
> > > > >> at
> > > > >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > > ThreadPoolExecutor.java:617)
> > > > >> at java.lang.Thread.run(Thread.java:748)
> > > > >>
> > > > >> In a FreeIPA environment these python lines "just" work.
> > > > >>
> > > > >> Any suggestions are welcome!
> > > > >>
> > > > >> Marc
> > > > >>
> > > > >>
> > > > > --
> > > > > Marc de Lignie
> > > > >
> > > >
> > > > --
> > > > Marc de Lignie
> > > >
> > > >
> > >
> > >
> > > --
> > > Colm O hEigeartaigh
> > >
> > > Talend Community Coder
> > > http://coders.talend.com
> > >
> >
> >
> >
> > --
> > Colm O hEigeartaigh
> >
> > Talend Community Coder
> > http://coders.talend.com
> >
>
>
>
> --
> Colm O hEigeartaigh
>
> Talend Community Coder
> http://coders.talend.com
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
RE: MIT Kerberos compatibility
Posted by "Li, Jiajia" <ji...@intel.com>.
Are you sure add kdc_allow_udp = false in kdc.conf?
Thanks
Jiajia
-----Original Message-----
From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
Sent: Friday, May 5, 2017 11:41 PM
To: Li, Jiajia <ji...@intel.com>
Cc: kerby@directory.apache.org; Zheng, Kai <ka...@intel.com>; mailto:m.c.delignie@xs4all.nl <m....@xs4all.nl>
Subject: Re: MIT Kerberos compatibility
Sorry, it was my error, UDP was actually enabled there. But why am I still seeing that error message?
Colm.
On Fri, May 5, 2017 at 4:39 PM, Li, Jiajia <ji...@intel.com> wrote:
> Hi Colm,
> I also test the Kerby KDC with kerby kint and MIT kinit, and only
> listen the tcp port(disable udp), both got ticket successfully. But I
> don't get the error message. Both krb.conf and kdc.conf should set udp
> to be false, udp is enabled in default.
>
> Thanks
> Jiajia
>
> -----Original Message-----
> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> Sent: Friday, May 5, 2017 11:34 PM
> To: kerby@directory.apache.org
> Cc: Zheng, Kai <ka...@intel.com>; mailto:m.c.delignie@xs4all.nl <
> m.c.delignie@xs4all.nl>
> Subject: Re: MIT Kerberos compatibility
>
> Hi Jiajia,
>
> If UDP is disabled and we don't use Netty, I can get a token
> successfully via kinit. However I then see an error message in the Kerby console:
>
> Exception in thread "Thread-1" java.lang.RuntimeException: Error
> occured while checking udp connections
> at
> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> KdcNetwork.java:105)
> at
> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> access$000(KdcNetwork.java:39)
> at
> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> run(KdcNetwork.java:75)
> at java.lang.Thread.run(Thread.java:748)
> Caused by: java.nio.channels.ClosedChannelException
> at
> sun.nio.ch.DatagramChannelImpl.ensureOpen(DatagramChannelImpl.java:320)
> at sun.nio.ch.DatagramChannelImpl.receive(
> DatagramChannelImpl.java:331)
> at
> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> checkUdpMessage(KdcNetwork.java:132)
> at
> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> KdcNetwork.java:101)
>
> I'm not sure why we are seeing UDP errors when it's disabled?
>
> Colm.
>
> On Fri, May 5, 2017 at 3:57 PM, Li, Jiajia <ji...@intel.com> wrote:
>
> > Hi Colm,
> > The shell client can't connect to kdc if the UDP is disabled.
> > We don't use Netty in default.
> > What's your test-cases? The same as the Marc's?
> >
> > Thanks
> > Jiajia
> >
> > -----Original Message-----
> > From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > Sent: Friday, May 5, 2017 10:09 PM
> > To: kerby@directory.apache.org
> > Cc: Zheng, Kai <ka...@intel.com>; mailto:m.c.delignie@xs4all.nl
> > < m.c.delignie@xs4all.nl>
> > Subject: Re: MIT Kerberos compatibility
> >
> > Hi Jiajia,
> >
> > What are the issues if UDP is disabled and we don't use Netty? I
> > tried doing this with my own test-cases and it didn't work, so it
> > would be good to get this fixed soon.
> >
> > Colm.
> >
> > On Fri, May 5, 2017 at 2:46 PM, Li, Jiajia <ji...@intel.com> wrote:
> >
> > > Hi Marc,
> > > >>> - your KRB5 tracing looks quite different. What OS and
> > > >>> mit-kerberos
> > > version did you use?
> > > I use mac os and the python version is 2.7.10
> > >
> > > >>>- your KRB5 tracing shows UDP comms between kerberos client and
> > > >>>KDC,
> > > despite the allowUDP = false setting
> > > >>> in my test. I did this setting because I get different
> > > >>> problems
> > > without it, see the additional logs below. So,
> > > >>>we must also be aware of networking problems at my side.
> > > I enable the UDP and use netty network, there are some issues if
> > > UDP disabled, you can create a JIRA for this and we can fix this
> > > issue in the next release version.
> > >
> > > The changes in my side as following:
> > >
> > > protected boolean allowUdp() {
> > > return true;
> > > }
> > > @Override
> > > protected void prepareKdc() throws KrbException {
> > > getKdcServer().setInnerKdcImpl(
> > > new NettyKdcServerImpl(getKdcServer().getKdcSetting()));
> > > super.prepareKdc();
> > > }
> > >
> > > Here is log of MitIssueTest:
> > > [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > > [nioEventLoopGroup-2-1] INFO
> > > io.netty.handler.logging.LoggingHandler
> > > -
> > > [id: 0x2634fe6b] REGISTERED
> > > [nioEventLoopGroup-2-1] INFO
> > > io.netty.handler.logging.LoggingHandler
> > > -
> > > [id: 0x2634fe6b] BIND(0.0.0.0/0.0.0.0:53957)
> > > [nioEventLoopGroup-2-1] INFO
> > > io.netty.handler.logging.LoggingHandler -
> > > [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] ACTIVE [main] INFO
> > > org.apache.kerby.kerberos.kdc.impl.NettyKdcServerImpl - Netty kdc
> > > server started.
> > > [nioEventLoopGroup-2-1] INFO
> > > io.netty.handler.logging.LoggingHandler
> > > -
> > > [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] RECEIVED: [id:
> > > 0xdac7228b, /
> > > 127.0.0.1:53961 => /127.0.0.1:53957]
> > > [defaultEventExecutorGroup-4-1] INFO
> > > org.apache.kerby.kerberos.kerb.server.request.AsRequest
> > > - AS_REQ ISSUE: authtime 1493991123792,drankye@TEST.COM for
> > > krbtgt/ TEST.COM@TEST.COM [main] INFO
> > > org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClien
> > > t
> > > - Send to kdc success.
> > > [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
> > > Storing the tgt to the credential cache file.
> > > [nioEventLoopGroup-5-1] INFO
> > > org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> > > - The preauth data is empty.
> > > [nioEventLoopGroup-5-1] INFO
> > > org.apache.kerby.kerberos.kerb.server.KdcHandler
> > > - KRB error occurred while processing request:Additional
> > > pre-authentication required [nioEventLoopGroup-5-1] INFO
> > > org.apache.kerby.kerberos.kerb.server.request.AsRequest
> > > - AS_REQ ISSUE: authtime
> > > 1493991123859,test-service/localhost@TEST.COM
> > > for krbtgt/TEST.COM@TEST.COM
> > > [nioEventLoopGroup-5-1] INFO
> > > org.apache.kerby.kerberos.kerb.server.request.TgsRequest
> > > - TGS_REQ ISSUE: authtime 1493991142850,drankye for test-service/
> > > localhost@TEST.COM
> > >
> > > Thanks
> > > Jiajia
> > >
> > > -----Original Message-----
> > > From: Zheng, Kai
> > > Sent: Friday, May 5, 2017 7:46 PM
> > > To: kerby@directory.apache.org; Li, Jiajia <ji...@intel.com>
> > > Subject: RE: MIT Kerberos compatibility
> > >
> > > Hi Marc,
> > >
> > > Looks like this is quite environment related, could you fire an
> > > issue for this? I would suggest we target it to 1.1.0, which can
> > > be done in
> > June.
> > >
> > > Regards,
> > > Kai
> > >
> > > -----Original Message-----
> > > From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> > > Sent: Friday, May 05, 2017 4:44 PM
> > > To: Li, Jiajia <ji...@intel.com>
> > > Cc: kerby@directory.apache.org
> > > Subject: Re: MIT Kerberos compatibility
> > >
> > > Hi Jiajia,
> > >
> > > Great to read that you made progress on this issue and to see a
> > > working config at your side. Below, I list my progress below (with
> > > trunk merged into my MitIssue branch), but I am afraid we are not
> > > done
> > yet.
> > >
> > > Things that stand out:
> > >
> > > - the kdc decoding error is solved, relative to the logs without
> > > your patch
> > >
> > > - your KRB5 tracing looks quite different. What OS and
> > > mit-kerberos version did you use?
> > >
> > > - your KRB5 tracing shows UDP comms between kerberos client and
> > > KDC, despite the allowUDP = false setting in my test. I did this
> > > setting because I get different problems without it, see the
> > > additional logs below. So, we must also be aware of networking problems at my side.
> > >
> > > - the "Response was not from master KDC" msg is not relevant; it
> > > disappears if you manually add master_kdc to the realms section of
> > > the krb5.conf
> > >
> > > I have no idea how to proceed from here, so that is why I just
> > > document the status at my side and ask about your - apparently
> > > working -
> > config.
> > >
> > > Cheers, Marc
> > >
> > >
> > > KDC logging with allowUDP = false:
> > >
> > > [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > > [pool-1-thread-1] INFO
> > > org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
> ISSUE:
> > > authtime 1493970789075,drankye@TEST.COM for
> > > krbtgt/TEST.COM@TEST.COM [main] INFO
> > > org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClien
> > > t
> > > - Send to kdc success.
> > > [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
> > > Storing the tgt to the credential cache file.
> > > [pool-1-thread-1] INFO
> > > org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The
> > > preauth data is empty.
> > > [pool-1-thread-1] INFO
> > > org.apache.kerby.kerberos.kerb.server.KdcHandler
> > > - KRB error occurred while processing request:Additional
> > > pre-authentication required [pool-1-thread-1] INFO
> > > org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
> ISSUE:
> > > authtime 1493970789108,test-service/localhost@TEST.COM for krbtgt/
> > > TEST.COM@TEST.COM [pool-1-thread-1] INFO
> > > org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> > > - Found fast padata and starting to process it.
> > > [pool-1-thread-1] INFO
> > > org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found
> > > fast padata and starting to process it.
> > >
> > > Python script KRB5 tracing (MIT Kerberos 1.13.2 of Ubuntu Xenial)
> > > with allowUDP = false:
> > >
> > > $ .
> > > kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/
> > > kerberos/kerb/server/MitIssueTest.sh
> > > [25281] 1493970797.298753: Retrieving drankye@TEST.COM from
> > > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > [25281]
> > > 1493970797.298952: Retrieving drankye@TEST.COM from
> > > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > [25281]
> > > 1493970797.299106: Retrieving drankye@TEST.COM from
> > > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > [25281]
> > > 1493970797.299213: Retrieving drankye@TEST.COM from
> > > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > [25281]
> > > 1493970797.299323: Retrieving drankye@TEST.COM from
> > > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > [25281]
> > > 1493970797.299436: Retrieving drankye@TEST.COM from
> > > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > [25281]
> > > 1493970797.299545: Retrieving drankye@TEST.COM from
> > > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > [25281]
> > > 1493970797.299654: Retrieving drankye@TEST.COM from
> > > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > kerberos.authGSSClientInit successful [25281] 1493970797.299922:
> > > Getting credentials drankye@TEST.COM -> test-service/localhost@
> > > using ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > [25281] 1493970797.299945: Retrieving drankye@TEST.COM ->
> > > test-service/localhost@ from
> > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > with result:
> > > -1765328243/Matching credential not found [25281] 1493970797.299959:
> > > Retrying drankye@TEST.COM -> test-service/localhost@TEST.COM with
> > result:
> > > -1765328243/Matching credential not found [25281] 1493970797.299962:
> > > Server has referral realm; starting with
> > > test-service/localhost@TEST.COM [25281]
> > > 1493970797.299975: Retrieving drankye@TEST.COM ->
> > > krbtgt/TEST.COM@TEST.COM from
> > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > with result:
> > > 0/Success [25281] 1493970797.299979: Starting with TGT for client
> realm:
> > > drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [25281]
> 1493970797.299981:
> > > Requesting tickets for test-service/localhost@TEST.COM, referrals
> > > on [25281] 1493970797.299994: Generated subkey for TGS request:
> > > aes128-cts/1B9B [25281] 1493970797.300009: etypes requested in TGS
> > request:
> > > aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
> > > camellia256-cts [25281] 1493970797.300054: Encoding request body
> > > and padata into FAST request [25281] 1493970797.300080: Sending
> > > request
> > > (823 bytes) to TEST.COM [25281] 1493970797.300091: Resolving
> > > hostname localhost [25281]
> > > 1493970797.300136: Initiating TCP connection to stream
> > > 127.0.0.1:34319
> > > [25281] 1493970797.300191: Sending TCP request to stream
> > > 127.0.0.1:34319 [25281] 1493970797.303610: Received answer (125
> > > bytes) from stream
> > > 127.0.0.1:34319
> > > [25281] 1493970797.303618: Terminating TCP connection to stream
> > > 127.0.0.1:34319
> > > [25281] 1493970797.553126: Response was not from master KDC
> > > [25281]
> > > 1493970797.553198: TGS request result: -1765323383/Unknown code
> > > krcM
> > > 137 [25281] 1493970797.553234: Requesting tickets for
> > > test-service/ localhost@TEST.COM, referrals off [25281] 1493970797.553273:
> > > Generated subkey for TGS request: aes128-cts/94C6 [25281]
> 1493970797.553323:
> > > etypes requested in TGS request: aes256-cts, aes128-cts,
> > > des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts [25281]
> > > 1493970797.553436: Encoding request body and padata into FAST
> > > request
> > [25281] 1493970797.553532:
> > > Sending request (823 bytes) to TEST.COM [25281] 1493970797.553567:
> > > Resolving hostname localhost [25281] 1493970797.553745: Initiating
> > > TCP connection to stream
> > > 127.0.0.1:34319
> > > [25281] 1493970797.553889: Sending TCP request to stream
> > > 127.0.0.1:34319 [25281] 1493970797.558297: Received answer (125
> > > bytes) from stream
> > > 127.0.0.1:34319
> > > [25281] 1493970797.558318: Terminating TCP connection to stream
> > > 127.0.0.1:34319
> > > [25281] 1493970797.561189: Response was not from master KDC
> > > [25281]
> > > 1493970797.561258: TGS request result: -1765323383/Unknown code
> > > krcM
> > > 137 ('First kerberos.authGSSClientStep not successful',
> > > GSSError(('Unspecified GSS failure. Minor code may provide more
> > > information', 851968), ('Unknown code krcM 137', -1765323383)))
> > >
> > >
> > > KDC logging with allowUDP = true:
> > >
> > > [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > > [pool-1-thread-1] INFO
> > > org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
> ISSUE:
> > > authtime 1493972505784,drankye@TEST.COM for
> > > krbtgt/TEST.COM@TEST.COM [main] INFO
> > > org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClien
> > > t
> > > - Send to kdc success.
> > > [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
> > > Storing the tgt to the credential cache file.
> > > [pool-1-thread-1] INFO
> > > org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The
> > > preauth data is empty.
> > > [pool-1-thread-1] INFO
> > > org.apache.kerby.kerberos.kerb.server.KdcHandler
> > > - KRB error occurred while processing request:Additional
> > > pre-authentication required [pool-1-thread-2] INFO
> > > org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
> ISSUE:
> > > authtime 1493972505948,test-service/localhost@TEST.COM for krbtgt/
> > > TEST.COM@TEST.COM Exception in thread "Thread-0"
> > > java.lang.RuntimeException: Error occured while checking udp
> connections
> > > at
> > > org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > KdcNetwork.java:105)
> > > at
> > > org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > access$000(KdcNetwork.java:39)
> > > at
> > > org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > > run(KdcNetwork.java:75)
> > > at java.lang.Thread.run(Thread.java:748)
> > > Caused by: java.nio.channels.ClosedChannelException
> > > at
> > > sun.nio.ch.DatagramChannelImpl.ensureOpen(
> DatagramChannelImpl.java:320)
> > > at sun.nio.ch.DatagramChannelImpl.receive(
> > > DatagramChannelImpl.java:331)
> > > at
> > > org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > checkUdpMessage(KdcNetwork.java:132)
> > > at
> > > org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > KdcNetwork.java:101)
> > > ... 3 more
> > >
> > >
> > > krb5.conf:
> > >
> > > [libdefaults]
> > > kdc_realm = TEST.COM
> > > default_realm = TEST.COM
> > > udp_preference_limit = 4096
> > > kdc_tcp_port = 37080
> > > kdc_udp_port = 36525
> > >
> > > [realms]
> > > TEST.COM = {
> > > kdc = localhost:36525
> > > }
> > >
> > > And port 36525 does not show up in `netstat -l` (while 37080 does)
> > >
> > >
> > > Op 04-05-17 om 14:55 schreef Li, Jiajia:
> > > > Hi Marc,
> > > > I try to run your test(through applying your patch in the trunk)
> > > > , I
> > > think it's success now. Could you take some time to check about it?
> > > > Here is the log:
> > > >
> > > > directory-kerby git:(trunk) ✗ .
> > > > kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos
> > > > /k
> > > > er
> > > > b/
> > > > server/MitIssueTest.sh
> > > > kerberos.authGSSClientInit successful
> > > > 2017-05-04T20:44:06 set-error: -1765328234: entypes not
> > > > supported
> > > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > credential for krb5_ccache_conf_data/realm-config@X-CACHECONF:
> > > > in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > credential for test-service/localhost@TEST.COM in cache
> > > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > credential for
> > > > krb5_ccache_conf_data/negative-cache/test-service\134/localhost\
> > > > 13
> > > > 4@
> > > > TE
> > > > ST.COM@X-CACHECONF: in cache
> > > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > credential for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF:
> > > > in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > credential for krb5_ccache_conf_data/sitename@X-CACHECONF: in
> > > > cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > credential for test-service/localhost@TEST.COM in cache
> > > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > > des-cbc-md5-deprecated not supported
> > > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > > des-cbc-md4-deprecated not supported
> > > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > > des-cbc-crc-deprecated not supported
> > > > 2017-05-04T20:44:06 Trying to find service kdc for realm
> > > > TEST.COM flags 0
> > > > 2017-05-04T20:44:06 configuration file for realm TEST.COM found
> > > > 2017-05-04T20:44:06 submissing new requests to new host
> > > > 2017-05-04T20:44:06 host_create: setting hostname localhost
> > > > 2017-05-04T20:44:06 connecting to host: udp ::1:52534
> > > > (localhost)
> tid:
> > > > 00000001
> > > > 2017-05-04T20:44:06 host_create: setting hostname localhost
> > > > 2017-05-04T20:44:06 Queuing host in future (in 3s), its the 2
> > > > address on the same name: udp 127.0.0.1:52534 (localhost) tid:
> > > > 00000002
> > > > 2017-05-04T20:44:06 writing packet: udp ::1:52534 (localhost) tid:
> > > > 00000001
> > > > 2017-05-04T20:44:06 reading packet: udp ::1:52534 (localhost) tid:
> > > > 00000001
> > > > 2017-05-04T20:44:06 host completed: udp ::1:52534 (localhost) tid:
> > > > 00000001
> > > > 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0 hosts 1
> > > > packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814 tid: 00000002
> > > > 2017-05-04T20:44:06 tkt: extract key 17/763641F3
> > > > 2017-05-04T20:44:06 set-error: -1765328353: Decrypt integrity
> > > > check failed for checksum type hmac-sha1-96-aes128, key type
> > > > aes128-cts-hmac-sha1-96
> > > > 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
> > > > 2017-05-04T20:44:06 krb5_get_credentials_with_flags: TEST.COM wc:
> > > > 0.050317
> > > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > credential for krb5_ccache_conf_data/realm-config@X-CACHECONF:
> > > > in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > credential for
> > > > krb5_ccache_conf_data/time-offset/test-service\134/
> localhost\134@TEST.
> > > > COM@X-CACHECONF: in cache
> > > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > 2017-05-04T20:44:06 Setting up PFS for auth context
> > > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > > des-cbc-md5-deprecated not supported
> > > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > > des-cbc-md4-deprecated not supported
> > > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > > des-cbc-crc-deprecated not supported First
> > > > kerberos.authGSSClientStep successful
> > > >
> > > > Thanks
> > > > Jiajia
> > > >
> > > > -----Original Message-----
> > > > From: Zheng, Kai [mailto:kai.zheng@intel.com]
> > > > Sent: Wednesday, May 3, 2017 7:29 PM
> > > > To: kerby@directory.apache.org
> > > > Subject: RE: MIT Kerberos compatibility
> > > >
> > > > Hi Marc,
> > > >
> > > > In case you're not aware of this, please check out the latest
> > > > fix made
> > > by Jiajia. We thought your case may be different, but would be
> > > good to have a check before we can repeat/fix your case. Thanks.
> > > > https://issues.apache.org/jira/browse/DIRKRB-625
> > > >
> > > > Regards,
> > > > Kai
> > > >
> > > > -----Original Message-----
> > > > From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> > > > Sent: Sunday, April 30, 2017 7:45 PM
> > > > To: kerby@directory.apache.org
> > > > Subject: Re: MIT Kerberos compatibility
> > > >
> > > > Hi Kai,
> > > >
> > > > The terminal output below is for the latest MIT Kerberos 1.15.1
> > > > (locally
> > > built on Ubuntu Xenial). Before that, I also tested with the
> > > default Xenial MIT Kerberos packages (1.13.2), with the same
> > > result. I did not try earlier MIT Kerberos versions.
> > > >
> > > > Marc
> > > >
> > > > Op 29-04-17 om 21:42 schreef Marc de Lignie:
> > > >> Hi Kai,
> > > >>
> > > >> Thanks for the response. I prepared a minimal config that
> > > >> reproduces my problem.
> > > >>
> > > >> You can fetch the branch/commit from:
> > > >> https://github.com/vtslab/directory-kerby/commits/MitIssue
> > > >>
> > > >> This is relative to RC2, but I also tried this on trunk for my
> > > >> actual project.
> > > >>
> > > >> This config produces the debug and error messages below.
> > > >>
> > > >> 1. For the terminal with the bash + python script $ klist
> > > >> Ticket
> > > >> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >> Default principal: drankye@TEST.COM
> > > >>
> > > >> Valid starting Expires Service principal
> > > >> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/TEST.COM@TEST.COM
> > > >> renew until 29-04-17 21:07:39
> > > >>
> > > >> $ .
> > > >> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerbero
> > > >> s/ ke rb / server/MitIssueTest.sh [15538] 1493491231.917606:
> > > >> Retrieving drankye@TEST.COM from
> > > >> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> > > >> result:
> > > >> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > >> [15538]
> > > >> 1493491231.917827: Retrieving drankye@TEST.COM from
> > > >> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> > result:
> > > >> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > >> kerberos.authGSSClientInit successful [15538] 1493491231.918185:
> > > >> Getting credentials drankye@TEST.COM -> test-service/localhost@
> > > >> using ccache
> > > >> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
> > > >> test-service/localhost@ from
> > > >> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
> > > >> -1765328243/Matching credential not found (filename:
> > > >> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> > > >> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
> > > >> test-service/localhost@TEST.COM with result:
> > > >> -1765328243/Matching credential not found (filename:
> > > >> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> > > >> [15538] 1493491231.918229: Server has referral realm; starting
> > > >> with test-service/localhost@TEST.COM [15538] 1493491231.918278:
> > > >> Retrieving drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM from
> > > >> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
> > > >> 0/Success
> > > >> [15538] 1493491231.918281: Starting with TGT for client realm:
> > > >> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
> > > >> 1493491231.918301: Requesting tickets for
> > > >> test-service/localhost@TEST.COM, referrals on [15538]
> > > >> 1493491231.918326: Generated subkey for TGS request:
> > > >> aes128-cts/FA30
> > > >> [15538] 1493491231.918359: etypes requested in TGS request:
> > > >> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2,
> > > >> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
> > > >> [15538]
> 1493491231.918484:
> > > >> Encoding request body and padata into FAST request [15538]
> > > >> 1493491231.918541: Sending request (836 bytes) to TEST.COM
> > > >> [15538]
> > > >> 1493491231.918597: Resolving hostname localhost [15538]
> > > >> 1493491231.918703: Initiating TCP connection to stream
> > > >> 127.0.0.1:44292
> > > >> [15538] 1493491231.918777: Sending TCP request to stream
> > > >> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error receiving
> > > >> from stream
> > > >> 127.0.0.1:44292: 104/Connection reset by peer [15538]
> > > >> 1493491231.922812: Terminating TCP connection to stream
> > > >> 127.0.0.1:44292
> > > >> [15538] 1493491231.922858: Sending initial UDP request to dgram
> > > >> 127.0.0.1:44292
> > > >> ('First kerberos.authGSSClientStep not successful',
> > > >> GSSError(('Unspecified GSS failure. Minor code may provide
> > > >> more information', 851968), ("Cannot contact any KDC for realm
> > > >> 'TEST.COM'",
> > > >> -1765328228)))
> > > >>
> > > >> 2. For the terminal that runs mvn clean test
> > > >> -Dtest=MitIssueTest Running
> > > >> org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > > >> 2017-04-29 21:07:39,182 DEBUG [main] backend.
> AbstractIdentityBackend:
> > > >> initialize called
> > > >> 2017-04-29 21:07:39,195 DEBUG [main] backend.
> AbstractIdentityBackend:
> > > >> getIdentity called, principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,195 DEBUG [main] backend.
> AbstractIdentityBackend:
> > > >> getIdentity failed, principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> AbstractIdentityBackend:
> > > >> addIdentity successful, principalName =
> > > >> krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> AbstractIdentityBackend:
> > > >> getIdentity called, principalName = kadmin/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> AbstractIdentityBackend:
> > > >> getIdentity failed, principalName = kadmin/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,213 DEBUG [main] backend.
> AbstractIdentityBackend:
> > > >> addIdentity successful, principalName =
> > > >> kadmin/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,216 DEBUG [main] backend.
> AbstractIdentityBackend:
> > > >> start called
> > > >> 2017-04-29 21:07:39,232 DEBUG [main] backend.
> AbstractIdentityBackend:
> > > >> addIdentity successful, principalName =
> > > >> test-service/localhost@TEST.COM
> > > >> 2017-04-29 21:07:39,425 DEBUG [main] backend.
> AbstractIdentityBackend:
> > > >> addIdentity successful, principalName = drankye@TEST.COM
> > > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1] request.KdcRequest:
> > > >> Client entry is empty.
> > > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > >> principalName = drankye@TEST.COM
> > > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > >> principalName = drankye@TEST.COM
> > > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
> > > >> impl.DefaultKdcHandler: Transport or decoding error occurred,
> > > >> disconnecting abnormally java.io.EOFException
> > > >> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > > receiveMessage(KrbTcpTransport.java:54)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
> > > >> n(
> > > DefaultKdcHandler.java:46)
> > > >> at
> > > >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > ThreadPoolExecutor.java:1142)
> > > >> at
> > > >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > ThreadPoolExecutor.java:617)
> > > >> at java.lang.Thread.run(Thread.java:748)
> > > >> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase:
> > > >> Storing the tgt to the credential cache file.
> > > >> 2017-04-29 21:07:39,491 DEBUG [main] backend.
> AbstractIdentityBackend:
> > > >> getIdentity called, principalName =
> > > >> test-service/localhost@TEST.COM
> > > >> 2017-04-29 21:07:39,491 DEBUG [main] backend.
> AbstractIdentityBackend:
> > > >> getIdentity successful, principalName =
> > > >> test-service/localhost@TEST.COM
> > > >> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1] request.KdcRequest:
> > > >> Client entry is empty.
> > > >> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > >> principalName = test-service/localhost@TEST.COM
> > > >> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > >> principalName = test-service/localhost@TEST.COM
> > > >> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1] request.KdcRequest:
> > > >> The preauth data is empty.
> > > >> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1] server.KdcHandler:
> > > >> KRB error occurred while processing request:Additional
> > > >> pre-authentication required
> > > >> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
> > > >> impl.DefaultKdcHandler: Transport or decoding error occurred,
> > > >> disconnecting abnormally java.io.EOFException
> > > >> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > > receiveMessage(KrbTcpTransport.java:54)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
> > > >> n(
> > > DefaultKdcHandler.java:46)
> > > >> at
> > > >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > ThreadPoolExecutor.java:1142)
> > > >> at
> > > >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > ThreadPoolExecutor.java:617)
> > > >> at java.lang.Thread.run(Thread.java:748)
> > > >> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1] request.KdcRequest:
> > > >> Client entry is empty.
> > > >> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > >> principalName = test-service/localhost@TEST.COM
> > > >> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > >> principalName = test-service/localhost@TEST.COM
> > > >> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
> > > >> impl.DefaultKdcHandler: Transport or decoding error occurred,
> > > >> disconnecting abnormally java.io.EOFException
> > > >> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > > receiveMessage(KrbTcpTransport.java:54)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
> > > >> n(
> > > DefaultKdcHandler.java:46)
> > > >> at
> > > >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > ThreadPoolExecutor.java:1142)
> > > >> at
> > > >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > ThreadPoolExecutor.java:617)
> > > >> at java.lang.Thread.run(Thread.java:748)
> > > >> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1] request.KdcRequest:
> > > >> Found fast padata and start to process it.
> > > >> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
> > > >> impl.DefaultKdcHandler: Error occured while processing request:
> > > >> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
> > > >> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> > > java:85)
> > > >> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> > > java:70)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFin
> > > >> dF
> > > >> as
> > > >> t(
> > > KdcRequest.java:208)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.server.request.
> > > KdcRequest.process(KdcRequest.java:168)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.server.KdcHandler.
> > > handleMessage(KdcHandler.java:115)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
> > > handleMessage(DefaultKdcHandler.java:67)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
> > > >> n(
> > > DefaultKdcHandler.java:52)
> > > >> at
> > > >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > ThreadPoolExecutor.java:1142)
> > > >> at
> > > >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > ThreadPoolExecutor.java:617)
> > > >> at java.lang.Thread.run(Thread.java:748)
> > > >> Caused by: java.io.IOException: Unexpected item context [0]
> > > >> [tag=0xA0, off=0, len=3+207], expecting 0x30
> > > >> at
> > > >> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > > Asn1Encodeable.java:210)
> > > >> at
> > > >> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > > Asn1Encodeable.java:197)
> > > >> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> > > java:83)
> > > >> ... 9 more
> > > >> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
> > > >> impl.DefaultKdcHandler: Transport or decoding error occurred,
> > > >> disconnecting abnormally
> > > >> java.net.SocketException: Socket closed
> > > >> at java.net.SocketInputStream.socketRead0(Native Method)
> > > >> at java.net.SocketInputStream.socketRead(SocketInputStream.
> > > java:116)
> > > >> at java.net.SocketInputStream.read(SocketInputStream.java:171)
> > > >> at java.net.SocketInputStream.read(SocketInputStream.java:141)
> > > >> at java.net.SocketInputStream.read(SocketInputStream.java:224)
> > > >> at java.io.DataInputStream.readInt(DataInputStream.java:387)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > > receiveMessage(KrbTcpTransport.java:54)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru
> > > >> n(
> > > DefaultKdcHandler.java:46)
> > > >> at
> > > >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > ThreadPoolExecutor.java:1142)
> > > >> at
> > > >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > ThreadPoolExecutor.java:617)
> > > >> at java.lang.Thread.run(Thread.java:748)
> > > >>
> > > >> In a FreeIPA environment these python lines "just" work.
> > > >>
> > > >> Any suggestions are welcome!
> > > >>
> > > >> Marc
> > > >>
> > > >>
> > > > --
> > > > Marc de Lignie
> > > >
> > >
> > > --
> > > Marc de Lignie
> > >
> > >
> >
> >
> > --
> > Colm O hEigeartaigh
> >
> > Talend Community Coder
> > http://coders.talend.com
> >
>
>
>
> --
> Colm O hEigeartaigh
>
> Talend Community Coder
> http://coders.talend.com
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
Re: MIT Kerberos compatibility
Posted by Colm O hEigeartaigh <co...@apache.org>.
Sorry, it was my error, UDP was actually enabled there. But why am I still
seeing that error message?
Colm.
On Fri, May 5, 2017 at 4:39 PM, Li, Jiajia <ji...@intel.com> wrote:
> Hi Colm,
> I also test the Kerby KDC with kerby kint and MIT kinit, and only listen
> the tcp port(disable udp),
> both got ticket successfully. But I don't get the error message. Both
> krb.conf and kdc.conf should set udp to be false, udp is enabled in default.
>
> Thanks
> Jiajia
>
> -----Original Message-----
> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> Sent: Friday, May 5, 2017 11:34 PM
> To: kerby@directory.apache.org
> Cc: Zheng, Kai <ka...@intel.com>; mailto:m.c.delignie@xs4all.nl <
> m.c.delignie@xs4all.nl>
> Subject: Re: MIT Kerberos compatibility
>
> Hi Jiajia,
>
> If UDP is disabled and we don't use Netty, I can get a token successfully
> via kinit. However I then see an error message in the Kerby console:
>
> Exception in thread "Thread-1" java.lang.RuntimeException: Error occured
> while checking udp connections
> at
> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> KdcNetwork.java:105)
> at
> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> access$000(KdcNetwork.java:39)
> at
> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> run(KdcNetwork.java:75)
> at java.lang.Thread.run(Thread.java:748)
> Caused by: java.nio.channels.ClosedChannelException
> at
> sun.nio.ch.DatagramChannelImpl.ensureOpen(DatagramChannelImpl.java:320)
> at sun.nio.ch.DatagramChannelImpl.receive(
> DatagramChannelImpl.java:331)
> at
> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> checkUdpMessage(KdcNetwork.java:132)
> at
> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> KdcNetwork.java:101)
>
> I'm not sure why we are seeing UDP errors when it's disabled?
>
> Colm.
>
> On Fri, May 5, 2017 at 3:57 PM, Li, Jiajia <ji...@intel.com> wrote:
>
> > Hi Colm,
> > The shell client can't connect to kdc if the UDP is disabled.
> > We don't use Netty in default.
> > What's your test-cases? The same as the Marc's?
> >
> > Thanks
> > Jiajia
> >
> > -----Original Message-----
> > From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > Sent: Friday, May 5, 2017 10:09 PM
> > To: kerby@directory.apache.org
> > Cc: Zheng, Kai <ka...@intel.com>; mailto:m.c.delignie@xs4all.nl <
> > m.c.delignie@xs4all.nl>
> > Subject: Re: MIT Kerberos compatibility
> >
> > Hi Jiajia,
> >
> > What are the issues if UDP is disabled and we don't use Netty? I tried
> > doing this with my own test-cases and it didn't work, so it would be
> > good to get this fixed soon.
> >
> > Colm.
> >
> > On Fri, May 5, 2017 at 2:46 PM, Li, Jiajia <ji...@intel.com> wrote:
> >
> > > Hi Marc,
> > > >>> - your KRB5 tracing looks quite different. What OS and
> > > >>> mit-kerberos
> > > version did you use?
> > > I use mac os and the python version is 2.7.10
> > >
> > > >>>- your KRB5 tracing shows UDP comms between kerberos client and
> > > >>>KDC,
> > > despite the allowUDP = false setting
> > > >>> in my test. I did this setting because I get different problems
> > > without it, see the additional logs below. So,
> > > >>>we must also be aware of networking problems at my side.
> > > I enable the UDP and use netty network, there are some issues if UDP
> > > disabled, you can create a JIRA for this and we can fix this issue
> > > in the next release version.
> > >
> > > The changes in my side as following:
> > >
> > > protected boolean allowUdp() {
> > > return true;
> > > }
> > > @Override
> > > protected void prepareKdc() throws KrbException {
> > > getKdcServer().setInnerKdcImpl(
> > > new NettyKdcServerImpl(getKdcServer().getKdcSetting()));
> > > super.prepareKdc();
> > > }
> > >
> > > Here is log of MitIssueTest:
> > > [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > > [nioEventLoopGroup-2-1] INFO io.netty.handler.logging.LoggingHandler
> > > -
> > > [id: 0x2634fe6b] REGISTERED
> > > [nioEventLoopGroup-2-1] INFO io.netty.handler.logging.LoggingHandler
> > > -
> > > [id: 0x2634fe6b] BIND(0.0.0.0/0.0.0.0:53957) [nioEventLoopGroup-2-1]
> > > INFO io.netty.handler.logging.LoggingHandler -
> > > [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] ACTIVE [main] INFO
> > > org.apache.kerby.kerberos.kdc.impl.NettyKdcServerImpl - Netty kdc
> > > server started.
> > > [nioEventLoopGroup-2-1] INFO io.netty.handler.logging.LoggingHandler
> > > -
> > > [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] RECEIVED: [id: 0xdac7228b,
> > > /
> > > 127.0.0.1:53961 => /127.0.0.1:53957] [defaultEventExecutorGroup-4-1]
> > > INFO org.apache.kerby.kerberos.kerb.server.request.AsRequest
> > > - AS_REQ ISSUE: authtime 1493991123792,drankye@TEST.COM for krbtgt/
> > > TEST.COM@TEST.COM [main] INFO
> > > org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClient
> > > - Send to kdc success.
> > > [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
> > > Storing the tgt to the credential cache file.
> > > [nioEventLoopGroup-5-1] INFO
> > > org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> > > - The preauth data is empty.
> > > [nioEventLoopGroup-5-1] INFO
> > > org.apache.kerby.kerberos.kerb.server.KdcHandler
> > > - KRB error occurred while processing request:Additional
> > > pre-authentication required [nioEventLoopGroup-5-1] INFO
> > > org.apache.kerby.kerberos.kerb.server.request.AsRequest
> > > - AS_REQ ISSUE: authtime
> > > 1493991123859,test-service/localhost@TEST.COM
> > > for krbtgt/TEST.COM@TEST.COM
> > > [nioEventLoopGroup-5-1] INFO
> > > org.apache.kerby.kerberos.kerb.server.request.TgsRequest
> > > - TGS_REQ ISSUE: authtime 1493991142850,drankye for test-service/
> > > localhost@TEST.COM
> > >
> > > Thanks
> > > Jiajia
> > >
> > > -----Original Message-----
> > > From: Zheng, Kai
> > > Sent: Friday, May 5, 2017 7:46 PM
> > > To: kerby@directory.apache.org; Li, Jiajia <ji...@intel.com>
> > > Subject: RE: MIT Kerberos compatibility
> > >
> > > Hi Marc,
> > >
> > > Looks like this is quite environment related, could you fire an
> > > issue for this? I would suggest we target it to 1.1.0, which can be
> > > done in
> > June.
> > >
> > > Regards,
> > > Kai
> > >
> > > -----Original Message-----
> > > From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> > > Sent: Friday, May 05, 2017 4:44 PM
> > > To: Li, Jiajia <ji...@intel.com>
> > > Cc: kerby@directory.apache.org
> > > Subject: Re: MIT Kerberos compatibility
> > >
> > > Hi Jiajia,
> > >
> > > Great to read that you made progress on this issue and to see a
> > > working config at your side. Below, I list my progress below (with
> > > trunk merged into my MitIssue branch), but I am afraid we are not
> > > done
> > yet.
> > >
> > > Things that stand out:
> > >
> > > - the kdc decoding error is solved, relative to the logs without
> > > your patch
> > >
> > > - your KRB5 tracing looks quite different. What OS and mit-kerberos
> > > version did you use?
> > >
> > > - your KRB5 tracing shows UDP comms between kerberos client and KDC,
> > > despite the allowUDP = false setting in my test. I did this setting
> > > because I get different problems without it, see the additional logs
> > > below. So, we must also be aware of networking problems at my side.
> > >
> > > - the "Response was not from master KDC" msg is not relevant; it
> > > disappears if you manually add master_kdc to the realms section of
> > > the krb5.conf
> > >
> > > I have no idea how to proceed from here, so that is why I just
> > > document the status at my side and ask about your - apparently
> > > working -
> > config.
> > >
> > > Cheers, Marc
> > >
> > >
> > > KDC logging with allowUDP = false:
> > >
> > > [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > > [pool-1-thread-1] INFO
> > > org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
> ISSUE:
> > > authtime 1493970789075,drankye@TEST.COM for krbtgt/TEST.COM@TEST.COM
> > > [main] INFO
> > > org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClient
> > > - Send to kdc success.
> > > [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
> > > Storing the tgt to the credential cache file.
> > > [pool-1-thread-1] INFO
> > > org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The
> > > preauth data is empty.
> > > [pool-1-thread-1] INFO
> > > org.apache.kerby.kerberos.kerb.server.KdcHandler
> > > - KRB error occurred while processing request:Additional
> > > pre-authentication required [pool-1-thread-1] INFO
> > > org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
> ISSUE:
> > > authtime 1493970789108,test-service/localhost@TEST.COM for krbtgt/
> > > TEST.COM@TEST.COM [pool-1-thread-1] INFO
> > > org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> > > - Found fast padata and starting to process it.
> > > [pool-1-thread-1] INFO
> > > org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found
> > > fast padata and starting to process it.
> > >
> > > Python script KRB5 tracing (MIT Kerberos 1.13.2 of Ubuntu Xenial)
> > > with allowUDP = false:
> > >
> > > $ .
> > > kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/
> > > kerberos/kerb/server/MitIssueTest.sh
> > > [25281] 1493970797.298753: Retrieving drankye@TEST.COM from
> > > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > [25281]
> > > 1493970797.298952: Retrieving drankye@TEST.COM from
> > > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > [25281]
> > > 1493970797.299106: Retrieving drankye@TEST.COM from
> > > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > [25281]
> > > 1493970797.299213: Retrieving drankye@TEST.COM from
> > > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > [25281]
> > > 1493970797.299323: Retrieving drankye@TEST.COM from
> > > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > [25281]
> > > 1493970797.299436: Retrieving drankye@TEST.COM from
> > > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > [25281]
> > > 1493970797.299545: Retrieving drankye@TEST.COM from
> > > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > [25281]
> > > 1493970797.299654: Retrieving drankye@TEST.COM from
> > > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > kerberos.authGSSClientInit successful [25281] 1493970797.299922:
> > > Getting credentials drankye@TEST.COM -> test-service/localhost@
> > > using ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > [25281] 1493970797.299945: Retrieving drankye@TEST.COM ->
> > > test-service/localhost@ from
> > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > with result:
> > > -1765328243/Matching credential not found [25281] 1493970797.299959:
> > > Retrying drankye@TEST.COM -> test-service/localhost@TEST.COM with
> > result:
> > > -1765328243/Matching credential not found [25281] 1493970797.299962:
> > > Server has referral realm; starting with
> > > test-service/localhost@TEST.COM [25281]
> > > 1493970797.299975: Retrieving drankye@TEST.COM ->
> > > krbtgt/TEST.COM@TEST.COM from
> > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > with result:
> > > 0/Success [25281] 1493970797.299979: Starting with TGT for client
> realm:
> > > drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [25281]
> 1493970797.299981:
> > > Requesting tickets for test-service/localhost@TEST.COM, referrals on
> > > [25281] 1493970797.299994: Generated subkey for TGS request:
> > > aes128-cts/1B9B [25281] 1493970797.300009: etypes requested in TGS
> > request:
> > > aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
> > > camellia256-cts [25281] 1493970797.300054: Encoding request body and
> > > padata into FAST request [25281] 1493970797.300080: Sending request
> > > (823 bytes) to TEST.COM [25281] 1493970797.300091: Resolving
> > > hostname localhost [25281]
> > > 1493970797.300136: Initiating TCP connection to stream
> > > 127.0.0.1:34319
> > > [25281] 1493970797.300191: Sending TCP request to stream
> > > 127.0.0.1:34319 [25281] 1493970797.303610: Received answer (125
> > > bytes) from stream
> > > 127.0.0.1:34319
> > > [25281] 1493970797.303618: Terminating TCP connection to stream
> > > 127.0.0.1:34319
> > > [25281] 1493970797.553126: Response was not from master KDC [25281]
> > > 1493970797.553198: TGS request result: -1765323383/Unknown code krcM
> > > 137 [25281] 1493970797.553234: Requesting tickets for test-service/
> > > localhost@TEST.COM, referrals off [25281] 1493970797.553273:
> > > Generated subkey for TGS request: aes128-cts/94C6 [25281]
> 1493970797.553323:
> > > etypes requested in TGS request: aes256-cts, aes128-cts,
> > > des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts [25281]
> > > 1493970797.553436: Encoding request body and padata into FAST
> > > request
> > [25281] 1493970797.553532:
> > > Sending request (823 bytes) to TEST.COM [25281] 1493970797.553567:
> > > Resolving hostname localhost [25281] 1493970797.553745: Initiating
> > > TCP connection to stream
> > > 127.0.0.1:34319
> > > [25281] 1493970797.553889: Sending TCP request to stream
> > > 127.0.0.1:34319 [25281] 1493970797.558297: Received answer (125
> > > bytes) from stream
> > > 127.0.0.1:34319
> > > [25281] 1493970797.558318: Terminating TCP connection to stream
> > > 127.0.0.1:34319
> > > [25281] 1493970797.561189: Response was not from master KDC [25281]
> > > 1493970797.561258: TGS request result: -1765323383/Unknown code krcM
> > > 137 ('First kerberos.authGSSClientStep not successful',
> > > GSSError(('Unspecified GSS failure. Minor code may provide more
> > > information', 851968), ('Unknown code krcM 137', -1765323383)))
> > >
> > >
> > > KDC logging with allowUDP = true:
> > >
> > > [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > > [pool-1-thread-1] INFO
> > > org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
> ISSUE:
> > > authtime 1493972505784,drankye@TEST.COM for krbtgt/TEST.COM@TEST.COM
> > > [main] INFO
> > > org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClient
> > > - Send to kdc success.
> > > [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
> > > Storing the tgt to the credential cache file.
> > > [pool-1-thread-1] INFO
> > > org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The
> > > preauth data is empty.
> > > [pool-1-thread-1] INFO
> > > org.apache.kerby.kerberos.kerb.server.KdcHandler
> > > - KRB error occurred while processing request:Additional
> > > pre-authentication required [pool-1-thread-2] INFO
> > > org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
> ISSUE:
> > > authtime 1493972505948,test-service/localhost@TEST.COM for krbtgt/
> > > TEST.COM@TEST.COM Exception in thread "Thread-0"
> > > java.lang.RuntimeException: Error occured while checking udp
> connections
> > > at
> > > org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > KdcNetwork.java:105)
> > > at
> > > org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > access$000(KdcNetwork.java:39)
> > > at
> > > org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > > run(KdcNetwork.java:75)
> > > at java.lang.Thread.run(Thread.java:748)
> > > Caused by: java.nio.channels.ClosedChannelException
> > > at
> > > sun.nio.ch.DatagramChannelImpl.ensureOpen(
> DatagramChannelImpl.java:320)
> > > at sun.nio.ch.DatagramChannelImpl.receive(
> > > DatagramChannelImpl.java:331)
> > > at
> > > org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > > checkUdpMessage(KdcNetwork.java:132)
> > > at
> > > org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > > KdcNetwork.java:101)
> > > ... 3 more
> > >
> > >
> > > krb5.conf:
> > >
> > > [libdefaults]
> > > kdc_realm = TEST.COM
> > > default_realm = TEST.COM
> > > udp_preference_limit = 4096
> > > kdc_tcp_port = 37080
> > > kdc_udp_port = 36525
> > >
> > > [realms]
> > > TEST.COM = {
> > > kdc = localhost:36525
> > > }
> > >
> > > And port 36525 does not show up in `netstat -l` (while 37080 does)
> > >
> > >
> > > Op 04-05-17 om 14:55 schreef Li, Jiajia:
> > > > Hi Marc,
> > > > I try to run your test(through applying your patch in the trunk) ,
> > > > I
> > > think it's success now. Could you take some time to check about it?
> > > > Here is the log:
> > > >
> > > > directory-kerby git:(trunk) ✗ .
> > > > kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/k
> > > > er
> > > > b/
> > > > server/MitIssueTest.sh
> > > > kerberos.authGSSClientInit successful
> > > > 2017-05-04T20:44:06 set-error: -1765328234: entypes not supported
> > > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > credential for krb5_ccache_conf_data/realm-config@X-CACHECONF: in
> > > > cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > credential for test-service/localhost@TEST.COM in cache
> > > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > credential for
> > > > krb5_ccache_conf_data/negative-cache/test-service\134/localhost\13
> > > > 4@
> > > > TE
> > > > ST.COM@X-CACHECONF: in cache
> > > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > credential for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF: in
> > > > cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > credential for krb5_ccache_conf_data/sitename@X-CACHECONF: in
> > > > cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > credential for test-service/localhost@TEST.COM in cache
> > > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > > des-cbc-md5-deprecated not supported
> > > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > > des-cbc-md4-deprecated not supported
> > > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > > des-cbc-crc-deprecated not supported
> > > > 2017-05-04T20:44:06 Trying to find service kdc for realm TEST.COM
> > > > flags 0
> > > > 2017-05-04T20:44:06 configuration file for realm TEST.COM found
> > > > 2017-05-04T20:44:06 submissing new requests to new host
> > > > 2017-05-04T20:44:06 host_create: setting hostname localhost
> > > > 2017-05-04T20:44:06 connecting to host: udp ::1:52534 (localhost)
> tid:
> > > > 00000001
> > > > 2017-05-04T20:44:06 host_create: setting hostname localhost
> > > > 2017-05-04T20:44:06 Queuing host in future (in 3s), its the 2
> > > > address on the same name: udp 127.0.0.1:52534 (localhost) tid:
> > > > 00000002
> > > > 2017-05-04T20:44:06 writing packet: udp ::1:52534 (localhost) tid:
> > > > 00000001
> > > > 2017-05-04T20:44:06 reading packet: udp ::1:52534 (localhost) tid:
> > > > 00000001
> > > > 2017-05-04T20:44:06 host completed: udp ::1:52534 (localhost) tid:
> > > > 00000001
> > > > 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0 hosts 1
> > > > packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814 tid: 00000002
> > > > 2017-05-04T20:44:06 tkt: extract key 17/763641F3
> > > > 2017-05-04T20:44:06 set-error: -1765328353: Decrypt integrity
> > > > check failed for checksum type hmac-sha1-96-aes128, key type
> > > > aes128-cts-hmac-sha1-96
> > > > 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
> > > > 2017-05-04T20:44:06 krb5_get_credentials_with_flags: TEST.COM wc:
> > > > 0.050317
> > > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > credential for krb5_ccache_conf_data/realm-config@X-CACHECONF: in
> > > > cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > > credential for
> > > > krb5_ccache_conf_data/time-offset/test-service\134/
> localhost\134@TEST.
> > > > COM@X-CACHECONF: in cache
> > > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > > 2017-05-04T20:44:06 Setting up PFS for auth context
> > > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > > des-cbc-md5-deprecated not supported
> > > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > > des-cbc-md4-deprecated not supported
> > > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > > des-cbc-crc-deprecated not supported First
> > > > kerberos.authGSSClientStep successful
> > > >
> > > > Thanks
> > > > Jiajia
> > > >
> > > > -----Original Message-----
> > > > From: Zheng, Kai [mailto:kai.zheng@intel.com]
> > > > Sent: Wednesday, May 3, 2017 7:29 PM
> > > > To: kerby@directory.apache.org
> > > > Subject: RE: MIT Kerberos compatibility
> > > >
> > > > Hi Marc,
> > > >
> > > > In case you're not aware of this, please check out the latest fix
> > > > made
> > > by Jiajia. We thought your case may be different, but would be good
> > > to have a check before we can repeat/fix your case. Thanks.
> > > > https://issues.apache.org/jira/browse/DIRKRB-625
> > > >
> > > > Regards,
> > > > Kai
> > > >
> > > > -----Original Message-----
> > > > From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> > > > Sent: Sunday, April 30, 2017 7:45 PM
> > > > To: kerby@directory.apache.org
> > > > Subject: Re: MIT Kerberos compatibility
> > > >
> > > > Hi Kai,
> > > >
> > > > The terminal output below is for the latest MIT Kerberos 1.15.1
> > > > (locally
> > > built on Ubuntu Xenial). Before that, I also tested with the default
> > > Xenial MIT Kerberos packages (1.13.2), with the same result. I did
> > > not try earlier MIT Kerberos versions.
> > > >
> > > > Marc
> > > >
> > > > Op 29-04-17 om 21:42 schreef Marc de Lignie:
> > > >> Hi Kai,
> > > >>
> > > >> Thanks for the response. I prepared a minimal config that
> > > >> reproduces my problem.
> > > >>
> > > >> You can fetch the branch/commit from:
> > > >> https://github.com/vtslab/directory-kerby/commits/MitIssue
> > > >>
> > > >> This is relative to RC2, but I also tried this on trunk for my
> > > >> actual project.
> > > >>
> > > >> This config produces the debug and error messages below.
> > > >>
> > > >> 1. For the terminal with the bash + python script $ klist Ticket
> > > >> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >> Default principal: drankye@TEST.COM
> > > >>
> > > >> Valid starting Expires Service principal
> > > >> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/TEST.COM@TEST.COM
> > > >> renew until 29-04-17 21:07:39
> > > >>
> > > >> $ .
> > > >> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/
> > > >> ke rb / server/MitIssueTest.sh [15538] 1493491231.917606:
> > > >> Retrieving drankye@TEST.COM from
> > > >> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> > > >> result:
> > > >> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > >> [15538]
> > > >> 1493491231.917827: Retrieving drankye@TEST.COM from
> > > >> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> > result:
> > > >> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > > >> kerberos.authGSSClientInit successful [15538] 1493491231.918185:
> > > >> Getting credentials drankye@TEST.COM -> test-service/localhost@
> > > >> using ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > >> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
> > > >> test-service/localhost@ from
> > > >> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
> > > >> -1765328243/Matching credential not found (filename:
> > > >> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> > > >> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
> > > >> test-service/localhost@TEST.COM with result: -1765328243/Matching
> > > >> credential not found (filename:
> > > >> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> > > >> [15538] 1493491231.918229: Server has referral realm; starting
> > > >> with test-service/localhost@TEST.COM [15538] 1493491231.918278:
> > > >> Retrieving drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM from
> > > >> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
> > > >> 0/Success
> > > >> [15538] 1493491231.918281: Starting with TGT for client realm:
> > > >> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
> > > >> 1493491231.918301: Requesting tickets for
> > > >> test-service/localhost@TEST.COM, referrals on [15538]
> > > >> 1493491231.918326: Generated subkey for TGS request:
> > > >> aes128-cts/FA30
> > > >> [15538] 1493491231.918359: etypes requested in TGS request:
> > > >> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1,
> > > >> rc4-hmac, camellia128-cts, camellia256-cts [15538]
> 1493491231.918484:
> > > >> Encoding request body and padata into FAST request [15538]
> > > >> 1493491231.918541: Sending request (836 bytes) to TEST.COM
> > > >> [15538]
> > > >> 1493491231.918597: Resolving hostname localhost [15538]
> > > >> 1493491231.918703: Initiating TCP connection to stream
> > > >> 127.0.0.1:44292
> > > >> [15538] 1493491231.918777: Sending TCP request to stream
> > > >> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error receiving
> > > >> from stream
> > > >> 127.0.0.1:44292: 104/Connection reset by peer [15538]
> > > >> 1493491231.922812: Terminating TCP connection to stream
> > > >> 127.0.0.1:44292
> > > >> [15538] 1493491231.922858: Sending initial UDP request to dgram
> > > >> 127.0.0.1:44292
> > > >> ('First kerberos.authGSSClientStep not successful',
> > > >> GSSError(('Unspecified GSS failure. Minor code may provide more
> > > >> information', 851968), ("Cannot contact any KDC for realm
> > > >> 'TEST.COM'",
> > > >> -1765328228)))
> > > >>
> > > >> 2. For the terminal that runs mvn clean test -Dtest=MitIssueTest
> > > >> Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > > >> 2017-04-29 21:07:39,182 DEBUG [main] backend.
> AbstractIdentityBackend:
> > > >> initialize called
> > > >> 2017-04-29 21:07:39,195 DEBUG [main] backend.
> AbstractIdentityBackend:
> > > >> getIdentity called, principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,195 DEBUG [main] backend.
> AbstractIdentityBackend:
> > > >> getIdentity failed, principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> AbstractIdentityBackend:
> > > >> addIdentity successful, principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> AbstractIdentityBackend:
> > > >> getIdentity called, principalName = kadmin/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,212 DEBUG [main] backend.
> AbstractIdentityBackend:
> > > >> getIdentity failed, principalName = kadmin/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,213 DEBUG [main] backend.
> AbstractIdentityBackend:
> > > >> addIdentity successful, principalName = kadmin/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,216 DEBUG [main] backend.
> AbstractIdentityBackend:
> > > >> start called
> > > >> 2017-04-29 21:07:39,232 DEBUG [main] backend.
> AbstractIdentityBackend:
> > > >> addIdentity successful, principalName =
> > > >> test-service/localhost@TEST.COM
> > > >> 2017-04-29 21:07:39,425 DEBUG [main] backend.
> AbstractIdentityBackend:
> > > >> addIdentity successful, principalName = drankye@TEST.COM
> > > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1] request.KdcRequest:
> > > >> Client entry is empty.
> > > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > >> principalName = drankye@TEST.COM
> > > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > >> principalName = drankye@TEST.COM
> > > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
> > > >> impl.DefaultKdcHandler: Transport or decoding error occurred,
> > > >> disconnecting abnormally java.io.EOFException
> > > >> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > > receiveMessage(KrbTcpTransport.java:54)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> > > DefaultKdcHandler.java:46)
> > > >> at
> > > >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > ThreadPoolExecutor.java:1142)
> > > >> at
> > > >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > ThreadPoolExecutor.java:617)
> > > >> at java.lang.Thread.run(Thread.java:748)
> > > >> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase:
> > > >> Storing the tgt to the credential cache file.
> > > >> 2017-04-29 21:07:39,491 DEBUG [main] backend.
> AbstractIdentityBackend:
> > > >> getIdentity called, principalName =
> > > >> test-service/localhost@TEST.COM
> > > >> 2017-04-29 21:07:39,491 DEBUG [main] backend.
> AbstractIdentityBackend:
> > > >> getIdentity successful, principalName =
> > > >> test-service/localhost@TEST.COM
> > > >> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1] request.KdcRequest:
> > > >> Client entry is empty.
> > > >> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > >> principalName = test-service/localhost@TEST.COM
> > > >> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > >> principalName = test-service/localhost@TEST.COM
> > > >> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1] request.KdcRequest:
> > > >> The preauth data is empty.
> > > >> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1] server.KdcHandler:
> > > >> KRB error occurred while processing request:Additional
> > > >> pre-authentication required
> > > >> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
> > > >> impl.DefaultKdcHandler: Transport or decoding error occurred,
> > > >> disconnecting abnormally java.io.EOFException
> > > >> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > > receiveMessage(KrbTcpTransport.java:54)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> > > DefaultKdcHandler.java:46)
> > > >> at
> > > >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > ThreadPoolExecutor.java:1142)
> > > >> at
> > > >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > ThreadPoolExecutor.java:617)
> > > >> at java.lang.Thread.run(Thread.java:748)
> > > >> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1] request.KdcRequest:
> > > >> Client entry is empty.
> > > >> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > >> principalName = test-service/localhost@TEST.COM
> > > >> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > >> principalName = test-service/localhost@TEST.COM
> > > >> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
> > > >> impl.DefaultKdcHandler: Transport or decoding error occurred,
> > > >> disconnecting abnormally java.io.EOFException
> > > >> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > > receiveMessage(KrbTcpTransport.java:54)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> > > DefaultKdcHandler.java:46)
> > > >> at
> > > >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > ThreadPoolExecutor.java:1142)
> > > >> at
> > > >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > ThreadPoolExecutor.java:617)
> > > >> at java.lang.Thread.run(Thread.java:748)
> > > >> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity called,
> > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> > > >> backend.AbstractIdentityBackend: getIdentity successful,
> > > >> principalName = krbtgt/TEST.COM@TEST.COM
> > > >> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1] request.KdcRequest:
> > > >> Found fast padata and start to process it.
> > > >> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
> > > >> impl.DefaultKdcHandler: Error occured while processing request:
> > > >> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
> > > >> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> > > java:85)
> > > >> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> > > java:70)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindF
> > > >> as
> > > >> t(
> > > KdcRequest.java:208)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.server.request.
> > > KdcRequest.process(KdcRequest.java:168)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.server.KdcHandler.
> > > handleMessage(KdcHandler.java:115)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
> > > handleMessage(DefaultKdcHandler.java:67)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> > > DefaultKdcHandler.java:52)
> > > >> at
> > > >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > ThreadPoolExecutor.java:1142)
> > > >> at
> > > >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > ThreadPoolExecutor.java:617)
> > > >> at java.lang.Thread.run(Thread.java:748)
> > > >> Caused by: java.io.IOException: Unexpected item context [0]
> > > >> [tag=0xA0, off=0, len=3+207], expecting 0x30
> > > >> at
> > > >> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > > Asn1Encodeable.java:210)
> > > >> at
> > > >> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > > Asn1Encodeable.java:197)
> > > >> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> > > java:83)
> > > >> ... 9 more
> > > >> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
> > > >> impl.DefaultKdcHandler: Transport or decoding error occurred,
> > > >> disconnecting abnormally
> > > >> java.net.SocketException: Socket closed
> > > >> at java.net.SocketInputStream.socketRead0(Native Method)
> > > >> at java.net.SocketInputStream.socketRead(SocketInputStream.
> > > java:116)
> > > >> at java.net.SocketInputStream.read(SocketInputStream.java:171)
> > > >> at java.net.SocketInputStream.read(SocketInputStream.java:141)
> > > >> at java.net.SocketInputStream.read(SocketInputStream.java:224)
> > > >> at java.io.DataInputStream.readInt(DataInputStream.java:387)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > > receiveMessage(KrbTcpTransport.java:54)
> > > >> at
> > > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> > > DefaultKdcHandler.java:46)
> > > >> at
> > > >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > > ThreadPoolExecutor.java:1142)
> > > >> at
> > > >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > > ThreadPoolExecutor.java:617)
> > > >> at java.lang.Thread.run(Thread.java:748)
> > > >>
> > > >> In a FreeIPA environment these python lines "just" work.
> > > >>
> > > >> Any suggestions are welcome!
> > > >>
> > > >> Marc
> > > >>
> > > >>
> > > > --
> > > > Marc de Lignie
> > > >
> > >
> > > --
> > > Marc de Lignie
> > >
> > >
> >
> >
> > --
> > Colm O hEigeartaigh
> >
> > Talend Community Coder
> > http://coders.talend.com
> >
>
>
>
> --
> Colm O hEigeartaigh
>
> Talend Community Coder
> http://coders.talend.com
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
RE: MIT Kerberos compatibility
Posted by "Li, Jiajia" <ji...@intel.com>.
Hi Colm,
I also test the Kerby KDC with kerby kint and MIT kinit, and only listen the tcp port(disable udp),
both got ticket successfully. But I don't get the error message. Both krb.conf and kdc.conf should set udp to be false, udp is enabled in default.
Thanks
Jiajia
-----Original Message-----
From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
Sent: Friday, May 5, 2017 11:34 PM
To: kerby@directory.apache.org
Cc: Zheng, Kai <ka...@intel.com>; mailto:m.c.delignie@xs4all.nl <m....@xs4all.nl>
Subject: Re: MIT Kerberos compatibility
Hi Jiajia,
If UDP is disabled and we don't use Netty, I can get a token successfully via kinit. However I then see an error message in the Kerby console:
Exception in thread "Thread-1" java.lang.RuntimeException: Error occured while checking udp connections
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(KdcNetwork.java:105)
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork.access$000(KdcNetwork.java:39)
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.run(KdcNetwork.java:75)
at java.lang.Thread.run(Thread.java:748)
Caused by: java.nio.channels.ClosedChannelException
at
sun.nio.ch.DatagramChannelImpl.ensureOpen(DatagramChannelImpl.java:320)
at sun.nio.ch.DatagramChannelImpl.receive(DatagramChannelImpl.java:331)
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork.checkUdpMessage(KdcNetwork.java:132)
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(KdcNetwork.java:101)
I'm not sure why we are seeing UDP errors when it's disabled?
Colm.
On Fri, May 5, 2017 at 3:57 PM, Li, Jiajia <ji...@intel.com> wrote:
> Hi Colm,
> The shell client can't connect to kdc if the UDP is disabled.
> We don't use Netty in default.
> What's your test-cases? The same as the Marc's?
>
> Thanks
> Jiajia
>
> -----Original Message-----
> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> Sent: Friday, May 5, 2017 10:09 PM
> To: kerby@directory.apache.org
> Cc: Zheng, Kai <ka...@intel.com>; mailto:m.c.delignie@xs4all.nl <
> m.c.delignie@xs4all.nl>
> Subject: Re: MIT Kerberos compatibility
>
> Hi Jiajia,
>
> What are the issues if UDP is disabled and we don't use Netty? I tried
> doing this with my own test-cases and it didn't work, so it would be
> good to get this fixed soon.
>
> Colm.
>
> On Fri, May 5, 2017 at 2:46 PM, Li, Jiajia <ji...@intel.com> wrote:
>
> > Hi Marc,
> > >>> - your KRB5 tracing looks quite different. What OS and
> > >>> mit-kerberos
> > version did you use?
> > I use mac os and the python version is 2.7.10
> >
> > >>>- your KRB5 tracing shows UDP comms between kerberos client and
> > >>>KDC,
> > despite the allowUDP = false setting
> > >>> in my test. I did this setting because I get different problems
> > without it, see the additional logs below. So,
> > >>>we must also be aware of networking problems at my side.
> > I enable the UDP and use netty network, there are some issues if UDP
> > disabled, you can create a JIRA for this and we can fix this issue
> > in the next release version.
> >
> > The changes in my side as following:
> >
> > protected boolean allowUdp() {
> > return true;
> > }
> > @Override
> > protected void prepareKdc() throws KrbException {
> > getKdcServer().setInnerKdcImpl(
> > new NettyKdcServerImpl(getKdcServer().getKdcSetting()));
> > super.prepareKdc();
> > }
> >
> > Here is log of MitIssueTest:
> > [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > [nioEventLoopGroup-2-1] INFO io.netty.handler.logging.LoggingHandler
> > -
> > [id: 0x2634fe6b] REGISTERED
> > [nioEventLoopGroup-2-1] INFO io.netty.handler.logging.LoggingHandler
> > -
> > [id: 0x2634fe6b] BIND(0.0.0.0/0.0.0.0:53957) [nioEventLoopGroup-2-1]
> > INFO io.netty.handler.logging.LoggingHandler -
> > [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] ACTIVE [main] INFO
> > org.apache.kerby.kerberos.kdc.impl.NettyKdcServerImpl - Netty kdc
> > server started.
> > [nioEventLoopGroup-2-1] INFO io.netty.handler.logging.LoggingHandler
> > -
> > [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] RECEIVED: [id: 0xdac7228b,
> > /
> > 127.0.0.1:53961 => /127.0.0.1:53957] [defaultEventExecutorGroup-4-1]
> > INFO org.apache.kerby.kerberos.kerb.server.request.AsRequest
> > - AS_REQ ISSUE: authtime 1493991123792,drankye@TEST.COM for krbtgt/
> > TEST.COM@TEST.COM [main] INFO
> > org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClient
> > - Send to kdc success.
> > [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
> > Storing the tgt to the credential cache file.
> > [nioEventLoopGroup-5-1] INFO
> > org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> > - The preauth data is empty.
> > [nioEventLoopGroup-5-1] INFO
> > org.apache.kerby.kerberos.kerb.server.KdcHandler
> > - KRB error occurred while processing request:Additional
> > pre-authentication required [nioEventLoopGroup-5-1] INFO
> > org.apache.kerby.kerberos.kerb.server.request.AsRequest
> > - AS_REQ ISSUE: authtime
> > 1493991123859,test-service/localhost@TEST.COM
> > for krbtgt/TEST.COM@TEST.COM
> > [nioEventLoopGroup-5-1] INFO
> > org.apache.kerby.kerberos.kerb.server.request.TgsRequest
> > - TGS_REQ ISSUE: authtime 1493991142850,drankye for test-service/
> > localhost@TEST.COM
> >
> > Thanks
> > Jiajia
> >
> > -----Original Message-----
> > From: Zheng, Kai
> > Sent: Friday, May 5, 2017 7:46 PM
> > To: kerby@directory.apache.org; Li, Jiajia <ji...@intel.com>
> > Subject: RE: MIT Kerberos compatibility
> >
> > Hi Marc,
> >
> > Looks like this is quite environment related, could you fire an
> > issue for this? I would suggest we target it to 1.1.0, which can be
> > done in
> June.
> >
> > Regards,
> > Kai
> >
> > -----Original Message-----
> > From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> > Sent: Friday, May 05, 2017 4:44 PM
> > To: Li, Jiajia <ji...@intel.com>
> > Cc: kerby@directory.apache.org
> > Subject: Re: MIT Kerberos compatibility
> >
> > Hi Jiajia,
> >
> > Great to read that you made progress on this issue and to see a
> > working config at your side. Below, I list my progress below (with
> > trunk merged into my MitIssue branch), but I am afraid we are not
> > done
> yet.
> >
> > Things that stand out:
> >
> > - the kdc decoding error is solved, relative to the logs without
> > your patch
> >
> > - your KRB5 tracing looks quite different. What OS and mit-kerberos
> > version did you use?
> >
> > - your KRB5 tracing shows UDP comms between kerberos client and KDC,
> > despite the allowUDP = false setting in my test. I did this setting
> > because I get different problems without it, see the additional logs
> > below. So, we must also be aware of networking problems at my side.
> >
> > - the "Response was not from master KDC" msg is not relevant; it
> > disappears if you manually add master_kdc to the realms section of
> > the krb5.conf
> >
> > I have no idea how to proceed from here, so that is why I just
> > document the status at my side and ask about your - apparently
> > working -
> config.
> >
> > Cheers, Marc
> >
> >
> > KDC logging with allowUDP = false:
> >
> > [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > [pool-1-thread-1] INFO
> > org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
> > authtime 1493970789075,drankye@TEST.COM for krbtgt/TEST.COM@TEST.COM
> > [main] INFO
> > org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClient
> > - Send to kdc success.
> > [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
> > Storing the tgt to the credential cache file.
> > [pool-1-thread-1] INFO
> > org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The
> > preauth data is empty.
> > [pool-1-thread-1] INFO
> > org.apache.kerby.kerberos.kerb.server.KdcHandler
> > - KRB error occurred while processing request:Additional
> > pre-authentication required [pool-1-thread-1] INFO
> > org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
> > authtime 1493970789108,test-service/localhost@TEST.COM for krbtgt/
> > TEST.COM@TEST.COM [pool-1-thread-1] INFO
> > org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> > - Found fast padata and starting to process it.
> > [pool-1-thread-1] INFO
> > org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found
> > fast padata and starting to process it.
> >
> > Python script KRB5 tracing (MIT Kerberos 1.13.2 of Ubuntu Xenial)
> > with allowUDP = false:
> >
> > $ .
> > kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/
> > kerberos/kerb/server/MitIssueTest.sh
> > [25281] 1493970797.298753: Retrieving drankye@TEST.COM from
> > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > [25281]
> > 1493970797.298952: Retrieving drankye@TEST.COM from
> > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > [25281]
> > 1493970797.299106: Retrieving drankye@TEST.COM from
> > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > [25281]
> > 1493970797.299213: Retrieving drankye@TEST.COM from
> > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > [25281]
> > 1493970797.299323: Retrieving drankye@TEST.COM from
> > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > [25281]
> > 1493970797.299436: Retrieving drankye@TEST.COM from
> > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > [25281]
> > 1493970797.299545: Retrieving drankye@TEST.COM from
> > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > [25281]
> > 1493970797.299654: Retrieving drankye@TEST.COM from
> > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > kerberos.authGSSClientInit successful [25281] 1493970797.299922:
> > Getting credentials drankye@TEST.COM -> test-service/localhost@
> > using ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > [25281] 1493970797.299945: Retrieving drankye@TEST.COM ->
> > test-service/localhost@ from
> > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > with result:
> > -1765328243/Matching credential not found [25281] 1493970797.299959:
> > Retrying drankye@TEST.COM -> test-service/localhost@TEST.COM with
> result:
> > -1765328243/Matching credential not found [25281] 1493970797.299962:
> > Server has referral realm; starting with
> > test-service/localhost@TEST.COM [25281]
> > 1493970797.299975: Retrieving drankye@TEST.COM ->
> > krbtgt/TEST.COM@TEST.COM from
> > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> with result:
> > 0/Success [25281] 1493970797.299979: Starting with TGT for client realm:
> > drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [25281] 1493970797.299981:
> > Requesting tickets for test-service/localhost@TEST.COM, referrals on
> > [25281] 1493970797.299994: Generated subkey for TGS request:
> > aes128-cts/1B9B [25281] 1493970797.300009: etypes requested in TGS
> request:
> > aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
> > camellia256-cts [25281] 1493970797.300054: Encoding request body and
> > padata into FAST request [25281] 1493970797.300080: Sending request
> > (823 bytes) to TEST.COM [25281] 1493970797.300091: Resolving
> > hostname localhost [25281]
> > 1493970797.300136: Initiating TCP connection to stream
> > 127.0.0.1:34319
> > [25281] 1493970797.300191: Sending TCP request to stream
> > 127.0.0.1:34319 [25281] 1493970797.303610: Received answer (125
> > bytes) from stream
> > 127.0.0.1:34319
> > [25281] 1493970797.303618: Terminating TCP connection to stream
> > 127.0.0.1:34319
> > [25281] 1493970797.553126: Response was not from master KDC [25281]
> > 1493970797.553198: TGS request result: -1765323383/Unknown code krcM
> > 137 [25281] 1493970797.553234: Requesting tickets for test-service/
> > localhost@TEST.COM, referrals off [25281] 1493970797.553273:
> > Generated subkey for TGS request: aes128-cts/94C6 [25281] 1493970797.553323:
> > etypes requested in TGS request: aes256-cts, aes128-cts,
> > des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts [25281]
> > 1493970797.553436: Encoding request body and padata into FAST
> > request
> [25281] 1493970797.553532:
> > Sending request (823 bytes) to TEST.COM [25281] 1493970797.553567:
> > Resolving hostname localhost [25281] 1493970797.553745: Initiating
> > TCP connection to stream
> > 127.0.0.1:34319
> > [25281] 1493970797.553889: Sending TCP request to stream
> > 127.0.0.1:34319 [25281] 1493970797.558297: Received answer (125
> > bytes) from stream
> > 127.0.0.1:34319
> > [25281] 1493970797.558318: Terminating TCP connection to stream
> > 127.0.0.1:34319
> > [25281] 1493970797.561189: Response was not from master KDC [25281]
> > 1493970797.561258: TGS request result: -1765323383/Unknown code krcM
> > 137 ('First kerberos.authGSSClientStep not successful',
> > GSSError(('Unspecified GSS failure. Minor code may provide more
> > information', 851968), ('Unknown code krcM 137', -1765323383)))
> >
> >
> > KDC logging with allowUDP = true:
> >
> > [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > [pool-1-thread-1] INFO
> > org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
> > authtime 1493972505784,drankye@TEST.COM for krbtgt/TEST.COM@TEST.COM
> > [main] INFO
> > org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClient
> > - Send to kdc success.
> > [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
> > Storing the tgt to the credential cache file.
> > [pool-1-thread-1] INFO
> > org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The
> > preauth data is empty.
> > [pool-1-thread-1] INFO
> > org.apache.kerby.kerberos.kerb.server.KdcHandler
> > - KRB error occurred while processing request:Additional
> > pre-authentication required [pool-1-thread-2] INFO
> > org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
> > authtime 1493972505948,test-service/localhost@TEST.COM for krbtgt/
> > TEST.COM@TEST.COM Exception in thread "Thread-0"
> > java.lang.RuntimeException: Error occured while checking udp connections
> > at
> > org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > KdcNetwork.java:105)
> > at
> > org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > access$000(KdcNetwork.java:39)
> > at
> > org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > run(KdcNetwork.java:75)
> > at java.lang.Thread.run(Thread.java:748)
> > Caused by: java.nio.channels.ClosedChannelException
> > at
> > sun.nio.ch.DatagramChannelImpl.ensureOpen(DatagramChannelImpl.java:320)
> > at sun.nio.ch.DatagramChannelImpl.receive(
> > DatagramChannelImpl.java:331)
> > at
> > org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > checkUdpMessage(KdcNetwork.java:132)
> > at
> > org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > KdcNetwork.java:101)
> > ... 3 more
> >
> >
> > krb5.conf:
> >
> > [libdefaults]
> > kdc_realm = TEST.COM
> > default_realm = TEST.COM
> > udp_preference_limit = 4096
> > kdc_tcp_port = 37080
> > kdc_udp_port = 36525
> >
> > [realms]
> > TEST.COM = {
> > kdc = localhost:36525
> > }
> >
> > And port 36525 does not show up in `netstat -l` (while 37080 does)
> >
> >
> > Op 04-05-17 om 14:55 schreef Li, Jiajia:
> > > Hi Marc,
> > > I try to run your test(through applying your patch in the trunk) ,
> > > I
> > think it's success now. Could you take some time to check about it?
> > > Here is the log:
> > >
> > > directory-kerby git:(trunk) ✗ .
> > > kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/k
> > > er
> > > b/
> > > server/MitIssueTest.sh
> > > kerberos.authGSSClientInit successful
> > > 2017-05-04T20:44:06 set-error: -1765328234: entypes not supported
> > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > credential for krb5_ccache_conf_data/realm-config@X-CACHECONF: in
> > > cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > credential for test-service/localhost@TEST.COM in cache
> > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > credential for
> > > krb5_ccache_conf_data/negative-cache/test-service\134/localhost\13
> > > 4@
> > > TE
> > > ST.COM@X-CACHECONF: in cache
> > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > credential for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF: in
> > > cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > credential for krb5_ccache_conf_data/sitename@X-CACHECONF: in
> > > cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > credential for test-service/localhost@TEST.COM in cache
> > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > des-cbc-md5-deprecated not supported
> > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > des-cbc-md4-deprecated not supported
> > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > des-cbc-crc-deprecated not supported
> > > 2017-05-04T20:44:06 Trying to find service kdc for realm TEST.COM
> > > flags 0
> > > 2017-05-04T20:44:06 configuration file for realm TEST.COM found
> > > 2017-05-04T20:44:06 submissing new requests to new host
> > > 2017-05-04T20:44:06 host_create: setting hostname localhost
> > > 2017-05-04T20:44:06 connecting to host: udp ::1:52534 (localhost) tid:
> > > 00000001
> > > 2017-05-04T20:44:06 host_create: setting hostname localhost
> > > 2017-05-04T20:44:06 Queuing host in future (in 3s), its the 2
> > > address on the same name: udp 127.0.0.1:52534 (localhost) tid:
> > > 00000002
> > > 2017-05-04T20:44:06 writing packet: udp ::1:52534 (localhost) tid:
> > > 00000001
> > > 2017-05-04T20:44:06 reading packet: udp ::1:52534 (localhost) tid:
> > > 00000001
> > > 2017-05-04T20:44:06 host completed: udp ::1:52534 (localhost) tid:
> > > 00000001
> > > 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0 hosts 1
> > > packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814 tid: 00000002
> > > 2017-05-04T20:44:06 tkt: extract key 17/763641F3
> > > 2017-05-04T20:44:06 set-error: -1765328353: Decrypt integrity
> > > check failed for checksum type hmac-sha1-96-aes128, key type
> > > aes128-cts-hmac-sha1-96
> > > 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
> > > 2017-05-04T20:44:06 krb5_get_credentials_with_flags: TEST.COM wc:
> > > 0.050317
> > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > credential for krb5_ccache_conf_data/realm-config@X-CACHECONF: in
> > > cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find
> > > credential for
> > > krb5_ccache_conf_data/time-offset/test-service\134/localhost\134@TEST.
> > > COM@X-CACHECONF: in cache
> > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > 2017-05-04T20:44:06 Setting up PFS for auth context
> > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > des-cbc-md5-deprecated not supported
> > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > des-cbc-md4-deprecated not supported
> > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > des-cbc-crc-deprecated not supported First
> > > kerberos.authGSSClientStep successful
> > >
> > > Thanks
> > > Jiajia
> > >
> > > -----Original Message-----
> > > From: Zheng, Kai [mailto:kai.zheng@intel.com]
> > > Sent: Wednesday, May 3, 2017 7:29 PM
> > > To: kerby@directory.apache.org
> > > Subject: RE: MIT Kerberos compatibility
> > >
> > > Hi Marc,
> > >
> > > In case you're not aware of this, please check out the latest fix
> > > made
> > by Jiajia. We thought your case may be different, but would be good
> > to have a check before we can repeat/fix your case. Thanks.
> > > https://issues.apache.org/jira/browse/DIRKRB-625
> > >
> > > Regards,
> > > Kai
> > >
> > > -----Original Message-----
> > > From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> > > Sent: Sunday, April 30, 2017 7:45 PM
> > > To: kerby@directory.apache.org
> > > Subject: Re: MIT Kerberos compatibility
> > >
> > > Hi Kai,
> > >
> > > The terminal output below is for the latest MIT Kerberos 1.15.1
> > > (locally
> > built on Ubuntu Xenial). Before that, I also tested with the default
> > Xenial MIT Kerberos packages (1.13.2), with the same result. I did
> > not try earlier MIT Kerberos versions.
> > >
> > > Marc
> > >
> > > Op 29-04-17 om 21:42 schreef Marc de Lignie:
> > >> Hi Kai,
> > >>
> > >> Thanks for the response. I prepared a minimal config that
> > >> reproduces my problem.
> > >>
> > >> You can fetch the branch/commit from:
> > >> https://github.com/vtslab/directory-kerby/commits/MitIssue
> > >>
> > >> This is relative to RC2, but I also tried this on trunk for my
> > >> actual project.
> > >>
> > >> This config produces the debug and error messages below.
> > >>
> > >> 1. For the terminal with the bash + python script $ klist Ticket
> > >> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >> Default principal: drankye@TEST.COM
> > >>
> > >> Valid starting Expires Service principal
> > >> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/TEST.COM@TEST.COM
> > >> renew until 29-04-17 21:07:39
> > >>
> > >> $ .
> > >> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/
> > >> ke rb / server/MitIssueTest.sh [15538] 1493491231.917606:
> > >> Retrieving drankye@TEST.COM from
> > >> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> > >> result:
> > >> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > >> [15538]
> > >> 1493491231.917827: Retrieving drankye@TEST.COM from
> > >> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> result:
> > >> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > >> kerberos.authGSSClientInit successful [15538] 1493491231.918185:
> > >> Getting credentials drankye@TEST.COM -> test-service/localhost@
> > >> using ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
> > >> test-service/localhost@ from
> > >> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
> > >> -1765328243/Matching credential not found (filename:
> > >> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> > >> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
> > >> test-service/localhost@TEST.COM with result: -1765328243/Matching
> > >> credential not found (filename:
> > >> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> > >> [15538] 1493491231.918229: Server has referral realm; starting
> > >> with test-service/localhost@TEST.COM [15538] 1493491231.918278:
> > >> Retrieving drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM from
> > >> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
> > >> 0/Success
> > >> [15538] 1493491231.918281: Starting with TGT for client realm:
> > >> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
> > >> 1493491231.918301: Requesting tickets for
> > >> test-service/localhost@TEST.COM, referrals on [15538]
> > >> 1493491231.918326: Generated subkey for TGS request:
> > >> aes128-cts/FA30
> > >> [15538] 1493491231.918359: etypes requested in TGS request:
> > >> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1,
> > >> rc4-hmac, camellia128-cts, camellia256-cts [15538] 1493491231.918484:
> > >> Encoding request body and padata into FAST request [15538]
> > >> 1493491231.918541: Sending request (836 bytes) to TEST.COM
> > >> [15538]
> > >> 1493491231.918597: Resolving hostname localhost [15538]
> > >> 1493491231.918703: Initiating TCP connection to stream
> > >> 127.0.0.1:44292
> > >> [15538] 1493491231.918777: Sending TCP request to stream
> > >> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error receiving
> > >> from stream
> > >> 127.0.0.1:44292: 104/Connection reset by peer [15538]
> > >> 1493491231.922812: Terminating TCP connection to stream
> > >> 127.0.0.1:44292
> > >> [15538] 1493491231.922858: Sending initial UDP request to dgram
> > >> 127.0.0.1:44292
> > >> ('First kerberos.authGSSClientStep not successful',
> > >> GSSError(('Unspecified GSS failure. Minor code may provide more
> > >> information', 851968), ("Cannot contact any KDC for realm
> > >> 'TEST.COM'",
> > >> -1765328228)))
> > >>
> > >> 2. For the terminal that runs mvn clean test -Dtest=MitIssueTest
> > >> Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > >> 2017-04-29 21:07:39,182 DEBUG [main] backend.AbstractIdentityBackend:
> > >> initialize called
> > >> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
> > >> getIdentity called, principalName = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
> > >> getIdentity failed, principalName = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
> > >> addIdentity successful, principalName = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
> > >> getIdentity called, principalName = kadmin/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
> > >> getIdentity failed, principalName = kadmin/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,213 DEBUG [main] backend.AbstractIdentityBackend:
> > >> addIdentity successful, principalName = kadmin/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,216 DEBUG [main] backend.AbstractIdentityBackend:
> > >> start called
> > >> 2017-04-29 21:07:39,232 DEBUG [main] backend.AbstractIdentityBackend:
> > >> addIdentity successful, principalName =
> > >> test-service/localhost@TEST.COM
> > >> 2017-04-29 21:07:39,425 DEBUG [main] backend.AbstractIdentityBackend:
> > >> addIdentity successful, principalName = drankye@TEST.COM
> > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity called,
> > >> principalName = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity successful,
> > >> principalName = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1] request.KdcRequest:
> > >> Client entry is empty.
> > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity called,
> > >> principalName = drankye@TEST.COM
> > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity successful,
> > >> principalName = drankye@TEST.COM
> > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity called,
> > >> principalName = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity successful,
> > >> principalName = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
> > >> impl.DefaultKdcHandler: Transport or decoding error occurred,
> > >> disconnecting abnormally java.io.EOFException
> > >> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > receiveMessage(KrbTcpTransport.java:54)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> > DefaultKdcHandler.java:46)
> > >> at
> > >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > ThreadPoolExecutor.java:1142)
> > >> at
> > >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > ThreadPoolExecutor.java:617)
> > >> at java.lang.Thread.run(Thread.java:748)
> > >> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase:
> > >> Storing the tgt to the credential cache file.
> > >> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
> > >> getIdentity called, principalName =
> > >> test-service/localhost@TEST.COM
> > >> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
> > >> getIdentity successful, principalName =
> > >> test-service/localhost@TEST.COM
> > >> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity called,
> > >> principalName = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity successful,
> > >> principalName = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1] request.KdcRequest:
> > >> Client entry is empty.
> > >> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity called,
> > >> principalName = test-service/localhost@TEST.COM
> > >> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity successful,
> > >> principalName = test-service/localhost@TEST.COM
> > >> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity called,
> > >> principalName = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity successful,
> > >> principalName = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1] request.KdcRequest:
> > >> The preauth data is empty.
> > >> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1] server.KdcHandler:
> > >> KRB error occurred while processing request:Additional
> > >> pre-authentication required
> > >> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
> > >> impl.DefaultKdcHandler: Transport or decoding error occurred,
> > >> disconnecting abnormally java.io.EOFException
> > >> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > receiveMessage(KrbTcpTransport.java:54)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> > DefaultKdcHandler.java:46)
> > >> at
> > >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > ThreadPoolExecutor.java:1142)
> > >> at
> > >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > ThreadPoolExecutor.java:617)
> > >> at java.lang.Thread.run(Thread.java:748)
> > >> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity called,
> > >> principalName = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity successful,
> > >> principalName = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1] request.KdcRequest:
> > >> Client entry is empty.
> > >> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity called,
> > >> principalName = test-service/localhost@TEST.COM
> > >> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity successful,
> > >> principalName = test-service/localhost@TEST.COM
> > >> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity called,
> > >> principalName = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity successful,
> > >> principalName = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
> > >> impl.DefaultKdcHandler: Transport or decoding error occurred,
> > >> disconnecting abnormally java.io.EOFException
> > >> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > receiveMessage(KrbTcpTransport.java:54)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> > DefaultKdcHandler.java:46)
> > >> at
> > >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > ThreadPoolExecutor.java:1142)
> > >> at
> > >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > ThreadPoolExecutor.java:617)
> > >> at java.lang.Thread.run(Thread.java:748)
> > >> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity called,
> > >> principalName = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity successful,
> > >> principalName = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1] request.KdcRequest:
> > >> Found fast padata and start to process it.
> > >> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
> > >> impl.DefaultKdcHandler: Error occured while processing request:
> > >> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
> > >> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> > java:85)
> > >> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> > java:70)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindF
> > >> as
> > >> t(
> > KdcRequest.java:208)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.server.request.
> > KdcRequest.process(KdcRequest.java:168)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.server.KdcHandler.
> > handleMessage(KdcHandler.java:115)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
> > handleMessage(DefaultKdcHandler.java:67)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> > DefaultKdcHandler.java:52)
> > >> at
> > >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > ThreadPoolExecutor.java:1142)
> > >> at
> > >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > ThreadPoolExecutor.java:617)
> > >> at java.lang.Thread.run(Thread.java:748)
> > >> Caused by: java.io.IOException: Unexpected item context [0]
> > >> [tag=0xA0, off=0, len=3+207], expecting 0x30
> > >> at
> > >> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > Asn1Encodeable.java:210)
> > >> at
> > >> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > Asn1Encodeable.java:197)
> > >> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> > java:83)
> > >> ... 9 more
> > >> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
> > >> impl.DefaultKdcHandler: Transport or decoding error occurred,
> > >> disconnecting abnormally
> > >> java.net.SocketException: Socket closed
> > >> at java.net.SocketInputStream.socketRead0(Native Method)
> > >> at java.net.SocketInputStream.socketRead(SocketInputStream.
> > java:116)
> > >> at java.net.SocketInputStream.read(SocketInputStream.java:171)
> > >> at java.net.SocketInputStream.read(SocketInputStream.java:141)
> > >> at java.net.SocketInputStream.read(SocketInputStream.java:224)
> > >> at java.io.DataInputStream.readInt(DataInputStream.java:387)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > receiveMessage(KrbTcpTransport.java:54)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> > DefaultKdcHandler.java:46)
> > >> at
> > >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > ThreadPoolExecutor.java:1142)
> > >> at
> > >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > ThreadPoolExecutor.java:617)
> > >> at java.lang.Thread.run(Thread.java:748)
> > >>
> > >> In a FreeIPA environment these python lines "just" work.
> > >>
> > >> Any suggestions are welcome!
> > >>
> > >> Marc
> > >>
> > >>
> > > --
> > > Marc de Lignie
> > >
> >
> > --
> > Marc de Lignie
> >
> >
>
>
> --
> Colm O hEigeartaigh
>
> Talend Community Coder
> http://coders.talend.com
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
Re: MIT Kerberos compatibility
Posted by Colm O hEigeartaigh <co...@apache.org>.
Hi Jiajia,
If UDP is disabled and we don't use Netty, I can get a token successfully
via kinit. However I then see an error message in the Kerby console:
Exception in thread "Thread-1" java.lang.RuntimeException: Error occured
while checking udp connections
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(KdcNetwork.java:105)
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork.access$000(KdcNetwork.java:39)
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.run(KdcNetwork.java:75)
at java.lang.Thread.run(Thread.java:748)
Caused by: java.nio.channels.ClosedChannelException
at
sun.nio.ch.DatagramChannelImpl.ensureOpen(DatagramChannelImpl.java:320)
at sun.nio.ch.DatagramChannelImpl.receive(DatagramChannelImpl.java:331)
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork.checkUdpMessage(KdcNetwork.java:132)
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(KdcNetwork.java:101)
I'm not sure why we are seeing UDP errors when it's disabled?
Colm.
On Fri, May 5, 2017 at 3:57 PM, Li, Jiajia <ji...@intel.com> wrote:
> Hi Colm,
> The shell client can't connect to kdc if the UDP is disabled.
> We don't use Netty in default.
> What's your test-cases? The same as the Marc's?
>
> Thanks
> Jiajia
>
> -----Original Message-----
> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> Sent: Friday, May 5, 2017 10:09 PM
> To: kerby@directory.apache.org
> Cc: Zheng, Kai <ka...@intel.com>; mailto:m.c.delignie@xs4all.nl <
> m.c.delignie@xs4all.nl>
> Subject: Re: MIT Kerberos compatibility
>
> Hi Jiajia,
>
> What are the issues if UDP is disabled and we don't use Netty? I tried
> doing this with my own test-cases and it didn't work, so it would be good
> to get this fixed soon.
>
> Colm.
>
> On Fri, May 5, 2017 at 2:46 PM, Li, Jiajia <ji...@intel.com> wrote:
>
> > Hi Marc,
> > >>> - your KRB5 tracing looks quite different. What OS and
> > >>> mit-kerberos
> > version did you use?
> > I use mac os and the python version is 2.7.10
> >
> > >>>- your KRB5 tracing shows UDP comms between kerberos client and
> > >>>KDC,
> > despite the allowUDP = false setting
> > >>> in my test. I did this setting because I get different problems
> > without it, see the additional logs below. So,
> > >>>we must also be aware of networking problems at my side.
> > I enable the UDP and use netty network, there are some issues if UDP
> > disabled, you can create a JIRA for this and we can fix this issue in
> > the next release version.
> >
> > The changes in my side as following:
> >
> > protected boolean allowUdp() {
> > return true;
> > }
> > @Override
> > protected void prepareKdc() throws KrbException {
> > getKdcServer().setInnerKdcImpl(
> > new NettyKdcServerImpl(getKdcServer().getKdcSetting()));
> > super.prepareKdc();
> > }
> >
> > Here is log of MitIssueTest:
> > [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > [nioEventLoopGroup-2-1] INFO io.netty.handler.logging.LoggingHandler -
> > [id: 0x2634fe6b] REGISTERED
> > [nioEventLoopGroup-2-1] INFO io.netty.handler.logging.LoggingHandler -
> > [id: 0x2634fe6b] BIND(0.0.0.0/0.0.0.0:53957) [nioEventLoopGroup-2-1]
> > INFO io.netty.handler.logging.LoggingHandler -
> > [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] ACTIVE [main] INFO
> > org.apache.kerby.kerberos.kdc.impl.NettyKdcServerImpl - Netty kdc
> > server started.
> > [nioEventLoopGroup-2-1] INFO io.netty.handler.logging.LoggingHandler -
> > [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] RECEIVED: [id: 0xdac7228b, /
> > 127.0.0.1:53961 => /127.0.0.1:53957]
> > [defaultEventExecutorGroup-4-1] INFO
> > org.apache.kerby.kerberos.kerb.server.request.AsRequest
> > - AS_REQ ISSUE: authtime 1493991123792,drankye@TEST.COM for krbtgt/
> > TEST.COM@TEST.COM [main] INFO
> > org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClient
> > - Send to kdc success.
> > [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
> > Storing the tgt to the credential cache file.
> > [nioEventLoopGroup-5-1] INFO
> > org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> > - The preauth data is empty.
> > [nioEventLoopGroup-5-1] INFO
> > org.apache.kerby.kerberos.kerb.server.KdcHandler
> > - KRB error occurred while processing request:Additional
> > pre-authentication required [nioEventLoopGroup-5-1] INFO
> > org.apache.kerby.kerberos.kerb.server.request.AsRequest
> > - AS_REQ ISSUE: authtime 1493991123859,test-service/localhost@TEST.COM
> > for krbtgt/TEST.COM@TEST.COM
> > [nioEventLoopGroup-5-1] INFO
> > org.apache.kerby.kerberos.kerb.server.request.TgsRequest
> > - TGS_REQ ISSUE: authtime 1493991142850,drankye for test-service/
> > localhost@TEST.COM
> >
> > Thanks
> > Jiajia
> >
> > -----Original Message-----
> > From: Zheng, Kai
> > Sent: Friday, May 5, 2017 7:46 PM
> > To: kerby@directory.apache.org; Li, Jiajia <ji...@intel.com>
> > Subject: RE: MIT Kerberos compatibility
> >
> > Hi Marc,
> >
> > Looks like this is quite environment related, could you fire an issue
> > for this? I would suggest we target it to 1.1.0, which can be done in
> June.
> >
> > Regards,
> > Kai
> >
> > -----Original Message-----
> > From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> > Sent: Friday, May 05, 2017 4:44 PM
> > To: Li, Jiajia <ji...@intel.com>
> > Cc: kerby@directory.apache.org
> > Subject: Re: MIT Kerberos compatibility
> >
> > Hi Jiajia,
> >
> > Great to read that you made progress on this issue and to see a
> > working config at your side. Below, I list my progress below (with
> > trunk merged into my MitIssue branch), but I am afraid we are not done
> yet.
> >
> > Things that stand out:
> >
> > - the kdc decoding error is solved, relative to the logs without your
> > patch
> >
> > - your KRB5 tracing looks quite different. What OS and mit-kerberos
> > version did you use?
> >
> > - your KRB5 tracing shows UDP comms between kerberos client and KDC,
> > despite the allowUDP = false setting in my test. I did this setting
> > because I get different problems without it, see the additional logs
> > below. So, we must also be aware of networking problems at my side.
> >
> > - the "Response was not from master KDC" msg is not relevant; it
> > disappears if you manually add master_kdc to the realms section of the
> > krb5.conf
> >
> > I have no idea how to proceed from here, so that is why I just
> > document the status at my side and ask about your - apparently working -
> config.
> >
> > Cheers, Marc
> >
> >
> > KDC logging with allowUDP = false:
> >
> > [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > [pool-1-thread-1] INFO
> > org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
> > authtime 1493970789075,drankye@TEST.COM for krbtgt/TEST.COM@TEST.COM
> > [main] INFO
> > org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClient
> > - Send to kdc success.
> > [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
> > Storing the tgt to the credential cache file.
> > [pool-1-thread-1] INFO
> > org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The preauth
> > data is empty.
> > [pool-1-thread-1] INFO
> > org.apache.kerby.kerberos.kerb.server.KdcHandler
> > - KRB error occurred while processing request:Additional
> > pre-authentication required [pool-1-thread-1] INFO
> > org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
> > authtime 1493970789108,test-service/localhost@TEST.COM for krbtgt/
> > TEST.COM@TEST.COM [pool-1-thread-1] INFO
> > org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> > - Found fast padata and starting to process it.
> > [pool-1-thread-1] INFO
> > org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found fast
> > padata and starting to process it.
> >
> > Python script KRB5 tracing (MIT Kerberos 1.13.2 of Ubuntu Xenial) with
> > allowUDP = false:
> >
> > $ .
> > kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/
> > kerberos/kerb/server/MitIssueTest.sh
> > [25281] 1493970797.298753: Retrieving drankye@TEST.COM from
> > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281]
> > 1493970797.298952: Retrieving drankye@TEST.COM from
> > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281]
> > 1493970797.299106: Retrieving drankye@TEST.COM from
> > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281]
> > 1493970797.299213: Retrieving drankye@TEST.COM from
> > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281]
> > 1493970797.299323: Retrieving drankye@TEST.COM from
> > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281]
> > 1493970797.299436: Retrieving drankye@TEST.COM from
> > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281]
> > 1493970797.299545: Retrieving drankye@TEST.COM from
> > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281]
> > 1493970797.299654: Retrieving drankye@TEST.COM from
> > FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> > 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > kerberos.authGSSClientInit successful [25281] 1493970797.299922:
> > Getting credentials drankye@TEST.COM -> test-service/localhost@ using
> > ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > [25281] 1493970797.299945: Retrieving drankye@TEST.COM ->
> > test-service/localhost@ from
> > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > with result:
> > -1765328243/Matching credential not found [25281] 1493970797.299959:
> > Retrying drankye@TEST.COM -> test-service/localhost@TEST.COM with
> result:
> > -1765328243/Matching credential not found [25281] 1493970797.299962:
> > Server has referral realm; starting with
> > test-service/localhost@TEST.COM [25281]
> > 1493970797.299975: Retrieving drankye@TEST.COM ->
> > krbtgt/TEST.COM@TEST.COM from FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> with result:
> > 0/Success [25281] 1493970797.299979: Starting with TGT for client realm:
> > drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [25281] 1493970797.299981:
> > Requesting tickets for test-service/localhost@TEST.COM, referrals on
> > [25281] 1493970797.299994: Generated subkey for TGS request:
> > aes128-cts/1B9B [25281] 1493970797.300009: etypes requested in TGS
> request:
> > aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
> > camellia256-cts [25281] 1493970797.300054: Encoding request body and
> > padata into FAST request [25281] 1493970797.300080: Sending request
> > (823 bytes) to TEST.COM [25281] 1493970797.300091: Resolving hostname
> > localhost [25281]
> > 1493970797.300136: Initiating TCP connection to stream
> > 127.0.0.1:34319
> > [25281] 1493970797.300191: Sending TCP request to stream
> > 127.0.0.1:34319 [25281] 1493970797.303610: Received answer (125 bytes)
> > from stream
> > 127.0.0.1:34319
> > [25281] 1493970797.303618: Terminating TCP connection to stream
> > 127.0.0.1:34319
> > [25281] 1493970797.553126: Response was not from master KDC [25281]
> > 1493970797.553198: TGS request result: -1765323383/Unknown code krcM
> > 137 [25281] 1493970797.553234: Requesting tickets for test-service/
> > localhost@TEST.COM, referrals off [25281] 1493970797.553273: Generated
> > subkey for TGS request: aes128-cts/94C6 [25281] 1493970797.553323:
> > etypes requested in TGS request: aes256-cts, aes128-cts,
> > des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts [25281]
> > 1493970797.553436: Encoding request body and padata into FAST request
> [25281] 1493970797.553532:
> > Sending request (823 bytes) to TEST.COM [25281] 1493970797.553567:
> > Resolving hostname localhost [25281] 1493970797.553745: Initiating TCP
> > connection to stream
> > 127.0.0.1:34319
> > [25281] 1493970797.553889: Sending TCP request to stream
> > 127.0.0.1:34319 [25281] 1493970797.558297: Received answer (125 bytes)
> > from stream
> > 127.0.0.1:34319
> > [25281] 1493970797.558318: Terminating TCP connection to stream
> > 127.0.0.1:34319
> > [25281] 1493970797.561189: Response was not from master KDC [25281]
> > 1493970797.561258: TGS request result: -1765323383/Unknown code krcM
> > 137 ('First kerberos.authGSSClientStep not successful',
> > GSSError(('Unspecified GSS failure. Minor code may provide more
> > information', 851968), ('Unknown code krcM 137', -1765323383)))
> >
> >
> > KDC logging with allowUDP = true:
> >
> > [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > [pool-1-thread-1] INFO
> > org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
> > authtime 1493972505784,drankye@TEST.COM for krbtgt/TEST.COM@TEST.COM
> > [main] INFO
> > org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClient
> > - Send to kdc success.
> > [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
> > Storing the tgt to the credential cache file.
> > [pool-1-thread-1] INFO
> > org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The preauth
> > data is empty.
> > [pool-1-thread-1] INFO
> > org.apache.kerby.kerberos.kerb.server.KdcHandler
> > - KRB error occurred while processing request:Additional
> > pre-authentication required [pool-1-thread-2] INFO
> > org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
> > authtime 1493972505948,test-service/localhost@TEST.COM for krbtgt/
> > TEST.COM@TEST.COM Exception in thread "Thread-0"
> > java.lang.RuntimeException: Error occured while checking udp connections
> > at
> > org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > KdcNetwork.java:105)
> > at
> > org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > access$000(KdcNetwork.java:39)
> > at
> > org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> > run(KdcNetwork.java:75)
> > at java.lang.Thread.run(Thread.java:748)
> > Caused by: java.nio.channels.ClosedChannelException
> > at
> > sun.nio.ch.DatagramChannelImpl.ensureOpen(DatagramChannelImpl.java:320)
> > at sun.nio.ch.DatagramChannelImpl.receive(
> > DatagramChannelImpl.java:331)
> > at
> > org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> > checkUdpMessage(KdcNetwork.java:132)
> > at
> > org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> > KdcNetwork.java:101)
> > ... 3 more
> >
> >
> > krb5.conf:
> >
> > [libdefaults]
> > kdc_realm = TEST.COM
> > default_realm = TEST.COM
> > udp_preference_limit = 4096
> > kdc_tcp_port = 37080
> > kdc_udp_port = 36525
> >
> > [realms]
> > TEST.COM = {
> > kdc = localhost:36525
> > }
> >
> > And port 36525 does not show up in `netstat -l` (while 37080 does)
> >
> >
> > Op 04-05-17 om 14:55 schreef Li, Jiajia:
> > > Hi Marc,
> > > I try to run your test(through applying your patch in the trunk) , I
> > think it's success now. Could you take some time to check about it?
> > > Here is the log:
> > >
> > > directory-kerby git:(trunk) ✗ .
> > > kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/ker
> > > b/
> > > server/MitIssueTest.sh
> > > kerberos.authGSSClientInit successful
> > > 2017-05-04T20:44:06 set-error: -1765328234: entypes not supported
> > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> > > for krb5_ccache_conf_data/realm-config@X-CACHECONF: in cache
> > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> > > for test-service/localhost@TEST.COM in cache
> > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> > > for
> > > krb5_ccache_conf_data/negative-cache/test-service\134/localhost\134@
> > > TE
> > > ST.COM@X-CACHECONF: in cache
> > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> > > for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF: in cache
> > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> > > for krb5_ccache_conf_data/sitename@X-CACHECONF: in cache
> > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> > > for test-service/localhost@TEST.COM in cache
> > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > des-cbc-md5-deprecated not supported
> > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > des-cbc-md4-deprecated not supported
> > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > des-cbc-crc-deprecated not supported
> > > 2017-05-04T20:44:06 Trying to find service kdc for realm TEST.COM
> > > flags 0
> > > 2017-05-04T20:44:06 configuration file for realm TEST.COM found
> > > 2017-05-04T20:44:06 submissing new requests to new host
> > > 2017-05-04T20:44:06 host_create: setting hostname localhost
> > > 2017-05-04T20:44:06 connecting to host: udp ::1:52534 (localhost) tid:
> > > 00000001
> > > 2017-05-04T20:44:06 host_create: setting hostname localhost
> > > 2017-05-04T20:44:06 Queuing host in future (in 3s), its the 2
> > > address on the same name: udp 127.0.0.1:52534 (localhost) tid:
> > > 00000002
> > > 2017-05-04T20:44:06 writing packet: udp ::1:52534 (localhost) tid:
> > > 00000001
> > > 2017-05-04T20:44:06 reading packet: udp ::1:52534 (localhost) tid:
> > > 00000001
> > > 2017-05-04T20:44:06 host completed: udp ::1:52534 (localhost) tid:
> > > 00000001
> > > 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0 hosts 1
> > > packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814 tid: 00000002
> > > 2017-05-04T20:44:06 tkt: extract key 17/763641F3
> > > 2017-05-04T20:44:06 set-error: -1765328353: Decrypt integrity check
> > > failed for checksum type hmac-sha1-96-aes128, key type
> > > aes128-cts-hmac-sha1-96
> > > 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
> > > 2017-05-04T20:44:06 krb5_get_credentials_with_flags: TEST.COM wc:
> > > 0.050317
> > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> > > for krb5_ccache_conf_data/realm-config@X-CACHECONF: in cache
> > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> > > for
> > > krb5_ccache_conf_data/time-offset/test-service\134/localhost\134@TEST.
> > > COM@X-CACHECONF: in cache
> > > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > > 2017-05-04T20:44:06 Setting up PFS for auth context
> > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > des-cbc-md5-deprecated not supported
> > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > des-cbc-md4-deprecated not supported
> > > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > > des-cbc-crc-deprecated not supported First
> > > kerberos.authGSSClientStep successful
> > >
> > > Thanks
> > > Jiajia
> > >
> > > -----Original Message-----
> > > From: Zheng, Kai [mailto:kai.zheng@intel.com]
> > > Sent: Wednesday, May 3, 2017 7:29 PM
> > > To: kerby@directory.apache.org
> > > Subject: RE: MIT Kerberos compatibility
> > >
> > > Hi Marc,
> > >
> > > In case you're not aware of this, please check out the latest fix
> > > made
> > by Jiajia. We thought your case may be different, but would be good to
> > have a check before we can repeat/fix your case. Thanks.
> > > https://issues.apache.org/jira/browse/DIRKRB-625
> > >
> > > Regards,
> > > Kai
> > >
> > > -----Original Message-----
> > > From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> > > Sent: Sunday, April 30, 2017 7:45 PM
> > > To: kerby@directory.apache.org
> > > Subject: Re: MIT Kerberos compatibility
> > >
> > > Hi Kai,
> > >
> > > The terminal output below is for the latest MIT Kerberos 1.15.1
> > > (locally
> > built on Ubuntu Xenial). Before that, I also tested with the default
> > Xenial MIT Kerberos packages (1.13.2), with the same result. I did not
> > try earlier MIT Kerberos versions.
> > >
> > > Marc
> > >
> > > Op 29-04-17 om 21:42 schreef Marc de Lignie:
> > >> Hi Kai,
> > >>
> > >> Thanks for the response. I prepared a minimal config that
> > >> reproduces my problem.
> > >>
> > >> You can fetch the branch/commit from:
> > >> https://github.com/vtslab/directory-kerby/commits/MitIssue
> > >>
> > >> This is relative to RC2, but I also tried this on trunk for my
> > >> actual project.
> > >>
> > >> This config produces the debug and error messages below.
> > >>
> > >> 1. For the terminal with the bash + python script $ klist Ticket
> > >> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >> Default principal: drankye@TEST.COM
> > >>
> > >> Valid starting Expires Service principal
> > >> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/TEST.COM@TEST.COM
> > >> renew until 29-04-17 21:07:39
> > >>
> > >> $ .
> > >> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/ke
> > >> rb / server/MitIssueTest.sh [15538] 1493491231.917606: Retrieving
> > >> drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno
> > >> 0, enctype 0) with result:
> > >> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > >> [15538]
> > >> 1493491231.917827: Retrieving drankye@TEST.COM from
> > >> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with
> result:
> > >> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> > >> kerberos.authGSSClientInit successful [15538] 1493491231.918185:
> > >> Getting credentials drankye@TEST.COM -> test-service/localhost@
> > >> using ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > >> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
> > >> test-service/localhost@ from
> > >> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
> > >> -1765328243/Matching credential not found (filename:
> > >> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> > >> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
> > >> test-service/localhost@TEST.COM with result: -1765328243/Matching
> > >> credential not found (filename:
> > >> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> > >> [15538] 1493491231.918229: Server has referral realm; starting with
> > >> test-service/localhost@TEST.COM [15538] 1493491231.918278:
> > >> Retrieving drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM from
> > >> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
> > >> 0/Success
> > >> [15538] 1493491231.918281: Starting with TGT for client realm:
> > >> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
> > >> 1493491231.918301: Requesting tickets for
> > >> test-service/localhost@TEST.COM, referrals on [15538]
> > >> 1493491231.918326: Generated subkey for TGS request:
> > >> aes128-cts/FA30
> > >> [15538] 1493491231.918359: etypes requested in TGS request:
> > >> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1,
> > >> rc4-hmac, camellia128-cts, camellia256-cts [15538] 1493491231.918484:
> > >> Encoding request body and padata into FAST request [15538]
> > >> 1493491231.918541: Sending request (836 bytes) to TEST.COM [15538]
> > >> 1493491231.918597: Resolving hostname localhost [15538]
> > >> 1493491231.918703: Initiating TCP connection to stream
> > >> 127.0.0.1:44292
> > >> [15538] 1493491231.918777: Sending TCP request to stream
> > >> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error receiving from
> > >> stream
> > >> 127.0.0.1:44292: 104/Connection reset by peer [15538]
> > >> 1493491231.922812: Terminating TCP connection to stream
> > >> 127.0.0.1:44292
> > >> [15538] 1493491231.922858: Sending initial UDP request to dgram
> > >> 127.0.0.1:44292
> > >> ('First kerberos.authGSSClientStep not successful',
> > >> GSSError(('Unspecified GSS failure. Minor code may provide more
> > >> information', 851968), ("Cannot contact any KDC for realm
> > >> 'TEST.COM'",
> > >> -1765328228)))
> > >>
> > >> 2. For the terminal that runs mvn clean test -Dtest=MitIssueTest
> > >> Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> > >> 2017-04-29 21:07:39,182 DEBUG [main] backend.AbstractIdentityBackend:
> > >> initialize called
> > >> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
> > >> getIdentity called, principalName = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
> > >> getIdentity failed, principalName = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
> > >> addIdentity successful, principalName = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
> > >> getIdentity called, principalName = kadmin/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
> > >> getIdentity failed, principalName = kadmin/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,213 DEBUG [main] backend.AbstractIdentityBackend:
> > >> addIdentity successful, principalName = kadmin/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,216 DEBUG [main] backend.AbstractIdentityBackend:
> > >> start called
> > >> 2017-04-29 21:07:39,232 DEBUG [main] backend.AbstractIdentityBackend:
> > >> addIdentity successful, principalName =
> > >> test-service/localhost@TEST.COM
> > >> 2017-04-29 21:07:39,425 DEBUG [main] backend.AbstractIdentityBackend:
> > >> addIdentity successful, principalName = drankye@TEST.COM
> > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity called, principalName
> > >> = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity successful,
> > >> principalName = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1] request.KdcRequest:
> > >> Client entry is empty.
> > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity called, principalName
> > >> = drankye@TEST.COM
> > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity successful,
> > >> principalName = drankye@TEST.COM
> > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity called, principalName
> > >> = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity successful,
> > >> principalName = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
> > >> impl.DefaultKdcHandler: Transport or decoding error occurred,
> > >> disconnecting abnormally java.io.EOFException
> > >> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > receiveMessage(KrbTcpTransport.java:54)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> > DefaultKdcHandler.java:46)
> > >> at
> > >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > ThreadPoolExecutor.java:1142)
> > >> at
> > >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > ThreadPoolExecutor.java:617)
> > >> at java.lang.Thread.run(Thread.java:748)
> > >> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase: Storing
> > >> the tgt to the credential cache file.
> > >> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
> > >> getIdentity called, principalName = test-service/localhost@TEST.COM
> > >> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
> > >> getIdentity successful, principalName =
> > >> test-service/localhost@TEST.COM
> > >> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity called, principalName
> > >> = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity successful,
> > >> principalName = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1] request.KdcRequest:
> > >> Client entry is empty.
> > >> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity called, principalName
> > >> = test-service/localhost@TEST.COM
> > >> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity successful,
> > >> principalName = test-service/localhost@TEST.COM
> > >> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity called, principalName
> > >> = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity successful,
> > >> principalName = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1] request.KdcRequest:
> > >> The preauth data is empty.
> > >> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1] server.KdcHandler:
> > >> KRB error occurred while processing request:Additional
> > >> pre-authentication required
> > >> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
> > >> impl.DefaultKdcHandler: Transport or decoding error occurred,
> > >> disconnecting abnormally java.io.EOFException
> > >> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > receiveMessage(KrbTcpTransport.java:54)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> > DefaultKdcHandler.java:46)
> > >> at
> > >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > ThreadPoolExecutor.java:1142)
> > >> at
> > >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > ThreadPoolExecutor.java:617)
> > >> at java.lang.Thread.run(Thread.java:748)
> > >> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity called, principalName
> > >> = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity successful,
> > >> principalName = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1] request.KdcRequest:
> > >> Client entry is empty.
> > >> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity called, principalName
> > >> = test-service/localhost@TEST.COM
> > >> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity successful,
> > >> principalName = test-service/localhost@TEST.COM
> > >> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity called, principalName
> > >> = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity successful,
> > >> principalName = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
> > >> impl.DefaultKdcHandler: Transport or decoding error occurred,
> > >> disconnecting abnormally java.io.EOFException
> > >> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > receiveMessage(KrbTcpTransport.java:54)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> > DefaultKdcHandler.java:46)
> > >> at
> > >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > ThreadPoolExecutor.java:1142)
> > >> at
> > >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > ThreadPoolExecutor.java:617)
> > >> at java.lang.Thread.run(Thread.java:748)
> > >> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity called, principalName
> > >> = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> > >> backend.AbstractIdentityBackend: getIdentity successful,
> > >> principalName = krbtgt/TEST.COM@TEST.COM
> > >> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1] request.KdcRequest:
> > >> Found fast padata and start to process it.
> > >> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
> > >> impl.DefaultKdcHandler: Error occured while processing request:
> > >> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
> > >> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> > java:85)
> > >> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> > java:70)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFas
> > >> t(
> > KdcRequest.java:208)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.server.request.
> > KdcRequest.process(KdcRequest.java:168)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.server.KdcHandler.
> > handleMessage(KdcHandler.java:115)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
> > handleMessage(DefaultKdcHandler.java:67)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> > DefaultKdcHandler.java:52)
> > >> at
> > >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > ThreadPoolExecutor.java:1142)
> > >> at
> > >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > ThreadPoolExecutor.java:617)
> > >> at java.lang.Thread.run(Thread.java:748)
> > >> Caused by: java.io.IOException: Unexpected item context [0]
> > >> [tag=0xA0, off=0, len=3+207], expecting 0x30
> > >> at
> > >> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > Asn1Encodeable.java:210)
> > >> at
> > >> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > Asn1Encodeable.java:197)
> > >> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> > java:83)
> > >> ... 9 more
> > >> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
> > >> impl.DefaultKdcHandler: Transport or decoding error occurred,
> > >> disconnecting abnormally
> > >> java.net.SocketException: Socket closed
> > >> at java.net.SocketInputStream.socketRead0(Native Method)
> > >> at java.net.SocketInputStream.socketRead(SocketInputStream.
> > java:116)
> > >> at java.net.SocketInputStream.read(SocketInputStream.java:171)
> > >> at java.net.SocketInputStream.read(SocketInputStream.java:141)
> > >> at java.net.SocketInputStream.read(SocketInputStream.java:224)
> > >> at java.io.DataInputStream.readInt(DataInputStream.java:387)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> > receiveMessage(KrbTcpTransport.java:54)
> > >> at
> > >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> > DefaultKdcHandler.java:46)
> > >> at
> > >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > ThreadPoolExecutor.java:1142)
> > >> at
> > >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > ThreadPoolExecutor.java:617)
> > >> at java.lang.Thread.run(Thread.java:748)
> > >>
> > >> In a FreeIPA environment these python lines "just" work.
> > >>
> > >> Any suggestions are welcome!
> > >>
> > >> Marc
> > >>
> > >>
> > > --
> > > Marc de Lignie
> > >
> >
> > --
> > Marc de Lignie
> >
> >
>
>
> --
> Colm O hEigeartaigh
>
> Talend Community Coder
> http://coders.talend.com
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
RE: MIT Kerberos compatibility
Posted by "Li, Jiajia" <ji...@intel.com>.
Hi Colm,
The shell client can't connect to kdc if the UDP is disabled.
We don't use Netty in default.
What's your test-cases? The same as the Marc's?
Thanks
Jiajia
-----Original Message-----
From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
Sent: Friday, May 5, 2017 10:09 PM
To: kerby@directory.apache.org
Cc: Zheng, Kai <ka...@intel.com>; mailto:m.c.delignie@xs4all.nl <m....@xs4all.nl>
Subject: Re: MIT Kerberos compatibility
Hi Jiajia,
What are the issues if UDP is disabled and we don't use Netty? I tried doing this with my own test-cases and it didn't work, so it would be good to get this fixed soon.
Colm.
On Fri, May 5, 2017 at 2:46 PM, Li, Jiajia <ji...@intel.com> wrote:
> Hi Marc,
> >>> - your KRB5 tracing looks quite different. What OS and
> >>> mit-kerberos
> version did you use?
> I use mac os and the python version is 2.7.10
>
> >>>- your KRB5 tracing shows UDP comms between kerberos client and
> >>>KDC,
> despite the allowUDP = false setting
> >>> in my test. I did this setting because I get different problems
> without it, see the additional logs below. So,
> >>>we must also be aware of networking problems at my side.
> I enable the UDP and use netty network, there are some issues if UDP
> disabled, you can create a JIRA for this and we can fix this issue in
> the next release version.
>
> The changes in my side as following:
>
> protected boolean allowUdp() {
> return true;
> }
> @Override
> protected void prepareKdc() throws KrbException {
> getKdcServer().setInnerKdcImpl(
> new NettyKdcServerImpl(getKdcServer().getKdcSetting()));
> super.prepareKdc();
> }
>
> Here is log of MitIssueTest:
> [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> [nioEventLoopGroup-2-1] INFO io.netty.handler.logging.LoggingHandler -
> [id: 0x2634fe6b] REGISTERED
> [nioEventLoopGroup-2-1] INFO io.netty.handler.logging.LoggingHandler -
> [id: 0x2634fe6b] BIND(0.0.0.0/0.0.0.0:53957) [nioEventLoopGroup-2-1]
> INFO io.netty.handler.logging.LoggingHandler -
> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] ACTIVE [main] INFO
> org.apache.kerby.kerberos.kdc.impl.NettyKdcServerImpl - Netty kdc
> server started.
> [nioEventLoopGroup-2-1] INFO io.netty.handler.logging.LoggingHandler -
> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] RECEIVED: [id: 0xdac7228b, /
> 127.0.0.1:53961 => /127.0.0.1:53957]
> [defaultEventExecutorGroup-4-1] INFO
> org.apache.kerby.kerberos.kerb.server.request.AsRequest
> - AS_REQ ISSUE: authtime 1493991123792,drankye@TEST.COM for krbtgt/
> TEST.COM@TEST.COM [main] INFO
> org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClient
> - Send to kdc success.
> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
> Storing the tgt to the credential cache file.
> [nioEventLoopGroup-5-1] INFO
> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> - The preauth data is empty.
> [nioEventLoopGroup-5-1] INFO
> org.apache.kerby.kerberos.kerb.server.KdcHandler
> - KRB error occurred while processing request:Additional
> pre-authentication required [nioEventLoopGroup-5-1] INFO
> org.apache.kerby.kerberos.kerb.server.request.AsRequest
> - AS_REQ ISSUE: authtime 1493991123859,test-service/localhost@TEST.COM
> for krbtgt/TEST.COM@TEST.COM
> [nioEventLoopGroup-5-1] INFO
> org.apache.kerby.kerberos.kerb.server.request.TgsRequest
> - TGS_REQ ISSUE: authtime 1493991142850,drankye for test-service/
> localhost@TEST.COM
>
> Thanks
> Jiajia
>
> -----Original Message-----
> From: Zheng, Kai
> Sent: Friday, May 5, 2017 7:46 PM
> To: kerby@directory.apache.org; Li, Jiajia <ji...@intel.com>
> Subject: RE: MIT Kerberos compatibility
>
> Hi Marc,
>
> Looks like this is quite environment related, could you fire an issue
> for this? I would suggest we target it to 1.1.0, which can be done in June.
>
> Regards,
> Kai
>
> -----Original Message-----
> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> Sent: Friday, May 05, 2017 4:44 PM
> To: Li, Jiajia <ji...@intel.com>
> Cc: kerby@directory.apache.org
> Subject: Re: MIT Kerberos compatibility
>
> Hi Jiajia,
>
> Great to read that you made progress on this issue and to see a
> working config at your side. Below, I list my progress below (with
> trunk merged into my MitIssue branch), but I am afraid we are not done yet.
>
> Things that stand out:
>
> - the kdc decoding error is solved, relative to the logs without your
> patch
>
> - your KRB5 tracing looks quite different. What OS and mit-kerberos
> version did you use?
>
> - your KRB5 tracing shows UDP comms between kerberos client and KDC,
> despite the allowUDP = false setting in my test. I did this setting
> because I get different problems without it, see the additional logs
> below. So, we must also be aware of networking problems at my side.
>
> - the "Response was not from master KDC" msg is not relevant; it
> disappears if you manually add master_kdc to the realms section of the
> krb5.conf
>
> I have no idea how to proceed from here, so that is why I just
> document the status at my side and ask about your - apparently working - config.
>
> Cheers, Marc
>
>
> KDC logging with allowUDP = false:
>
> [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> [pool-1-thread-1] INFO
> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
> authtime 1493970789075,drankye@TEST.COM for krbtgt/TEST.COM@TEST.COM
> [main] INFO
> org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClient
> - Send to kdc success.
> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
> Storing the tgt to the credential cache file.
> [pool-1-thread-1] INFO
> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The preauth
> data is empty.
> [pool-1-thread-1] INFO
> org.apache.kerby.kerberos.kerb.server.KdcHandler
> - KRB error occurred while processing request:Additional
> pre-authentication required [pool-1-thread-1] INFO
> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
> authtime 1493970789108,test-service/localhost@TEST.COM for krbtgt/
> TEST.COM@TEST.COM [pool-1-thread-1] INFO
> org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> - Found fast padata and starting to process it.
> [pool-1-thread-1] INFO
> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found fast
> padata and starting to process it.
>
> Python script KRB5 tracing (MIT Kerberos 1.13.2 of Ubuntu Xenial) with
> allowUDP = false:
>
> $ .
> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/
> kerberos/kerb/server/MitIssueTest.sh
> [25281] 1493970797.298753: Retrieving drankye@TEST.COM from
> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281]
> 1493970797.298952: Retrieving drankye@TEST.COM from
> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281]
> 1493970797.299106: Retrieving drankye@TEST.COM from
> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281]
> 1493970797.299213: Retrieving drankye@TEST.COM from
> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281]
> 1493970797.299323: Retrieving drankye@TEST.COM from
> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281]
> 1493970797.299436: Retrieving drankye@TEST.COM from
> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281]
> 1493970797.299545: Retrieving drankye@TEST.COM from
> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281]
> 1493970797.299654: Retrieving drankye@TEST.COM from
> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> kerberos.authGSSClientInit successful [25281] 1493970797.299922:
> Getting credentials drankye@TEST.COM -> test-service/localhost@ using
> ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> [25281] 1493970797.299945: Retrieving drankye@TEST.COM ->
> test-service/localhost@ from
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> with result:
> -1765328243/Matching credential not found [25281] 1493970797.299959:
> Retrying drankye@TEST.COM -> test-service/localhost@TEST.COM with result:
> -1765328243/Matching credential not found [25281] 1493970797.299962:
> Server has referral realm; starting with
> test-service/localhost@TEST.COM [25281]
> 1493970797.299975: Retrieving drankye@TEST.COM ->
> krbtgt/TEST.COM@TEST.COM from FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
> 0/Success [25281] 1493970797.299979: Starting with TGT for client realm:
> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [25281] 1493970797.299981:
> Requesting tickets for test-service/localhost@TEST.COM, referrals on
> [25281] 1493970797.299994: Generated subkey for TGS request:
> aes128-cts/1B9B [25281] 1493970797.300009: etypes requested in TGS request:
> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
> camellia256-cts [25281] 1493970797.300054: Encoding request body and
> padata into FAST request [25281] 1493970797.300080: Sending request
> (823 bytes) to TEST.COM [25281] 1493970797.300091: Resolving hostname
> localhost [25281]
> 1493970797.300136: Initiating TCP connection to stream
> 127.0.0.1:34319
> [25281] 1493970797.300191: Sending TCP request to stream
> 127.0.0.1:34319 [25281] 1493970797.303610: Received answer (125 bytes)
> from stream
> 127.0.0.1:34319
> [25281] 1493970797.303618: Terminating TCP connection to stream
> 127.0.0.1:34319
> [25281] 1493970797.553126: Response was not from master KDC [25281]
> 1493970797.553198: TGS request result: -1765323383/Unknown code krcM
> 137 [25281] 1493970797.553234: Requesting tickets for test-service/
> localhost@TEST.COM, referrals off [25281] 1493970797.553273: Generated
> subkey for TGS request: aes128-cts/94C6 [25281] 1493970797.553323:
> etypes requested in TGS request: aes256-cts, aes128-cts,
> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts [25281]
> 1493970797.553436: Encoding request body and padata into FAST request [25281] 1493970797.553532:
> Sending request (823 bytes) to TEST.COM [25281] 1493970797.553567:
> Resolving hostname localhost [25281] 1493970797.553745: Initiating TCP
> connection to stream
> 127.0.0.1:34319
> [25281] 1493970797.553889: Sending TCP request to stream
> 127.0.0.1:34319 [25281] 1493970797.558297: Received answer (125 bytes)
> from stream
> 127.0.0.1:34319
> [25281] 1493970797.558318: Terminating TCP connection to stream
> 127.0.0.1:34319
> [25281] 1493970797.561189: Response was not from master KDC [25281]
> 1493970797.561258: TGS request result: -1765323383/Unknown code krcM
> 137 ('First kerberos.authGSSClientStep not successful',
> GSSError(('Unspecified GSS failure. Minor code may provide more
> information', 851968), ('Unknown code krcM 137', -1765323383)))
>
>
> KDC logging with allowUDP = true:
>
> [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> [pool-1-thread-1] INFO
> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
> authtime 1493972505784,drankye@TEST.COM for krbtgt/TEST.COM@TEST.COM
> [main] INFO
> org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClient
> - Send to kdc success.
> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
> Storing the tgt to the credential cache file.
> [pool-1-thread-1] INFO
> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The preauth
> data is empty.
> [pool-1-thread-1] INFO
> org.apache.kerby.kerberos.kerb.server.KdcHandler
> - KRB error occurred while processing request:Additional
> pre-authentication required [pool-1-thread-2] INFO
> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
> authtime 1493972505948,test-service/localhost@TEST.COM for krbtgt/
> TEST.COM@TEST.COM Exception in thread "Thread-0"
> java.lang.RuntimeException: Error occured while checking udp connections
> at
> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> KdcNetwork.java:105)
> at
> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> access$000(KdcNetwork.java:39)
> at
> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> run(KdcNetwork.java:75)
> at java.lang.Thread.run(Thread.java:748)
> Caused by: java.nio.channels.ClosedChannelException
> at
> sun.nio.ch.DatagramChannelImpl.ensureOpen(DatagramChannelImpl.java:320)
> at sun.nio.ch.DatagramChannelImpl.receive(
> DatagramChannelImpl.java:331)
> at
> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> checkUdpMessage(KdcNetwork.java:132)
> at
> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> KdcNetwork.java:101)
> ... 3 more
>
>
> krb5.conf:
>
> [libdefaults]
> kdc_realm = TEST.COM
> default_realm = TEST.COM
> udp_preference_limit = 4096
> kdc_tcp_port = 37080
> kdc_udp_port = 36525
>
> [realms]
> TEST.COM = {
> kdc = localhost:36525
> }
>
> And port 36525 does not show up in `netstat -l` (while 37080 does)
>
>
> Op 04-05-17 om 14:55 schreef Li, Jiajia:
> > Hi Marc,
> > I try to run your test(through applying your patch in the trunk) , I
> think it's success now. Could you take some time to check about it?
> > Here is the log:
> >
> > directory-kerby git:(trunk) ✗ .
> > kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/ker
> > b/
> > server/MitIssueTest.sh
> > kerberos.authGSSClientInit successful
> > 2017-05-04T20:44:06 set-error: -1765328234: entypes not supported
> > 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> > for krb5_ccache_conf_data/realm-config@X-CACHECONF: in cache
> > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> > for test-service/localhost@TEST.COM in cache
> > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> > for
> > krb5_ccache_conf_data/negative-cache/test-service\134/localhost\134@
> > TE
> > ST.COM@X-CACHECONF: in cache
> > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> > for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF: in cache
> > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> > for krb5_ccache_conf_data/sitename@X-CACHECONF: in cache
> > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> > for test-service/localhost@TEST.COM in cache
> > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > des-cbc-md5-deprecated not supported
> > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > des-cbc-md4-deprecated not supported
> > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > des-cbc-crc-deprecated not supported
> > 2017-05-04T20:44:06 Trying to find service kdc for realm TEST.COM
> > flags 0
> > 2017-05-04T20:44:06 configuration file for realm TEST.COM found
> > 2017-05-04T20:44:06 submissing new requests to new host
> > 2017-05-04T20:44:06 host_create: setting hostname localhost
> > 2017-05-04T20:44:06 connecting to host: udp ::1:52534 (localhost) tid:
> > 00000001
> > 2017-05-04T20:44:06 host_create: setting hostname localhost
> > 2017-05-04T20:44:06 Queuing host in future (in 3s), its the 2
> > address on the same name: udp 127.0.0.1:52534 (localhost) tid:
> > 00000002
> > 2017-05-04T20:44:06 writing packet: udp ::1:52534 (localhost) tid:
> > 00000001
> > 2017-05-04T20:44:06 reading packet: udp ::1:52534 (localhost) tid:
> > 00000001
> > 2017-05-04T20:44:06 host completed: udp ::1:52534 (localhost) tid:
> > 00000001
> > 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0 hosts 1
> > packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814 tid: 00000002
> > 2017-05-04T20:44:06 tkt: extract key 17/763641F3
> > 2017-05-04T20:44:06 set-error: -1765328353: Decrypt integrity check
> > failed for checksum type hmac-sha1-96-aes128, key type
> > aes128-cts-hmac-sha1-96
> > 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
> > 2017-05-04T20:44:06 krb5_get_credentials_with_flags: TEST.COM wc:
> > 0.050317
> > 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> > for krb5_ccache_conf_data/realm-config@X-CACHECONF: in cache
> > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> > for
> > krb5_ccache_conf_data/time-offset/test-service\134/localhost\134@TEST.
> > COM@X-CACHECONF: in cache
> > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > 2017-05-04T20:44:06 Setting up PFS for auth context
> > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > des-cbc-md5-deprecated not supported
> > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > des-cbc-md4-deprecated not supported
> > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > des-cbc-crc-deprecated not supported First
> > kerberos.authGSSClientStep successful
> >
> > Thanks
> > Jiajia
> >
> > -----Original Message-----
> > From: Zheng, Kai [mailto:kai.zheng@intel.com]
> > Sent: Wednesday, May 3, 2017 7:29 PM
> > To: kerby@directory.apache.org
> > Subject: RE: MIT Kerberos compatibility
> >
> > Hi Marc,
> >
> > In case you're not aware of this, please check out the latest fix
> > made
> by Jiajia. We thought your case may be different, but would be good to
> have a check before we can repeat/fix your case. Thanks.
> > https://issues.apache.org/jira/browse/DIRKRB-625
> >
> > Regards,
> > Kai
> >
> > -----Original Message-----
> > From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> > Sent: Sunday, April 30, 2017 7:45 PM
> > To: kerby@directory.apache.org
> > Subject: Re: MIT Kerberos compatibility
> >
> > Hi Kai,
> >
> > The terminal output below is for the latest MIT Kerberos 1.15.1
> > (locally
> built on Ubuntu Xenial). Before that, I also tested with the default
> Xenial MIT Kerberos packages (1.13.2), with the same result. I did not
> try earlier MIT Kerberos versions.
> >
> > Marc
> >
> > Op 29-04-17 om 21:42 schreef Marc de Lignie:
> >> Hi Kai,
> >>
> >> Thanks for the response. I prepared a minimal config that
> >> reproduces my problem.
> >>
> >> You can fetch the branch/commit from:
> >> https://github.com/vtslab/directory-kerby/commits/MitIssue
> >>
> >> This is relative to RC2, but I also tried this on trunk for my
> >> actual project.
> >>
> >> This config produces the debug and error messages below.
> >>
> >> 1. For the terminal with the bash + python script $ klist Ticket
> >> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >> Default principal: drankye@TEST.COM
> >>
> >> Valid starting Expires Service principal
> >> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/TEST.COM@TEST.COM
> >> renew until 29-04-17 21:07:39
> >>
> >> $ .
> >> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/ke
> >> rb / server/MitIssueTest.sh [15538] 1493491231.917606: Retrieving
> >> drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno
> >> 0, enctype 0) with result:
> >> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> >> [15538]
> >> 1493491231.917827: Retrieving drankye@TEST.COM from
> >> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> >> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> >> kerberos.authGSSClientInit successful [15538] 1493491231.918185:
> >> Getting credentials drankye@TEST.COM -> test-service/localhost@
> >> using ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
> >> test-service/localhost@ from
> >> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
> >> -1765328243/Matching credential not found (filename:
> >> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> >> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
> >> test-service/localhost@TEST.COM with result: -1765328243/Matching
> >> credential not found (filename:
> >> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> >> [15538] 1493491231.918229: Server has referral realm; starting with
> >> test-service/localhost@TEST.COM [15538] 1493491231.918278:
> >> Retrieving drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM from
> >> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
> >> 0/Success
> >> [15538] 1493491231.918281: Starting with TGT for client realm:
> >> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
> >> 1493491231.918301: Requesting tickets for
> >> test-service/localhost@TEST.COM, referrals on [15538]
> >> 1493491231.918326: Generated subkey for TGS request:
> >> aes128-cts/FA30
> >> [15538] 1493491231.918359: etypes requested in TGS request:
> >> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1,
> >> rc4-hmac, camellia128-cts, camellia256-cts [15538] 1493491231.918484:
> >> Encoding request body and padata into FAST request [15538]
> >> 1493491231.918541: Sending request (836 bytes) to TEST.COM [15538]
> >> 1493491231.918597: Resolving hostname localhost [15538]
> >> 1493491231.918703: Initiating TCP connection to stream
> >> 127.0.0.1:44292
> >> [15538] 1493491231.918777: Sending TCP request to stream
> >> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error receiving from
> >> stream
> >> 127.0.0.1:44292: 104/Connection reset by peer [15538]
> >> 1493491231.922812: Terminating TCP connection to stream
> >> 127.0.0.1:44292
> >> [15538] 1493491231.922858: Sending initial UDP request to dgram
> >> 127.0.0.1:44292
> >> ('First kerberos.authGSSClientStep not successful',
> >> GSSError(('Unspecified GSS failure. Minor code may provide more
> >> information', 851968), ("Cannot contact any KDC for realm
> >> 'TEST.COM'",
> >> -1765328228)))
> >>
> >> 2. For the terminal that runs mvn clean test -Dtest=MitIssueTest
> >> Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> >> 2017-04-29 21:07:39,182 DEBUG [main] backend.AbstractIdentityBackend:
> >> initialize called
> >> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
> >> getIdentity called, principalName = krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
> >> getIdentity failed, principalName = krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
> >> addIdentity successful, principalName = krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
> >> getIdentity called, principalName = kadmin/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
> >> getIdentity failed, principalName = kadmin/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,213 DEBUG [main] backend.AbstractIdentityBackend:
> >> addIdentity successful, principalName = kadmin/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,216 DEBUG [main] backend.AbstractIdentityBackend:
> >> start called
> >> 2017-04-29 21:07:39,232 DEBUG [main] backend.AbstractIdentityBackend:
> >> addIdentity successful, principalName =
> >> test-service/localhost@TEST.COM
> >> 2017-04-29 21:07:39,425 DEBUG [main] backend.AbstractIdentityBackend:
> >> addIdentity successful, principalName = drankye@TEST.COM
> >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity called, principalName
> >> = krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity successful,
> >> principalName = krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1] request.KdcRequest:
> >> Client entry is empty.
> >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity called, principalName
> >> = drankye@TEST.COM
> >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity successful,
> >> principalName = drankye@TEST.COM
> >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity called, principalName
> >> = krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity successful,
> >> principalName = krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
> >> impl.DefaultKdcHandler: Transport or decoding error occurred,
> >> disconnecting abnormally java.io.EOFException
> >> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> >> at
> >> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> receiveMessage(KrbTcpTransport.java:54)
> >> at
> >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> DefaultKdcHandler.java:46)
> >> at
> >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> ThreadPoolExecutor.java:1142)
> >> at
> >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> ThreadPoolExecutor.java:617)
> >> at java.lang.Thread.run(Thread.java:748)
> >> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase: Storing
> >> the tgt to the credential cache file.
> >> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
> >> getIdentity called, principalName = test-service/localhost@TEST.COM
> >> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
> >> getIdentity successful, principalName =
> >> test-service/localhost@TEST.COM
> >> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity called, principalName
> >> = krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity successful,
> >> principalName = krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1] request.KdcRequest:
> >> Client entry is empty.
> >> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity called, principalName
> >> = test-service/localhost@TEST.COM
> >> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity successful,
> >> principalName = test-service/localhost@TEST.COM
> >> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity called, principalName
> >> = krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity successful,
> >> principalName = krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1] request.KdcRequest:
> >> The preauth data is empty.
> >> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1] server.KdcHandler:
> >> KRB error occurred while processing request:Additional
> >> pre-authentication required
> >> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
> >> impl.DefaultKdcHandler: Transport or decoding error occurred,
> >> disconnecting abnormally java.io.EOFException
> >> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> >> at
> >> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> receiveMessage(KrbTcpTransport.java:54)
> >> at
> >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> DefaultKdcHandler.java:46)
> >> at
> >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> ThreadPoolExecutor.java:1142)
> >> at
> >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> ThreadPoolExecutor.java:617)
> >> at java.lang.Thread.run(Thread.java:748)
> >> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity called, principalName
> >> = krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity successful,
> >> principalName = krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1] request.KdcRequest:
> >> Client entry is empty.
> >> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity called, principalName
> >> = test-service/localhost@TEST.COM
> >> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity successful,
> >> principalName = test-service/localhost@TEST.COM
> >> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity called, principalName
> >> = krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity successful,
> >> principalName = krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
> >> impl.DefaultKdcHandler: Transport or decoding error occurred,
> >> disconnecting abnormally java.io.EOFException
> >> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> >> at
> >> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> receiveMessage(KrbTcpTransport.java:54)
> >> at
> >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> DefaultKdcHandler.java:46)
> >> at
> >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> ThreadPoolExecutor.java:1142)
> >> at
> >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> ThreadPoolExecutor.java:617)
> >> at java.lang.Thread.run(Thread.java:748)
> >> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity called, principalName
> >> = krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity successful,
> >> principalName = krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1] request.KdcRequest:
> >> Found fast padata and start to process it.
> >> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
> >> impl.DefaultKdcHandler: Error occured while processing request:
> >> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
> >> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> java:85)
> >> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> java:70)
> >> at
> >> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFas
> >> t(
> KdcRequest.java:208)
> >> at
> >> org.apache.kerby.kerberos.kerb.server.request.
> KdcRequest.process(KdcRequest.java:168)
> >> at
> >> org.apache.kerby.kerberos.kerb.server.KdcHandler.
> handleMessage(KdcHandler.java:115)
> >> at
> >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
> handleMessage(DefaultKdcHandler.java:67)
> >> at
> >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> DefaultKdcHandler.java:52)
> >> at
> >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> ThreadPoolExecutor.java:1142)
> >> at
> >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> ThreadPoolExecutor.java:617)
> >> at java.lang.Thread.run(Thread.java:748)
> >> Caused by: java.io.IOException: Unexpected item context [0]
> >> [tag=0xA0, off=0, len=3+207], expecting 0x30
> >> at
> >> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> Asn1Encodeable.java:210)
> >> at
> >> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> Asn1Encodeable.java:197)
> >> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> java:83)
> >> ... 9 more
> >> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
> >> impl.DefaultKdcHandler: Transport or decoding error occurred,
> >> disconnecting abnormally
> >> java.net.SocketException: Socket closed
> >> at java.net.SocketInputStream.socketRead0(Native Method)
> >> at java.net.SocketInputStream.socketRead(SocketInputStream.
> java:116)
> >> at java.net.SocketInputStream.read(SocketInputStream.java:171)
> >> at java.net.SocketInputStream.read(SocketInputStream.java:141)
> >> at java.net.SocketInputStream.read(SocketInputStream.java:224)
> >> at java.io.DataInputStream.readInt(DataInputStream.java:387)
> >> at
> >> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> receiveMessage(KrbTcpTransport.java:54)
> >> at
> >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> DefaultKdcHandler.java:46)
> >> at
> >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> ThreadPoolExecutor.java:1142)
> >> at
> >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> ThreadPoolExecutor.java:617)
> >> at java.lang.Thread.run(Thread.java:748)
> >>
> >> In a FreeIPA environment these python lines "just" work.
> >>
> >> Any suggestions are welcome!
> >>
> >> Marc
> >>
> >>
> > --
> > Marc de Lignie
> >
>
> --
> Marc de Lignie
>
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
Re: MIT Kerberos compatibility
Posted by Colm O hEigeartaigh <co...@apache.org>.
Hi Jiajia,
What are the issues if UDP is disabled and we don't use Netty? I tried
doing this with my own test-cases and it didn't work, so it would be good
to get this fixed soon.
Colm.
On Fri, May 5, 2017 at 2:46 PM, Li, Jiajia <ji...@intel.com> wrote:
> Hi Marc,
> >>> - your KRB5 tracing looks quite different. What OS and mit-kerberos
> version did you use?
> I use mac os and the python version is 2.7.10
>
> >>>- your KRB5 tracing shows UDP comms between kerberos client and KDC,
> despite the allowUDP = false setting
> >>> in my test. I did this setting because I get different problems
> without it, see the additional logs below. So,
> >>>we must also be aware of networking problems at my side.
> I enable the UDP and use netty network, there are some issues if UDP
> disabled, you can create a JIRA for this and we can fix this issue in the
> next release version.
>
> The changes in my side as following:
>
> protected boolean allowUdp() {
> return true;
> }
> @Override
> protected void prepareKdc() throws KrbException {
> getKdcServer().setInnerKdcImpl(
> new NettyKdcServerImpl(getKdcServer().getKdcSetting()));
> super.prepareKdc();
> }
>
> Here is log of MitIssueTest:
> [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> [nioEventLoopGroup-2-1] INFO io.netty.handler.logging.LoggingHandler -
> [id: 0x2634fe6b] REGISTERED
> [nioEventLoopGroup-2-1] INFO io.netty.handler.logging.LoggingHandler -
> [id: 0x2634fe6b] BIND(0.0.0.0/0.0.0.0:53957)
> [nioEventLoopGroup-2-1] INFO io.netty.handler.logging.LoggingHandler -
> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] ACTIVE
> [main] INFO org.apache.kerby.kerberos.kdc.impl.NettyKdcServerImpl - Netty
> kdc server started.
> [nioEventLoopGroup-2-1] INFO io.netty.handler.logging.LoggingHandler -
> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] RECEIVED: [id: 0xdac7228b, /
> 127.0.0.1:53961 => /127.0.0.1:53957]
> [defaultEventExecutorGroup-4-1] INFO org.apache.kerby.kerberos.kerb.server.request.AsRequest
> - AS_REQ ISSUE: authtime 1493991123792,drankye@TEST.COM for krbtgt/
> TEST.COM@TEST.COM
> [main] INFO org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClient
> - Send to kdc success.
> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing
> the tgt to the credential cache file.
> [nioEventLoopGroup-5-1] INFO org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> - The preauth data is empty.
> [nioEventLoopGroup-5-1] INFO org.apache.kerby.kerberos.kerb.server.KdcHandler
> - KRB error occurred while processing request:Additional pre-authentication
> required
> [nioEventLoopGroup-5-1] INFO org.apache.kerby.kerberos.kerb.server.request.AsRequest
> - AS_REQ ISSUE: authtime 1493991123859,test-service/localhost@TEST.COM
> for krbtgt/TEST.COM@TEST.COM
> [nioEventLoopGroup-5-1] INFO org.apache.kerby.kerberos.kerb.server.request.TgsRequest
> - TGS_REQ ISSUE: authtime 1493991142850,drankye for test-service/
> localhost@TEST.COM
>
> Thanks
> Jiajia
>
> -----Original Message-----
> From: Zheng, Kai
> Sent: Friday, May 5, 2017 7:46 PM
> To: kerby@directory.apache.org; Li, Jiajia <ji...@intel.com>
> Subject: RE: MIT Kerberos compatibility
>
> Hi Marc,
>
> Looks like this is quite environment related, could you fire an issue for
> this? I would suggest we target it to 1.1.0, which can be done in June.
>
> Regards,
> Kai
>
> -----Original Message-----
> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> Sent: Friday, May 05, 2017 4:44 PM
> To: Li, Jiajia <ji...@intel.com>
> Cc: kerby@directory.apache.org
> Subject: Re: MIT Kerberos compatibility
>
> Hi Jiajia,
>
> Great to read that you made progress on this issue and to see a working
> config at your side. Below, I list my progress below (with trunk merged
> into my MitIssue branch), but I am afraid we are not done yet.
>
> Things that stand out:
>
> - the kdc decoding error is solved, relative to the logs without your patch
>
> - your KRB5 tracing looks quite different. What OS and mit-kerberos
> version did you use?
>
> - your KRB5 tracing shows UDP comms between kerberos client and KDC,
> despite the allowUDP = false setting in my test. I did this setting because
> I get different problems without it, see the additional logs below. So, we
> must also be aware of networking problems at my side.
>
> - the "Response was not from master KDC" msg is not relevant; it
> disappears if you manually add master_kdc to the realms section of the
> krb5.conf
>
> I have no idea how to proceed from here, so that is why I just document
> the status at my side and ask about your - apparently working - config.
>
> Cheers, Marc
>
>
> KDC logging with allowUDP = false:
>
> [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> [pool-1-thread-1] INFO
> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
> authtime 1493970789075,drankye@TEST.COM for krbtgt/TEST.COM@TEST.COM
> [main] INFO org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClient
> - Send to kdc success.
> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing
> the tgt to the credential cache file.
> [pool-1-thread-1] INFO
> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The preauth
> data is empty.
> [pool-1-thread-1] INFO org.apache.kerby.kerberos.kerb.server.KdcHandler
> - KRB error occurred while processing request:Additional
> pre-authentication required [pool-1-thread-1] INFO
> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
> authtime 1493970789108,test-service/localhost@TEST.COM for krbtgt/
> TEST.COM@TEST.COM [pool-1-thread-1] INFO org.apache.kerby.kerberos.kerb.server.request.KdcRequest
> - Found fast padata and starting to process it.
> [pool-1-thread-1] INFO
> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found fast
> padata and starting to process it.
>
> Python script KRB5 tracing (MIT Kerberos 1.13.2 of Ubuntu Xenial) with
> allowUDP = false:
>
> $ .
> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/
> kerberos/kerb/server/MitIssueTest.sh
> [25281] 1493970797.298753: Retrieving drankye@TEST.COM from
> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281]
> 1493970797.298952: Retrieving drankye@TEST.COM from
> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281]
> 1493970797.299106: Retrieving drankye@TEST.COM from
> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281]
> 1493970797.299213: Retrieving drankye@TEST.COM from
> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281]
> 1493970797.299323: Retrieving drankye@TEST.COM from
> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281]
> 1493970797.299436: Retrieving drankye@TEST.COM from
> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281]
> 1493970797.299545: Retrieving drankye@TEST.COM from
> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281]
> 1493970797.299654: Retrieving drankye@TEST.COM from
> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> kerberos.authGSSClientInit successful [25281] 1493970797.299922: Getting
> credentials drankye@TEST.COM -> test-service/localhost@ using ccache
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> [25281] 1493970797.299945: Retrieving drankye@TEST.COM ->
> test-service/localhost@ from FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> with result:
> -1765328243/Matching credential not found [25281] 1493970797.299959:
> Retrying drankye@TEST.COM -> test-service/localhost@TEST.COM with result:
> -1765328243/Matching credential not found [25281] 1493970797.299962: Server
> has referral realm; starting with test-service/localhost@TEST.COM [25281]
> 1493970797.299975: Retrieving drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM
> from FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
> 0/Success [25281] 1493970797.299979: Starting with TGT for client realm:
> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [25281] 1493970797.299981:
> Requesting tickets for test-service/localhost@TEST.COM, referrals on
> [25281] 1493970797.299994: Generated subkey for TGS request:
> aes128-cts/1B9B [25281] 1493970797.300009: etypes requested in TGS request:
> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
> camellia256-cts [25281] 1493970797.300054: Encoding request body and padata
> into FAST request [25281] 1493970797.300080: Sending request (823 bytes) to
> TEST.COM [25281] 1493970797.300091: Resolving hostname localhost [25281]
> 1493970797.300136: Initiating TCP connection to stream
> 127.0.0.1:34319
> [25281] 1493970797.300191: Sending TCP request to stream 127.0.0.1:34319
> [25281] 1493970797.303610: Received answer (125 bytes) from stream
> 127.0.0.1:34319
> [25281] 1493970797.303618: Terminating TCP connection to stream
> 127.0.0.1:34319
> [25281] 1493970797.553126: Response was not from master KDC [25281]
> 1493970797.553198: TGS request result: -1765323383/Unknown code krcM 137
> [25281] 1493970797.553234: Requesting tickets for test-service/
> localhost@TEST.COM, referrals off [25281] 1493970797.553273: Generated
> subkey for TGS request: aes128-cts/94C6 [25281] 1493970797.553323: etypes
> requested in TGS request: aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac,
> camellia128-cts, camellia256-cts [25281] 1493970797.553436: Encoding
> request body and padata into FAST request [25281] 1493970797.553532:
> Sending request (823 bytes) to TEST.COM [25281] 1493970797.553567:
> Resolving hostname localhost [25281] 1493970797.553745: Initiating TCP
> connection to stream
> 127.0.0.1:34319
> [25281] 1493970797.553889: Sending TCP request to stream 127.0.0.1:34319
> [25281] 1493970797.558297: Received answer (125 bytes) from stream
> 127.0.0.1:34319
> [25281] 1493970797.558318: Terminating TCP connection to stream
> 127.0.0.1:34319
> [25281] 1493970797.561189: Response was not from master KDC [25281]
> 1493970797.561258: TGS request result: -1765323383/Unknown code krcM 137
> ('First kerberos.authGSSClientStep not successful', GSSError(('Unspecified
> GSS failure. Minor code may provide more information', 851968), ('Unknown
> code krcM 137', -1765323383)))
>
>
> KDC logging with allowUDP = true:
>
> [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> [pool-1-thread-1] INFO
> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
> authtime 1493972505784,drankye@TEST.COM for krbtgt/TEST.COM@TEST.COM
> [main] INFO org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClient
> - Send to kdc success.
> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing
> the tgt to the credential cache file.
> [pool-1-thread-1] INFO
> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The preauth
> data is empty.
> [pool-1-thread-1] INFO org.apache.kerby.kerberos.kerb.server.KdcHandler
> - KRB error occurred while processing request:Additional
> pre-authentication required [pool-1-thread-2] INFO
> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
> authtime 1493972505948,test-service/localhost@TEST.COM for krbtgt/
> TEST.COM@TEST.COM Exception in thread "Thread-0"
> java.lang.RuntimeException: Error occured while checking udp connections
> at
> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> KdcNetwork.java:105)
> at
> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> access$000(KdcNetwork.java:39)
> at
> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.
> run(KdcNetwork.java:75)
> at java.lang.Thread.run(Thread.java:748)
> Caused by: java.nio.channels.ClosedChannelException
> at
> sun.nio.ch.DatagramChannelImpl.ensureOpen(DatagramChannelImpl.java:320)
> at sun.nio.ch.DatagramChannelImpl.receive(
> DatagramChannelImpl.java:331)
> at
> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.
> checkUdpMessage(KdcNetwork.java:132)
> at
> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(
> KdcNetwork.java:101)
> ... 3 more
>
>
> krb5.conf:
>
> [libdefaults]
> kdc_realm = TEST.COM
> default_realm = TEST.COM
> udp_preference_limit = 4096
> kdc_tcp_port = 37080
> kdc_udp_port = 36525
>
> [realms]
> TEST.COM = {
> kdc = localhost:36525
> }
>
> And port 36525 does not show up in `netstat -l` (while 37080 does)
>
>
> Op 04-05-17 om 14:55 schreef Li, Jiajia:
> > Hi Marc,
> > I try to run your test(through applying your patch in the trunk) , I
> think it's success now. Could you take some time to check about it?
> > Here is the log:
> >
> > directory-kerby git:(trunk) ✗ .
> > kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/
> > server/MitIssueTest.sh
> > kerberos.authGSSClientInit successful
> > 2017-05-04T20:44:06 set-error: -1765328234: entypes not supported
> > 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> > for krb5_ccache_conf_data/realm-config@X-CACHECONF: in cache
> > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> > for test-service/localhost@TEST.COM in cache
> > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> > for
> > krb5_ccache_conf_data/negative-cache/test-service\134/localhost\134@TE
> > ST.COM@X-CACHECONF: in cache
> > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> > for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF: in cache
> > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> > for krb5_ccache_conf_data/sitename@X-CACHECONF: in cache
> > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> > for test-service/localhost@TEST.COM in cache
> > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > des-cbc-md5-deprecated not supported
> > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > des-cbc-md4-deprecated not supported
> > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > des-cbc-crc-deprecated not supported
> > 2017-05-04T20:44:06 Trying to find service kdc for realm TEST.COM
> > flags 0
> > 2017-05-04T20:44:06 configuration file for realm TEST.COM found
> > 2017-05-04T20:44:06 submissing new requests to new host
> > 2017-05-04T20:44:06 host_create: setting hostname localhost
> > 2017-05-04T20:44:06 connecting to host: udp ::1:52534 (localhost) tid:
> > 00000001
> > 2017-05-04T20:44:06 host_create: setting hostname localhost
> > 2017-05-04T20:44:06 Queuing host in future (in 3s), its the 2 address
> > on the same name: udp 127.0.0.1:52534 (localhost) tid: 00000002
> > 2017-05-04T20:44:06 writing packet: udp ::1:52534 (localhost) tid:
> > 00000001
> > 2017-05-04T20:44:06 reading packet: udp ::1:52534 (localhost) tid:
> > 00000001
> > 2017-05-04T20:44:06 host completed: udp ::1:52534 (localhost) tid:
> > 00000001
> > 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0 hosts 1
> > packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814 tid: 00000002
> > 2017-05-04T20:44:06 tkt: extract key 17/763641F3
> > 2017-05-04T20:44:06 set-error: -1765328353: Decrypt integrity check
> > failed for checksum type hmac-sha1-96-aes128, key type
> > aes128-cts-hmac-sha1-96
> > 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
> > 2017-05-04T20:44:06 krb5_get_credentials_with_flags: TEST.COM wc:
> > 0.050317
> > 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> > for krb5_ccache_conf_data/realm-config@X-CACHECONF: in cache
> > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> > for
> > krb5_ccache_conf_data/time-offset/test-service\134/localhost\134@TEST.
> > COM@X-CACHECONF: in cache
> > FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> > 2017-05-04T20:44:06 Setting up PFS for auth context
> > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > des-cbc-md5-deprecated not supported
> > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > des-cbc-md4-deprecated not supported
> > 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> > des-cbc-crc-deprecated not supported First kerberos.authGSSClientStep
> > successful
> >
> > Thanks
> > Jiajia
> >
> > -----Original Message-----
> > From: Zheng, Kai [mailto:kai.zheng@intel.com]
> > Sent: Wednesday, May 3, 2017 7:29 PM
> > To: kerby@directory.apache.org
> > Subject: RE: MIT Kerberos compatibility
> >
> > Hi Marc,
> >
> > In case you're not aware of this, please check out the latest fix made
> by Jiajia. We thought your case may be different, but would be good to have
> a check before we can repeat/fix your case. Thanks.
> > https://issues.apache.org/jira/browse/DIRKRB-625
> >
> > Regards,
> > Kai
> >
> > -----Original Message-----
> > From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> > Sent: Sunday, April 30, 2017 7:45 PM
> > To: kerby@directory.apache.org
> > Subject: Re: MIT Kerberos compatibility
> >
> > Hi Kai,
> >
> > The terminal output below is for the latest MIT Kerberos 1.15.1 (locally
> built on Ubuntu Xenial). Before that, I also tested with the default Xenial
> MIT Kerberos packages (1.13.2), with the same result. I did not try earlier
> MIT Kerberos versions.
> >
> > Marc
> >
> > Op 29-04-17 om 21:42 schreef Marc de Lignie:
> >> Hi Kai,
> >>
> >> Thanks for the response. I prepared a minimal config that reproduces
> >> my problem.
> >>
> >> You can fetch the branch/commit from:
> >> https://github.com/vtslab/directory-kerby/commits/MitIssue
> >>
> >> This is relative to RC2, but I also tried this on trunk for my actual
> >> project.
> >>
> >> This config produces the debug and error messages below.
> >>
> >> 1. For the terminal with the bash + python script $ klist Ticket
> >> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >> Default principal: drankye@TEST.COM
> >>
> >> Valid starting Expires Service principal
> >> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/TEST.COM@TEST.COM
> >> renew until 29-04-17 21:07:39
> >>
> >> $ .
> >> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb
> >> / server/MitIssueTest.sh [15538] 1493491231.917606: Retrieving
> >> drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0,
> >> enctype 0) with result:
> >> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> >> [15538]
> >> 1493491231.917827: Retrieving drankye@TEST.COM from
> >> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> >> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> >> kerberos.authGSSClientInit successful [15538] 1493491231.918185:
> >> Getting credentials drankye@TEST.COM -> test-service/localhost@ using
> >> ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> >> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
> >> test-service/localhost@ from
> >> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
> >> -1765328243/Matching credential not found (filename:
> >> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> >> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
> >> test-service/localhost@TEST.COM with result: -1765328243/Matching
> >> credential not found (filename:
> >> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> >> [15538] 1493491231.918229: Server has referral realm; starting with
> >> test-service/localhost@TEST.COM [15538] 1493491231.918278: Retrieving
> >> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM from
> >> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
> >> 0/Success
> >> [15538] 1493491231.918281: Starting with TGT for client realm:
> >> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
> >> 1493491231.918301: Requesting tickets for
> >> test-service/localhost@TEST.COM, referrals on [15538]
> >> 1493491231.918326: Generated subkey for TGS request:
> >> aes128-cts/FA30
> >> [15538] 1493491231.918359: etypes requested in TGS request:
> >> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1,
> >> rc4-hmac, camellia128-cts, camellia256-cts [15538] 1493491231.918484:
> >> Encoding request body and padata into FAST request [15538]
> >> 1493491231.918541: Sending request (836 bytes) to TEST.COM [15538]
> >> 1493491231.918597: Resolving hostname localhost [15538]
> >> 1493491231.918703: Initiating TCP connection to stream
> >> 127.0.0.1:44292
> >> [15538] 1493491231.918777: Sending TCP request to stream
> >> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error receiving from
> >> stream
> >> 127.0.0.1:44292: 104/Connection reset by peer [15538]
> >> 1493491231.922812: Terminating TCP connection to stream
> >> 127.0.0.1:44292
> >> [15538] 1493491231.922858: Sending initial UDP request to dgram
> >> 127.0.0.1:44292
> >> ('First kerberos.authGSSClientStep not successful',
> >> GSSError(('Unspecified GSS failure. Minor code may provide more
> >> information', 851968), ("Cannot contact any KDC for realm
> >> 'TEST.COM'",
> >> -1765328228)))
> >>
> >> 2. For the terminal that runs mvn clean test -Dtest=MitIssueTest
> >> Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> >> 2017-04-29 21:07:39,182 DEBUG [main] backend.AbstractIdentityBackend:
> >> initialize called
> >> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
> >> getIdentity called, principalName = krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
> >> getIdentity failed, principalName = krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
> >> addIdentity successful, principalName = krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
> >> getIdentity called, principalName = kadmin/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
> >> getIdentity failed, principalName = kadmin/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,213 DEBUG [main] backend.AbstractIdentityBackend:
> >> addIdentity successful, principalName = kadmin/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,216 DEBUG [main] backend.AbstractIdentityBackend:
> >> start called
> >> 2017-04-29 21:07:39,232 DEBUG [main] backend.AbstractIdentityBackend:
> >> addIdentity successful, principalName =
> >> test-service/localhost@TEST.COM
> >> 2017-04-29 21:07:39,425 DEBUG [main] backend.AbstractIdentityBackend:
> >> addIdentity successful, principalName = drankye@TEST.COM
> >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity called, principalName =
> >> krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity successful,
> >> principalName = krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1] request.KdcRequest:
> >> Client entry is empty.
> >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity called, principalName =
> >> drankye@TEST.COM
> >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity successful,
> >> principalName = drankye@TEST.COM
> >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity called, principalName =
> >> krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity successful,
> >> principalName = krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
> >> impl.DefaultKdcHandler: Transport or decoding error occurred,
> >> disconnecting abnormally java.io.EOFException
> >> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> >> at
> >> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> receiveMessage(KrbTcpTransport.java:54)
> >> at
> >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> DefaultKdcHandler.java:46)
> >> at
> >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> ThreadPoolExecutor.java:1142)
> >> at
> >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> ThreadPoolExecutor.java:617)
> >> at java.lang.Thread.run(Thread.java:748)
> >> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase: Storing
> >> the tgt to the credential cache file.
> >> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
> >> getIdentity called, principalName = test-service/localhost@TEST.COM
> >> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
> >> getIdentity successful, principalName =
> >> test-service/localhost@TEST.COM
> >> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity called, principalName =
> >> krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity successful,
> >> principalName = krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1] request.KdcRequest:
> >> Client entry is empty.
> >> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity called, principalName =
> >> test-service/localhost@TEST.COM
> >> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity successful,
> >> principalName = test-service/localhost@TEST.COM
> >> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity called, principalName =
> >> krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity successful,
> >> principalName = krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1] request.KdcRequest:
> >> The preauth data is empty.
> >> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1] server.KdcHandler:
> >> KRB error occurred while processing request:Additional
> >> pre-authentication required
> >> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
> >> impl.DefaultKdcHandler: Transport or decoding error occurred,
> >> disconnecting abnormally java.io.EOFException
> >> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> >> at
> >> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> receiveMessage(KrbTcpTransport.java:54)
> >> at
> >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> DefaultKdcHandler.java:46)
> >> at
> >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> ThreadPoolExecutor.java:1142)
> >> at
> >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> ThreadPoolExecutor.java:617)
> >> at java.lang.Thread.run(Thread.java:748)
> >> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity called, principalName =
> >> krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity successful,
> >> principalName = krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1] request.KdcRequest:
> >> Client entry is empty.
> >> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity called, principalName =
> >> test-service/localhost@TEST.COM
> >> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity successful,
> >> principalName = test-service/localhost@TEST.COM
> >> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity called, principalName =
> >> krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity successful,
> >> principalName = krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
> >> impl.DefaultKdcHandler: Transport or decoding error occurred,
> >> disconnecting abnormally java.io.EOFException
> >> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> >> at
> >> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> receiveMessage(KrbTcpTransport.java:54)
> >> at
> >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> DefaultKdcHandler.java:46)
> >> at
> >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> ThreadPoolExecutor.java:1142)
> >> at
> >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> ThreadPoolExecutor.java:617)
> >> at java.lang.Thread.run(Thread.java:748)
> >> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity called, principalName =
> >> krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> >> backend.AbstractIdentityBackend: getIdentity successful,
> >> principalName = krbtgt/TEST.COM@TEST.COM
> >> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1] request.KdcRequest:
> >> Found fast padata and start to process it.
> >> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
> >> impl.DefaultKdcHandler: Error occured while processing request:
> >> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
> >> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> java:85)
> >> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> java:70)
> >> at
> >> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast(
> KdcRequest.java:208)
> >> at
> >> org.apache.kerby.kerberos.kerb.server.request.
> KdcRequest.process(KdcRequest.java:168)
> >> at
> >> org.apache.kerby.kerberos.kerb.server.KdcHandler.
> handleMessage(KdcHandler.java:115)
> >> at
> >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
> handleMessage(DefaultKdcHandler.java:67)
> >> at
> >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> DefaultKdcHandler.java:52)
> >> at
> >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> ThreadPoolExecutor.java:1142)
> >> at
> >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> ThreadPoolExecutor.java:617)
> >> at java.lang.Thread.run(Thread.java:748)
> >> Caused by: java.io.IOException: Unexpected item context [0]
> >> [tag=0xA0, off=0, len=3+207], expecting 0x30
> >> at
> >> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> Asn1Encodeable.java:210)
> >> at
> >> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> Asn1Encodeable.java:197)
> >> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.
> java:83)
> >> ... 9 more
> >> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
> >> impl.DefaultKdcHandler: Transport or decoding error occurred,
> >> disconnecting abnormally
> >> java.net.SocketException: Socket closed
> >> at java.net.SocketInputStream.socketRead0(Native Method)
> >> at java.net.SocketInputStream.socketRead(SocketInputStream.
> java:116)
> >> at java.net.SocketInputStream.read(SocketInputStream.java:171)
> >> at java.net.SocketInputStream.read(SocketInputStream.java:141)
> >> at java.net.SocketInputStream.read(SocketInputStream.java:224)
> >> at java.io.DataInputStream.readInt(DataInputStream.java:387)
> >> at
> >> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.
> receiveMessage(KrbTcpTransport.java:54)
> >> at
> >> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> DefaultKdcHandler.java:46)
> >> at
> >> java.util.concurrent.ThreadPoolExecutor.runWorker(
> ThreadPoolExecutor.java:1142)
> >> at
> >> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> ThreadPoolExecutor.java:617)
> >> at java.lang.Thread.run(Thread.java:748)
> >>
> >> In a FreeIPA environment these python lines "just" work.
> >>
> >> Any suggestions are welcome!
> >>
> >> Marc
> >>
> >>
> > --
> > Marc de Lignie
> >
>
> --
> Marc de Lignie
>
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
RE: MIT Kerberos compatibility
Posted by "Li, Jiajia" <ji...@intel.com>.
Hi Marc,
>>> - your KRB5 tracing looks quite different. What OS and mit-kerberos version did you use?
I use mac os and the python version is 2.7.10
>>>- your KRB5 tracing shows UDP comms between kerberos client and KDC, despite the allowUDP = false setting
>>> in my test. I did this setting because I get different problems without it, see the additional logs below. So,
>>>we must also be aware of networking problems at my side.
I enable the UDP and use netty network, there are some issues if UDP disabled, you can create a JIRA for this and we can fix this issue in the next release version.
The changes in my side as following:
protected boolean allowUdp() {
return true;
}
@Override
protected void prepareKdc() throws KrbException {
getKdcServer().setInnerKdcImpl(
new NettyKdcServerImpl(getKdcServer().getKdcSetting()));
super.prepareKdc();
}
Here is log of MitIssueTest:
[INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
[nioEventLoopGroup-2-1] INFO io.netty.handler.logging.LoggingHandler - [id: 0x2634fe6b] REGISTERED
[nioEventLoopGroup-2-1] INFO io.netty.handler.logging.LoggingHandler - [id: 0x2634fe6b] BIND(0.0.0.0/0.0.0.0:53957)
[nioEventLoopGroup-2-1] INFO io.netty.handler.logging.LoggingHandler - [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] ACTIVE
[main] INFO org.apache.kerby.kerberos.kdc.impl.NettyKdcServerImpl - Netty kdc server started.
[nioEventLoopGroup-2-1] INFO io.netty.handler.logging.LoggingHandler - [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] RECEIVED: [id: 0xdac7228b, /127.0.0.1:53961 => /127.0.0.1:53957]
[defaultEventExecutorGroup-4-1] INFO org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE: authtime 1493991123792,drankye@TEST.COM for krbtgt/TEST.COM@TEST.COM
[main] INFO org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClient - Send to kdc success.
[main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing the tgt to the credential cache file.
[nioEventLoopGroup-5-1] INFO org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The preauth data is empty.
[nioEventLoopGroup-5-1] INFO org.apache.kerby.kerberos.kerb.server.KdcHandler - KRB error occurred while processing request:Additional pre-authentication required
[nioEventLoopGroup-5-1] INFO org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE: authtime 1493991123859,test-service/localhost@TEST.COM for krbtgt/TEST.COM@TEST.COM
[nioEventLoopGroup-5-1] INFO org.apache.kerby.kerberos.kerb.server.request.TgsRequest - TGS_REQ ISSUE: authtime 1493991142850,drankye for test-service/localhost@TEST.COM
Thanks
Jiajia
-----Original Message-----
From: Zheng, Kai
Sent: Friday, May 5, 2017 7:46 PM
To: kerby@directory.apache.org; Li, Jiajia <ji...@intel.com>
Subject: RE: MIT Kerberos compatibility
Hi Marc,
Looks like this is quite environment related, could you fire an issue for this? I would suggest we target it to 1.1.0, which can be done in June.
Regards,
Kai
-----Original Message-----
From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
Sent: Friday, May 05, 2017 4:44 PM
To: Li, Jiajia <ji...@intel.com>
Cc: kerby@directory.apache.org
Subject: Re: MIT Kerberos compatibility
Hi Jiajia,
Great to read that you made progress on this issue and to see a working config at your side. Below, I list my progress below (with trunk merged into my MitIssue branch), but I am afraid we are not done yet.
Things that stand out:
- the kdc decoding error is solved, relative to the logs without your patch
- your KRB5 tracing looks quite different. What OS and mit-kerberos version did you use?
- your KRB5 tracing shows UDP comms between kerberos client and KDC, despite the allowUDP = false setting in my test. I did this setting because I get different problems without it, see the additional logs below. So, we must also be aware of networking problems at my side.
- the "Response was not from master KDC" msg is not relevant; it disappears if you manually add master_kdc to the realms section of the krb5.conf
I have no idea how to proceed from here, so that is why I just document the status at my side and ask about your - apparently working - config.
Cheers, Marc
KDC logging with allowUDP = false:
[INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
[pool-1-thread-1] INFO
org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
authtime 1493970789075,drankye@TEST.COM for krbtgt/TEST.COM@TEST.COM [main] INFO org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClient - Send to kdc success.
[main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing the tgt to the credential cache file.
[pool-1-thread-1] INFO
org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The preauth data is empty.
[pool-1-thread-1] INFO org.apache.kerby.kerberos.kerb.server.KdcHandler
- KRB error occurred while processing request:Additional pre-authentication required [pool-1-thread-1] INFO org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
authtime 1493970789108,test-service/localhost@TEST.COM for krbtgt/TEST.COM@TEST.COM [pool-1-thread-1] INFO org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found fast padata and starting to process it.
[pool-1-thread-1] INFO
org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found fast padata and starting to process it.
Python script KRB5 tracing (MIT Kerberos 1.13.2 of Ubuntu Xenial) with allowUDP = false:
$ .
kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/server/MitIssueTest.sh
[25281] 1493970797.298753: Retrieving drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281] 1493970797.298952: Retrieving drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281] 1493970797.299106: Retrieving drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281] 1493970797.299213: Retrieving drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281] 1493970797.299323: Retrieving drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281] 1493970797.299436: Retrieving drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281] 1493970797.299545: Retrieving drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281] 1493970797.299654: Retrieving drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
2/Key table file '/etc/krb5/user/1000/client.keytab' not found kerberos.authGSSClientInit successful [25281] 1493970797.299922: Getting credentials drankye@TEST.COM -> test-service/localhost@ using ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
[25281] 1493970797.299945: Retrieving drankye@TEST.COM -> test-service/localhost@ from FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
-1765328243/Matching credential not found [25281] 1493970797.299959: Retrying drankye@TEST.COM -> test-service/localhost@TEST.COM with result: -1765328243/Matching credential not found [25281] 1493970797.299962: Server has referral realm; starting with test-service/localhost@TEST.COM [25281] 1493970797.299975: Retrieving drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM from FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result: 0/Success [25281] 1493970797.299979: Starting with TGT for client realm:
drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [25281] 1493970797.299981: Requesting tickets for test-service/localhost@TEST.COM, referrals on [25281] 1493970797.299994: Generated subkey for TGS request: aes128-cts/1B9B [25281] 1493970797.300009: etypes requested in TGS request: aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts [25281] 1493970797.300054: Encoding request body and padata into FAST request [25281] 1493970797.300080: Sending request (823 bytes) to TEST.COM [25281] 1493970797.300091: Resolving hostname localhost [25281] 1493970797.300136: Initiating TCP connection to stream
127.0.0.1:34319
[25281] 1493970797.300191: Sending TCP request to stream 127.0.0.1:34319 [25281] 1493970797.303610: Received answer (125 bytes) from stream
127.0.0.1:34319
[25281] 1493970797.303618: Terminating TCP connection to stream
127.0.0.1:34319
[25281] 1493970797.553126: Response was not from master KDC [25281] 1493970797.553198: TGS request result: -1765323383/Unknown code krcM 137 [25281] 1493970797.553234: Requesting tickets for test-service/localhost@TEST.COM, referrals off [25281] 1493970797.553273: Generated subkey for TGS request: aes128-cts/94C6 [25281] 1493970797.553323: etypes requested in TGS request: aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts [25281] 1493970797.553436: Encoding request body and padata into FAST request [25281] 1493970797.553532: Sending request (823 bytes) to TEST.COM [25281] 1493970797.553567: Resolving hostname localhost [25281] 1493970797.553745: Initiating TCP connection to stream
127.0.0.1:34319
[25281] 1493970797.553889: Sending TCP request to stream 127.0.0.1:34319 [25281] 1493970797.558297: Received answer (125 bytes) from stream
127.0.0.1:34319
[25281] 1493970797.558318: Terminating TCP connection to stream
127.0.0.1:34319
[25281] 1493970797.561189: Response was not from master KDC [25281] 1493970797.561258: TGS request result: -1765323383/Unknown code krcM 137 ('First kerberos.authGSSClientStep not successful', GSSError(('Unspecified GSS failure. Minor code may provide more information', 851968), ('Unknown code krcM 137', -1765323383)))
KDC logging with allowUDP = true:
[INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
[pool-1-thread-1] INFO
org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
authtime 1493972505784,drankye@TEST.COM for krbtgt/TEST.COM@TEST.COM [main] INFO org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClient - Send to kdc success.
[main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing the tgt to the credential cache file.
[pool-1-thread-1] INFO
org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The preauth data is empty.
[pool-1-thread-1] INFO org.apache.kerby.kerberos.kerb.server.KdcHandler
- KRB error occurred while processing request:Additional pre-authentication required [pool-1-thread-2] INFO org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
authtime 1493972505948,test-service/localhost@TEST.COM for krbtgt/TEST.COM@TEST.COM Exception in thread "Thread-0" java.lang.RuntimeException: Error occured while checking udp connections
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(KdcNetwork.java:105)
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork.access$000(KdcNetwork.java:39)
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.run(KdcNetwork.java:75)
at java.lang.Thread.run(Thread.java:748)
Caused by: java.nio.channels.ClosedChannelException
at
sun.nio.ch.DatagramChannelImpl.ensureOpen(DatagramChannelImpl.java:320)
at sun.nio.ch.DatagramChannelImpl.receive(DatagramChannelImpl.java:331)
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork.checkUdpMessage(KdcNetwork.java:132)
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(KdcNetwork.java:101)
... 3 more
krb5.conf:
[libdefaults]
kdc_realm = TEST.COM
default_realm = TEST.COM
udp_preference_limit = 4096
kdc_tcp_port = 37080
kdc_udp_port = 36525
[realms]
TEST.COM = {
kdc = localhost:36525
}
And port 36525 does not show up in `netstat -l` (while 37080 does)
Op 04-05-17 om 14:55 schreef Li, Jiajia:
> Hi Marc,
> I try to run your test(through applying your patch in the trunk) , I think it's success now. Could you take some time to check about it?
> Here is the log:
>
> directory-kerby git:(trunk) ✗ .
> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/
> server/MitIssueTest.sh
> kerberos.authGSSClientInit successful
> 2017-05-04T20:44:06 set-error: -1765328234: entypes not supported
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> for krb5_ccache_conf_data/realm-config@X-CACHECONF: in cache
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> for test-service/localhost@TEST.COM in cache
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> for
> krb5_ccache_conf_data/negative-cache/test-service\134/localhost\134@TE
> ST.COM@X-CACHECONF: in cache
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF: in cache
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> for krb5_ccache_conf_data/sitename@X-CACHECONF: in cache
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> for test-service/localhost@TEST.COM in cache
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> des-cbc-md5-deprecated not supported
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> des-cbc-md4-deprecated not supported
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> des-cbc-crc-deprecated not supported
> 2017-05-04T20:44:06 Trying to find service kdc for realm TEST.COM
> flags 0
> 2017-05-04T20:44:06 configuration file for realm TEST.COM found
> 2017-05-04T20:44:06 submissing new requests to new host
> 2017-05-04T20:44:06 host_create: setting hostname localhost
> 2017-05-04T20:44:06 connecting to host: udp ::1:52534 (localhost) tid:
> 00000001
> 2017-05-04T20:44:06 host_create: setting hostname localhost
> 2017-05-04T20:44:06 Queuing host in future (in 3s), its the 2 address
> on the same name: udp 127.0.0.1:52534 (localhost) tid: 00000002
> 2017-05-04T20:44:06 writing packet: udp ::1:52534 (localhost) tid:
> 00000001
> 2017-05-04T20:44:06 reading packet: udp ::1:52534 (localhost) tid:
> 00000001
> 2017-05-04T20:44:06 host completed: udp ::1:52534 (localhost) tid:
> 00000001
> 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0 hosts 1
> packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814 tid: 00000002
> 2017-05-04T20:44:06 tkt: extract key 17/763641F3
> 2017-05-04T20:44:06 set-error: -1765328353: Decrypt integrity check
> failed for checksum type hmac-sha1-96-aes128, key type
> aes128-cts-hmac-sha1-96
> 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
> 2017-05-04T20:44:06 krb5_get_credentials_with_flags: TEST.COM wc:
> 0.050317
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> for krb5_ccache_conf_data/realm-config@X-CACHECONF: in cache
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> for
> krb5_ccache_conf_data/time-offset/test-service\134/localhost\134@TEST.
> COM@X-CACHECONF: in cache
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 Setting up PFS for auth context
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> des-cbc-md5-deprecated not supported
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> des-cbc-md4-deprecated not supported
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> des-cbc-crc-deprecated not supported First kerberos.authGSSClientStep
> successful
>
> Thanks
> Jiajia
>
> -----Original Message-----
> From: Zheng, Kai [mailto:kai.zheng@intel.com]
> Sent: Wednesday, May 3, 2017 7:29 PM
> To: kerby@directory.apache.org
> Subject: RE: MIT Kerberos compatibility
>
> Hi Marc,
>
> In case you're not aware of this, please check out the latest fix made by Jiajia. We thought your case may be different, but would be good to have a check before we can repeat/fix your case. Thanks.
> https://issues.apache.org/jira/browse/DIRKRB-625
>
> Regards,
> Kai
>
> -----Original Message-----
> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> Sent: Sunday, April 30, 2017 7:45 PM
> To: kerby@directory.apache.org
> Subject: Re: MIT Kerberos compatibility
>
> Hi Kai,
>
> The terminal output below is for the latest MIT Kerberos 1.15.1 (locally built on Ubuntu Xenial). Before that, I also tested with the default Xenial MIT Kerberos packages (1.13.2), with the same result. I did not try earlier MIT Kerberos versions.
>
> Marc
>
> Op 29-04-17 om 21:42 schreef Marc de Lignie:
>> Hi Kai,
>>
>> Thanks for the response. I prepared a minimal config that reproduces
>> my problem.
>>
>> You can fetch the branch/commit from:
>> https://github.com/vtslab/directory-kerby/commits/MitIssue
>>
>> This is relative to RC2, but I also tried this on trunk for my actual
>> project.
>>
>> This config produces the debug and error messages below.
>>
>> 1. For the terminal with the bash + python script $ klist Ticket
>> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> Default principal: drankye@TEST.COM
>>
>> Valid starting Expires Service principal
>> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/TEST.COM@TEST.COM
>> renew until 29-04-17 21:07:39
>>
>> $ .
>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb
>> / server/MitIssueTest.sh [15538] 1493491231.917606: Retrieving
>> drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0,
>> enctype 0) with result:
>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>> [15538]
>> 1493491231.917827: Retrieving drankye@TEST.COM from
>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>> kerberos.authGSSClientInit successful [15538] 1493491231.918185:
>> Getting credentials drankye@TEST.COM -> test-service/localhost@ using
>> ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
>> test-service/localhost@ from
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>> -1765328243/Matching credential not found (filename:
>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
>> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
>> test-service/localhost@TEST.COM with result: -1765328243/Matching
>> credential not found (filename:
>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
>> [15538] 1493491231.918229: Server has referral realm; starting with
>> test-service/localhost@TEST.COM [15538] 1493491231.918278: Retrieving
>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM from
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>> 0/Success
>> [15538] 1493491231.918281: Starting with TGT for client realm:
>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
>> 1493491231.918301: Requesting tickets for
>> test-service/localhost@TEST.COM, referrals on [15538]
>> 1493491231.918326: Generated subkey for TGS request:
>> aes128-cts/FA30
>> [15538] 1493491231.918359: etypes requested in TGS request:
>> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1,
>> rc4-hmac, camellia128-cts, camellia256-cts [15538] 1493491231.918484:
>> Encoding request body and padata into FAST request [15538]
>> 1493491231.918541: Sending request (836 bytes) to TEST.COM [15538]
>> 1493491231.918597: Resolving hostname localhost [15538]
>> 1493491231.918703: Initiating TCP connection to stream
>> 127.0.0.1:44292
>> [15538] 1493491231.918777: Sending TCP request to stream
>> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error receiving from
>> stream
>> 127.0.0.1:44292: 104/Connection reset by peer [15538]
>> 1493491231.922812: Terminating TCP connection to stream
>> 127.0.0.1:44292
>> [15538] 1493491231.922858: Sending initial UDP request to dgram
>> 127.0.0.1:44292
>> ('First kerberos.authGSSClientStep not successful',
>> GSSError(('Unspecified GSS failure. Minor code may provide more
>> information', 851968), ("Cannot contact any KDC for realm
>> 'TEST.COM'",
>> -1765328228)))
>>
>> 2. For the terminal that runs mvn clean test -Dtest=MitIssueTest
>> Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
>> 2017-04-29 21:07:39,182 DEBUG [main] backend.AbstractIdentityBackend:
>> initialize called
>> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity called, principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity failed, principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>> addIdentity successful, principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity called, principalName = kadmin/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity failed, principalName = kadmin/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,213 DEBUG [main] backend.AbstractIdentityBackend:
>> addIdentity successful, principalName = kadmin/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,216 DEBUG [main] backend.AbstractIdentityBackend:
>> start called
>> 2017-04-29 21:07:39,232 DEBUG [main] backend.AbstractIdentityBackend:
>> addIdentity successful, principalName =
>> test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,425 DEBUG [main] backend.AbstractIdentityBackend:
>> addIdentity successful, principalName = drankye@TEST.COM
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1] request.KdcRequest:
>> Client entry is empty.
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> drankye@TEST.COM
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = drankye@TEST.COM
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>> disconnecting abnormally java.io.EOFException
>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
>> at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>> at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>> at java.lang.Thread.run(Thread.java:748)
>> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase: Storing
>> the tgt to the credential cache file.
>> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity called, principalName = test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity successful, principalName =
>> test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1] request.KdcRequest:
>> Client entry is empty.
>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1] request.KdcRequest:
>> The preauth data is empty.
>> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1] server.KdcHandler:
>> KRB error occurred while processing request:Additional
>> pre-authentication required
>> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>> disconnecting abnormally java.io.EOFException
>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
>> at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>> at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>> at java.lang.Thread.run(Thread.java:748)
>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1] request.KdcRequest:
>> Client entry is empty.
>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>> disconnecting abnormally java.io.EOFException
>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
>> at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>> at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>> at java.lang.Thread.run(Thread.java:748)
>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1] request.KdcRequest:
>> Found fast padata and start to process it.
>> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
>> impl.DefaultKdcHandler: Error occured while processing request:
>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
>> at
>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast(KdcRequest.java:208)
>> at
>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.process(KdcRequest.java:168)
>> at
>> org.apache.kerby.kerberos.kerb.server.KdcHandler.handleMessage(KdcHandler.java:115)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.handleMessage(DefaultKdcHandler.java:67)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:52)
>> at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>> at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>> at java.lang.Thread.run(Thread.java:748)
>> Caused by: java.io.IOException: Unexpected item context [0]
>> [tag=0xA0, off=0, len=3+207], expecting 0x30
>> at
>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(Asn1Encodeable.java:210)
>> at
>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(Asn1Encodeable.java:197)
>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
>> ... 9 more
>> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>> disconnecting abnormally
>> java.net.SocketException: Socket closed
>> at java.net.SocketInputStream.socketRead0(Native Method)
>> at java.net.SocketInputStream.socketRead(SocketInputStream.java:116)
>> at java.net.SocketInputStream.read(SocketInputStream.java:171)
>> at java.net.SocketInputStream.read(SocketInputStream.java:141)
>> at java.net.SocketInputStream.read(SocketInputStream.java:224)
>> at java.io.DataInputStream.readInt(DataInputStream.java:387)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
>> at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>> at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>> at java.lang.Thread.run(Thread.java:748)
>>
>> In a FreeIPA environment these python lines "just" work.
>>
>> Any suggestions are welcome!
>>
>> Marc
>>
>>
> --
> Marc de Lignie
>
--
Marc de Lignie
RE: MIT Kerberos compatibility
Posted by "Zheng, Kai" <ka...@intel.com>.
Hi Marc,
Looks like this is quite environment related, could you fire an issue for this? I would suggest we target it to 1.1.0, which can be done in June.
Regards,
Kai
-----Original Message-----
From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
Sent: Friday, May 05, 2017 4:44 PM
To: Li, Jiajia <ji...@intel.com>
Cc: kerby@directory.apache.org
Subject: Re: MIT Kerberos compatibility
Hi Jiajia,
Great to read that you made progress on this issue and to see a working config at your side. Below, I list my progress below (with trunk merged into my MitIssue branch), but I am afraid we are not done yet.
Things that stand out:
- the kdc decoding error is solved, relative to the logs without your patch
- your KRB5 tracing looks quite different. What OS and mit-kerberos version did you use?
- your KRB5 tracing shows UDP comms between kerberos client and KDC, despite the allowUDP = false setting in my test. I did this setting because I get different problems without it, see the additional logs below. So, we must also be aware of networking problems at my side.
- the "Response was not from master KDC" msg is not relevant; it disappears if you manually add master_kdc to the realms section of the krb5.conf
I have no idea how to proceed from here, so that is why I just document the status at my side and ask about your - apparently working - config.
Cheers, Marc
KDC logging with allowUDP = false:
[INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
[pool-1-thread-1] INFO
org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
authtime 1493970789075,drankye@TEST.COM for krbtgt/TEST.COM@TEST.COM [main] INFO org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClient - Send to kdc success.
[main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing the tgt to the credential cache file.
[pool-1-thread-1] INFO
org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The preauth data is empty.
[pool-1-thread-1] INFO org.apache.kerby.kerberos.kerb.server.KdcHandler
- KRB error occurred while processing request:Additional pre-authentication required [pool-1-thread-1] INFO org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
authtime 1493970789108,test-service/localhost@TEST.COM for krbtgt/TEST.COM@TEST.COM [pool-1-thread-1] INFO org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found fast padata and starting to process it.
[pool-1-thread-1] INFO
org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found fast padata and starting to process it.
Python script KRB5 tracing (MIT Kerberos 1.13.2 of Ubuntu Xenial) with allowUDP = false:
$ .
kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/server/MitIssueTest.sh
[25281] 1493970797.298753: Retrieving drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281] 1493970797.298952: Retrieving drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281] 1493970797.299106: Retrieving drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281] 1493970797.299213: Retrieving drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281] 1493970797.299323: Retrieving drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281] 1493970797.299436: Retrieving drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281] 1493970797.299545: Retrieving drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
2/Key table file '/etc/krb5/user/1000/client.keytab' not found [25281] 1493970797.299654: Retrieving drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
2/Key table file '/etc/krb5/user/1000/client.keytab' not found kerberos.authGSSClientInit successful [25281] 1493970797.299922: Getting credentials drankye@TEST.COM -> test-service/localhost@ using ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
[25281] 1493970797.299945: Retrieving drankye@TEST.COM -> test-service/localhost@ from FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
-1765328243/Matching credential not found [25281] 1493970797.299959: Retrying drankye@TEST.COM -> test-service/localhost@TEST.COM with result: -1765328243/Matching credential not found [25281] 1493970797.299962: Server has referral realm; starting with test-service/localhost@TEST.COM [25281] 1493970797.299975: Retrieving drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM from FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result: 0/Success [25281] 1493970797.299979: Starting with TGT for client realm:
drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [25281] 1493970797.299981: Requesting tickets for test-service/localhost@TEST.COM, referrals on [25281] 1493970797.299994: Generated subkey for TGS request: aes128-cts/1B9B [25281] 1493970797.300009: etypes requested in TGS request: aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts [25281] 1493970797.300054: Encoding request body and padata into FAST request [25281] 1493970797.300080: Sending request (823 bytes) to TEST.COM [25281] 1493970797.300091: Resolving hostname localhost [25281] 1493970797.300136: Initiating TCP connection to stream
127.0.0.1:34319
[25281] 1493970797.300191: Sending TCP request to stream 127.0.0.1:34319 [25281] 1493970797.303610: Received answer (125 bytes) from stream
127.0.0.1:34319
[25281] 1493970797.303618: Terminating TCP connection to stream
127.0.0.1:34319
[25281] 1493970797.553126: Response was not from master KDC [25281] 1493970797.553198: TGS request result: -1765323383/Unknown code krcM 137 [25281] 1493970797.553234: Requesting tickets for test-service/localhost@TEST.COM, referrals off [25281] 1493970797.553273: Generated subkey for TGS request: aes128-cts/94C6 [25281] 1493970797.553323: etypes requested in TGS request: aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts [25281] 1493970797.553436: Encoding request body and padata into FAST request [25281] 1493970797.553532: Sending request (823 bytes) to TEST.COM [25281] 1493970797.553567: Resolving hostname localhost [25281] 1493970797.553745: Initiating TCP connection to stream
127.0.0.1:34319
[25281] 1493970797.553889: Sending TCP request to stream 127.0.0.1:34319 [25281] 1493970797.558297: Received answer (125 bytes) from stream
127.0.0.1:34319
[25281] 1493970797.558318: Terminating TCP connection to stream
127.0.0.1:34319
[25281] 1493970797.561189: Response was not from master KDC [25281] 1493970797.561258: TGS request result: -1765323383/Unknown code krcM 137 ('First kerberos.authGSSClientStep not successful', GSSError(('Unspecified GSS failure. Minor code may provide more information', 851968), ('Unknown code krcM 137', -1765323383)))
KDC logging with allowUDP = true:
[INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
[pool-1-thread-1] INFO
org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
authtime 1493972505784,drankye@TEST.COM for krbtgt/TEST.COM@TEST.COM [main] INFO org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClient - Send to kdc success.
[main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase - Storing the tgt to the credential cache file.
[pool-1-thread-1] INFO
org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The preauth data is empty.
[pool-1-thread-1] INFO org.apache.kerby.kerberos.kerb.server.KdcHandler
- KRB error occurred while processing request:Additional pre-authentication required [pool-1-thread-2] INFO org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
authtime 1493972505948,test-service/localhost@TEST.COM for krbtgt/TEST.COM@TEST.COM Exception in thread "Thread-0" java.lang.RuntimeException: Error occured while checking udp connections
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(KdcNetwork.java:105)
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork.access$000(KdcNetwork.java:39)
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.run(KdcNetwork.java:75)
at java.lang.Thread.run(Thread.java:748)
Caused by: java.nio.channels.ClosedChannelException
at
sun.nio.ch.DatagramChannelImpl.ensureOpen(DatagramChannelImpl.java:320)
at sun.nio.ch.DatagramChannelImpl.receive(DatagramChannelImpl.java:331)
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork.checkUdpMessage(KdcNetwork.java:132)
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(KdcNetwork.java:101)
... 3 more
krb5.conf:
[libdefaults]
kdc_realm = TEST.COM
default_realm = TEST.COM
udp_preference_limit = 4096
kdc_tcp_port = 37080
kdc_udp_port = 36525
[realms]
TEST.COM = {
kdc = localhost:36525
}
And port 36525 does not show up in `netstat -l` (while 37080 does)
Op 04-05-17 om 14:55 schreef Li, Jiajia:
> Hi Marc,
> I try to run your test(through applying your patch in the trunk) , I think it's success now. Could you take some time to check about it?
> Here is the log:
>
> directory-kerby git:(trunk) ✗ .
> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/
> server/MitIssueTest.sh
> kerberos.authGSSClientInit successful
> 2017-05-04T20:44:06 set-error: -1765328234: entypes not supported
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> for krb5_ccache_conf_data/realm-config@X-CACHECONF: in cache
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> for test-service/localhost@TEST.COM in cache
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> for
> krb5_ccache_conf_data/negative-cache/test-service\134/localhost\134@TE
> ST.COM@X-CACHECONF: in cache
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF: in cache
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> for krb5_ccache_conf_data/sitename@X-CACHECONF: in cache
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> for test-service/localhost@TEST.COM in cache
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> des-cbc-md5-deprecated not supported
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> des-cbc-md4-deprecated not supported
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> des-cbc-crc-deprecated not supported
> 2017-05-04T20:44:06 Trying to find service kdc for realm TEST.COM
> flags 0
> 2017-05-04T20:44:06 configuration file for realm TEST.COM found
> 2017-05-04T20:44:06 submissing new requests to new host
> 2017-05-04T20:44:06 host_create: setting hostname localhost
> 2017-05-04T20:44:06 connecting to host: udp ::1:52534 (localhost) tid:
> 00000001
> 2017-05-04T20:44:06 host_create: setting hostname localhost
> 2017-05-04T20:44:06 Queuing host in future (in 3s), its the 2 address
> on the same name: udp 127.0.0.1:52534 (localhost) tid: 00000002
> 2017-05-04T20:44:06 writing packet: udp ::1:52534 (localhost) tid:
> 00000001
> 2017-05-04T20:44:06 reading packet: udp ::1:52534 (localhost) tid:
> 00000001
> 2017-05-04T20:44:06 host completed: udp ::1:52534 (localhost) tid:
> 00000001
> 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0 hosts 1
> packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814 tid: 00000002
> 2017-05-04T20:44:06 tkt: extract key 17/763641F3
> 2017-05-04T20:44:06 set-error: -1765328353: Decrypt integrity check
> failed for checksum type hmac-sha1-96-aes128, key type
> aes128-cts-hmac-sha1-96
> 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
> 2017-05-04T20:44:06 krb5_get_credentials_with_flags: TEST.COM wc:
> 0.050317
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> for krb5_ccache_conf_data/realm-config@X-CACHECONF: in cache
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> for
> krb5_ccache_conf_data/time-offset/test-service\134/localhost\134@TEST.
> COM@X-CACHECONF: in cache
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 Setting up PFS for auth context
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> des-cbc-md5-deprecated not supported
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> des-cbc-md4-deprecated not supported
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> des-cbc-crc-deprecated not supported First kerberos.authGSSClientStep
> successful
>
> Thanks
> Jiajia
>
> -----Original Message-----
> From: Zheng, Kai [mailto:kai.zheng@intel.com]
> Sent: Wednesday, May 3, 2017 7:29 PM
> To: kerby@directory.apache.org
> Subject: RE: MIT Kerberos compatibility
>
> Hi Marc,
>
> In case you're not aware of this, please check out the latest fix made by Jiajia. We thought your case may be different, but would be good to have a check before we can repeat/fix your case. Thanks.
> https://issues.apache.org/jira/browse/DIRKRB-625
>
> Regards,
> Kai
>
> -----Original Message-----
> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> Sent: Sunday, April 30, 2017 7:45 PM
> To: kerby@directory.apache.org
> Subject: Re: MIT Kerberos compatibility
>
> Hi Kai,
>
> The terminal output below is for the latest MIT Kerberos 1.15.1 (locally built on Ubuntu Xenial). Before that, I also tested with the default Xenial MIT Kerberos packages (1.13.2), with the same result. I did not try earlier MIT Kerberos versions.
>
> Marc
>
> Op 29-04-17 om 21:42 schreef Marc de Lignie:
>> Hi Kai,
>>
>> Thanks for the response. I prepared a minimal config that reproduces
>> my problem.
>>
>> You can fetch the branch/commit from:
>> https://github.com/vtslab/directory-kerby/commits/MitIssue
>>
>> This is relative to RC2, but I also tried this on trunk for my actual
>> project.
>>
>> This config produces the debug and error messages below.
>>
>> 1. For the terminal with the bash + python script $ klist Ticket
>> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> Default principal: drankye@TEST.COM
>>
>> Valid starting Expires Service principal
>> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/TEST.COM@TEST.COM
>> renew until 29-04-17 21:07:39
>>
>> $ .
>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb
>> / server/MitIssueTest.sh [15538] 1493491231.917606: Retrieving
>> drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0,
>> enctype 0) with result:
>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>> [15538]
>> 1493491231.917827: Retrieving drankye@TEST.COM from
>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>> kerberos.authGSSClientInit successful [15538] 1493491231.918185:
>> Getting credentials drankye@TEST.COM -> test-service/localhost@ using
>> ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
>> test-service/localhost@ from
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>> -1765328243/Matching credential not found (filename:
>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
>> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
>> test-service/localhost@TEST.COM with result: -1765328243/Matching
>> credential not found (filename:
>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
>> [15538] 1493491231.918229: Server has referral realm; starting with
>> test-service/localhost@TEST.COM [15538] 1493491231.918278: Retrieving
>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM from
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>> 0/Success
>> [15538] 1493491231.918281: Starting with TGT for client realm:
>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
>> 1493491231.918301: Requesting tickets for
>> test-service/localhost@TEST.COM, referrals on [15538]
>> 1493491231.918326: Generated subkey for TGS request:
>> aes128-cts/FA30
>> [15538] 1493491231.918359: etypes requested in TGS request:
>> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1,
>> rc4-hmac, camellia128-cts, camellia256-cts [15538] 1493491231.918484:
>> Encoding request body and padata into FAST request [15538]
>> 1493491231.918541: Sending request (836 bytes) to TEST.COM [15538]
>> 1493491231.918597: Resolving hostname localhost [15538]
>> 1493491231.918703: Initiating TCP connection to stream
>> 127.0.0.1:44292
>> [15538] 1493491231.918777: Sending TCP request to stream
>> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error receiving from
>> stream
>> 127.0.0.1:44292: 104/Connection reset by peer [15538]
>> 1493491231.922812: Terminating TCP connection to stream
>> 127.0.0.1:44292
>> [15538] 1493491231.922858: Sending initial UDP request to dgram
>> 127.0.0.1:44292
>> ('First kerberos.authGSSClientStep not successful',
>> GSSError(('Unspecified GSS failure. Minor code may provide more
>> information', 851968), ("Cannot contact any KDC for realm
>> 'TEST.COM'",
>> -1765328228)))
>>
>> 2. For the terminal that runs mvn clean test -Dtest=MitIssueTest
>> Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
>> 2017-04-29 21:07:39,182 DEBUG [main] backend.AbstractIdentityBackend:
>> initialize called
>> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity called, principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity failed, principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>> addIdentity successful, principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity called, principalName = kadmin/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity failed, principalName = kadmin/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,213 DEBUG [main] backend.AbstractIdentityBackend:
>> addIdentity successful, principalName = kadmin/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,216 DEBUG [main] backend.AbstractIdentityBackend:
>> start called
>> 2017-04-29 21:07:39,232 DEBUG [main] backend.AbstractIdentityBackend:
>> addIdentity successful, principalName =
>> test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,425 DEBUG [main] backend.AbstractIdentityBackend:
>> addIdentity successful, principalName = drankye@TEST.COM
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1] request.KdcRequest:
>> Client entry is empty.
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> drankye@TEST.COM
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = drankye@TEST.COM
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>> disconnecting abnormally java.io.EOFException
>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
>> at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>> at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>> at java.lang.Thread.run(Thread.java:748)
>> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase: Storing
>> the tgt to the credential cache file.
>> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity called, principalName = test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity successful, principalName =
>> test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1] request.KdcRequest:
>> Client entry is empty.
>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1] request.KdcRequest:
>> The preauth data is empty.
>> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1] server.KdcHandler:
>> KRB error occurred while processing request:Additional
>> pre-authentication required
>> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>> disconnecting abnormally java.io.EOFException
>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
>> at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>> at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>> at java.lang.Thread.run(Thread.java:748)
>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1] request.KdcRequest:
>> Client entry is empty.
>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>> disconnecting abnormally java.io.EOFException
>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
>> at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>> at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>> at java.lang.Thread.run(Thread.java:748)
>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1] request.KdcRequest:
>> Found fast padata and start to process it.
>> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
>> impl.DefaultKdcHandler: Error occured while processing request:
>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
>> at
>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast(KdcRequest.java:208)
>> at
>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.process(KdcRequest.java:168)
>> at
>> org.apache.kerby.kerberos.kerb.server.KdcHandler.handleMessage(KdcHandler.java:115)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.handleMessage(DefaultKdcHandler.java:67)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:52)
>> at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>> at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>> at java.lang.Thread.run(Thread.java:748)
>> Caused by: java.io.IOException: Unexpected item context [0]
>> [tag=0xA0, off=0, len=3+207], expecting 0x30
>> at
>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(Asn1Encodeable.java:210)
>> at
>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(Asn1Encodeable.java:197)
>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
>> ... 9 more
>> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>> disconnecting abnormally
>> java.net.SocketException: Socket closed
>> at java.net.SocketInputStream.socketRead0(Native Method)
>> at java.net.SocketInputStream.socketRead(SocketInputStream.java:116)
>> at java.net.SocketInputStream.read(SocketInputStream.java:171)
>> at java.net.SocketInputStream.read(SocketInputStream.java:141)
>> at java.net.SocketInputStream.read(SocketInputStream.java:224)
>> at java.io.DataInputStream.readInt(DataInputStream.java:387)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
>> at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>> at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>> at java.lang.Thread.run(Thread.java:748)
>>
>> In a FreeIPA environment these python lines "just" work.
>>
>> Any suggestions are welcome!
>>
>> Marc
>>
>>
> --
> Marc de Lignie
>
--
Marc de Lignie
Re: MIT Kerberos compatibility
Posted by Marc de Lignie <m....@xs4all.nl>.
Hi Jiajia,
Great to read that you made progress on this issue and to see a working
config at your side. Below, I list my progress below (with trunk merged
into my MitIssue branch), but I am afraid we are not done yet.
Things that stand out:
- the kdc decoding error is solved, relative to the logs without your patch
- your KRB5 tracing looks quite different. What OS and mit-kerberos
version did you use?
- your KRB5 tracing shows UDP comms between kerberos client and KDC,
despite the allowUDP = false setting in my test. I did this setting
because I get different problems without it, see the additional logs
below. So, we must also be aware of networking problems at my side.
- the "Response was not from master KDC" msg is not relevant; it
disappears if you manually add master_kdc to the realms section of the
krb5.conf
I have no idea how to proceed from here, so that is why I just document
the status at my side and ask about your - apparently working - config.
Cheers, Marc
KDC logging with allowUDP = false:
[INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
[pool-1-thread-1] INFO
org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
authtime 1493970789075,drankye@TEST.COM for krbtgt/TEST.COM@TEST.COM
[main] INFO
org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClient -
Send to kdc success.
[main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
Storing the tgt to the credential cache file.
[pool-1-thread-1] INFO
org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The preauth
data is empty.
[pool-1-thread-1] INFO org.apache.kerby.kerberos.kerb.server.KdcHandler
- KRB error occurred while processing request:Additional
pre-authentication required
[pool-1-thread-1] INFO
org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
authtime 1493970789108,test-service/localhost@TEST.COM for
krbtgt/TEST.COM@TEST.COM
[pool-1-thread-1] INFO
org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found fast
padata and starting to process it.
[pool-1-thread-1] INFO
org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found fast
padata and starting to process it.
Python script KRB5 tracing (MIT Kerberos 1.13.2 of Ubuntu Xenial) with
allowUDP = false:
$ .
kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/server/MitIssueTest.sh
[25281] 1493970797.298753: Retrieving drankye@TEST.COM from
FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
2/Key table file '/etc/krb5/user/1000/client.keytab' not found
[25281] 1493970797.298952: Retrieving drankye@TEST.COM from
FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
2/Key table file '/etc/krb5/user/1000/client.keytab' not found
[25281] 1493970797.299106: Retrieving drankye@TEST.COM from
FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
2/Key table file '/etc/krb5/user/1000/client.keytab' not found
[25281] 1493970797.299213: Retrieving drankye@TEST.COM from
FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
2/Key table file '/etc/krb5/user/1000/client.keytab' not found
[25281] 1493970797.299323: Retrieving drankye@TEST.COM from
FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
2/Key table file '/etc/krb5/user/1000/client.keytab' not found
[25281] 1493970797.299436: Retrieving drankye@TEST.COM from
FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
2/Key table file '/etc/krb5/user/1000/client.keytab' not found
[25281] 1493970797.299545: Retrieving drankye@TEST.COM from
FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
2/Key table file '/etc/krb5/user/1000/client.keytab' not found
[25281] 1493970797.299654: Retrieving drankye@TEST.COM from
FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
2/Key table file '/etc/krb5/user/1000/client.keytab' not found
kerberos.authGSSClientInit successful
[25281] 1493970797.299922: Getting credentials drankye@TEST.COM ->
test-service/localhost@ using ccache
FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
[25281] 1493970797.299945: Retrieving drankye@TEST.COM ->
test-service/localhost@ from
FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
-1765328243/Matching credential not found
[25281] 1493970797.299959: Retrying drankye@TEST.COM ->
test-service/localhost@TEST.COM with result: -1765328243/Matching
credential not found
[25281] 1493970797.299962: Server has referral realm; starting with
test-service/localhost@TEST.COM
[25281] 1493970797.299975: Retrieving drankye@TEST.COM ->
krbtgt/TEST.COM@TEST.COM from
FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result: 0/Success
[25281] 1493970797.299979: Starting with TGT for client realm:
drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM
[25281] 1493970797.299981: Requesting tickets for
test-service/localhost@TEST.COM, referrals on
[25281] 1493970797.299994: Generated subkey for TGS request: aes128-cts/1B9B
[25281] 1493970797.300009: etypes requested in TGS request: aes256-cts,
aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
[25281] 1493970797.300054: Encoding request body and padata into FAST
request
[25281] 1493970797.300080: Sending request (823 bytes) to TEST.COM
[25281] 1493970797.300091: Resolving hostname localhost
[25281] 1493970797.300136: Initiating TCP connection to stream
127.0.0.1:34319
[25281] 1493970797.300191: Sending TCP request to stream 127.0.0.1:34319
[25281] 1493970797.303610: Received answer (125 bytes) from stream
127.0.0.1:34319
[25281] 1493970797.303618: Terminating TCP connection to stream
127.0.0.1:34319
[25281] 1493970797.553126: Response was not from master KDC
[25281] 1493970797.553198: TGS request result: -1765323383/Unknown code
krcM 137
[25281] 1493970797.553234: Requesting tickets for
test-service/localhost@TEST.COM, referrals off
[25281] 1493970797.553273: Generated subkey for TGS request: aes128-cts/94C6
[25281] 1493970797.553323: etypes requested in TGS request: aes256-cts,
aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts
[25281] 1493970797.553436: Encoding request body and padata into FAST
request
[25281] 1493970797.553532: Sending request (823 bytes) to TEST.COM
[25281] 1493970797.553567: Resolving hostname localhost
[25281] 1493970797.553745: Initiating TCP connection to stream
127.0.0.1:34319
[25281] 1493970797.553889: Sending TCP request to stream 127.0.0.1:34319
[25281] 1493970797.558297: Received answer (125 bytes) from stream
127.0.0.1:34319
[25281] 1493970797.558318: Terminating TCP connection to stream
127.0.0.1:34319
[25281] 1493970797.561189: Response was not from master KDC
[25281] 1493970797.561258: TGS request result: -1765323383/Unknown code
krcM 137
('First kerberos.authGSSClientStep not successful',
GSSError(('Unspecified GSS failure. Minor code may provide more
information', 851968), ('Unknown code krcM 137', -1765323383)))
KDC logging with allowUDP = true:
[INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
[pool-1-thread-1] INFO
org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
authtime 1493972505784,drankye@TEST.COM for krbtgt/TEST.COM@TEST.COM
[main] INFO
org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClient -
Send to kdc success.
[main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase -
Storing the tgt to the credential cache file.
[pool-1-thread-1] INFO
org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The preauth
data is empty.
[pool-1-thread-1] INFO org.apache.kerby.kerberos.kerb.server.KdcHandler
- KRB error occurred while processing request:Additional
pre-authentication required
[pool-1-thread-2] INFO
org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
authtime 1493972505948,test-service/localhost@TEST.COM for
krbtgt/TEST.COM@TEST.COM
Exception in thread "Thread-0" java.lang.RuntimeException: Error occured
while checking udp connections
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(KdcNetwork.java:105)
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork.access$000(KdcNetwork.java:39)
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.run(KdcNetwork.java:75)
at java.lang.Thread.run(Thread.java:748)
Caused by: java.nio.channels.ClosedChannelException
at
sun.nio.ch.DatagramChannelImpl.ensureOpen(DatagramChannelImpl.java:320)
at sun.nio.ch.DatagramChannelImpl.receive(DatagramChannelImpl.java:331)
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork.checkUdpMessage(KdcNetwork.java:132)
at
org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(KdcNetwork.java:101)
... 3 more
krb5.conf:
[libdefaults]
kdc_realm = TEST.COM
default_realm = TEST.COM
udp_preference_limit = 4096
kdc_tcp_port = 37080
kdc_udp_port = 36525
[realms]
TEST.COM = {
kdc = localhost:36525
}
And port 36525 does not show up in `netstat -l` (while 37080 does)
Op 04-05-17 om 14:55 schreef Li, Jiajia:
> Hi Marc,
> I try to run your test(through applying your patch in the trunk) , I think it's success now. Could you take some time to check about it?
> Here is the log:
>
> directory-kerby git:(trunk) ✗ . kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/server/MitIssueTest.sh
> kerberos.authGSSClientInit successful
> 2017-05-04T20:44:06 set-error: -1765328234: entypes not supported
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential for krb5_ccache_conf_data/realm-config@X-CACHECONF: in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential for test-service/localhost@TEST.COM in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential for krb5_ccache_conf_data/negative-cache/test-service\134/localhost\134@TEST.COM@X-CACHECONF: in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF: in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential for krb5_ccache_conf_data/sitename@X-CACHECONF: in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential for test-service/localhost@TEST.COM in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type des-cbc-md5-deprecated not supported
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type des-cbc-md4-deprecated not supported
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type des-cbc-crc-deprecated not supported
> 2017-05-04T20:44:06 Trying to find service kdc for realm TEST.COM flags 0
> 2017-05-04T20:44:06 configuration file for realm TEST.COM found
> 2017-05-04T20:44:06 submissing new requests to new host
> 2017-05-04T20:44:06 host_create: setting hostname localhost
> 2017-05-04T20:44:06 connecting to host: udp ::1:52534 (localhost) tid: 00000001
> 2017-05-04T20:44:06 host_create: setting hostname localhost
> 2017-05-04T20:44:06 Queuing host in future (in 3s), its the 2 address on the same name: udp 127.0.0.1:52534 (localhost) tid: 00000002
> 2017-05-04T20:44:06 writing packet: udp ::1:52534 (localhost) tid: 00000001
> 2017-05-04T20:44:06 reading packet: udp ::1:52534 (localhost) tid: 00000001
> 2017-05-04T20:44:06 host completed: udp ::1:52534 (localhost) tid: 00000001
> 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0 hosts 1 packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814 tid: 00000002
> 2017-05-04T20:44:06 tkt: extract key 17/763641F3
> 2017-05-04T20:44:06 set-error: -1765328353: Decrypt integrity check failed for checksum type hmac-sha1-96-aes128, key type aes128-cts-hmac-sha1-96
> 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
> 2017-05-04T20:44:06 krb5_get_credentials_with_flags: TEST.COM wc: 0.050317
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential for krb5_ccache_conf_data/realm-config@X-CACHECONF: in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential for krb5_ccache_conf_data/time-offset/test-service\134/localhost\134@TEST.COM@X-CACHECONF: in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 Setting up PFS for auth context
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type des-cbc-md5-deprecated not supported
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type des-cbc-md4-deprecated not supported
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type des-cbc-crc-deprecated not supported
> First kerberos.authGSSClientStep successful
>
> Thanks
> Jiajia
>
> -----Original Message-----
> From: Zheng, Kai [mailto:kai.zheng@intel.com]
> Sent: Wednesday, May 3, 2017 7:29 PM
> To: kerby@directory.apache.org
> Subject: RE: MIT Kerberos compatibility
>
> Hi Marc,
>
> In case you're not aware of this, please check out the latest fix made by Jiajia. We thought your case may be different, but would be good to have a check before we can repeat/fix your case. Thanks.
> https://issues.apache.org/jira/browse/DIRKRB-625
>
> Regards,
> Kai
>
> -----Original Message-----
> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> Sent: Sunday, April 30, 2017 7:45 PM
> To: kerby@directory.apache.org
> Subject: Re: MIT Kerberos compatibility
>
> Hi Kai,
>
> The terminal output below is for the latest MIT Kerberos 1.15.1 (locally built on Ubuntu Xenial). Before that, I also tested with the default Xenial MIT Kerberos packages (1.13.2), with the same result. I did not try earlier MIT Kerberos versions.
>
> Marc
>
> Op 29-04-17 om 21:42 schreef Marc de Lignie:
>> Hi Kai,
>>
>> Thanks for the response. I prepared a minimal config that reproduces
>> my problem.
>>
>> You can fetch the branch/commit from:
>> https://github.com/vtslab/directory-kerby/commits/MitIssue
>>
>> This is relative to RC2, but I also tried this on trunk for my actual
>> project.
>>
>> This config produces the debug and error messages below.
>>
>> 1. For the terminal with the bash + python script $ klist Ticket
>> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> Default principal: drankye@TEST.COM
>>
>> Valid starting Expires Service principal
>> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/TEST.COM@TEST.COM
>> renew until 29-04-17 21:07:39
>>
>> $ .
>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/
>> server/MitIssueTest.sh [15538] 1493491231.917606: Retrieving
>> drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0,
>> enctype 0) with result:
>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [15538]
>> 1493491231.917827: Retrieving drankye@TEST.COM from
>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>> kerberos.authGSSClientInit successful [15538] 1493491231.918185:
>> Getting credentials drankye@TEST.COM -> test-service/localhost@ using
>> ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
>> test-service/localhost@ from
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>> -1765328243/Matching credential not found (filename:
>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
>> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
>> test-service/localhost@TEST.COM with result: -1765328243/Matching
>> credential not found (filename:
>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
>> [15538] 1493491231.918229: Server has referral realm; starting with
>> test-service/localhost@TEST.COM [15538] 1493491231.918278: Retrieving
>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM from
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>> 0/Success
>> [15538] 1493491231.918281: Starting with TGT for client realm:
>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
>> 1493491231.918301: Requesting tickets for
>> test-service/localhost@TEST.COM, referrals on [15538]
>> 1493491231.918326: Generated subkey for TGS request:
>> aes128-cts/FA30
>> [15538] 1493491231.918359: etypes requested in TGS request:
>> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1,
>> rc4-hmac, camellia128-cts, camellia256-cts [15538] 1493491231.918484:
>> Encoding request body and padata into FAST request [15538]
>> 1493491231.918541: Sending request (836 bytes) to TEST.COM [15538]
>> 1493491231.918597: Resolving hostname localhost [15538]
>> 1493491231.918703: Initiating TCP connection to stream
>> 127.0.0.1:44292
>> [15538] 1493491231.918777: Sending TCP request to stream
>> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error receiving from
>> stream
>> 127.0.0.1:44292: 104/Connection reset by peer [15538]
>> 1493491231.922812: Terminating TCP connection to stream
>> 127.0.0.1:44292
>> [15538] 1493491231.922858: Sending initial UDP request to dgram
>> 127.0.0.1:44292
>> ('First kerberos.authGSSClientStep not successful',
>> GSSError(('Unspecified GSS failure. Minor code may provide more
>> information', 851968), ("Cannot contact any KDC for realm 'TEST.COM'",
>> -1765328228)))
>>
>> 2. For the terminal that runs mvn clean test -Dtest=MitIssueTest
>> Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
>> 2017-04-29 21:07:39,182 DEBUG [main] backend.AbstractIdentityBackend:
>> initialize called
>> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity called, principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity failed, principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>> addIdentity successful, principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity called, principalName = kadmin/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity failed, principalName = kadmin/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,213 DEBUG [main] backend.AbstractIdentityBackend:
>> addIdentity successful, principalName = kadmin/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,216 DEBUG [main] backend.AbstractIdentityBackend:
>> start called
>> 2017-04-29 21:07:39,232 DEBUG [main] backend.AbstractIdentityBackend:
>> addIdentity successful, principalName =
>> test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,425 DEBUG [main] backend.AbstractIdentityBackend:
>> addIdentity successful, principalName = drankye@TEST.COM
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>> = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1] request.KdcRequest:
>> Client entry is empty.
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> drankye@TEST.COM
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>> = drankye@TEST.COM
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>> = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>> disconnecting abnormally java.io.EOFException
>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
>> at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>> at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>> at java.lang.Thread.run(Thread.java:748)
>> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase: Storing the
>> tgt to the credential cache file.
>> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity called, principalName = test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity successful, principalName =
>> test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>> = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1] request.KdcRequest:
>> Client entry is empty.
>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>> = test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>> = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1] request.KdcRequest:
>> The preauth data is empty.
>> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1] server.KdcHandler: KRB
>> error occurred while processing request:Additional pre-authentication
>> required
>> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>> disconnecting abnormally java.io.EOFException
>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
>> at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>> at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>> at java.lang.Thread.run(Thread.java:748)
>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>> = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1] request.KdcRequest:
>> Client entry is empty.
>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>> = test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>> = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>> disconnecting abnormally java.io.EOFException
>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
>> at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>> at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>> at java.lang.Thread.run(Thread.java:748)
>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>> = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1] request.KdcRequest:
>> Found fast padata and start to process it.
>> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
>> impl.DefaultKdcHandler: Error occured while processing request:
>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
>> at
>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast(KdcRequest.java:208)
>> at
>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.process(KdcRequest.java:168)
>> at
>> org.apache.kerby.kerberos.kerb.server.KdcHandler.handleMessage(KdcHandler.java:115)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.handleMessage(DefaultKdcHandler.java:67)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:52)
>> at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>> at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>> at java.lang.Thread.run(Thread.java:748)
>> Caused by: java.io.IOException: Unexpected item context [0] [tag=0xA0,
>> off=0, len=3+207], expecting 0x30
>> at
>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(Asn1Encodeable.java:210)
>> at
>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(Asn1Encodeable.java:197)
>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
>> ... 9 more
>> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>> disconnecting abnormally
>> java.net.SocketException: Socket closed
>> at java.net.SocketInputStream.socketRead0(Native Method)
>> at java.net.SocketInputStream.socketRead(SocketInputStream.java:116)
>> at java.net.SocketInputStream.read(SocketInputStream.java:171)
>> at java.net.SocketInputStream.read(SocketInputStream.java:141)
>> at java.net.SocketInputStream.read(SocketInputStream.java:224)
>> at java.io.DataInputStream.readInt(DataInputStream.java:387)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
>> at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>> at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>> at java.lang.Thread.run(Thread.java:748)
>>
>> In a FreeIPA environment these python lines "just" work.
>>
>> Any suggestions are welcome!
>>
>> Marc
>>
>>
> --
> Marc de Lignie
>
--
Marc de Lignie
RE: MIT Kerberos compatibility
Posted by "Li, Jiajia" <ji...@intel.com>.
I think it contains the service ticket for test-service. Here is the log:
klist
Credentials cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
Principal: drankye@TEST.COM
2017-05-06T07:59:44 set-error: -1765328243: Did not find credential for krb5_ccache_conf_data/FriendlyName@X-CACHECONF: in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
Issued Expires Principal
May 6 07:57:58 2017 May 6 17:57:45 2017 krbtgt/TEST.COM@TEST.COM
May 6 07:59:40 2017 May 7 07:59:40 2017 test-service/localhost@TEST.COM
Thanks
Jiajia
-----Original Message-----
From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
Sent: Saturday, May 6, 2017 4:13 AM
To: Li, Jiajia <ji...@intel.com>
Cc: kerby@directory.apache.org
Subject: Re: MIT Kerberos compatibility
Hi Jiajia,
Thanks for the netty config option. This indeed helped to get rid of the udp errors, but did not help in getting the service ticket (final error message remains the same).
I also noticed that I get the same error from the python console whether I specify the right service name or some service name for which no service principal exists in the TestKdc.
I did not succeed in getting mvn tst to print the debug logging of the various kdc classes involved.
Did you check with klist whether drankye's credential cache contains the service ticket for test-service?
Cheers, Marc
Op 04-05-17 om 14:55 schreef Li, Jiajia:
> Hi Marc,
> I try to run your test(through applying your patch in the trunk) , I think it's success now. Could you take some time to check about it?
> Here is the log:
>
> directory-kerby git:(trunk) ✗ .
> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/
> server/MitIssueTest.sh
> kerberos.authGSSClientInit successful
> 2017-05-04T20:44:06 set-error: -1765328234: entypes not supported
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> for krb5_ccache_conf_data/realm-config@X-CACHECONF: in cache
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> for test-service/localhost@TEST.COM in cache
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> for
> krb5_ccache_conf_data/negative-cache/test-service\134/localhost\134@TE
> ST.COM@X-CACHECONF: in cache
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF: in cache
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> for krb5_ccache_conf_data/sitename@X-CACHECONF: in cache
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> for test-service/localhost@TEST.COM in cache
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> des-cbc-md5-deprecated not supported
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> des-cbc-md4-deprecated not supported
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> des-cbc-crc-deprecated not supported
> 2017-05-04T20:44:06 Trying to find service kdc for realm TEST.COM
> flags 0
> 2017-05-04T20:44:06 configuration file for realm TEST.COM found
> 2017-05-04T20:44:06 submissing new requests to new host
> 2017-05-04T20:44:06 host_create: setting hostname localhost
> 2017-05-04T20:44:06 connecting to host: udp ::1:52534 (localhost) tid:
> 00000001
> 2017-05-04T20:44:06 host_create: setting hostname localhost
> 2017-05-04T20:44:06 Queuing host in future (in 3s), its the 2 address
> on the same name: udp 127.0.0.1:52534 (localhost) tid: 00000002
> 2017-05-04T20:44:06 writing packet: udp ::1:52534 (localhost) tid:
> 00000001
> 2017-05-04T20:44:06 reading packet: udp ::1:52534 (localhost) tid:
> 00000001
> 2017-05-04T20:44:06 host completed: udp ::1:52534 (localhost) tid:
> 00000001
> 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0 hosts 1
> packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814 tid: 00000002
> 2017-05-04T20:44:06 tkt: extract key 17/763641F3
> 2017-05-04T20:44:06 set-error: -1765328353: Decrypt integrity check
> failed for checksum type hmac-sha1-96-aes128, key type
> aes128-cts-hmac-sha1-96
> 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
> 2017-05-04T20:44:06 krb5_get_credentials_with_flags: TEST.COM wc:
> 0.050317
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> for krb5_ccache_conf_data/realm-config@X-CACHECONF: in cache
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
> for
> krb5_ccache_conf_data/time-offset/test-service\134/localhost\134@TEST.
> COM@X-CACHECONF: in cache
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 Setting up PFS for auth context
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> des-cbc-md5-deprecated not supported
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> des-cbc-md4-deprecated not supported
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
> des-cbc-crc-deprecated not supported First kerberos.authGSSClientStep
> successful
>
> Thanks
> Jiajia
>
> -----Original Message-----
> From: Zheng, Kai [mailto:kai.zheng@intel.com]
> Sent: Wednesday, May 3, 2017 7:29 PM
> To: kerby@directory.apache.org
> Subject: RE: MIT Kerberos compatibility
>
> Hi Marc,
>
> In case you're not aware of this, please check out the latest fix made by Jiajia. We thought your case may be different, but would be good to have a check before we can repeat/fix your case. Thanks.
> https://issues.apache.org/jira/browse/DIRKRB-625
>
> Regards,
> Kai
>
> -----Original Message-----
> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> Sent: Sunday, April 30, 2017 7:45 PM
> To: kerby@directory.apache.org
> Subject: Re: MIT Kerberos compatibility
>
> Hi Kai,
>
> The terminal output below is for the latest MIT Kerberos 1.15.1 (locally built on Ubuntu Xenial). Before that, I also tested with the default Xenial MIT Kerberos packages (1.13.2), with the same result. I did not try earlier MIT Kerberos versions.
>
> Marc
>
> Op 29-04-17 om 21:42 schreef Marc de Lignie:
>> Hi Kai,
>>
>> Thanks for the response. I prepared a minimal config that reproduces
>> my problem.
>>
>> You can fetch the branch/commit from:
>> https://github.com/vtslab/directory-kerby/commits/MitIssue
>>
>> This is relative to RC2, but I also tried this on trunk for my actual
>> project.
>>
>> This config produces the debug and error messages below.
>>
>> 1. For the terminal with the bash + python script $ klist Ticket
>> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> Default principal: drankye@TEST.COM
>>
>> Valid starting Expires Service principal
>> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/TEST.COM@TEST.COM
>> renew until 29-04-17 21:07:39
>>
>> $ .
>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb
>> / server/MitIssueTest.sh [15538] 1493491231.917606: Retrieving
>> drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0,
>> enctype 0) with result:
>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>> [15538]
>> 1493491231.917827: Retrieving drankye@TEST.COM from
>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>> kerberos.authGSSClientInit successful [15538] 1493491231.918185:
>> Getting credentials drankye@TEST.COM -> test-service/localhost@ using
>> ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
>> test-service/localhost@ from
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>> -1765328243/Matching credential not found (filename:
>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
>> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
>> test-service/localhost@TEST.COM with result: -1765328243/Matching
>> credential not found (filename:
>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
>> [15538] 1493491231.918229: Server has referral realm; starting with
>> test-service/localhost@TEST.COM [15538] 1493491231.918278: Retrieving
>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM from
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>> 0/Success
>> [15538] 1493491231.918281: Starting with TGT for client realm:
>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
>> 1493491231.918301: Requesting tickets for
>> test-service/localhost@TEST.COM, referrals on [15538]
>> 1493491231.918326: Generated subkey for TGS request:
>> aes128-cts/FA30
>> [15538] 1493491231.918359: etypes requested in TGS request:
>> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1,
>> rc4-hmac, camellia128-cts, camellia256-cts [15538] 1493491231.918484:
>> Encoding request body and padata into FAST request [15538]
>> 1493491231.918541: Sending request (836 bytes) to TEST.COM [15538]
>> 1493491231.918597: Resolving hostname localhost [15538]
>> 1493491231.918703: Initiating TCP connection to stream
>> 127.0.0.1:44292
>> [15538] 1493491231.918777: Sending TCP request to stream
>> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error receiving from
>> stream
>> 127.0.0.1:44292: 104/Connection reset by peer [15538]
>> 1493491231.922812: Terminating TCP connection to stream
>> 127.0.0.1:44292
>> [15538] 1493491231.922858: Sending initial UDP request to dgram
>> 127.0.0.1:44292
>> ('First kerberos.authGSSClientStep not successful',
>> GSSError(('Unspecified GSS failure. Minor code may provide more
>> information', 851968), ("Cannot contact any KDC for realm
>> 'TEST.COM'",
>> -1765328228)))
>>
>> 2. For the terminal that runs mvn clean test -Dtest=MitIssueTest
>> Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
>> 2017-04-29 21:07:39,182 DEBUG [main] backend.AbstractIdentityBackend:
>> initialize called
>> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity called, principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity failed, principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>> addIdentity successful, principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity called, principalName = kadmin/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity failed, principalName = kadmin/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,213 DEBUG [main] backend.AbstractIdentityBackend:
>> addIdentity successful, principalName = kadmin/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,216 DEBUG [main] backend.AbstractIdentityBackend:
>> start called
>> 2017-04-29 21:07:39,232 DEBUG [main] backend.AbstractIdentityBackend:
>> addIdentity successful, principalName =
>> test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,425 DEBUG [main] backend.AbstractIdentityBackend:
>> addIdentity successful, principalName = drankye@TEST.COM
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1] request.KdcRequest:
>> Client entry is empty.
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> drankye@TEST.COM
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = drankye@TEST.COM
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>> disconnecting abnormally java.io.EOFException
>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
>> at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>> at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>> at java.lang.Thread.run(Thread.java:748)
>> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase: Storing
>> the tgt to the credential cache file.
>> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity called, principalName = test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity successful, principalName =
>> test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1] request.KdcRequest:
>> Client entry is empty.
>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1] request.KdcRequest:
>> The preauth data is empty.
>> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1] server.KdcHandler:
>> KRB error occurred while processing request:Additional
>> pre-authentication required
>> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>> disconnecting abnormally java.io.EOFException
>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
>> at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>> at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>> at java.lang.Thread.run(Thread.java:748)
>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1] request.KdcRequest:
>> Client entry is empty.
>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>> disconnecting abnormally java.io.EOFException
>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
>> at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>> at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>> at java.lang.Thread.run(Thread.java:748)
>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful,
>> principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1] request.KdcRequest:
>> Found fast padata and start to process it.
>> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
>> impl.DefaultKdcHandler: Error occured while processing request:
>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
>> at
>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast(KdcRequest.java:208)
>> at
>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.process(KdcRequest.java:168)
>> at
>> org.apache.kerby.kerberos.kerb.server.KdcHandler.handleMessage(KdcHandler.java:115)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.handleMessage(DefaultKdcHandler.java:67)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:52)
>> at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>> at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>> at java.lang.Thread.run(Thread.java:748)
>> Caused by: java.io.IOException: Unexpected item context [0]
>> [tag=0xA0, off=0, len=3+207], expecting 0x30
>> at
>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(Asn1Encodeable.java:210)
>> at
>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(Asn1Encodeable.java:197)
>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
>> ... 9 more
>> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>> disconnecting abnormally
>> java.net.SocketException: Socket closed
>> at java.net.SocketInputStream.socketRead0(Native Method)
>> at java.net.SocketInputStream.socketRead(SocketInputStream.java:116)
>> at java.net.SocketInputStream.read(SocketInputStream.java:171)
>> at java.net.SocketInputStream.read(SocketInputStream.java:141)
>> at java.net.SocketInputStream.read(SocketInputStream.java:224)
>> at java.io.DataInputStream.readInt(DataInputStream.java:387)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
>> at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>> at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>> at java.lang.Thread.run(Thread.java:748)
>>
>> In a FreeIPA environment these python lines "just" work.
>>
>> Any suggestions are welcome!
>>
>> Marc
>>
>>
> --
> Marc de Lignie
>
--
Marc de Lignie
Re: MIT Kerberos compatibility
Posted by Marc de Lignie <m....@xs4all.nl>.
Hi Chris, Jiajia, Kai,
Thanks for your additional suggestions. In the mean time I can confirm
my test working on a Centos 6.x system, see logs below, that is with Mit
Kerberos installed and the MitIssueTest.
So, there must be something strange on my Ubuntu Xenial + Mate system
(maybe something silly as host resolution); that is for me to find out.
At least I can compare a failing system with a working system now.
Cheers, Marc
$ python
kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/server/MitIssueTest.py
[26558] 1494229795.344270: Retrieving drankye@TEST.COM ->
krb5_ccache_conf_data/proxy_impersonator@X-CACHECONF: from
FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
-1765328243/Matching credential not found
[26558] 1494229795.344941: Retrieving drankye@TEST.COM ->
krb5_ccache_conf_data/proxy_impersonator@X-CACHECONF: from
FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
-1765328243/Matching credential not found
[26558] 1494229795.345472: Retrieving drankye@TEST.COM ->
krb5_ccache_conf_data/proxy_impersonator@X-CACHECONF: from
FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
-1765328243/Matching credential not found
[26558] 1494229795.346300: Retrieving drankye@TEST.COM ->
krb5_ccache_conf_data/proxy_impersonator@X-CACHECONF: from
FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
-1765328243/Matching credential not found
[26558] 1494229795.346911: Retrieving drankye@TEST.COM ->
krb5_ccache_conf_data/proxy_impersonator@X-CACHECONF: from
FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
-1765328243/Matching credential not found
[26558] 1494229795.347490: Retrieving drankye@TEST.COM ->
krb5_ccache_conf_data/proxy_impersonator@X-CACHECONF: from
FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
-1765328243/Matching credential not found
[26558] 1494229795.348050: Retrieving drankye@TEST.COM ->
krb5_ccache_conf_data/proxy_impersonator@X-CACHECONF: from
FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
-1765328243/Matching credential not found
[26558] 1494229795.348559: Retrieving drankye@TEST.COM ->
krb5_ccache_conf_data/proxy_impersonator@X-CACHECONF: from
FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
-1765328243/Matching credential not found
kerberos.authGSSClientInit successful
[26558] 1494229795.350166: Getting credentials drankye@TEST.COM ->
test-service/localhost@ using ccache
FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
[26558] 1494229795.350278: Retrieving drankye@TEST.COM ->
test-service/localhost@ from
FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
-1765328243/Matching credential not found
[26558] 1494229795.350332: Retrying drankye@TEST.COM ->
test-service/localhost@TEST.COM with result: -1765328243/Matching
credential not found
[26558] 1494229795.350349: Server has referral realm; starting with
test-service/localhost@TEST.COM
[26558] 1494229795.350402: Retrieving drankye@TEST.COM ->
krbtgt/TEST.COM@TEST.COM from
FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result: 0/Success
[26558] 1494229795.350416: Found cached TGT for service realm:
drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM
[26558] 1494229795.350431: Requesting tickets for
test-service/localhost@TEST.COM, referrals on
[26558] 1494229795.350519: Generated subkey for TGS request:
aes128-cts/F635
[26558] 1494229795.350541: etypes requested in TGS request: aes256-cts,
aes128-cts, des3-cbc-sha1, rc4-hmac
[26558] 1494229795.350919: Sending request (599 bytes) to TEST.COM
[26558] 1494229795.352645: Resolving hostname localhost
[26558] 1494229795.352836: Initiating TCP connection to stream ::1:43227
[26558] 1494229795.353888: Terminating TCP connection to stream ::1:43227
[26558] 1494229795.353935: Initiating TCP connection to stream
127.0.0.1:43227
[26558] 1494229795.356311: Sending TCP request to stream 127.0.0.1:43227
[26558] 1494229795.416195: Received answer from stream 127.0.0.1:43227
[26558] 1494229795.730533: Response was not from master KDC
[26558] 1494229795.730754: TGS reply didn't decode with subkey; trying
session key (
[26558] 1494229795.730858: TGS reply is for drankye@TEST.COM ->
test-service/localhost@TEST.COM with session key aes128-cts/B24D
[26558] 1494229795.730910: TGS request result: 0/Success
[26558] 1494229795.730919: Received creds for desired service
test-service/localhost@TEST.COM
[26558] 1494229795.730935: Removing drankye@TEST.COM ->
test-service/localhost@ from
FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
[26558] 1494229795.730947: Storing drankye@TEST.COM ->
test-service/localhost@ in
FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
[26558] 1494229795.731216: Also storing drankye@TEST.COM ->
test-service/localhost@TEST.COM based on ticket
[26558] 1494229795.731231: Removing drankye@TEST.COM ->
test-service/localhost@TEST.COM from
FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
[26558] 1494229795.731541: Creating authenticator for drankye@TEST.COM
-> test-service/localhost@, seqnum 682578751, subkey aes128-cts/6920,
session key aes128-cts/B24D
[26558] 1494229795.731564: Negotiating for enctypes in authenticator:
aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac
First kerberos.authGSSClientStep successful
$ klist
Ticket cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
Default principal: drankye@TEST.COM
Valid starting Expires Service principal
05/08/17 09:33:27 05/09/17 09:33:27 krbtgt/TEST.COM@TEST.COM
renew until 05/09/17 09:33:27
05/08/17 09:49:55 05/09/17 09:33:27 test-service/localhost@
renew until 05/09/17 09:33:27
05/08/17 09:49:55 05/09/17 09:33:27 test-service/localhost@TEST.COM
renew until 05/09/17 09:33:27
Op 07-05-17 om 16:12 schreef Marc de Lignie:
> Hi Jiajia and Kai,
>
> Puzzled by the fact that the Mit Kerberos over python service ticket
> request works on Jiajia's system but not on mine. I attempted to
> request the service ticket with Mit Kerberos's kinit tool and .... it
> worked.
>
> This means that my issue probably lies in the kerberos python wrapper
> around the Mit Kerberos shared libs (or in the way how I use it). I
> tried both with the Debian python-kerberos package,
> https://pypi.python.org/pypi/kerberos and with
> https://pypi.python.org/pypi/pykerberos/1.1.14, neither of which got
> the ticket. This still makes me curious where Mac-OS gets its python
> kerberos package from :-)
>
> Here, the kinit shell commands to reproduce my test.
>
> cd $PROJECTROOT
> WORKDIR=kerby-kerb/kerb-kdc-test/target/tmp
> export KRB5_CONFIG=$WORKDIR/krb5.conf
> export KRB5CCNAME=$WORKDIR/test-tkt.cc
> export KRB5_TRACE=/dev/stdout
>
> $ kinit -S test-service/localhost
> [3141] 1494161999.566468: Getting initial credentials for
> drankye@TEST.COM
> [3141] 1494161999.566835: Setting initial creds service to
> test-service/localhost
> [3141] 1494161999.566952: Sending request (168 bytes) to TEST.COM
> [3141] 1494161999.566997: Resolving hostname localhost
> [3141] 1494161999.567467: Sending initial UDP request to dgram
> 127.0.0.1:45527
> [3141] 1494161999.573494: Received answer (555 bytes) from dgram
> 127.0.0.1:45527
> [3141] 1494161999.576791: Response was not from master KDC
> [3141] 1494161999.576822: Salt derived from principal: TEST.COMdrankye
> [3141] 1494161999.576824: Getting AS key, salt "TEST.COMdrankye",
> params ""
> Password for drankye@TEST.COM:
> [3141] 1494162015.450071: AS key obtained from gak_fct: aes128-cts/0548
> [3141] 1494162015.450101: Decrypted AS reply; session key is:
> aes128-cts/4EFE
> [3141] 1494162015.450103: FAST negotiation: unavailable
> [3141] 1494162015.450112: Initializing
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with default
> princ drankye@TEST.COM
> [3141] 1494162015.450305: Storing drankye@TEST.COM ->
> test-service/localhost@TEST.COM in
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>
> $ klist
> Ticket cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> Default principal: drankye@TEST.COM
>
> Valid starting Expires Service principal
> 07-05-17 14:59:59 08-05-17 14:59:59 test-service/localhost@TEST.COM
> renew until 08-05-17 14:59:59
>
> What is also notable here is that the TestKdc only produces one log
> message:
>
> [nioEventLoopGroup-5-1] INFO
> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ
> ISSUE: authtime 1494164956766,drankye@TEST.COM for
> test-service/localhost@TEST.COM
>
> while in the error situation from python it produces (and not the
> AS_REQ line):
>
> [nioEventLoopGroup-5-1] INFO
> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found fast
> padata and starting to process it.
> [nioEventLoopGroup-5-1] INFO
> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found fast
> padata and starting to process it.
>
> Note also that kinit requires to give the password while in the python
> testcase it is attempted to use the tgt from the credential cache.
>
> Maybe it also useful to restate my target: I want to authenticate a
> python client towards a service using GSSAPI with SASL (the service
> being gremlin-server from the Apache Tinkerpop project). So I want to
> get the service ticket using GSSAPI and an existing tgt from the
> credential cache.
>
> Any additional hints are welcome, good luck with the Kerby GA release.
>
> Marc
>
> Op 05-05-17 om 22:12 schreef Marc de Lignie:
>> Hi Jiajia,
>>
>> Thanks for the netty config option. This indeed helped to get rid of
>> the udp errors, but did not help in getting the service ticket (final
>> error message remains the same).
>>
>> I also noticed that I get the same error from the python console
>> whether I specify the right service name or some service name for
>> which no service principal exists in the TestKdc.
>>
>> I did not succeed in getting mvn tst to print the debug logging of
>> the various kdc classes involved.
>>
>> Did you check with klist whether drankye's credential cache contains
>> the service ticket for test-service?
>>
>> Cheers, Marc
>>
>>
>> Op 04-05-17 om 14:55 schreef Li, Jiajia:
>>> Hi Marc,
>>> I try to run your test(through applying your patch in the trunk) , I
>>> think it's success now. Could you take some time to check about it?
>>> Here is the log:
>>>
>>> directory-kerby git:(trunk) ✗ .
>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/server/MitIssueTest.sh
>>> kerberos.authGSSClientInit successful
>>> 2017-05-04T20:44:06 set-error: -1765328234: entypes not supported
>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>>> for krb5_ccache_conf_data/realm-config@X-CACHECONF: in cache
>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>>> for test-service/localhost@TEST.COM in cache
>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>>> for
>>> krb5_ccache_conf_data/negative-cache/test-service\134/localhost\134@TEST.COM@X-CACHECONF:
>>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>>> for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF: in cache
>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>>> for krb5_ccache_conf_data/sitename@X-CACHECONF: in cache
>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>>> for test-service/localhost@TEST.COM in cache
>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>> des-cbc-md5-deprecated not supported
>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>> des-cbc-md4-deprecated not supported
>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>> des-cbc-crc-deprecated not supported
>>> 2017-05-04T20:44:06 Trying to find service kdc for realm TEST.COM
>>> flags 0
>>> 2017-05-04T20:44:06 configuration file for realm TEST.COM found
>>> 2017-05-04T20:44:06 submissing new requests to new host
>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
>>> 2017-05-04T20:44:06 connecting to host: udp ::1:52534 (localhost)
>>> tid: 00000001
>>> 2017-05-04T20:44:06 host_create: setting hostname localhost
>>> 2017-05-04T20:44:06 Queuing host in future (in 3s), its the 2
>>> address on the same name: udp 127.0.0.1:52534 (localhost) tid: 00000002
>>> 2017-05-04T20:44:06 writing packet: udp ::1:52534 (localhost) tid:
>>> 00000001
>>> 2017-05-04T20:44:06 reading packet: udp ::1:52534 (localhost) tid:
>>> 00000001
>>> 2017-05-04T20:44:06 host completed: udp ::1:52534 (localhost) tid:
>>> 00000001
>>> 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0 hosts 1
>>> packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814 tid: 00000002
>>> 2017-05-04T20:44:06 tkt: extract key 17/763641F3
>>> 2017-05-04T20:44:06 set-error: -1765328353: Decrypt integrity check
>>> failed for checksum type hmac-sha1-96-aes128, key type
>>> aes128-cts-hmac-sha1-96
>>> 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
>>> 2017-05-04T20:44:06 krb5_get_credentials_with_flags: TEST.COM wc:
>>> 0.050317
>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>>> for krb5_ccache_conf_data/realm-config@X-CACHECONF: in cache
>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>>> for
>>> krb5_ccache_conf_data/time-offset/test-service\134/localhost\134@TEST.COM@X-CACHECONF:
>>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>> 2017-05-04T20:44:06 Setting up PFS for auth context
>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>> des-cbc-md5-deprecated not supported
>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>> des-cbc-md4-deprecated not supported
>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>>> des-cbc-crc-deprecated not supported
>>> First kerberos.authGSSClientStep successful
>>>
>>> Thanks
>>> Jiajia
>>>
>>> -----Original Message-----
>>> From: Zheng, Kai [mailto:kai.zheng@intel.com]
>>> Sent: Wednesday, May 3, 2017 7:29 PM
>>> To: kerby@directory.apache.org
>>> Subject: RE: MIT Kerberos compatibility
>>>
>>> Hi Marc,
>>>
>>> In case you're not aware of this, please check out the latest fix
>>> made by Jiajia. We thought your case may be different, but would be
>>> good to have a check before we can repeat/fix your case. Thanks.
>>> https://issues.apache.org/jira/browse/DIRKRB-625
>>>
>>> Regards,
>>> Kai
>>>
>>> -----Original Message-----
>>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
>>> Sent: Sunday, April 30, 2017 7:45 PM
>>> To: kerby@directory.apache.org
>>> Subject: Re: MIT Kerberos compatibility
>>>
>>> Hi Kai,
>>>
>>> The terminal output below is for the latest MIT Kerberos 1.15.1
>>> (locally built on Ubuntu Xenial). Before that, I also tested with
>>> the default Xenial MIT Kerberos packages (1.13.2), with the same
>>> result. I did not try earlier MIT Kerberos versions.
>>>
>>> Marc
>>>
>>> Op 29-04-17 om 21:42 schreef Marc de Lignie:
>>>> Hi Kai,
>>>>
>>>> Thanks for the response. I prepared a minimal config that reproduces
>>>> my problem.
>>>>
>>>> You can fetch the branch/commit from:
>>>> https://github.com/vtslab/directory-kerby/commits/MitIssue
>>>>
>>>> This is relative to RC2, but I also tried this on trunk for my actual
>>>> project.
>>>>
>>>> This config produces the debug and error messages below.
>>>>
>>>> 1. For the terminal with the bash + python script $ klist Ticket
>>>> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>> Default principal: drankye@TEST.COM
>>>>
>>>> Valid starting Expires Service principal
>>>> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/TEST.COM@TEST.COM
>>>> renew until 29-04-17 21:07:39
>>>>
>>>> $ .
>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/
>>>> server/MitIssueTest.sh [15538] 1493491231.917606: Retrieving
>>>> drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0,
>>>> enctype 0) with result:
>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [15538]
>>>> 1493491231.917827: Retrieving drankye@TEST.COM from
>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>>> kerberos.authGSSClientInit successful [15538] 1493491231.918185:
>>>> Getting credentials drankye@TEST.COM -> test-service/localhost@ using
>>>> ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>>> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
>>>> test-service/localhost@ from
>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>>>> -1765328243/Matching credential not found (filename:
>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
>>>> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
>>>> test-service/localhost@TEST.COM with result: -1765328243/Matching
>>>> credential not found (filename:
>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
>>>> [15538] 1493491231.918229: Server has referral realm; starting with
>>>> test-service/localhost@TEST.COM [15538] 1493491231.918278: Retrieving
>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM from
>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>>>> 0/Success
>>>> [15538] 1493491231.918281: Starting with TGT for client realm:
>>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
>>>> 1493491231.918301: Requesting tickets for
>>>> test-service/localhost@TEST.COM, referrals on [15538]
>>>> 1493491231.918326: Generated subkey for TGS request:
>>>> aes128-cts/FA30
>>>> [15538] 1493491231.918359: etypes requested in TGS request:
>>>> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1,
>>>> rc4-hmac, camellia128-cts, camellia256-cts [15538] 1493491231.918484:
>>>> Encoding request body and padata into FAST request [15538]
>>>> 1493491231.918541: Sending request (836 bytes) to TEST.COM [15538]
>>>> 1493491231.918597: Resolving hostname localhost [15538]
>>>> 1493491231.918703: Initiating TCP connection to stream
>>>> 127.0.0.1:44292
>>>> [15538] 1493491231.918777: Sending TCP request to stream
>>>> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error receiving from
>>>> stream
>>>> 127.0.0.1:44292: 104/Connection reset by peer [15538]
>>>> 1493491231.922812: Terminating TCP connection to stream
>>>> 127.0.0.1:44292
>>>> [15538] 1493491231.922858: Sending initial UDP request to dgram
>>>> 127.0.0.1:44292
>>>> ('First kerberos.authGSSClientStep not successful',
>>>> GSSError(('Unspecified GSS failure. Minor code may provide more
>>>> information', 851968), ("Cannot contact any KDC for realm 'TEST.COM'",
>>>> -1765328228)))
>>>>
>>>> 2. For the terminal that runs mvn clean test -Dtest=MitIssueTest
>>>> Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
>>>> 2017-04-29 21:07:39,182 DEBUG [main] backend.AbstractIdentityBackend:
>>>> initialize called
>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
>>>> getIdentity called, principalName = krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
>>>> getIdentity failed, principalName = krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>>>> addIdentity successful, principalName = krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>>>> getIdentity called, principalName = kadmin/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>>>> getIdentity failed, principalName = kadmin/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,213 DEBUG [main] backend.AbstractIdentityBackend:
>>>> addIdentity successful, principalName = kadmin/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,216 DEBUG [main] backend.AbstractIdentityBackend:
>>>> start called
>>>> 2017-04-29 21:07:39,232 DEBUG [main] backend.AbstractIdentityBackend:
>>>> addIdentity successful, principalName =
>>>> test-service/localhost@TEST.COM
>>>> 2017-04-29 21:07:39,425 DEBUG [main] backend.AbstractIdentityBackend:
>>>> addIdentity successful, principalName = drankye@TEST.COM
>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>>> krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>>>> = krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1] request.KdcRequest:
>>>> Client entry is empty.
>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>>> drankye@TEST.COM
>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>>>> = drankye@TEST.COM
>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>>> krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>>>> = krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>>> disconnecting abnormally java.io.EOFException
>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>>>> at
>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
>>>>
>>>> at
>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
>>>>
>>>> at
>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>>>>
>>>> at
>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>>>>
>>>> at java.lang.Thread.run(Thread.java:748)
>>>> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase: Storing the
>>>> tgt to the credential cache file.
>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
>>>> getIdentity called, principalName = test-service/localhost@TEST.COM
>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
>>>> getIdentity successful, principalName =
>>>> test-service/localhost@TEST.COM
>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>>> krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>>>> = krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1] request.KdcRequest:
>>>> Client entry is empty.
>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>>> test-service/localhost@TEST.COM
>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>>>> = test-service/localhost@TEST.COM
>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>>> krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>>>> = krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1] request.KdcRequest:
>>>> The preauth data is empty.
>>>> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1] server.KdcHandler: KRB
>>>> error occurred while processing request:Additional pre-authentication
>>>> required
>>>> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>>> disconnecting abnormally java.io.EOFException
>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>>>> at
>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
>>>>
>>>> at
>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
>>>>
>>>> at
>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>>>>
>>>> at
>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>>>>
>>>> at java.lang.Thread.run(Thread.java:748)
>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>>> krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>>>> = krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1] request.KdcRequest:
>>>> Client entry is empty.
>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>>> test-service/localhost@TEST.COM
>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>>>> = test-service/localhost@TEST.COM
>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>>> krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>>>> = krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>>> disconnecting abnormally java.io.EOFException
>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>>>> at
>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
>>>>
>>>> at
>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
>>>>
>>>> at
>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>>>>
>>>> at
>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>>>>
>>>> at java.lang.Thread.run(Thread.java:748)
>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>>> krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
>>>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>>>> = krbtgt/TEST.COM@TEST.COM
>>>> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1] request.KdcRequest:
>>>> Found fast padata and start to process it.
>>>> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
>>>> impl.DefaultKdcHandler: Error occured while processing request:
>>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
>>>> at
>>>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
>>>> at
>>>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
>>>> at
>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast(KdcRequest.java:208)
>>>>
>>>> at
>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.process(KdcRequest.java:168)
>>>>
>>>> at
>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler.handleMessage(KdcHandler.java:115)
>>>>
>>>> at
>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.handleMessage(DefaultKdcHandler.java:67)
>>>>
>>>> at
>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:52)
>>>>
>>>> at
>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>>>>
>>>> at
>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>>>>
>>>> at java.lang.Thread.run(Thread.java:748)
>>>> Caused by: java.io.IOException: Unexpected item context [0] [tag=0xA0,
>>>> off=0, len=3+207], expecting 0x30
>>>> at
>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(Asn1Encodeable.java:210)
>>>>
>>>> at
>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(Asn1Encodeable.java:197)
>>>>
>>>> at
>>>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
>>>> ... 9 more
>>>> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
>>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>>> disconnecting abnormally
>>>> java.net.SocketException: Socket closed
>>>> at java.net.SocketInputStream.socketRead0(Native Method)
>>>> at
>>>> java.net.SocketInputStream.socketRead(SocketInputStream.java:116)
>>>> at java.net.SocketInputStream.read(SocketInputStream.java:171)
>>>> at java.net.SocketInputStream.read(SocketInputStream.java:141)
>>>> at java.net.SocketInputStream.read(SocketInputStream.java:224)
>>>> at java.io.DataInputStream.readInt(DataInputStream.java:387)
>>>> at
>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
>>>>
>>>> at
>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
>>>>
>>>> at
>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>>>>
>>>> at
>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>>>>
>>>> at java.lang.Thread.run(Thread.java:748)
>>>>
>>>> In a FreeIPA environment these python lines "just" work.
>>>>
>>>> Any suggestions are welcome!
>>>>
>>>> Marc
>>>>
>>>>
>>> --
>>> Marc de Lignie
>>>
>>
>
--
Marc de Lignie
RE: MIT Kerberos compatibility
Posted by Christopher Lamb <ch...@ch.ibm.com>.
Hi Marc
On the topic of python and kerberos, have you tried python gssapi?
The code snippet below works for me against a FreeIPA client, KDC and
Service Principal, whereas the equivalent Java GSS-API does not (yet),
which made me look at kerb-client....
#!/usr/bin/python3.5
import gssapi
from io import BytesIO
server_name = 'HTTP/app-srv.acme.com@ACME.COM'
service_name = gssapi.Name(server_name)
client_ctx = gssapi.SecurityContext(name=service_name, usage='initiate')
initial_client_token = client_ctx.step()
Cheers
Chris
From: "Zheng, Kai" <ka...@intel.com>
To: "kerby@directory.apache.org" <ke...@directory.apache.org>
Date: 08/05/2017 12:58
Subject: RE: MIT Kerberos compatibility
Hi Marc,
Thanks for your patience. It looks to me there is some issue in Kerby with
Heimdal compatibility. Note we haven't supported Heimdal yet. So far, Kerby
is tested and can support these clients:
1. Oracle Java;
2. Kerby client;
3. MIT client.
Both compatibility tests with MS AD and Heimdal haven't been done yet. For
Heimdal, I thought we can get back to this later (hope soon, a week later).
We're pretty busy with urgent things, sorry.
Regards,
Kai
-----Original Message-----
From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
Sent: Sunday, May 07, 2017 10:13 PM
To: kerby@directory.apache.org
Subject: Re: MIT Kerberos compatibility
Hi Jiajia and Kai,
Puzzled by the fact that the Mit Kerberos over python service ticket
request works on Jiajia's system but not on mine. I attempted to request
the service ticket with Mit Kerberos's kinit tool and .... it worked.
This means that my issue probably lies in the kerberos python wrapper
around the Mit Kerberos shared libs (or in the way how I use it). I tried
both with the Debian python-kerberos package,
https://pypi.python.org/pypi/kerberos and with
https://pypi.python.org/pypi/pykerberos/1.1.14, neither of which got the
ticket. This still makes me curious where Mac-OS gets its python kerberos
package from :-)
Here, the kinit shell commands to reproduce my test.
cd $PROJECTROOT
WORKDIR=kerby-kerb/kerb-kdc-test/target/tmp
export KRB5_CONFIG=$WORKDIR/krb5.conf
export KRB5CCNAME=$WORKDIR/test-tkt.cc
export KRB5_TRACE=/dev/stdout
$ kinit -S test-service/localhost
[3141] 1494161999.566468: Getting initial credentials for drankye@TEST.COM
[3141] 1494161999.566835: Setting initial creds service to
test-service/localhost [3141] 1494161999.566952: Sending request (168
bytes) to TEST.COM [3141] 1494161999.566997: Resolving hostname localhost
[3141] 1494161999.567467: Sending initial UDP request to dgram
127.0.0.1:45527
[3141] 1494161999.573494: Received answer (555 bytes) from dgram
127.0.0.1:45527
[3141] 1494161999.576791: Response was not from master KDC [3141]
1494161999.576822: Salt derived from principal: TEST.COMdrankye [3141]
1494161999.576824: Getting AS key, salt "TEST.COMdrankye", params ""
Password for drankye@TEST.COM:
[3141] 1494162015.450071: AS key obtained from gak_fct: aes128-cts/0548
[3141] 1494162015.450101: Decrypted AS reply; session key is:
aes128-cts/4EFE
[3141] 1494162015.450103: FAST negotiation: unavailable [3141]
1494162015.450112: Initializing
FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with default princ
drankye@TEST.COM [3141] 1494162015.450305: Storing drankye@TEST.COM ->
test-service/localhost@TEST.COM in
FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
$ klist
Ticket cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
Default principal: drankye@TEST.COM
Valid starting Expires Service principal
07-05-17 14:59:59 08-05-17 14:59:59 test-service/localhost@TEST.COM
renew until 08-05-17 14:59:59
What is also notable here is that the TestKdc only produces one log
message:
[nioEventLoopGroup-5-1] INFO
org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
authtime 1494164956766,drankye@TEST.COM for test-service/localhost@TEST.COM
while in the error situation from python it produces (and not the AS_REQ
line):
[nioEventLoopGroup-5-1] INFO
org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found fast
padata and starting to process it.
[nioEventLoopGroup-5-1] INFO
org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found fast
padata and starting to process it.
Note also that kinit requires to give the password while in the python
testcase it is attempted to use the tgt from the credential cache.
Maybe it also useful to restate my target: I want to authenticate a python
client towards a service using GSSAPI with SASL (the service being
gremlin-server from the Apache Tinkerpop project). So I want to get the
service ticket using GSSAPI and an existing tgt from the credential cache.
Any additional hints are welcome, good luck with the Kerby GA release.
Marc
Op 05-05-17 om 22:12 schreef Marc de Lignie:
> Hi Jiajia,
>
> Thanks for the netty config option. This indeed helped to get rid of
> the udp errors, but did not help in getting the service ticket (final
> error message remains the same).
>
> I also noticed that I get the same error from the python console
> whether I specify the right service name or some service name for
> which no service principal exists in the TestKdc.
>
> I did not succeed in getting mvn tst to print the debug logging of the
> various kdc classes involved.
>
> Did you check with klist whether drankye's credential cache contains
> the service ticket for test-service?
>
> Cheers, Marc
>
>
> Op 04-05-17 om 14:55 schreef Li, Jiajia:
>> Hi Marc,
>> I try to run your test(through applying your patch in the trunk) , I
>> think it's success now. Could you take some time to check about it?
>> Here is the log:
>>
>> directory-kerby git:(trunk) ✗ .
>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb
>> /server/MitIssueTest.sh kerberos.authGSSClientInit successful
>> 2017-05-04T20:44:06 set-error: -1765328234: entypes not supported
>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>> for krb5_ccache_conf_data/realm-config@X-CACHECONF: in cache
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>> for test-service/localhost@TEST.COM in cache
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>> for
>> krb5_ccache_conf_data/negative-cache/test-service\134/localhost
\134@TEST.COM@X-CACHECONF:
>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>> for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF: in cache
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>> for krb5_ccache_conf_data/sitename@X-CACHECONF: in cache
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>> for test-service/localhost@TEST.COM in cache
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>> des-cbc-md5-deprecated not supported
>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>> des-cbc-md4-deprecated not supported
>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>> des-cbc-crc-deprecated not supported
>> 2017-05-04T20:44:06 Trying to find service kdc for realm TEST.COM
>> flags 0
>> 2017-05-04T20:44:06 configuration file for realm TEST.COM found
>> 2017-05-04T20:44:06 submissing new requests to new host
>> 2017-05-04T20:44:06 host_create: setting hostname localhost
>> 2017-05-04T20:44:06 connecting to host: udp ::1:52534 (localhost)
>> tid: 00000001
>> 2017-05-04T20:44:06 host_create: setting hostname localhost
>> 2017-05-04T20:44:06 Queuing host in future (in 3s), its the 2 address
>> on the same name: udp 127.0.0.1:52534 (localhost) tid: 00000002
>> 2017-05-04T20:44:06 writing packet: udp ::1:52534 (localhost) tid:
>> 00000001
>> 2017-05-04T20:44:06 reading packet: udp ::1:52534 (localhost) tid:
>> 00000001
>> 2017-05-04T20:44:06 host completed: udp ::1:52534 (localhost) tid:
>> 00000001
>> 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0 hosts 1
>> packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814 tid: 00000002
>> 2017-05-04T20:44:06 tkt: extract key 17/763641F3
>> 2017-05-04T20:44:06 set-error: -1765328353: Decrypt integrity check
>> failed for checksum type hmac-sha1-96-aes128, key type
>> aes128-cts-hmac-sha1-96
>> 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
>> 2017-05-04T20:44:06 krb5_get_credentials_with_flags: TEST.COM wc:
>> 0.050317
>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>> for krb5_ccache_conf_data/realm-config@X-CACHECONF: in cache
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>> for
>> krb5_ccache_conf_data/time-offset/test-service\134/localhost
\134@TEST.COM@X-CACHECONF:
>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> 2017-05-04T20:44:06 Setting up PFS for auth context
>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>> des-cbc-md5-deprecated not supported
>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>> des-cbc-md4-deprecated not supported
>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>> des-cbc-crc-deprecated not supported First kerberos.authGSSClientStep
>> successful
>>
>> Thanks
>> Jiajia
>>
>> -----Original Message-----
>> From: Zheng, Kai [mailto:kai.zheng@intel.com]
>> Sent: Wednesday, May 3, 2017 7:29 PM
>> To: kerby@directory.apache.org
>> Subject: RE: MIT Kerberos compatibility
>>
>> Hi Marc,
>>
>> In case you're not aware of this, please check out the latest fix
>> made by Jiajia. We thought your case may be different, but would be
>> good to have a check before we can repeat/fix your case. Thanks.
>> https://issues.apache.org/jira/browse/DIRKRB-625
>>
>> Regards,
>> Kai
>>
>> -----Original Message-----
>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
>> Sent: Sunday, April 30, 2017 7:45 PM
>> To: kerby@directory.apache.org
>> Subject: Re: MIT Kerberos compatibility
>>
>> Hi Kai,
>>
>> The terminal output below is for the latest MIT Kerberos 1.15.1
>> (locally built on Ubuntu Xenial). Before that, I also tested with the
>> default Xenial MIT Kerberos packages (1.13.2), with the same result.
>> I did not try earlier MIT Kerberos versions.
>>
>> Marc
>>
>> Op 29-04-17 om 21:42 schreef Marc de Lignie:
>>> Hi Kai,
>>>
>>> Thanks for the response. I prepared a minimal config that reproduces
>>> my problem.
>>>
>>> You can fetch the branch/commit from:
>>> https://github.com/vtslab/directory-kerby/commits/MitIssue
>>>
>>> This is relative to RC2, but I also tried this on trunk for my
>>> actual project.
>>>
>>> This config produces the debug and error messages below.
>>>
>>> 1. For the terminal with the bash + python script $ klist Ticket
>>> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>> Default principal: drankye@TEST.COM
>>>
>>> Valid starting Expires Service principal
>>> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/TEST.COM@TEST.COM
>>> renew until 29-04-17 21:07:39
>>>
>>> $ .
>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/ker
>>> b/ server/MitIssueTest.sh [15538] 1493491231.917606: Retrieving
>>> drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0,
>>> enctype 0) with result:
>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>> [15538]
>>> 1493491231.917827: Retrieving drankye@TEST.COM from
>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>> kerberos.authGSSClientInit successful [15538] 1493491231.918185:
>>> Getting credentials drankye@TEST.COM -> test-service/localhost@
>>> using ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
>>> test-service/localhost@ from
>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>>> -1765328243/Matching credential not found (filename:
>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
>>> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
>>> test-service/localhost@TEST.COM with result: -1765328243/Matching
>>> credential not found (filename:
>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
>>> [15538] 1493491231.918229: Server has referral realm; starting with
>>> test-service/localhost@TEST.COM [15538] 1493491231.918278:
>>> Retrieving drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM from
>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>>> 0/Success
>>> [15538] 1493491231.918281: Starting with TGT for client realm:
>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
>>> 1493491231.918301: Requesting tickets for
>>> test-service/localhost@TEST.COM, referrals on [15538]
>>> 1493491231.918326: Generated subkey for TGS request:
>>> aes128-cts/FA30
>>> [15538] 1493491231.918359: etypes requested in TGS request:
>>> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1,
>>> rc4-hmac, camellia128-cts, camellia256-cts [15538] 1493491231.918484:
>>> Encoding request body and padata into FAST request [15538]
>>> 1493491231.918541: Sending request (836 bytes) to TEST.COM [15538]
>>> 1493491231.918597: Resolving hostname localhost [15538]
>>> 1493491231.918703: Initiating TCP connection to stream
>>> 127.0.0.1:44292
>>> [15538] 1493491231.918777: Sending TCP request to stream
>>> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error receiving from
>>> stream
>>> 127.0.0.1:44292: 104/Connection reset by peer [15538]
>>> 1493491231.922812: Terminating TCP connection to stream
>>> 127.0.0.1:44292
>>> [15538] 1493491231.922858: Sending initial UDP request to dgram
>>> 127.0.0.1:44292
>>> ('First kerberos.authGSSClientStep not successful',
>>> GSSError(('Unspecified GSS failure. Minor code may provide more
>>> information', 851968), ("Cannot contact any KDC for realm
>>> 'TEST.COM'",
>>> -1765328228)))
>>>
>>> 2. For the terminal that runs mvn clean test -Dtest=MitIssueTest
>>> Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
>>> 2017-04-29 21:07:39,182 DEBUG [main] backend.AbstractIdentityBackend:
>>> initialize called
>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
>>> getIdentity called, principalName = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
>>> getIdentity failed, principalName = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>>> addIdentity successful, principalName = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>>> getIdentity called, principalName = kadmin/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>>> getIdentity failed, principalName = kadmin/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,213 DEBUG [main] backend.AbstractIdentityBackend:
>>> addIdentity successful, principalName = kadmin/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,216 DEBUG [main] backend.AbstractIdentityBackend:
>>> start called
>>> 2017-04-29 21:07:39,232 DEBUG [main] backend.AbstractIdentityBackend:
>>> addIdentity successful, principalName =
>>> test-service/localhost@TEST.COM
>>> 2017-04-29 21:07:39,425 DEBUG [main] backend.AbstractIdentityBackend:
>>> addIdentity successful, principalName = drankye@TEST.COM
>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful,
>>> principalName = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1] request.KdcRequest:
>>> Client entry is empty.
>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> drankye@TEST.COM
>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful,
>>> principalName = drankye@TEST.COM
>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful,
>>> principalName = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>> disconnecting abnormally java.io.EOFException
>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>>> at
>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMess
>>> age(KrbTcpTransport.java:54)
>>>
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(Def
>>> aultKdcHandler.java:46)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor
>>> .java:1142)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecuto
>>> r.java:617)
>>>
>>> at java.lang.Thread.run(Thread.java:748)
>>> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase: Storing
>>> the tgt to the credential cache file.
>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
>>> getIdentity called, principalName = test-service/localhost@TEST.COM
>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
>>> getIdentity successful, principalName =
>>> test-service/localhost@TEST.COM
>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful,
>>> principalName = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1] request.KdcRequest:
>>> Client entry is empty.
>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> test-service/localhost@TEST.COM
>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful,
>>> principalName = test-service/localhost@TEST.COM
>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful,
>>> principalName = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1] request.KdcRequest:
>>> The preauth data is empty.
>>> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1] server.KdcHandler:
>>> KRB error occurred while processing request:Additional
>>> pre-authentication required
>>> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>> disconnecting abnormally java.io.EOFException
>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>>> at
>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMess
>>> age(KrbTcpTransport.java:54)
>>>
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(Def
>>> aultKdcHandler.java:46)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor
>>> .java:1142)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecuto
>>> r.java:617)
>>>
>>> at java.lang.Thread.run(Thread.java:748)
>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful,
>>> principalName = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1] request.KdcRequest:
>>> Client entry is empty.
>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> test-service/localhost@TEST.COM
>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful,
>>> principalName = test-service/localhost@TEST.COM
>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful,
>>> principalName = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>> disconnecting abnormally java.io.EOFException
>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>>> at
>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMess
>>> age(KrbTcpTransport.java:54)
>>>
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(Def
>>> aultKdcHandler.java:46)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor
>>> .java:1142)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecuto
>>> r.java:617)
>>>
>>> at java.lang.Thread.run(Thread.java:748)
>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful,
>>> principalName = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1] request.KdcRequest:
>>> Found fast padata and start to process it.
>>> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
>>> impl.DefaultKdcHandler: Error occured while processing request:
>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
>>> at
>>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
>>> at
>>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast
>>> (KdcRequest.java:208)
>>>
>>> at
>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.process(Kdc
>>> Request.java:168)
>>>
>>> at
>>> org.apache.kerby.kerberos.kerb.server.KdcHandler.handleMessage(KdcHa
>>> ndler.java:115)
>>>
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.handleM
>>> essage(DefaultKdcHandler.java:67)
>>>
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(Def
>>> aultKdcHandler.java:52)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor
>>> .java:1142)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecuto
>>> r.java:617)
>>>
>>> at java.lang.Thread.run(Thread.java:748)
>>> Caused by: java.io.IOException: Unexpected item context [0]
>>> [tag=0xA0, off=0, len=3+207], expecting 0x30
>>> at
>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(Asn1Encodeable.java
>>> :210)
>>>
>>> at
>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(Asn1Encodeable.java
>>> :197)
>>>
>>> at
>>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
>>> ... 9 more
>>> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>> disconnecting abnormally
>>> java.net.SocketException: Socket closed
>>> at java.net.SocketInputStream.socketRead0(Native Method)
>>> at
>>> java.net.SocketInputStream.socketRead(SocketInputStream.java:116)
>>> at java.net.SocketInputStream.read(SocketInputStream.java:171)
>>> at java.net.SocketInputStream.read(SocketInputStream.java:141)
>>> at java.net.SocketInputStream.read(SocketInputStream.java:224)
>>> at java.io.DataInputStream.readInt(DataInputStream.java:387)
>>> at
>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMess
>>> age(KrbTcpTransport.java:54)
>>>
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(Def
>>> aultKdcHandler.java:46)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor
>>> .java:1142)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecuto
>>> r.java:617)
>>>
>>> at java.lang.Thread.run(Thread.java:748)
>>>
>>> In a FreeIPA environment these python lines "just" work.
>>>
>>> Any suggestions are welcome!
>>>
>>> Marc
>>>
>>>
>> --
>> Marc de Lignie
>>
>
--
Marc de Lignie
RE: MIT Kerberos compatibility
Posted by "Zheng, Kai" <ka...@intel.com>.
Hi Marc,
Thanks for your patience. It looks to me there is some issue in Kerby with Heimdal compatibility. Note we haven't supported Heimdal yet. So far, Kerby is tested and can support these clients:
1. Oracle Java;
2. Kerby client;
3. MIT client.
Both compatibility tests with MS AD and Heimdal haven't been done yet. For Heimdal, I thought we can get back to this later (hope soon, a week later). We're pretty busy with urgent things, sorry.
Regards,
Kai
-----Original Message-----
From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
Sent: Sunday, May 07, 2017 10:13 PM
To: kerby@directory.apache.org
Subject: Re: MIT Kerberos compatibility
Hi Jiajia and Kai,
Puzzled by the fact that the Mit Kerberos over python service ticket request works on Jiajia's system but not on mine. I attempted to request the service ticket with Mit Kerberos's kinit tool and .... it worked.
This means that my issue probably lies in the kerberos python wrapper around the Mit Kerberos shared libs (or in the way how I use it). I tried both with the Debian python-kerberos package, https://pypi.python.org/pypi/kerberos and with https://pypi.python.org/pypi/pykerberos/1.1.14, neither of which got the ticket. This still makes me curious where Mac-OS gets its python kerberos package from :-)
Here, the kinit shell commands to reproduce my test.
cd $PROJECTROOT
WORKDIR=kerby-kerb/kerb-kdc-test/target/tmp
export KRB5_CONFIG=$WORKDIR/krb5.conf
export KRB5CCNAME=$WORKDIR/test-tkt.cc
export KRB5_TRACE=/dev/stdout
$ kinit -S test-service/localhost
[3141] 1494161999.566468: Getting initial credentials for drankye@TEST.COM [3141] 1494161999.566835: Setting initial creds service to test-service/localhost [3141] 1494161999.566952: Sending request (168 bytes) to TEST.COM [3141] 1494161999.566997: Resolving hostname localhost [3141] 1494161999.567467: Sending initial UDP request to dgram
127.0.0.1:45527
[3141] 1494161999.573494: Received answer (555 bytes) from dgram
127.0.0.1:45527
[3141] 1494161999.576791: Response was not from master KDC [3141] 1494161999.576822: Salt derived from principal: TEST.COMdrankye [3141] 1494161999.576824: Getting AS key, salt "TEST.COMdrankye", params ""
Password for drankye@TEST.COM:
[3141] 1494162015.450071: AS key obtained from gak_fct: aes128-cts/0548 [3141] 1494162015.450101: Decrypted AS reply; session key is:
aes128-cts/4EFE
[3141] 1494162015.450103: FAST negotiation: unavailable [3141] 1494162015.450112: Initializing FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with default princ drankye@TEST.COM [3141] 1494162015.450305: Storing drankye@TEST.COM -> test-service/localhost@TEST.COM in FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
$ klist
Ticket cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
Default principal: drankye@TEST.COM
Valid starting Expires Service principal
07-05-17 14:59:59 08-05-17 14:59:59 test-service/localhost@TEST.COM
renew until 08-05-17 14:59:59
What is also notable here is that the TestKdc only produces one log message:
[nioEventLoopGroup-5-1] INFO
org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
authtime 1494164956766,drankye@TEST.COM for test-service/localhost@TEST.COM
while in the error situation from python it produces (and not the AS_REQ
line):
[nioEventLoopGroup-5-1] INFO
org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found fast padata and starting to process it.
[nioEventLoopGroup-5-1] INFO
org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found fast padata and starting to process it.
Note also that kinit requires to give the password while in the python testcase it is attempted to use the tgt from the credential cache.
Maybe it also useful to restate my target: I want to authenticate a python client towards a service using GSSAPI with SASL (the service being gremlin-server from the Apache Tinkerpop project). So I want to get the service ticket using GSSAPI and an existing tgt from the credential cache.
Any additional hints are welcome, good luck with the Kerby GA release.
Marc
Op 05-05-17 om 22:12 schreef Marc de Lignie:
> Hi Jiajia,
>
> Thanks for the netty config option. This indeed helped to get rid of
> the udp errors, but did not help in getting the service ticket (final
> error message remains the same).
>
> I also noticed that I get the same error from the python console
> whether I specify the right service name or some service name for
> which no service principal exists in the TestKdc.
>
> I did not succeed in getting mvn tst to print the debug logging of the
> various kdc classes involved.
>
> Did you check with klist whether drankye's credential cache contains
> the service ticket for test-service?
>
> Cheers, Marc
>
>
> Op 04-05-17 om 14:55 schreef Li, Jiajia:
>> Hi Marc,
>> I try to run your test(through applying your patch in the trunk) , I
>> think it's success now. Could you take some time to check about it?
>> Here is the log:
>>
>> directory-kerby git:(trunk) ✗ .
>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb
>> /server/MitIssueTest.sh kerberos.authGSSClientInit successful
>> 2017-05-04T20:44:06 set-error: -1765328234: entypes not supported
>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>> for krb5_ccache_conf_data/realm-config@X-CACHECONF: in cache
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>> for test-service/localhost@TEST.COM in cache
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>> for
>> krb5_ccache_conf_data/negative-cache/test-service\134/localhost\134@TEST.COM@X-CACHECONF:
>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>> for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF: in cache
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>> for krb5_ccache_conf_data/sitename@X-CACHECONF: in cache
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>> for test-service/localhost@TEST.COM in cache
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>> des-cbc-md5-deprecated not supported
>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>> des-cbc-md4-deprecated not supported
>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>> des-cbc-crc-deprecated not supported
>> 2017-05-04T20:44:06 Trying to find service kdc for realm TEST.COM
>> flags 0
>> 2017-05-04T20:44:06 configuration file for realm TEST.COM found
>> 2017-05-04T20:44:06 submissing new requests to new host
>> 2017-05-04T20:44:06 host_create: setting hostname localhost
>> 2017-05-04T20:44:06 connecting to host: udp ::1:52534 (localhost)
>> tid: 00000001
>> 2017-05-04T20:44:06 host_create: setting hostname localhost
>> 2017-05-04T20:44:06 Queuing host in future (in 3s), its the 2 address
>> on the same name: udp 127.0.0.1:52534 (localhost) tid: 00000002
>> 2017-05-04T20:44:06 writing packet: udp ::1:52534 (localhost) tid:
>> 00000001
>> 2017-05-04T20:44:06 reading packet: udp ::1:52534 (localhost) tid:
>> 00000001
>> 2017-05-04T20:44:06 host completed: udp ::1:52534 (localhost) tid:
>> 00000001
>> 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0 hosts 1
>> packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814 tid: 00000002
>> 2017-05-04T20:44:06 tkt: extract key 17/763641F3
>> 2017-05-04T20:44:06 set-error: -1765328353: Decrypt integrity check
>> failed for checksum type hmac-sha1-96-aes128, key type
>> aes128-cts-hmac-sha1-96
>> 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
>> 2017-05-04T20:44:06 krb5_get_credentials_with_flags: TEST.COM wc:
>> 0.050317
>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>> for krb5_ccache_conf_data/realm-config@X-CACHECONF: in cache
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>> for
>> krb5_ccache_conf_data/time-offset/test-service\134/localhost\134@TEST.COM@X-CACHECONF:
>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> 2017-05-04T20:44:06 Setting up PFS for auth context
>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>> des-cbc-md5-deprecated not supported
>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>> des-cbc-md4-deprecated not supported
>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>> des-cbc-crc-deprecated not supported First kerberos.authGSSClientStep
>> successful
>>
>> Thanks
>> Jiajia
>>
>> -----Original Message-----
>> From: Zheng, Kai [mailto:kai.zheng@intel.com]
>> Sent: Wednesday, May 3, 2017 7:29 PM
>> To: kerby@directory.apache.org
>> Subject: RE: MIT Kerberos compatibility
>>
>> Hi Marc,
>>
>> In case you're not aware of this, please check out the latest fix
>> made by Jiajia. We thought your case may be different, but would be
>> good to have a check before we can repeat/fix your case. Thanks.
>> https://issues.apache.org/jira/browse/DIRKRB-625
>>
>> Regards,
>> Kai
>>
>> -----Original Message-----
>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
>> Sent: Sunday, April 30, 2017 7:45 PM
>> To: kerby@directory.apache.org
>> Subject: Re: MIT Kerberos compatibility
>>
>> Hi Kai,
>>
>> The terminal output below is for the latest MIT Kerberos 1.15.1
>> (locally built on Ubuntu Xenial). Before that, I also tested with the
>> default Xenial MIT Kerberos packages (1.13.2), with the same result.
>> I did not try earlier MIT Kerberos versions.
>>
>> Marc
>>
>> Op 29-04-17 om 21:42 schreef Marc de Lignie:
>>> Hi Kai,
>>>
>>> Thanks for the response. I prepared a minimal config that reproduces
>>> my problem.
>>>
>>> You can fetch the branch/commit from:
>>> https://github.com/vtslab/directory-kerby/commits/MitIssue
>>>
>>> This is relative to RC2, but I also tried this on trunk for my
>>> actual project.
>>>
>>> This config produces the debug and error messages below.
>>>
>>> 1. For the terminal with the bash + python script $ klist Ticket
>>> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>> Default principal: drankye@TEST.COM
>>>
>>> Valid starting Expires Service principal
>>> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/TEST.COM@TEST.COM
>>> renew until 29-04-17 21:07:39
>>>
>>> $ .
>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/ker
>>> b/ server/MitIssueTest.sh [15538] 1493491231.917606: Retrieving
>>> drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0,
>>> enctype 0) with result:
>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>> [15538]
>>> 1493491231.917827: Retrieving drankye@TEST.COM from
>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>> kerberos.authGSSClientInit successful [15538] 1493491231.918185:
>>> Getting credentials drankye@TEST.COM -> test-service/localhost@
>>> using ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
>>> test-service/localhost@ from
>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>>> -1765328243/Matching credential not found (filename:
>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
>>> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
>>> test-service/localhost@TEST.COM with result: -1765328243/Matching
>>> credential not found (filename:
>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
>>> [15538] 1493491231.918229: Server has referral realm; starting with
>>> test-service/localhost@TEST.COM [15538] 1493491231.918278:
>>> Retrieving drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM from
>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>>> 0/Success
>>> [15538] 1493491231.918281: Starting with TGT for client realm:
>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
>>> 1493491231.918301: Requesting tickets for
>>> test-service/localhost@TEST.COM, referrals on [15538]
>>> 1493491231.918326: Generated subkey for TGS request:
>>> aes128-cts/FA30
>>> [15538] 1493491231.918359: etypes requested in TGS request:
>>> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1,
>>> rc4-hmac, camellia128-cts, camellia256-cts [15538] 1493491231.918484:
>>> Encoding request body and padata into FAST request [15538]
>>> 1493491231.918541: Sending request (836 bytes) to TEST.COM [15538]
>>> 1493491231.918597: Resolving hostname localhost [15538]
>>> 1493491231.918703: Initiating TCP connection to stream
>>> 127.0.0.1:44292
>>> [15538] 1493491231.918777: Sending TCP request to stream
>>> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error receiving from
>>> stream
>>> 127.0.0.1:44292: 104/Connection reset by peer [15538]
>>> 1493491231.922812: Terminating TCP connection to stream
>>> 127.0.0.1:44292
>>> [15538] 1493491231.922858: Sending initial UDP request to dgram
>>> 127.0.0.1:44292
>>> ('First kerberos.authGSSClientStep not successful',
>>> GSSError(('Unspecified GSS failure. Minor code may provide more
>>> information', 851968), ("Cannot contact any KDC for realm
>>> 'TEST.COM'",
>>> -1765328228)))
>>>
>>> 2. For the terminal that runs mvn clean test -Dtest=MitIssueTest
>>> Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
>>> 2017-04-29 21:07:39,182 DEBUG [main] backend.AbstractIdentityBackend:
>>> initialize called
>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
>>> getIdentity called, principalName = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
>>> getIdentity failed, principalName = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>>> addIdentity successful, principalName = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>>> getIdentity called, principalName = kadmin/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>>> getIdentity failed, principalName = kadmin/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,213 DEBUG [main] backend.AbstractIdentityBackend:
>>> addIdentity successful, principalName = kadmin/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,216 DEBUG [main] backend.AbstractIdentityBackend:
>>> start called
>>> 2017-04-29 21:07:39,232 DEBUG [main] backend.AbstractIdentityBackend:
>>> addIdentity successful, principalName =
>>> test-service/localhost@TEST.COM
>>> 2017-04-29 21:07:39,425 DEBUG [main] backend.AbstractIdentityBackend:
>>> addIdentity successful, principalName = drankye@TEST.COM
>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful,
>>> principalName = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1] request.KdcRequest:
>>> Client entry is empty.
>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> drankye@TEST.COM
>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful,
>>> principalName = drankye@TEST.COM
>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful,
>>> principalName = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>> disconnecting abnormally java.io.EOFException
>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>>> at
>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMess
>>> age(KrbTcpTransport.java:54)
>>>
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(Def
>>> aultKdcHandler.java:46)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor
>>> .java:1142)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecuto
>>> r.java:617)
>>>
>>> at java.lang.Thread.run(Thread.java:748)
>>> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase: Storing
>>> the tgt to the credential cache file.
>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
>>> getIdentity called, principalName = test-service/localhost@TEST.COM
>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
>>> getIdentity successful, principalName =
>>> test-service/localhost@TEST.COM
>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful,
>>> principalName = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1] request.KdcRequest:
>>> Client entry is empty.
>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> test-service/localhost@TEST.COM
>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful,
>>> principalName = test-service/localhost@TEST.COM
>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful,
>>> principalName = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1] request.KdcRequest:
>>> The preauth data is empty.
>>> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1] server.KdcHandler:
>>> KRB error occurred while processing request:Additional
>>> pre-authentication required
>>> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>> disconnecting abnormally java.io.EOFException
>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>>> at
>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMess
>>> age(KrbTcpTransport.java:54)
>>>
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(Def
>>> aultKdcHandler.java:46)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor
>>> .java:1142)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecuto
>>> r.java:617)
>>>
>>> at java.lang.Thread.run(Thread.java:748)
>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful,
>>> principalName = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1] request.KdcRequest:
>>> Client entry is empty.
>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> test-service/localhost@TEST.COM
>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful,
>>> principalName = test-service/localhost@TEST.COM
>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful,
>>> principalName = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>> disconnecting abnormally java.io.EOFException
>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>>> at
>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMess
>>> age(KrbTcpTransport.java:54)
>>>
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(Def
>>> aultKdcHandler.java:46)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor
>>> .java:1142)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecuto
>>> r.java:617)
>>>
>>> at java.lang.Thread.run(Thread.java:748)
>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful,
>>> principalName = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1] request.KdcRequest:
>>> Found fast padata and start to process it.
>>> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
>>> impl.DefaultKdcHandler: Error occured while processing request:
>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
>>> at
>>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
>>> at
>>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast
>>> (KdcRequest.java:208)
>>>
>>> at
>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.process(Kdc
>>> Request.java:168)
>>>
>>> at
>>> org.apache.kerby.kerberos.kerb.server.KdcHandler.handleMessage(KdcHa
>>> ndler.java:115)
>>>
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.handleM
>>> essage(DefaultKdcHandler.java:67)
>>>
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(Def
>>> aultKdcHandler.java:52)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor
>>> .java:1142)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecuto
>>> r.java:617)
>>>
>>> at java.lang.Thread.run(Thread.java:748)
>>> Caused by: java.io.IOException: Unexpected item context [0]
>>> [tag=0xA0, off=0, len=3+207], expecting 0x30
>>> at
>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(Asn1Encodeable.java
>>> :210)
>>>
>>> at
>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(Asn1Encodeable.java
>>> :197)
>>>
>>> at
>>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
>>> ... 9 more
>>> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>> disconnecting abnormally
>>> java.net.SocketException: Socket closed
>>> at java.net.SocketInputStream.socketRead0(Native Method)
>>> at
>>> java.net.SocketInputStream.socketRead(SocketInputStream.java:116)
>>> at java.net.SocketInputStream.read(SocketInputStream.java:171)
>>> at java.net.SocketInputStream.read(SocketInputStream.java:141)
>>> at java.net.SocketInputStream.read(SocketInputStream.java:224)
>>> at java.io.DataInputStream.readInt(DataInputStream.java:387)
>>> at
>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMess
>>> age(KrbTcpTransport.java:54)
>>>
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(Def
>>> aultKdcHandler.java:46)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor
>>> .java:1142)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecuto
>>> r.java:617)
>>>
>>> at java.lang.Thread.run(Thread.java:748)
>>>
>>> In a FreeIPA environment these python lines "just" work.
>>>
>>> Any suggestions are welcome!
>>>
>>> Marc
>>>
>>>
>> --
>> Marc de Lignie
>>
>
--
Marc de Lignie
RE: [Kerby] TGS req failing with "Unexpected item context"
Posted by "Zheng, Kai" <ka...@intel.com>.
Hi Marc,
Thanks for your report and digging. I don't quite follow and am not sure it's pointing to the same issue? In your case does Kerby KDC report the same exception?
Regards,
Kai
-----Original Message-----
From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
Sent: Wednesday, June 07, 2017 3:02 AM
To: kerby@directory.apache.org
Subject: RE: [Kerby] TGS req failing with "Unexpected item context"
Pratjush,
I just posted a temporary workaround as a comment below:
https://issues.apache.org/jira/browse/DIRKRB-614
Cheers, Marc
Kai wrote:
It seems so and we need to fix it. However, I don't see any obvious cause for it. Hope we can get to this sooner (should be next week) after some deadline is caught. Sorry for the late.
Regards,
Kai
-----Original Message-----
From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
Sent: Monday, June 05, 2017 12:04 AM
To: kerby@directory.apache.org
Subject: Re: [Kerby] TGS req failing with "Unexpected item context"
Looks like you're running into this known issue:
https://issues.apache.org/jira/browse/DIRKRB-614
Colm.
On Sat, Jun 3, 2017 at 8:09 PM, pratyush parimal <pratyush.parimal@gmail.com
> wrote:
> Hi everyone,
>
> I'm writing a simple Java program that stands up a KDC using the
> SimpleKdcServer class, and I'm trying to use it for AS & TGS
> operations. Relevant code is below:
>
> kdc = new SimpleKdcServer();
> kdc.setKdcHost("kdc.example.com");
> kdc.setKdcPort(60088);
> kdc.setKdcRealm("EXAMPLE.COM");
>
> kdc.setAllowUdp(false);
> kdc.setWorkDir(keytabFile.getParentFile());
>
> kdc.init();
>
> kdc.createPrincipal("u1@EXAMPLE.COM", "u1pwd");
> kdc.createPrincipal("myservice/kdc.example.com@EXAMPLE.COM",
> "myservicepwd");
>
> kdc.start();
>
> I use kinit to fetch the TGT for my principal "u1" and that's successful.
> However, the subsequent TGS req from my client program fails with the
> error:
>
> GSSAPI continuation error: Unknown code krcM 137
>
> . I debugged through the source code for Kerby and saw that the full
> exception was not getting thrown because of a (e instanceof
> KdcRecoverableException) check. When I print the stacktrace via a
> debugger, I see the following (apologies for the huge stack trace):
>
> [pool-1-thread-1] INFO
> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found fast
> padata and starting to process it.
> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed at
> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
> at
> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast(
> KdcRequest.java:213)
> at
> org.apache.kerby.kerberos.kerb.server.request.
> KdcRequest.process(KdcRequest.java:170)
> at
> org.apache.kerby.kerberos.kerb.server.KdcHandler.
> handleMessage(KdcHandler.java:116)
> at
> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
> handleMessage(DefaultKdcHandler.java:67)
> at
> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> DefaultKdcHandler.java:52)
> at
> java.util.concurrent.ThreadPoolExecutor.runWorker(
> ThreadPoolExecutor.java:1145)
> at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> ThreadPoolExecutor.java:615)
> at java.lang.Thread.run(Thread.java:745)
> Caused by: java.io.IOException: Unexpected item context [0] [tag=0xA0,
> off=0, len=3+198], expecting 0x30 at
> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> Asn1Encodeable.java:219)
> at org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> Asn1Encodeable.java:207)
> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
> ... 9 more
> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed at
> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
> at
> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast(
> KdcRequest.java:213)
> at
> org.apache.kerby.kerberos.kerb.server.request.
> KdcRequest.process(KdcRequest.java:170)
> at
> org.apache.kerby.kerberos.kerb.server.KdcHandler.
> handleMessage(KdcHandler.java:116)
> at
> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
> handleMessage(DefaultKdcHandler.java:67)
> at
> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> DefaultKdcHandler.java:52)
> at
> java.util.concurrent.ThreadPoolExecutor.runWorker(
> ThreadPoolExecutor.java:1145)
> at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> ThreadPoolExecutor.java:615)
> at java.lang.Thread.run(Thread.java:745)
> Caused by: java.io.IOException: Unexpected item context [0] [tag=0xA0,
> off=0, len=3+198], expecting 0x30 at
> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> Asn1Encodeable.java:219)
> at org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> Asn1Encodeable.java:207)
> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
> ... 9 more
>
> The client program (and also kinit) were using the krb5.conf that was
> auto-generated by the SimpleKdcServer in the workdir, and looked like
> the following (I just replaced localhost with the FQDN of my machine):
>
> [libdefaults]
> kdc_realm = EXAMPLE.COM
> default_realm = EXAMPLE.COM
> udp_preference_limit = 1
> kdc_tcp_port = 60088
> #_KDC_UDP_PORT_
>
> [realms]
> EXAMPLE.COM = {
> kdc = kdc.example.com:60088
> }
>
> I had also enabled KRB5_TRACE on my client program that was making the
> TGS req, and it shows the following:
>
>
> [1588796] 1496515969.488037: ccselect can't find appropriate cache for
> server principal myservice/kdc.example.com@ [1588796]
> 1496515969.488112: Getting credentials u1@EXAMPLE.COM ->
> myservice/kdc.example.com@ using ccache FILE:/tmp/krb5cc_20474
> [1588796] 1496515969.488170: Retrieving u1@EXAMPLE.COM ->
> myservice/kdc.example.com@ from FILE:/tmp/krb5cc_20474 with result:
> -1765328243/Matching credential not found (filename:
> /tmp/krb5cc_20474) [1588796] 1496515969.488206: Retrying
> u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM with result:
> -1765328243/Matching credential not found (filename:
> /tmp/krb5cc_20474) [1588796] 1496515969.488214: Server has referral
> realm; starting with myservice/kdc.example.com@EXAMPLE.COM
> [1588796] 1496515969.488250: Retrieving u1@EXAMPLE.COM -> krbtgt/
> EXAMPLE.COM@EXAMPLE.COM from FILE:/tmp/krb5cc_20474 with result:
> 0/Success [1588796] 1496515969.488259: Starting with TGT for client realm:
> u1@EXAMPLE.COM -> krbtgt/EXAMPLE.COM@EXAMPLE.COM [1588796]
> 1496515969.488266: Requesting tickets for myservice/
> kdc.example.com@EXAMPLE.COM, referrals on [1588796] 1496515969.488298:
> Generated subkey for TGS request:
> aes128-cts/476E
> [1588796] 1496515969.488345: etypes requested in TGS request:
> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
> camellia256-cts [1588796] 1496515969.488460: Encoding request body and
> padata into FAST request [1588796] 1496515969.488522: Sending request
> (835 bytes) to EXAMPLE.COM [1588796] 1496515969.488553: Resolving
> hostname kdc.example.com [1588796] 1496515969.488621: Initiating TCP
> connection to stream
> 172.17.0.53:60088
> [1588796] 1496515969.488682: Sending TCP request to stream
> 172.17.0.53:60088
> [1588796] 1496515969.492213: Received answer (134 bytes) from stream
> 172.17.0.53:60088
> [1588796] 1496515969.492222: Terminating TCP connection to stream
> 172.17.0.53:60088
> [1588796] 1496515969.492292: Response was not from master KDC
> [1588796] 1496515969.492309: TGS request result: -1765323383/Unknown
> code krcM 137 [1588796] 1496515969.492332: Requesting tickets for
> myservice/ kdc.example.com@EXAMPLE.COM, referrals off [1588796]
> 1496515969.492351: Generated subkey for TGS request:
> aes128-cts/AECC
> [1588796] 1496515969.492377: etypes requested in TGS request:
> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
> camellia256-cts [1588796] 1496515969.492430: Encoding request body and
> padata into FAST request [1588796] 1496515969.492483: Sending request
> (835 bytes) to EXAMPLE.COM [1588796] 1496515969.492493: Resolving
> hostname kdc.example.com [1588796] 1496515969.492543: Initiating TCP
> connection to stream
> 172.17.0.53:60088
> [1588796] 1496515969.492586: Sending TCP request to stream
> 172.17.0.53:60088
> [1588796] 1496515969.496886: Received answer (134 bytes) from stream
> 172.17.0.53:60088
> [1588796] 1496515969.496894: Terminating TCP connection to stream
> 172.17.0.53:60088
> [1588796] 1496515969.496948: Response was not from master KDC
> [1588796] 1496515969.496963: TGS request result: -1765323383/Unknown
> code krcM 137
>
>
> I've tried the same scenario with the MIT krb5kdc service with the
> same principals, and the TGS req is successful, with the trace log:
>
> [1590761] 1496516355.23070: ccselect module realm chose cache
> FILE:/tmp/krb5cc_20474 with client principal u1@EXAMPLE.COM for server
> principal myservice/kdc.example.com@EXAMPLE.COM
> [1590761] 1496516355.23150: Getting credentials u1@EXAMPLE.COM ->
> myservice/ kdc.example.com@EXAMPLE.COM using ccache
> FILE:/tmp/krb5cc_20474 [1590761] 1496516355.23212: Retrieving
> u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM from
> FILE:/tmp/krb5cc_20474 with result:
> -1765328243/Matching credential not found (filename:
> /tmp/krb5cc_20474) [1590761] 1496516355.23260: Retrieving
> u1@EXAMPLE.COM -> krbtgt/ EXAMPLE.COM@EXAMPLE.COM from
> FILE:/tmp/krb5cc_20474 with result: 0/Success [1590761]
> 1496516355.23269: Starting with
TGT for client realm:
> u1@EXAMPLE.COM -> krbtgt/EXAMPLE.COM@EXAMPLE.COM [1590761]
> 1496516355.23277: Requesting tickets for myservice/
> kdc.example.com@EXAMPLE.COM, referrals on [1590761] 1496516355.23312:
> Generated subkey for TGS request:
> aes256-cts/3F0A
> [1590761] 1496516355.23368: etypes requested in TGS request:
> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
> camellia256-cts [1590761] 1496516355.23485: Encoding request body and
> padata into FAST request [1590761] 1496516355.23552: Sending request
> (933 bytes) to EXAMPLE.COM [1590761] 1496516355.23581: Resolving
> hostname kdc.example.com [1590761] 1496516355.23651: Sending initial
> UDP request to dgram
> 172.17.0.53:88
> [1590761] 1496516355.24205: Received answer (912 bytes) from dgram
> 172.17.0.53:88
> [1590761] 1496516355.24223: Response was not from master KDC [1590761]
> 1496516355.24240: Decoding FAST response [1590761] 1496516355.24334:
> FAST reply key: aes256-cts/8818 [1590761] 1496516355.24376: TGS reply
> is for u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM with
> session key aes256-cts/126E [1590761] 1496516355.24390: TGS request
> result: 0/Success [1590761] 1496516355.24395: Received creds for
> desired service myservice/ kdc.example.com@EXAMPLE.COM [1590761]
> 1496516355.24401: Storing u1@EXAMPLE.COM -> myservice/
> kdc.example.com@EXAMPLE.COM in FILE:/tmp/krb5cc_20474 [1590761]
> 1496516355.24517: Retrieving u1@EXAMPLE.COM -> krbtgt/
> EXAMPLE.COM@EXAMPLE.COM from FILE:/tmp/krb5cc_20474 with result:
> 0/Success [1590761] 1496516355.24528: Get cred via TGT krbtgt/
> EXAMPLE.COM@EXAMPLE.COM after requesting
> krbtgt/EXAMPLE.COM@EXAMPLE.COM (canonicalize off) [1590761]
> 1496516355.24546: Generated subkey for TGS request:
> aes256-cts/0D91
> [1590761] 1496516355.24574: etypes requested in TGS request:
> aes256-cts [1590761] 1496516355.24633: Encoding request body and
> padata into FAST request [1590761] 1496516355.24689: Sending request
> (931 bytes) to EXAMPLE.COM [1590761] 1496516355.24699: Resolving
> hostname kdc.example.com [1590761] 1496516355.24750: Sending initial
> UDP request to dgram
> 172.17.0.53:88
> [1590761] 1496516355.25098: Received answer (900 bytes) from dgram
> 172.17.0.53:88
> [1590761] 1496516355.25115: Response was not from master KDC [1590761]
> 1496516355.25127: Decoding FAST response [1590761] 1496516355.25198:
> FAST reply key: aes256-cts/03AB [1590761] 1496516355.25234: TGS reply
> is for u1@EXAMPLE.COM -> krbtgt/ EXAMPLE.COM@EXAMPLE.COM with session
> key aes256-cts/A423 [1590761] 1496516355.25246: Got cred; 0/Success
> [1590761] 1496516355.25315: Creating authenticator for u1@EXAMPLE.COM
> -> myservice/kdc.example.com@EXAMPLE.COM, seqnum 751690771, subkey
> aes256-cts/91D0, session key aes256-cts/126E
>
>
>
> My best guess is that maybe I'm missing some configuration steps in my
> Java code and that's causing the FAST request to fail. I couldn't find
> any code examples for kerby anywhere which can help me with my use
> case. Does anyone have any ideas about the above?
>
> Apologies again for the long email, just wanted to share my trials so far.
> Have a nice weekend.
>
> Cheers,
> Pratyush
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
Re: [Kerby] TGS req failing with "Unexpected item context"
Posted by Marc de Lignie <m....@xs4all.nl>.
I second Kai's compliments for Jiajia's work ! I will post my test report in the comments section of DIRKRB-631 soon after this message..
Cheers, Marc
Thank you Jiajia for your taking time to fix this long hanging issue. The fix looks great!
Regards,
Kai
-----Original Message-----
From: Li, Jiajia [mailto:jiajia.li@intel.com]
Sent: Wednesday, June 14, 2017 10:42 AM
To: kerby@directory.apache.org
Subject: RE: [Kerby] TGS req failing with "Unexpected item context"
Hi all,
I have some fix for this issue, could anyone help me to check it using your test env?
Commit log is:
commit a6224d2cf60e8e18ba5e307f1a4a2bc4c01a55b4
Author: plusplusjiajia <ji...@intel.com>
Date: Wed Jun 14 10:43:46 2017 +0800
Fix DIRKRB-614 and DIRKRB-631.
Thanks
Jiajia
-----Original Message-----
From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
Sent: Thursday, June 8, 2017 8:10 PM
To: kerby@directory.apache.org
Subject: Re: [Kerby] TGS req failing with "Unexpected item context"
Hi Kai,
See, my original logs from both the python client and the KDC at (this link is also present
in DIRKRB-631):
http://mail-archives.apache.org/mod_mbox/directory-kerby/201705.mbox/browser
Here, the logs of the python client coincide with Pratyush's report in the current thread.
The logs of the KDC coincide with the old
DIRKKRB-614 issue.
I would say all reports are related to the same error, Kerby not being able the decode the
FAST OTP requests of MIT Kerberos 1.11+. Also, all are related to a TGS request based on an
existing TGT.
Cheers, Marc
Op 06-06-17 om 21:07 schreef Marc de Lignie:
> Dear all,
>
> My bad, it seems I made a separate issue for this, which might add
> more details to DIRKRB-614 and might help you in finding the decode
> error:
>
> https://issues.apache.org/jira/browse/DIRKRB-631
>
> The workaround I mentioned is there, in the comments.
>
> Cheers, Marc
>
>
> Op 06-06-17 om 21:02 schreef Marc de Lignie:
>> Pratjush,
>>
>> I just posted a temporary workaround as a comment below:
>>
>> https://issues.apache.org/jira/browse/DIRKRB-614
>>
>> Cheers, Marc
>>
>>
>> Kai wrote:
>>
>> It seems so and we need to fix it. However, I don't see any obvious
>> cause for it. Hope we can get to this sooner (should be next week)
>> after some deadline is caught. Sorry for the late.
>>
>> Regards,
>> Kai
>>
>> -----Original Message-----
>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
>> Sent: Monday, June 05, 2017 12:04 AM
>> To: kerby@directory.apache.org
>> Subject: Re: [Kerby] TGS req failing with "Unexpected item context"
>>
>> Looks like you're running into this known issue:
>>
>> https://issues.apache.org/jira/browse/DIRKRB-614
>>
>> Colm.
>>
>> On Sat, Jun 3, 2017 at 8:09 PM, pratyush parimal
>> <pratyush.parimal@gmail.com
>>> wrote:
>>
>>> Hi everyone,
>>>
>>> I'm writing a simple Java program that stands up a KDC using the
>>> SimpleKdcServer class, and I'm trying to use it for AS & TGS
>>> operations. Relevant code is below:
>>>
>>> kdc = new SimpleKdcServer();
>>> kdc.setKdcHost("kdc.example.com");
>>> kdc.setKdcPort(60088);
>>> kdc.setKdcRealm("EXAMPLE.COM");
>>>
>>> kdc.setAllowUdp(false);
>>> kdc.setWorkDir(keytabFile.getParentFile());
>>>
>>> kdc.init();
>>>
>>> kdc.createPrincipal("u1@EXAMPLE.COM", "u1pwd");
>>> kdc.createPrincipal("myservice/kdc.example.com@EXAMPLE.COM",
>>> "myservicepwd");
>>>
>>> kdc.start();
>>>
>>> I use kinit to fetch the TGT for my principal "u1" and that's
>>> successful.
>>> However, the subsequent TGS req from my client program fails with
>>> the
>>> error:
>>>
>>> GSSAPI continuation error: Unknown code krcM 137
>>>
>>> . I debugged through the source code for Kerby and saw that the full
>>> exception was not getting thrown because of a (e instanceof
>>> KdcRecoverableException) check. When I print the stacktrace via a
>>> debugger, I see the following (apologies for the huge stack trace):
>>>
>>> [pool-1-thread-1] INFO
>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found
>>> fast padata and starting to process it.
>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed at
>>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast
>>> (
>>> KdcRequest.java:213)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.request.
>>> KdcRequest.process(KdcRequest.java:170)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
>>> handleMessage(KdcHandler.java:116)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
>>> handleMessage(DefaultKdcHandler.java:67)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
>>> DefaultKdcHandler.java:52)
>>> at
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>>> ThreadPoolExecutor.java:1145)
>>> at
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>>> ThreadPoolExecutor.java:615)
>>> at java.lang.Thread.run(Thread.java:745)
>>> Caused by: java.io.IOException: Unexpected item context [0]
>>> [tag=0xA0, off=0, len=3+198], expecting 0x30 at
>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>>> Asn1Encodeable.java:219)
>>> at org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>>> Asn1Encodeable.java:207)
>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
>>> ... 9 more
>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed at
>>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast
>>> (
>>> KdcRequest.java:213)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.request.
>>> KdcRequest.process(KdcRequest.java:170)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
>>> handleMessage(KdcHandler.java:116)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
>>> handleMessage(DefaultKdcHandler.java:67)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
>>> DefaultKdcHandler.java:52)
>>> at
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>>> ThreadPoolExecutor.java:1145)
>>> at
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>>> ThreadPoolExecutor.java:615)
>>> at java.lang.Thread.run(Thread.java:745)
>>> Caused by: java.io.IOException: Unexpected item context [0]
>>> [tag=0xA0, off=0, len=3+198], expecting 0x30 at
>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>>> Asn1Encodeable.java:219)
>>> at org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>>> Asn1Encodeable.java:207)
>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
>>> ... 9 more
>>>
>>> The client program (and also kinit) were using the krb5.conf that
>>> was auto-generated by the SimpleKdcServer in the workdir, and looked
>>> like the following (I just replaced localhost with the FQDN of my
>>> machine):
>>>
>>> [libdefaults]
>>> kdc_realm = EXAMPLE.COM
>>> default_realm = EXAMPLE.COM
>>> udp_preference_limit = 1
>>> kdc_tcp_port = 60088
>>> #_KDC_UDP_PORT_
>>>
>>> [realms]
>>> EXAMPLE.COM = {
>>> kdc = kdc.example.com:60088
>>> }
>>>
>>> I had also enabled KRB5_TRACE on my client program that was making
>>> the TGS req, and it shows the following:
>>>
>>>
>>> [1588796] 1496515969.488037: ccselect can't find appropriate cache
>>> for server principal myservice/kdc.example.com@ [1588796]
>>> 1496515969.488112: Getting credentials u1@EXAMPLE.COM ->
>>> myservice/kdc.example.com@ using ccache FILE:/tmp/krb5cc_20474
>>> [1588796] 1496515969.488170: Retrieving u1@EXAMPLE.COM ->
>>> myservice/kdc.example.com@ from FILE:/tmp/krb5cc_20474 with result:
>>> -1765328243/Matching credential not found (filename:
>>> /tmp/krb5cc_20474) [1588796] 1496515969.488206: Retrying
>>> u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM with
>>> result: -1765328243/Matching credential not found (filename:
>>> /tmp/krb5cc_20474) [1588796] 1496515969.488214: Server has referral
>>> realm; starting with myservice/kdc.example.com@EXAMPLE.COM
>>> [1588796] 1496515969.488250: Retrieving u1@EXAMPLE.COM -> krbtgt/
>>> EXAMPLE.COM@EXAMPLE.COM from FILE:/tmp/krb5cc_20474 with result:
>>> 0/Success [1588796] 1496515969.488259: Starting with TGT for client
>>> realm:
>>> u1@EXAMPLE.COM -> krbtgt/EXAMPLE.COM@EXAMPLE.COM [1588796]
>>> 1496515969.488266: Requesting tickets for myservice/
>>> kdc.example.com@EXAMPLE.COM, referrals on [1588796]
>>> 1496515969.488298: Generated subkey for TGS request:
>>> aes128-cts/476E
>>> [1588796] 1496515969.488345: etypes requested in TGS request:
>>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
>>> camellia256-cts [1588796] 1496515969.488460: Encoding request body
>>> and padata into FAST request [1588796] 1496515969.488522: Sending
>>> request (835 bytes) to EXAMPLE.COM [1588796] 1496515969.488553:
>>> Resolving hostname kdc.example.com [1588796] 1496515969.488621:
>>> Initiating TCP connection to stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.488682: Sending TCP request to stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.492213: Received answer (134 bytes) from stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.492222: Terminating TCP connection to stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.492292: Response was not from master KDC
>>> [1588796] 1496515969.492309: TGS request result: -1765323383/Unknown
>>> code krcM 137 [1588796] 1496515969.492332: Requesting tickets for
>>> myservice/ kdc.example.com@EXAMPLE.COM, referrals off [1588796]
>>> 1496515969.492351: Generated subkey for TGS request:
>>> aes128-cts/AECC
>>> [1588796] 1496515969.492377: etypes requested in TGS request:
>>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
>>> camellia256-cts [1588796] 1496515969.492430: Encoding request body
>>> and padata into FAST request [1588796] 1496515969.492483: Sending
>>> request (835 bytes) to EXAMPLE.COM [1588796] 1496515969.492493:
>>> Resolving hostname kdc.example.com [1588796] 1496515969.492543:
>>> Initiating TCP connection to stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.492586: Sending TCP request to stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.496886: Received answer (134 bytes) from stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.496894: Terminating TCP connection to stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.496948: Response was not from master KDC
>>> [1588796] 1496515969.496963: TGS request result: -1765323383/Unknown
>>> code krcM 137
>>>
>>>
>>> I've tried the same scenario with the MIT krb5kdc service with the
>>> same principals, and the TGS req is successful, with the trace log:
>>>
>>> [1590761] 1496516355.23070: ccselect module realm chose cache
>>> FILE:/tmp/krb5cc_20474 with client principal u1@EXAMPLE.COM for
>>> server principal myservice/kdc.example.com@EXAMPLE.COM
>>> [1590761] 1496516355.23150: Getting credentials u1@EXAMPLE.COM ->
>>> myservice/ kdc.example.com@EXAMPLE.COM using ccache
>>> FILE:/tmp/krb5cc_20474 [1590761] 1496516355.23212: Retrieving
>>> u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM from
>>> FILE:/tmp/krb5cc_20474 with result:
>>> -1765328243/Matching credential not found (filename:
>>> /tmp/krb5cc_20474) [1590761] 1496516355.23260: Retrieving
>>> u1@EXAMPLE.COM -> krbtgt/ EXAMPLE.COM@EXAMPLE.COM from
>>> FILE:/tmp/krb5cc_20474 with result: 0/Success [1590761]
>>> 1496516355.23269: Starting with
>> TGT for client realm:
>>> u1@EXAMPLE.COM -> krbtgt/EXAMPLE.COM@EXAMPLE.COM [1590761]
>>> 1496516355.23277: Requesting tickets for myservice/
>>> kdc.example.com@EXAMPLE.COM, referrals on [1590761]
>>> 1496516355.23312: Generated subkey for TGS request:
>>> aes256-cts/3F0A
>>> [1590761] 1496516355.23368: etypes requested in TGS request:
>>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
>>> camellia256-cts [1590761] 1496516355.23485: Encoding request body
>>> and padata into FAST request [1590761] 1496516355.23552: Sending
>>> request (933 bytes) to EXAMPLE.COM [1590761] 1496516355.23581:
>>> Resolving hostname kdc.example.com [1590761] 1496516355.23651:
>>> Sending initial UDP request to dgram
>>> 172.17.0.53:88
>>> [1590761] 1496516355.24205: Received answer (912 bytes) from dgram
>>> 172.17.0.53:88
>>> [1590761] 1496516355.24223: Response was not from master KDC
>>> [1590761] 1496516355.24240: Decoding FAST response [1590761]
>>> 1496516355.24334: FAST reply key: aes256-cts/8818 [1590761]
>>> 1496516355.24376: TGS reply is for u1@EXAMPLE.COM -> myservice/
>>> kdc.example.com@EXAMPLE.COM with session key aes256-cts/126E
>>> [1590761] 1496516355.24390: TGS request result: 0/Success [1590761]
>>> 1496516355.24395: Received creds for desired service myservice/
>>> kdc.example.com@EXAMPLE.COM [1590761] 1496516355.24401: Storing
>>> u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM in
>>> FILE:/tmp/krb5cc_20474 [1590761] 1496516355.24517: Retrieving
>>> u1@EXAMPLE.COM -> krbtgt/ EXAMPLE.COM@EXAMPLE.COM from
>>> FILE:/tmp/krb5cc_20474 with result: 0/Success [1590761]
>>> 1496516355.24528: Get cred via TGT krbtgt/ EXAMPLE.COM@EXAMPLE.COM
>>> after requesting krbtgt/EXAMPLE.COM@EXAMPLE.COM (canonicalize off)
>>> [1590761] 1496516355.24546: Generated subkey for TGS request:
>>> aes256-cts/0D91
>>> [1590761] 1496516355.24574: etypes requested in TGS request:
>>> aes256-cts [1590761] 1496516355.24633: Encoding request body and
>>> padata into FAST request [1590761] 1496516355.24689: Sending request
>>> (931 bytes) to EXAMPLE.COM [1590761] 1496516355.24699: Resolving
>>> hostname kdc.example.com [1590761] 1496516355.24750: Sending initial
>>> UDP request to dgram
>>> 172.17.0.53:88
>>> [1590761] 1496516355.25098: Received answer (900 bytes) from dgram
>>> 172.17.0.53:88
>>> [1590761] 1496516355.25115: Response was not from master KDC
>>> [1590761] 1496516355.25127: Decoding FAST response [1590761]
>>> 1496516355.25198: FAST reply key: aes256-cts/03AB [1590761]
>>> 1496516355.25234: TGS reply is for u1@EXAMPLE.COM -> krbtgt/
>>> EXAMPLE.COM@EXAMPLE.COM with session key aes256-cts/A423 [1590761]
>>> 1496516355.25246: Got cred; 0/Success [1590761] 1496516355.25315:
>>> Creating authenticator for u1@EXAMPLE.COM ->
>>> myservice/kdc.example.com@EXAMPLE.COM, seqnum 751690771, subkey
>>> aes256-cts/91D0, session key aes256-cts/126E
>>>
>>>
>>>
>>> My best guess is that maybe I'm missing some configuration steps in
>>> my Java code and that's causing the FAST request to fail. I couldn't
>>> find any code examples for kerby anywhere which can help me with my
>>> use case. Does anyone have any ideas about the above?
>>>
>>> Apologies again for the long email, just wanted to share my trials
>>> so far.
>>> Have a nice weekend.
>>>
>>> Cheers,
>>> Pratyush
>>>
>>
>>
>>
>> --
>> Colm O hEigeartaigh
>>
>> Talend Community Coder
>> http://coders.talend.com
>>
>
--
Marc de Lignie
RE: [Kerby] TGS req failing with "Unexpected item context"
Posted by "Li, Jiajia" <ji...@intel.com>.
Hi Pratyush,
The trunk is available.
Thanks
Jiajia
-----Original Message-----
From: pratyush parimal [mailto:pratyush.parimal@gmail.com]
Sent: Thursday, June 15, 2017 2:50 AM
To: kerby@directory.apache.org; Colm O hEigeartaigh <co...@apache.org>
Subject: Re: [Kerby] TGS req failing with "Unexpected item context"
Hi all,
I'm so excited to hear that the issue was addressed. I'd like to test it out as well.
What branch specifically should I checkout to get this fix? Is it available in master/trunk?
Cheers,
Pratyush
On Wed, Jun 14, 2017 at 6:44 AM, Colm O hEigeartaigh <co...@apache.org>
wrote:
> Yes, it fixes the issue that I ran into, thanks Jiajia!
>
> Colm.
>
> On Wed, Jun 14, 2017 at 6:30 AM, Zheng, Kai <ka...@intel.com> wrote:
>
> > Thank you Jiajia for your taking time to fix this long hanging
> > issue. The fix looks great!
> >
> > Regards,
> > Kai
> >
> > -----Original Message-----
> > From: Li, Jiajia [mailto:jiajia.li@intel.com]
> > Sent: Wednesday, June 14, 2017 10:42 AM
> > To: kerby@directory.apache.org
> > Subject: RE: [Kerby] TGS req failing with "Unexpected item context"
> >
> > Hi all,
> > I have some fix for this issue, could anyone help me to check it
> > using your test env?
> >
> > Commit log is:
> > commit a6224d2cf60e8e18ba5e307f1a4a2bc4c01a55b4
> > Author: plusplusjiajia <ji...@intel.com>
> > Date: Wed Jun 14 10:43:46 2017 +0800
> >
> > Fix DIRKRB-614 and DIRKRB-631.
> >
> > Thanks
> > Jiajia
> >
> > -----Original Message-----
> > From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> > Sent: Thursday, June 8, 2017 8:10 PM
> > To: kerby@directory.apache.org
> > Subject: Re: [Kerby] TGS req failing with "Unexpected item context"
> >
> > Hi Kai,
> >
> > See, my original logs from both the python client and the KDC at
> > (this link is also present in DIRKRB-631):
> >
> > http://mail-archives.apache.org/mod_mbox/directory-kerby/
> > 201705.mbox/browser
> >
> > Here, the logs of the python client coincide with Pratyush's report
> > in
> the
> > current thread. The logs of the KDC coincide with the old
> > DIRKKRB-614 issue.
> >
> > I would say all reports are related to the same error, Kerby not
> > being able the decode the FAST OTP requests of MIT Kerberos 1.11+.
> > Also, all
> are
> > related to a TGS request based on an existing TGT.
> >
> > Cheers, Marc
> >
> >
> > Op 06-06-17 om 21:07 schreef Marc de Lignie:
> > > Dear all,
> > >
> > > My bad, it seems I made a separate issue for this, which might add
> > > more details to DIRKRB-614 and might help you in finding the
> > > decode
> > > error:
> > >
> > > https://issues.apache.org/jira/browse/DIRKRB-631
> > >
> > > The workaround I mentioned is there, in the comments.
> > >
> > > Cheers, Marc
> > >
> > >
> > > Op 06-06-17 om 21:02 schreef Marc de Lignie:
> > >> Pratjush,
> > >>
> > >> I just posted a temporary workaround as a comment below:
> > >>
> > >> https://issues.apache.org/jira/browse/DIRKRB-614
> > >>
> > >> Cheers, Marc
> > >>
> > >>
> > >> Kai wrote:
> > >>
> > >> It seems so and we need to fix it. However, I don't see any
> > >> obvious cause for it. Hope we can get to this sooner (should be
> > >> next week) after some deadline is caught. Sorry for the late.
> > >>
> > >> Regards,
> > >> Kai
> > >>
> > >> -----Original Message-----
> > >> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > >> Sent: Monday, June 05, 2017 12:04 AM
> > >> To: kerby@directory.apache.org
> > >> Subject: Re: [Kerby] TGS req failing with "Unexpected item context"
> > >>
> > >> Looks like you're running into this known issue:
> > >>
> > >> https://issues.apache.org/jira/browse/DIRKRB-614
> > >>
> > >> Colm.
> > >>
> > >> On Sat, Jun 3, 2017 at 8:09 PM, pratyush parimal
> > >> <pratyush.parimal@gmail.com
> > >>> wrote:
> > >>
> > >>> Hi everyone,
> > >>>
> > >>> I'm writing a simple Java program that stands up a KDC using the
> > >>> SimpleKdcServer class, and I'm trying to use it for AS & TGS
> > >>> operations. Relevant code is below:
> > >>>
> > >>> kdc = new SimpleKdcServer();
> > >>> kdc.setKdcHost("kdc.example.com");
> > >>> kdc.setKdcPort(60088);
> > >>> kdc.setKdcRealm("EXAMPLE.COM");
> > >>>
> > >>> kdc.setAllowUdp(false);
> > >>> kdc.setWorkDir(keytabFile.getParentFile());
> > >>>
> > >>> kdc.init();
> > >>>
> > >>> kdc.createPrincipal("u1@EXAMPLE.COM", "u1pwd");
> > >>> kdc.createPrincipal("myservice/kdc.example.com@EXAMPLE.COM",
> > >>> "myservicepwd");
> > >>>
> > >>> kdc.start();
> > >>>
> > >>> I use kinit to fetch the TGT for my principal "u1" and that's
> > >>> successful.
> > >>> However, the subsequent TGS req from my client program fails
> > >>> with the
> > >>> error:
> > >>>
> > >>> GSSAPI continuation error: Unknown code krcM 137
> > >>>
> > >>> . I debugged through the source code for Kerby and saw that the
> > >>> full exception was not getting thrown because of a (e instanceof
> > >>> KdcRecoverableException) check. When I print the stacktrace via
> > >>> a debugger, I see the following (apologies for the huge stack trace):
> > >>>
> > >>> [pool-1-thread-1] INFO
> > >>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found
> > >>> fast padata and starting to process it.
> > >>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed at
> > >>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
> > >>> at
> > >>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
> > >>> at
> > >>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFind
> > >>> Fast
> > >>> (
> > >>> KdcRequest.java:213)
> > >>> at
> > >>> org.apache.kerby.kerberos.kerb.server.request.
> > >>> KdcRequest.process(KdcRequest.java:170)
> > >>> at
> > >>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
> > >>> handleMessage(KdcHandler.java:116)
> > >>> at
> > >>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
> > >>> handleMessage(DefaultKdcHandler.java:67)
> > >>> at
> > >>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run
> > >>> (
> > >>> DefaultKdcHandler.java:52)
> > >>> at
> > >>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > >>> ThreadPoolExecutor.java:1145)
> > >>> at
> > >>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > >>> ThreadPoolExecutor.java:615)
> > >>> at java.lang.Thread.run(Thread.java:745)
> > >>> Caused by: java.io.IOException: Unexpected item context [0]
> > >>> [tag=0xA0, off=0, len=3+198], expecting 0x30 at
> > >>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > >>> Asn1Encodeable.java:219)
> > >>> at org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > >>> Asn1Encodeable.java:207)
> > >>> at
> > >>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
> > >>> ... 9 more
> > >>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed at
> > >>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
> > >>> at
> > >>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
> > >>> at
> > >>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFind
> > >>> Fast
> > >>> (
> > >>> KdcRequest.java:213)
> > >>> at
> > >>> org.apache.kerby.kerberos.kerb.server.request.
> > >>> KdcRequest.process(KdcRequest.java:170)
> > >>> at
> > >>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
> > >>> handleMessage(KdcHandler.java:116)
> > >>> at
> > >>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
> > >>> handleMessage(DefaultKdcHandler.java:67)
> > >>> at
> > >>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run
> > >>> (
> > >>> DefaultKdcHandler.java:52)
> > >>> at
> > >>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > >>> ThreadPoolExecutor.java:1145)
> > >>> at
> > >>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > >>> ThreadPoolExecutor.java:615)
> > >>> at java.lang.Thread.run(Thread.java:745)
> > >>> Caused by: java.io.IOException: Unexpected item context [0]
> > >>> [tag=0xA0, off=0, len=3+198], expecting 0x30 at
> > >>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > >>> Asn1Encodeable.java:219)
> > >>> at org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > >>> Asn1Encodeable.java:207)
> > >>> at
> > >>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
> > >>> ... 9 more
> > >>>
> > >>> The client program (and also kinit) were using the krb5.conf
> > >>> that was auto-generated by the SimpleKdcServer in the workdir,
> > >>> and looked like the following (I just replaced localhost with
> > >>> the FQDN of my
> > >>> machine):
> > >>>
> > >>> [libdefaults]
> > >>> kdc_realm = EXAMPLE.COM
> > >>> default_realm = EXAMPLE.COM
> > >>> udp_preference_limit = 1
> > >>> kdc_tcp_port = 60088
> > >>> #_KDC_UDP_PORT_
> > >>>
> > >>> [realms]
> > >>> EXAMPLE.COM = {
> > >>> kdc = kdc.example.com:60088
> > >>> }
> > >>>
> > >>> I had also enabled KRB5_TRACE on my client program that was
> > >>> making the TGS req, and it shows the following:
> > >>>
> > >>>
> > >>> [1588796] 1496515969.488037: ccselect can't find appropriate
> > >>> cache for server principal myservice/kdc.example.com@ [1588796]
> > >>> 1496515969.488112: Getting credentials u1@EXAMPLE.COM ->
> > >>> myservice/kdc.example.com@ using ccache FILE:/tmp/krb5cc_20474
> > >>> [1588796] 1496515969.488170: Retrieving u1@EXAMPLE.COM ->
> > >>> myservice/kdc.example.com@ from FILE:/tmp/krb5cc_20474 with result:
> > >>> -1765328243/Matching credential not found (filename:
> > >>> /tmp/krb5cc_20474) [1588796] 1496515969.488206: Retrying
> > >>> u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM with
> > >>> result: -1765328243/Matching credential not found (filename:
> > >>> /tmp/krb5cc_20474) [1588796] 1496515969.488214: Server has
> > >>> referral realm; starting with
> > >>> myservice/kdc.example.com@EXAMPLE.COM
> > >>> [1588796] 1496515969.488250: Retrieving u1@EXAMPLE.COM ->
> > >>> krbtgt/ EXAMPLE.COM@EXAMPLE.COM from FILE:/tmp/krb5cc_20474 with result:
> > >>> 0/Success [1588796] 1496515969.488259: Starting with TGT for
> > >>> client
> > >>> realm:
> > >>> u1@EXAMPLE.COM -> krbtgt/EXAMPLE.COM@EXAMPLE.COM [1588796]
> > >>> 1496515969.488266: Requesting tickets for myservice/
> > >>> kdc.example.com@EXAMPLE.COM, referrals on [1588796]
> > >>> 1496515969.488298: Generated subkey for TGS request:
> > >>> aes128-cts/476E
> > >>> [1588796] 1496515969.488345: etypes requested in TGS request:
> > >>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac,
> > >>> camellia128-cts, camellia256-cts [1588796] 1496515969.488460:
> > >>> Encoding request body and padata into FAST request [1588796]
> > >>> 1496515969.488522: Sending request (835 bytes) to EXAMPLE.COM [1588796] 1496515969.488553:
> > >>> Resolving hostname kdc.example.com [1588796] 1496515969.488621:
> > >>> Initiating TCP connection to stream
> > >>> 172.17.0.53:60088
> > >>> [1588796] 1496515969.488682: Sending TCP request to stream
> > >>> 172.17.0.53:60088
> > >>> [1588796] 1496515969.492213: Received answer (134 bytes) from
> > >>> stream
> > >>> 172.17.0.53:60088
> > >>> [1588796] 1496515969.492222: Terminating TCP connection to
> > >>> stream
> > >>> 172.17.0.53:60088
> > >>> [1588796] 1496515969.492292: Response was not from master KDC
> > >>> [1588796] 1496515969.492309: TGS request result:
> > >>> -1765323383/Unknown code krcM 137 [1588796] 1496515969.492332:
> > >>> Requesting tickets for myservice/ kdc.example.com@EXAMPLE.COM,
> > >>> referrals off [1588796]
> > >>> 1496515969.492351: Generated subkey for TGS request:
> > >>> aes128-cts/AECC
> > >>> [1588796] 1496515969.492377: etypes requested in TGS request:
> > >>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac,
> > >>> camellia128-cts, camellia256-cts [1588796] 1496515969.492430:
> > >>> Encoding request body and padata into FAST request [1588796]
> > >>> 1496515969.492483: Sending request (835 bytes) to EXAMPLE.COM [1588796] 1496515969.492493:
> > >>> Resolving hostname kdc.example.com [1588796] 1496515969.492543:
> > >>> Initiating TCP connection to stream
> > >>> 172.17.0.53:60088
> > >>> [1588796] 1496515969.492586: Sending TCP request to stream
> > >>> 172.17.0.53:60088
> > >>> [1588796] 1496515969.496886: Received answer (134 bytes) from
> > >>> stream
> > >>> 172.17.0.53:60088
> > >>> [1588796] 1496515969.496894: Terminating TCP connection to
> > >>> stream
> > >>> 172.17.0.53:60088
> > >>> [1588796] 1496515969.496948: Response was not from master KDC
> > >>> [1588796] 1496515969.496963: TGS request result:
> > >>> -1765323383/Unknown code krcM 137
> > >>>
> > >>>
> > >>> I've tried the same scenario with the MIT krb5kdc service with
> > >>> the same principals, and the TGS req is successful, with the trace log:
> > >>>
> > >>> [1590761] 1496516355.23070: ccselect module realm chose cache
> > >>> FILE:/tmp/krb5cc_20474 with client principal u1@EXAMPLE.COM for
> > >>> server principal myservice/kdc.example.com@EXAMPLE.COM
> > >>> [1590761] 1496516355.23150: Getting credentials u1@EXAMPLE.COM
> > >>> -> myservice/ kdc.example.com@EXAMPLE.COM using ccache
> > >>> FILE:/tmp/krb5cc_20474 [1590761] 1496516355.23212: Retrieving
> > >>> u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM from
> > >>> FILE:/tmp/krb5cc_20474 with result:
> > >>> -1765328243/Matching credential not found (filename:
> > >>> /tmp/krb5cc_20474) [1590761] 1496516355.23260: Retrieving
> > >>> u1@EXAMPLE.COM -> krbtgt/ EXAMPLE.COM@EXAMPLE.COM from
> > >>> FILE:/tmp/krb5cc_20474 with result: 0/Success [1590761]
> > >>> 1496516355.23269: Starting with
> > >> TGT for client realm:
> > >>> u1@EXAMPLE.COM -> krbtgt/EXAMPLE.COM@EXAMPLE.COM [1590761]
> > >>> 1496516355.23277: Requesting tickets for myservice/
> > >>> kdc.example.com@EXAMPLE.COM, referrals on [1590761]
> > >>> 1496516355.23312: Generated subkey for TGS request:
> > >>> aes256-cts/3F0A
> > >>> [1590761] 1496516355.23368: etypes requested in TGS request:
> > >>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac,
> > >>> camellia128-cts, camellia256-cts [1590761] 1496516355.23485:
> > >>> Encoding request body and padata into FAST request [1590761]
> > >>> 1496516355.23552: Sending request (933 bytes) to EXAMPLE.COM [1590761] 1496516355.23581:
> > >>> Resolving hostname kdc.example.com [1590761] 1496516355.23651:
> > >>> Sending initial UDP request to dgram
> > >>> 172.17.0.53:88
> > >>> [1590761] 1496516355.24205: Received answer (912 bytes) from
> > >>> dgram
> > >>> 172.17.0.53:88
> > >>> [1590761] 1496516355.24223: Response was not from master KDC
> > >>> [1590761] 1496516355.24240: Decoding FAST response [1590761]
> > >>> 1496516355.24334: FAST reply key: aes256-cts/8818 [1590761]
> > >>> 1496516355.24376: TGS reply is for u1@EXAMPLE.COM -> myservice/
> > >>> kdc.example.com@EXAMPLE.COM with session key aes256-cts/126E
> > >>> [1590761] 1496516355.24390: TGS request result: 0/Success
> > >>> [1590761]
> > >>> 1496516355.24395: Received creds for desired service myservice/
> > >>> kdc.example.com@EXAMPLE.COM [1590761] 1496516355.24401: Storing
> > >>> u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM in
> > >>> FILE:/tmp/krb5cc_20474 [1590761] 1496516355.24517: Retrieving
> > >>> u1@EXAMPLE.COM -> krbtgt/ EXAMPLE.COM@EXAMPLE.COM from
> > >>> FILE:/tmp/krb5cc_20474 with result: 0/Success [1590761]
> > >>> 1496516355.24528: Get cred via TGT krbtgt/
> > >>> EXAMPLE.COM@EXAMPLE.COM after requesting
> > >>> krbtgt/EXAMPLE.COM@EXAMPLE.COM (canonicalize off) [1590761] 1496516355.24546: Generated subkey for TGS request:
> > >>> aes256-cts/0D91
> > >>> [1590761] 1496516355.24574: etypes requested in TGS request:
> > >>> aes256-cts [1590761] 1496516355.24633: Encoding request body and
> > >>> padata into FAST request [1590761] 1496516355.24689: Sending
> > >>> request
> > >>> (931 bytes) to EXAMPLE.COM [1590761] 1496516355.24699: Resolving
> > >>> hostname kdc.example.com [1590761] 1496516355.24750: Sending
> > >>> initial UDP request to dgram
> > >>> 172.17.0.53:88
> > >>> [1590761] 1496516355.25098: Received answer (900 bytes) from
> > >>> dgram
> > >>> 172.17.0.53:88
> > >>> [1590761] 1496516355.25115: Response was not from master KDC
> > >>> [1590761] 1496516355.25127: Decoding FAST response [1590761]
> > >>> 1496516355.25198: FAST reply key: aes256-cts/03AB [1590761]
> > >>> 1496516355.25234: TGS reply is for u1@EXAMPLE.COM -> krbtgt/
> > >>> EXAMPLE.COM@EXAMPLE.COM with session key aes256-cts/A423
> > >>> [1590761]
> > >>> 1496516355.25246: Got cred; 0/Success [1590761] 1496516355.25315:
> > >>> Creating authenticator for u1@EXAMPLE.COM ->
> > >>> myservice/kdc.example.com@EXAMPLE.COM, seqnum 751690771, subkey
> > >>> aes256-cts/91D0, session key aes256-cts/126E
> > >>>
> > >>>
> > >>>
> > >>> My best guess is that maybe I'm missing some configuration steps
> > >>> in my Java code and that's causing the FAST request to fail. I
> > >>> couldn't find any code examples for kerby anywhere which can
> > >>> help me with my use case. Does anyone have any ideas about the above?
> > >>>
> > >>> Apologies again for the long email, just wanted to share my
> > >>> trials so far.
> > >>> Have a nice weekend.
> > >>>
> > >>> Cheers,
> > >>> Pratyush
> > >>>
> > >>
> > >>
> > >>
> > >> --
> > >> Colm O hEigeartaigh
> > >>
> > >> Talend Community Coder
> > >> http://coders.talend.com
> > >>
> > >
> >
> > --
> > Marc de Lignie
> >
> >
>
>
> --
> Colm O hEigeartaigh
>
> Talend Community Coder
> http://coders.talend.com
>
Re: [Kerby] TGS req failing with "Unexpected item context"
Posted by pratyush parimal <pr...@gmail.com>.
Hi all,
I'm so excited to hear that the issue was addressed. I'd like to test it
out as well.
What branch specifically should I checkout to get this fix? Is it available
in master/trunk?
Cheers,
Pratyush
On Wed, Jun 14, 2017 at 6:44 AM, Colm O hEigeartaigh <co...@apache.org>
wrote:
> Yes, it fixes the issue that I ran into, thanks Jiajia!
>
> Colm.
>
> On Wed, Jun 14, 2017 at 6:30 AM, Zheng, Kai <ka...@intel.com> wrote:
>
> > Thank you Jiajia for your taking time to fix this long hanging issue. The
> > fix looks great!
> >
> > Regards,
> > Kai
> >
> > -----Original Message-----
> > From: Li, Jiajia [mailto:jiajia.li@intel.com]
> > Sent: Wednesday, June 14, 2017 10:42 AM
> > To: kerby@directory.apache.org
> > Subject: RE: [Kerby] TGS req failing with "Unexpected item context"
> >
> > Hi all,
> > I have some fix for this issue, could anyone help me to check it using
> > your test env?
> >
> > Commit log is:
> > commit a6224d2cf60e8e18ba5e307f1a4a2bc4c01a55b4
> > Author: plusplusjiajia <ji...@intel.com>
> > Date: Wed Jun 14 10:43:46 2017 +0800
> >
> > Fix DIRKRB-614 and DIRKRB-631.
> >
> > Thanks
> > Jiajia
> >
> > -----Original Message-----
> > From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> > Sent: Thursday, June 8, 2017 8:10 PM
> > To: kerby@directory.apache.org
> > Subject: Re: [Kerby] TGS req failing with "Unexpected item context"
> >
> > Hi Kai,
> >
> > See, my original logs from both the python client and the KDC at (this
> > link is also present in DIRKRB-631):
> >
> > http://mail-archives.apache.org/mod_mbox/directory-kerby/
> > 201705.mbox/browser
> >
> > Here, the logs of the python client coincide with Pratyush's report in
> the
> > current thread. The logs of the KDC coincide with the old
> > DIRKKRB-614 issue.
> >
> > I would say all reports are related to the same error, Kerby not being
> > able the decode the FAST OTP requests of MIT Kerberos 1.11+. Also, all
> are
> > related to a TGS request based on an existing TGT.
> >
> > Cheers, Marc
> >
> >
> > Op 06-06-17 om 21:07 schreef Marc de Lignie:
> > > Dear all,
> > >
> > > My bad, it seems I made a separate issue for this, which might add
> > > more details to DIRKRB-614 and might help you in finding the decode
> > > error:
> > >
> > > https://issues.apache.org/jira/browse/DIRKRB-631
> > >
> > > The workaround I mentioned is there, in the comments.
> > >
> > > Cheers, Marc
> > >
> > >
> > > Op 06-06-17 om 21:02 schreef Marc de Lignie:
> > >> Pratjush,
> > >>
> > >> I just posted a temporary workaround as a comment below:
> > >>
> > >> https://issues.apache.org/jira/browse/DIRKRB-614
> > >>
> > >> Cheers, Marc
> > >>
> > >>
> > >> Kai wrote:
> > >>
> > >> It seems so and we need to fix it. However, I don't see any obvious
> > >> cause for it. Hope we can get to this sooner (should be next week)
> > >> after some deadline is caught. Sorry for the late.
> > >>
> > >> Regards,
> > >> Kai
> > >>
> > >> -----Original Message-----
> > >> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> > >> Sent: Monday, June 05, 2017 12:04 AM
> > >> To: kerby@directory.apache.org
> > >> Subject: Re: [Kerby] TGS req failing with "Unexpected item context"
> > >>
> > >> Looks like you're running into this known issue:
> > >>
> > >> https://issues.apache.org/jira/browse/DIRKRB-614
> > >>
> > >> Colm.
> > >>
> > >> On Sat, Jun 3, 2017 at 8:09 PM, pratyush parimal
> > >> <pratyush.parimal@gmail.com
> > >>> wrote:
> > >>
> > >>> Hi everyone,
> > >>>
> > >>> I'm writing a simple Java program that stands up a KDC using the
> > >>> SimpleKdcServer class, and I'm trying to use it for AS & TGS
> > >>> operations. Relevant code is below:
> > >>>
> > >>> kdc = new SimpleKdcServer();
> > >>> kdc.setKdcHost("kdc.example.com");
> > >>> kdc.setKdcPort(60088);
> > >>> kdc.setKdcRealm("EXAMPLE.COM");
> > >>>
> > >>> kdc.setAllowUdp(false);
> > >>> kdc.setWorkDir(keytabFile.getParentFile());
> > >>>
> > >>> kdc.init();
> > >>>
> > >>> kdc.createPrincipal("u1@EXAMPLE.COM", "u1pwd");
> > >>> kdc.createPrincipal("myservice/kdc.example.com@EXAMPLE.COM",
> > >>> "myservicepwd");
> > >>>
> > >>> kdc.start();
> > >>>
> > >>> I use kinit to fetch the TGT for my principal "u1" and that's
> > >>> successful.
> > >>> However, the subsequent TGS req from my client program fails with
> > >>> the
> > >>> error:
> > >>>
> > >>> GSSAPI continuation error: Unknown code krcM 137
> > >>>
> > >>> . I debugged through the source code for Kerby and saw that the full
> > >>> exception was not getting thrown because of a (e instanceof
> > >>> KdcRecoverableException) check. When I print the stacktrace via a
> > >>> debugger, I see the following (apologies for the huge stack trace):
> > >>>
> > >>> [pool-1-thread-1] INFO
> > >>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found
> > >>> fast padata and starting to process it.
> > >>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed at
> > >>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
> > >>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
> > >>> at
> > >>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast
> > >>> (
> > >>> KdcRequest.java:213)
> > >>> at
> > >>> org.apache.kerby.kerberos.kerb.server.request.
> > >>> KdcRequest.process(KdcRequest.java:170)
> > >>> at
> > >>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
> > >>> handleMessage(KdcHandler.java:116)
> > >>> at
> > >>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
> > >>> handleMessage(DefaultKdcHandler.java:67)
> > >>> at
> > >>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> > >>> DefaultKdcHandler.java:52)
> > >>> at
> > >>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > >>> ThreadPoolExecutor.java:1145)
> > >>> at
> > >>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > >>> ThreadPoolExecutor.java:615)
> > >>> at java.lang.Thread.run(Thread.java:745)
> > >>> Caused by: java.io.IOException: Unexpected item context [0]
> > >>> [tag=0xA0, off=0, len=3+198], expecting 0x30 at
> > >>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > >>> Asn1Encodeable.java:219)
> > >>> at org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > >>> Asn1Encodeable.java:207)
> > >>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
> > >>> ... 9 more
> > >>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed at
> > >>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
> > >>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
> > >>> at
> > >>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast
> > >>> (
> > >>> KdcRequest.java:213)
> > >>> at
> > >>> org.apache.kerby.kerberos.kerb.server.request.
> > >>> KdcRequest.process(KdcRequest.java:170)
> > >>> at
> > >>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
> > >>> handleMessage(KdcHandler.java:116)
> > >>> at
> > >>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
> > >>> handleMessage(DefaultKdcHandler.java:67)
> > >>> at
> > >>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> > >>> DefaultKdcHandler.java:52)
> > >>> at
> > >>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> > >>> ThreadPoolExecutor.java:1145)
> > >>> at
> > >>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> > >>> ThreadPoolExecutor.java:615)
> > >>> at java.lang.Thread.run(Thread.java:745)
> > >>> Caused by: java.io.IOException: Unexpected item context [0]
> > >>> [tag=0xA0, off=0, len=3+198], expecting 0x30 at
> > >>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > >>> Asn1Encodeable.java:219)
> > >>> at org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> > >>> Asn1Encodeable.java:207)
> > >>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
> > >>> ... 9 more
> > >>>
> > >>> The client program (and also kinit) were using the krb5.conf that
> > >>> was auto-generated by the SimpleKdcServer in the workdir, and looked
> > >>> like the following (I just replaced localhost with the FQDN of my
> > >>> machine):
> > >>>
> > >>> [libdefaults]
> > >>> kdc_realm = EXAMPLE.COM
> > >>> default_realm = EXAMPLE.COM
> > >>> udp_preference_limit = 1
> > >>> kdc_tcp_port = 60088
> > >>> #_KDC_UDP_PORT_
> > >>>
> > >>> [realms]
> > >>> EXAMPLE.COM = {
> > >>> kdc = kdc.example.com:60088
> > >>> }
> > >>>
> > >>> I had also enabled KRB5_TRACE on my client program that was making
> > >>> the TGS req, and it shows the following:
> > >>>
> > >>>
> > >>> [1588796] 1496515969.488037: ccselect can't find appropriate cache
> > >>> for server principal myservice/kdc.example.com@ [1588796]
> > >>> 1496515969.488112: Getting credentials u1@EXAMPLE.COM ->
> > >>> myservice/kdc.example.com@ using ccache FILE:/tmp/krb5cc_20474
> > >>> [1588796] 1496515969.488170: Retrieving u1@EXAMPLE.COM ->
> > >>> myservice/kdc.example.com@ from FILE:/tmp/krb5cc_20474 with result:
> > >>> -1765328243/Matching credential not found (filename:
> > >>> /tmp/krb5cc_20474) [1588796] 1496515969.488206: Retrying
> > >>> u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM with
> > >>> result: -1765328243/Matching credential not found (filename:
> > >>> /tmp/krb5cc_20474) [1588796] 1496515969.488214: Server has referral
> > >>> realm; starting with myservice/kdc.example.com@EXAMPLE.COM
> > >>> [1588796] 1496515969.488250: Retrieving u1@EXAMPLE.COM -> krbtgt/
> > >>> EXAMPLE.COM@EXAMPLE.COM from FILE:/tmp/krb5cc_20474 with result:
> > >>> 0/Success [1588796] 1496515969.488259: Starting with TGT for client
> > >>> realm:
> > >>> u1@EXAMPLE.COM -> krbtgt/EXAMPLE.COM@EXAMPLE.COM [1588796]
> > >>> 1496515969.488266: Requesting tickets for myservice/
> > >>> kdc.example.com@EXAMPLE.COM, referrals on [1588796]
> > >>> 1496515969.488298: Generated subkey for TGS request:
> > >>> aes128-cts/476E
> > >>> [1588796] 1496515969.488345: etypes requested in TGS request:
> > >>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
> > >>> camellia256-cts [1588796] 1496515969.488460: Encoding request body
> > >>> and padata into FAST request [1588796] 1496515969.488522: Sending
> > >>> request (835 bytes) to EXAMPLE.COM [1588796] 1496515969.488553:
> > >>> Resolving hostname kdc.example.com [1588796] 1496515969.488621:
> > >>> Initiating TCP connection to stream
> > >>> 172.17.0.53:60088
> > >>> [1588796] 1496515969.488682: Sending TCP request to stream
> > >>> 172.17.0.53:60088
> > >>> [1588796] 1496515969.492213: Received answer (134 bytes) from stream
> > >>> 172.17.0.53:60088
> > >>> [1588796] 1496515969.492222: Terminating TCP connection to stream
> > >>> 172.17.0.53:60088
> > >>> [1588796] 1496515969.492292: Response was not from master KDC
> > >>> [1588796] 1496515969.492309: TGS request result: -1765323383/Unknown
> > >>> code krcM 137 [1588796] 1496515969.492332: Requesting tickets for
> > >>> myservice/ kdc.example.com@EXAMPLE.COM, referrals off [1588796]
> > >>> 1496515969.492351: Generated subkey for TGS request:
> > >>> aes128-cts/AECC
> > >>> [1588796] 1496515969.492377: etypes requested in TGS request:
> > >>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
> > >>> camellia256-cts [1588796] 1496515969.492430: Encoding request body
> > >>> and padata into FAST request [1588796] 1496515969.492483: Sending
> > >>> request (835 bytes) to EXAMPLE.COM [1588796] 1496515969.492493:
> > >>> Resolving hostname kdc.example.com [1588796] 1496515969.492543:
> > >>> Initiating TCP connection to stream
> > >>> 172.17.0.53:60088
> > >>> [1588796] 1496515969.492586: Sending TCP request to stream
> > >>> 172.17.0.53:60088
> > >>> [1588796] 1496515969.496886: Received answer (134 bytes) from stream
> > >>> 172.17.0.53:60088
> > >>> [1588796] 1496515969.496894: Terminating TCP connection to stream
> > >>> 172.17.0.53:60088
> > >>> [1588796] 1496515969.496948: Response was not from master KDC
> > >>> [1588796] 1496515969.496963: TGS request result: -1765323383/Unknown
> > >>> code krcM 137
> > >>>
> > >>>
> > >>> I've tried the same scenario with the MIT krb5kdc service with the
> > >>> same principals, and the TGS req is successful, with the trace log:
> > >>>
> > >>> [1590761] 1496516355.23070: ccselect module realm chose cache
> > >>> FILE:/tmp/krb5cc_20474 with client principal u1@EXAMPLE.COM for
> > >>> server principal myservice/kdc.example.com@EXAMPLE.COM
> > >>> [1590761] 1496516355.23150: Getting credentials u1@EXAMPLE.COM ->
> > >>> myservice/ kdc.example.com@EXAMPLE.COM using ccache
> > >>> FILE:/tmp/krb5cc_20474 [1590761] 1496516355.23212: Retrieving
> > >>> u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM from
> > >>> FILE:/tmp/krb5cc_20474 with result:
> > >>> -1765328243/Matching credential not found (filename:
> > >>> /tmp/krb5cc_20474) [1590761] 1496516355.23260: Retrieving
> > >>> u1@EXAMPLE.COM -> krbtgt/ EXAMPLE.COM@EXAMPLE.COM from
> > >>> FILE:/tmp/krb5cc_20474 with result: 0/Success [1590761]
> > >>> 1496516355.23269: Starting with
> > >> TGT for client realm:
> > >>> u1@EXAMPLE.COM -> krbtgt/EXAMPLE.COM@EXAMPLE.COM [1590761]
> > >>> 1496516355.23277: Requesting tickets for myservice/
> > >>> kdc.example.com@EXAMPLE.COM, referrals on [1590761]
> > >>> 1496516355.23312: Generated subkey for TGS request:
> > >>> aes256-cts/3F0A
> > >>> [1590761] 1496516355.23368: etypes requested in TGS request:
> > >>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
> > >>> camellia256-cts [1590761] 1496516355.23485: Encoding request body
> > >>> and padata into FAST request [1590761] 1496516355.23552: Sending
> > >>> request (933 bytes) to EXAMPLE.COM [1590761] 1496516355.23581:
> > >>> Resolving hostname kdc.example.com [1590761] 1496516355.23651:
> > >>> Sending initial UDP request to dgram
> > >>> 172.17.0.53:88
> > >>> [1590761] 1496516355.24205: Received answer (912 bytes) from dgram
> > >>> 172.17.0.53:88
> > >>> [1590761] 1496516355.24223: Response was not from master KDC
> > >>> [1590761] 1496516355.24240: Decoding FAST response [1590761]
> > >>> 1496516355.24334: FAST reply key: aes256-cts/8818 [1590761]
> > >>> 1496516355.24376: TGS reply is for u1@EXAMPLE.COM -> myservice/
> > >>> kdc.example.com@EXAMPLE.COM with session key aes256-cts/126E
> > >>> [1590761] 1496516355.24390: TGS request result: 0/Success [1590761]
> > >>> 1496516355.24395: Received creds for desired service myservice/
> > >>> kdc.example.com@EXAMPLE.COM [1590761] 1496516355.24401: Storing
> > >>> u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM in
> > >>> FILE:/tmp/krb5cc_20474 [1590761] 1496516355.24517: Retrieving
> > >>> u1@EXAMPLE.COM -> krbtgt/ EXAMPLE.COM@EXAMPLE.COM from
> > >>> FILE:/tmp/krb5cc_20474 with result: 0/Success [1590761]
> > >>> 1496516355.24528: Get cred via TGT krbtgt/ EXAMPLE.COM@EXAMPLE.COM
> > >>> after requesting krbtgt/EXAMPLE.COM@EXAMPLE.COM (canonicalize off)
> > >>> [1590761] 1496516355.24546: Generated subkey for TGS request:
> > >>> aes256-cts/0D91
> > >>> [1590761] 1496516355.24574: etypes requested in TGS request:
> > >>> aes256-cts [1590761] 1496516355.24633: Encoding request body and
> > >>> padata into FAST request [1590761] 1496516355.24689: Sending request
> > >>> (931 bytes) to EXAMPLE.COM [1590761] 1496516355.24699: Resolving
> > >>> hostname kdc.example.com [1590761] 1496516355.24750: Sending initial
> > >>> UDP request to dgram
> > >>> 172.17.0.53:88
> > >>> [1590761] 1496516355.25098: Received answer (900 bytes) from dgram
> > >>> 172.17.0.53:88
> > >>> [1590761] 1496516355.25115: Response was not from master KDC
> > >>> [1590761] 1496516355.25127: Decoding FAST response [1590761]
> > >>> 1496516355.25198: FAST reply key: aes256-cts/03AB [1590761]
> > >>> 1496516355.25234: TGS reply is for u1@EXAMPLE.COM -> krbtgt/
> > >>> EXAMPLE.COM@EXAMPLE.COM with session key aes256-cts/A423 [1590761]
> > >>> 1496516355.25246: Got cred; 0/Success [1590761] 1496516355.25315:
> > >>> Creating authenticator for u1@EXAMPLE.COM ->
> > >>> myservice/kdc.example.com@EXAMPLE.COM, seqnum 751690771, subkey
> > >>> aes256-cts/91D0, session key aes256-cts/126E
> > >>>
> > >>>
> > >>>
> > >>> My best guess is that maybe I'm missing some configuration steps in
> > >>> my Java code and that's causing the FAST request to fail. I couldn't
> > >>> find any code examples for kerby anywhere which can help me with my
> > >>> use case. Does anyone have any ideas about the above?
> > >>>
> > >>> Apologies again for the long email, just wanted to share my trials
> > >>> so far.
> > >>> Have a nice weekend.
> > >>>
> > >>> Cheers,
> > >>> Pratyush
> > >>>
> > >>
> > >>
> > >>
> > >> --
> > >> Colm O hEigeartaigh
> > >>
> > >> Talend Community Coder
> > >> http://coders.talend.com
> > >>
> > >
> >
> > --
> > Marc de Lignie
> >
> >
>
>
> --
> Colm O hEigeartaigh
>
> Talend Community Coder
> http://coders.talend.com
>
Re: [Kerby] TGS req failing with "Unexpected item context"
Posted by Colm O hEigeartaigh <co...@apache.org>.
Yes, it fixes the issue that I ran into, thanks Jiajia!
Colm.
On Wed, Jun 14, 2017 at 6:30 AM, Zheng, Kai <ka...@intel.com> wrote:
> Thank you Jiajia for your taking time to fix this long hanging issue. The
> fix looks great!
>
> Regards,
> Kai
>
> -----Original Message-----
> From: Li, Jiajia [mailto:jiajia.li@intel.com]
> Sent: Wednesday, June 14, 2017 10:42 AM
> To: kerby@directory.apache.org
> Subject: RE: [Kerby] TGS req failing with "Unexpected item context"
>
> Hi all,
> I have some fix for this issue, could anyone help me to check it using
> your test env?
>
> Commit log is:
> commit a6224d2cf60e8e18ba5e307f1a4a2bc4c01a55b4
> Author: plusplusjiajia <ji...@intel.com>
> Date: Wed Jun 14 10:43:46 2017 +0800
>
> Fix DIRKRB-614 and DIRKRB-631.
>
> Thanks
> Jiajia
>
> -----Original Message-----
> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> Sent: Thursday, June 8, 2017 8:10 PM
> To: kerby@directory.apache.org
> Subject: Re: [Kerby] TGS req failing with "Unexpected item context"
>
> Hi Kai,
>
> See, my original logs from both the python client and the KDC at (this
> link is also present in DIRKRB-631):
>
> http://mail-archives.apache.org/mod_mbox/directory-kerby/
> 201705.mbox/browser
>
> Here, the logs of the python client coincide with Pratyush's report in the
> current thread. The logs of the KDC coincide with the old
> DIRKKRB-614 issue.
>
> I would say all reports are related to the same error, Kerby not being
> able the decode the FAST OTP requests of MIT Kerberos 1.11+. Also, all are
> related to a TGS request based on an existing TGT.
>
> Cheers, Marc
>
>
> Op 06-06-17 om 21:07 schreef Marc de Lignie:
> > Dear all,
> >
> > My bad, it seems I made a separate issue for this, which might add
> > more details to DIRKRB-614 and might help you in finding the decode
> > error:
> >
> > https://issues.apache.org/jira/browse/DIRKRB-631
> >
> > The workaround I mentioned is there, in the comments.
> >
> > Cheers, Marc
> >
> >
> > Op 06-06-17 om 21:02 schreef Marc de Lignie:
> >> Pratjush,
> >>
> >> I just posted a temporary workaround as a comment below:
> >>
> >> https://issues.apache.org/jira/browse/DIRKRB-614
> >>
> >> Cheers, Marc
> >>
> >>
> >> Kai wrote:
> >>
> >> It seems so and we need to fix it. However, I don't see any obvious
> >> cause for it. Hope we can get to this sooner (should be next week)
> >> after some deadline is caught. Sorry for the late.
> >>
> >> Regards,
> >> Kai
> >>
> >> -----Original Message-----
> >> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> >> Sent: Monday, June 05, 2017 12:04 AM
> >> To: kerby@directory.apache.org
> >> Subject: Re: [Kerby] TGS req failing with "Unexpected item context"
> >>
> >> Looks like you're running into this known issue:
> >>
> >> https://issues.apache.org/jira/browse/DIRKRB-614
> >>
> >> Colm.
> >>
> >> On Sat, Jun 3, 2017 at 8:09 PM, pratyush parimal
> >> <pratyush.parimal@gmail.com
> >>> wrote:
> >>
> >>> Hi everyone,
> >>>
> >>> I'm writing a simple Java program that stands up a KDC using the
> >>> SimpleKdcServer class, and I'm trying to use it for AS & TGS
> >>> operations. Relevant code is below:
> >>>
> >>> kdc = new SimpleKdcServer();
> >>> kdc.setKdcHost("kdc.example.com");
> >>> kdc.setKdcPort(60088);
> >>> kdc.setKdcRealm("EXAMPLE.COM");
> >>>
> >>> kdc.setAllowUdp(false);
> >>> kdc.setWorkDir(keytabFile.getParentFile());
> >>>
> >>> kdc.init();
> >>>
> >>> kdc.createPrincipal("u1@EXAMPLE.COM", "u1pwd");
> >>> kdc.createPrincipal("myservice/kdc.example.com@EXAMPLE.COM",
> >>> "myservicepwd");
> >>>
> >>> kdc.start();
> >>>
> >>> I use kinit to fetch the TGT for my principal "u1" and that's
> >>> successful.
> >>> However, the subsequent TGS req from my client program fails with
> >>> the
> >>> error:
> >>>
> >>> GSSAPI continuation error: Unknown code krcM 137
> >>>
> >>> . I debugged through the source code for Kerby and saw that the full
> >>> exception was not getting thrown because of a (e instanceof
> >>> KdcRecoverableException) check. When I print the stacktrace via a
> >>> debugger, I see the following (apologies for the huge stack trace):
> >>>
> >>> [pool-1-thread-1] INFO
> >>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found
> >>> fast padata and starting to process it.
> >>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed at
> >>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
> >>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
> >>> at
> >>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast
> >>> (
> >>> KdcRequest.java:213)
> >>> at
> >>> org.apache.kerby.kerberos.kerb.server.request.
> >>> KdcRequest.process(KdcRequest.java:170)
> >>> at
> >>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
> >>> handleMessage(KdcHandler.java:116)
> >>> at
> >>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
> >>> handleMessage(DefaultKdcHandler.java:67)
> >>> at
> >>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> >>> DefaultKdcHandler.java:52)
> >>> at
> >>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> >>> ThreadPoolExecutor.java:1145)
> >>> at
> >>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> >>> ThreadPoolExecutor.java:615)
> >>> at java.lang.Thread.run(Thread.java:745)
> >>> Caused by: java.io.IOException: Unexpected item context [0]
> >>> [tag=0xA0, off=0, len=3+198], expecting 0x30 at
> >>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> >>> Asn1Encodeable.java:219)
> >>> at org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> >>> Asn1Encodeable.java:207)
> >>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
> >>> ... 9 more
> >>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed at
> >>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
> >>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
> >>> at
> >>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast
> >>> (
> >>> KdcRequest.java:213)
> >>> at
> >>> org.apache.kerby.kerberos.kerb.server.request.
> >>> KdcRequest.process(KdcRequest.java:170)
> >>> at
> >>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
> >>> handleMessage(KdcHandler.java:116)
> >>> at
> >>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
> >>> handleMessage(DefaultKdcHandler.java:67)
> >>> at
> >>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> >>> DefaultKdcHandler.java:52)
> >>> at
> >>> java.util.concurrent.ThreadPoolExecutor.runWorker(
> >>> ThreadPoolExecutor.java:1145)
> >>> at
> >>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> >>> ThreadPoolExecutor.java:615)
> >>> at java.lang.Thread.run(Thread.java:745)
> >>> Caused by: java.io.IOException: Unexpected item context [0]
> >>> [tag=0xA0, off=0, len=3+198], expecting 0x30 at
> >>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> >>> Asn1Encodeable.java:219)
> >>> at org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> >>> Asn1Encodeable.java:207)
> >>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
> >>> ... 9 more
> >>>
> >>> The client program (and also kinit) were using the krb5.conf that
> >>> was auto-generated by the SimpleKdcServer in the workdir, and looked
> >>> like the following (I just replaced localhost with the FQDN of my
> >>> machine):
> >>>
> >>> [libdefaults]
> >>> kdc_realm = EXAMPLE.COM
> >>> default_realm = EXAMPLE.COM
> >>> udp_preference_limit = 1
> >>> kdc_tcp_port = 60088
> >>> #_KDC_UDP_PORT_
> >>>
> >>> [realms]
> >>> EXAMPLE.COM = {
> >>> kdc = kdc.example.com:60088
> >>> }
> >>>
> >>> I had also enabled KRB5_TRACE on my client program that was making
> >>> the TGS req, and it shows the following:
> >>>
> >>>
> >>> [1588796] 1496515969.488037: ccselect can't find appropriate cache
> >>> for server principal myservice/kdc.example.com@ [1588796]
> >>> 1496515969.488112: Getting credentials u1@EXAMPLE.COM ->
> >>> myservice/kdc.example.com@ using ccache FILE:/tmp/krb5cc_20474
> >>> [1588796] 1496515969.488170: Retrieving u1@EXAMPLE.COM ->
> >>> myservice/kdc.example.com@ from FILE:/tmp/krb5cc_20474 with result:
> >>> -1765328243/Matching credential not found (filename:
> >>> /tmp/krb5cc_20474) [1588796] 1496515969.488206: Retrying
> >>> u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM with
> >>> result: -1765328243/Matching credential not found (filename:
> >>> /tmp/krb5cc_20474) [1588796] 1496515969.488214: Server has referral
> >>> realm; starting with myservice/kdc.example.com@EXAMPLE.COM
> >>> [1588796] 1496515969.488250: Retrieving u1@EXAMPLE.COM -> krbtgt/
> >>> EXAMPLE.COM@EXAMPLE.COM from FILE:/tmp/krb5cc_20474 with result:
> >>> 0/Success [1588796] 1496515969.488259: Starting with TGT for client
> >>> realm:
> >>> u1@EXAMPLE.COM -> krbtgt/EXAMPLE.COM@EXAMPLE.COM [1588796]
> >>> 1496515969.488266: Requesting tickets for myservice/
> >>> kdc.example.com@EXAMPLE.COM, referrals on [1588796]
> >>> 1496515969.488298: Generated subkey for TGS request:
> >>> aes128-cts/476E
> >>> [1588796] 1496515969.488345: etypes requested in TGS request:
> >>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
> >>> camellia256-cts [1588796] 1496515969.488460: Encoding request body
> >>> and padata into FAST request [1588796] 1496515969.488522: Sending
> >>> request (835 bytes) to EXAMPLE.COM [1588796] 1496515969.488553:
> >>> Resolving hostname kdc.example.com [1588796] 1496515969.488621:
> >>> Initiating TCP connection to stream
> >>> 172.17.0.53:60088
> >>> [1588796] 1496515969.488682: Sending TCP request to stream
> >>> 172.17.0.53:60088
> >>> [1588796] 1496515969.492213: Received answer (134 bytes) from stream
> >>> 172.17.0.53:60088
> >>> [1588796] 1496515969.492222: Terminating TCP connection to stream
> >>> 172.17.0.53:60088
> >>> [1588796] 1496515969.492292: Response was not from master KDC
> >>> [1588796] 1496515969.492309: TGS request result: -1765323383/Unknown
> >>> code krcM 137 [1588796] 1496515969.492332: Requesting tickets for
> >>> myservice/ kdc.example.com@EXAMPLE.COM, referrals off [1588796]
> >>> 1496515969.492351: Generated subkey for TGS request:
> >>> aes128-cts/AECC
> >>> [1588796] 1496515969.492377: etypes requested in TGS request:
> >>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
> >>> camellia256-cts [1588796] 1496515969.492430: Encoding request body
> >>> and padata into FAST request [1588796] 1496515969.492483: Sending
> >>> request (835 bytes) to EXAMPLE.COM [1588796] 1496515969.492493:
> >>> Resolving hostname kdc.example.com [1588796] 1496515969.492543:
> >>> Initiating TCP connection to stream
> >>> 172.17.0.53:60088
> >>> [1588796] 1496515969.492586: Sending TCP request to stream
> >>> 172.17.0.53:60088
> >>> [1588796] 1496515969.496886: Received answer (134 bytes) from stream
> >>> 172.17.0.53:60088
> >>> [1588796] 1496515969.496894: Terminating TCP connection to stream
> >>> 172.17.0.53:60088
> >>> [1588796] 1496515969.496948: Response was not from master KDC
> >>> [1588796] 1496515969.496963: TGS request result: -1765323383/Unknown
> >>> code krcM 137
> >>>
> >>>
> >>> I've tried the same scenario with the MIT krb5kdc service with the
> >>> same principals, and the TGS req is successful, with the trace log:
> >>>
> >>> [1590761] 1496516355.23070: ccselect module realm chose cache
> >>> FILE:/tmp/krb5cc_20474 with client principal u1@EXAMPLE.COM for
> >>> server principal myservice/kdc.example.com@EXAMPLE.COM
> >>> [1590761] 1496516355.23150: Getting credentials u1@EXAMPLE.COM ->
> >>> myservice/ kdc.example.com@EXAMPLE.COM using ccache
> >>> FILE:/tmp/krb5cc_20474 [1590761] 1496516355.23212: Retrieving
> >>> u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM from
> >>> FILE:/tmp/krb5cc_20474 with result:
> >>> -1765328243/Matching credential not found (filename:
> >>> /tmp/krb5cc_20474) [1590761] 1496516355.23260: Retrieving
> >>> u1@EXAMPLE.COM -> krbtgt/ EXAMPLE.COM@EXAMPLE.COM from
> >>> FILE:/tmp/krb5cc_20474 with result: 0/Success [1590761]
> >>> 1496516355.23269: Starting with
> >> TGT for client realm:
> >>> u1@EXAMPLE.COM -> krbtgt/EXAMPLE.COM@EXAMPLE.COM [1590761]
> >>> 1496516355.23277: Requesting tickets for myservice/
> >>> kdc.example.com@EXAMPLE.COM, referrals on [1590761]
> >>> 1496516355.23312: Generated subkey for TGS request:
> >>> aes256-cts/3F0A
> >>> [1590761] 1496516355.23368: etypes requested in TGS request:
> >>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
> >>> camellia256-cts [1590761] 1496516355.23485: Encoding request body
> >>> and padata into FAST request [1590761] 1496516355.23552: Sending
> >>> request (933 bytes) to EXAMPLE.COM [1590761] 1496516355.23581:
> >>> Resolving hostname kdc.example.com [1590761] 1496516355.23651:
> >>> Sending initial UDP request to dgram
> >>> 172.17.0.53:88
> >>> [1590761] 1496516355.24205: Received answer (912 bytes) from dgram
> >>> 172.17.0.53:88
> >>> [1590761] 1496516355.24223: Response was not from master KDC
> >>> [1590761] 1496516355.24240: Decoding FAST response [1590761]
> >>> 1496516355.24334: FAST reply key: aes256-cts/8818 [1590761]
> >>> 1496516355.24376: TGS reply is for u1@EXAMPLE.COM -> myservice/
> >>> kdc.example.com@EXAMPLE.COM with session key aes256-cts/126E
> >>> [1590761] 1496516355.24390: TGS request result: 0/Success [1590761]
> >>> 1496516355.24395: Received creds for desired service myservice/
> >>> kdc.example.com@EXAMPLE.COM [1590761] 1496516355.24401: Storing
> >>> u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM in
> >>> FILE:/tmp/krb5cc_20474 [1590761] 1496516355.24517: Retrieving
> >>> u1@EXAMPLE.COM -> krbtgt/ EXAMPLE.COM@EXAMPLE.COM from
> >>> FILE:/tmp/krb5cc_20474 with result: 0/Success [1590761]
> >>> 1496516355.24528: Get cred via TGT krbtgt/ EXAMPLE.COM@EXAMPLE.COM
> >>> after requesting krbtgt/EXAMPLE.COM@EXAMPLE.COM (canonicalize off)
> >>> [1590761] 1496516355.24546: Generated subkey for TGS request:
> >>> aes256-cts/0D91
> >>> [1590761] 1496516355.24574: etypes requested in TGS request:
> >>> aes256-cts [1590761] 1496516355.24633: Encoding request body and
> >>> padata into FAST request [1590761] 1496516355.24689: Sending request
> >>> (931 bytes) to EXAMPLE.COM [1590761] 1496516355.24699: Resolving
> >>> hostname kdc.example.com [1590761] 1496516355.24750: Sending initial
> >>> UDP request to dgram
> >>> 172.17.0.53:88
> >>> [1590761] 1496516355.25098: Received answer (900 bytes) from dgram
> >>> 172.17.0.53:88
> >>> [1590761] 1496516355.25115: Response was not from master KDC
> >>> [1590761] 1496516355.25127: Decoding FAST response [1590761]
> >>> 1496516355.25198: FAST reply key: aes256-cts/03AB [1590761]
> >>> 1496516355.25234: TGS reply is for u1@EXAMPLE.COM -> krbtgt/
> >>> EXAMPLE.COM@EXAMPLE.COM with session key aes256-cts/A423 [1590761]
> >>> 1496516355.25246: Got cred; 0/Success [1590761] 1496516355.25315:
> >>> Creating authenticator for u1@EXAMPLE.COM ->
> >>> myservice/kdc.example.com@EXAMPLE.COM, seqnum 751690771, subkey
> >>> aes256-cts/91D0, session key aes256-cts/126E
> >>>
> >>>
> >>>
> >>> My best guess is that maybe I'm missing some configuration steps in
> >>> my Java code and that's causing the FAST request to fail. I couldn't
> >>> find any code examples for kerby anywhere which can help me with my
> >>> use case. Does anyone have any ideas about the above?
> >>>
> >>> Apologies again for the long email, just wanted to share my trials
> >>> so far.
> >>> Have a nice weekend.
> >>>
> >>> Cheers,
> >>> Pratyush
> >>>
> >>
> >>
> >>
> >> --
> >> Colm O hEigeartaigh
> >>
> >> Talend Community Coder
> >> http://coders.talend.com
> >>
> >
>
> --
> Marc de Lignie
>
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
RE: [Kerby] TGS req failing with "Unexpected item context"
Posted by "Zheng, Kai" <ka...@intel.com>.
Thank you Jiajia for your taking time to fix this long hanging issue. The fix looks great!
Regards,
Kai
-----Original Message-----
From: Li, Jiajia [mailto:jiajia.li@intel.com]
Sent: Wednesday, June 14, 2017 10:42 AM
To: kerby@directory.apache.org
Subject: RE: [Kerby] TGS req failing with "Unexpected item context"
Hi all,
I have some fix for this issue, could anyone help me to check it using your test env?
Commit log is:
commit a6224d2cf60e8e18ba5e307f1a4a2bc4c01a55b4
Author: plusplusjiajia <ji...@intel.com>
Date: Wed Jun 14 10:43:46 2017 +0800
Fix DIRKRB-614 and DIRKRB-631.
Thanks
Jiajia
-----Original Message-----
From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
Sent: Thursday, June 8, 2017 8:10 PM
To: kerby@directory.apache.org
Subject: Re: [Kerby] TGS req failing with "Unexpected item context"
Hi Kai,
See, my original logs from both the python client and the KDC at (this link is also present in DIRKRB-631):
http://mail-archives.apache.org/mod_mbox/directory-kerby/201705.mbox/browser
Here, the logs of the python client coincide with Pratyush's report in the current thread. The logs of the KDC coincide with the old
DIRKKRB-614 issue.
I would say all reports are related to the same error, Kerby not being able the decode the FAST OTP requests of MIT Kerberos 1.11+. Also, all are related to a TGS request based on an existing TGT.
Cheers, Marc
Op 06-06-17 om 21:07 schreef Marc de Lignie:
> Dear all,
>
> My bad, it seems I made a separate issue for this, which might add
> more details to DIRKRB-614 and might help you in finding the decode
> error:
>
> https://issues.apache.org/jira/browse/DIRKRB-631
>
> The workaround I mentioned is there, in the comments.
>
> Cheers, Marc
>
>
> Op 06-06-17 om 21:02 schreef Marc de Lignie:
>> Pratjush,
>>
>> I just posted a temporary workaround as a comment below:
>>
>> https://issues.apache.org/jira/browse/DIRKRB-614
>>
>> Cheers, Marc
>>
>>
>> Kai wrote:
>>
>> It seems so and we need to fix it. However, I don't see any obvious
>> cause for it. Hope we can get to this sooner (should be next week)
>> after some deadline is caught. Sorry for the late.
>>
>> Regards,
>> Kai
>>
>> -----Original Message-----
>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
>> Sent: Monday, June 05, 2017 12:04 AM
>> To: kerby@directory.apache.org
>> Subject: Re: [Kerby] TGS req failing with "Unexpected item context"
>>
>> Looks like you're running into this known issue:
>>
>> https://issues.apache.org/jira/browse/DIRKRB-614
>>
>> Colm.
>>
>> On Sat, Jun 3, 2017 at 8:09 PM, pratyush parimal
>> <pratyush.parimal@gmail.com
>>> wrote:
>>
>>> Hi everyone,
>>>
>>> I'm writing a simple Java program that stands up a KDC using the
>>> SimpleKdcServer class, and I'm trying to use it for AS & TGS
>>> operations. Relevant code is below:
>>>
>>> kdc = new SimpleKdcServer();
>>> kdc.setKdcHost("kdc.example.com");
>>> kdc.setKdcPort(60088);
>>> kdc.setKdcRealm("EXAMPLE.COM");
>>>
>>> kdc.setAllowUdp(false);
>>> kdc.setWorkDir(keytabFile.getParentFile());
>>>
>>> kdc.init();
>>>
>>> kdc.createPrincipal("u1@EXAMPLE.COM", "u1pwd");
>>> kdc.createPrincipal("myservice/kdc.example.com@EXAMPLE.COM",
>>> "myservicepwd");
>>>
>>> kdc.start();
>>>
>>> I use kinit to fetch the TGT for my principal "u1" and that's
>>> successful.
>>> However, the subsequent TGS req from my client program fails with
>>> the
>>> error:
>>>
>>> GSSAPI continuation error: Unknown code krcM 137
>>>
>>> . I debugged through the source code for Kerby and saw that the full
>>> exception was not getting thrown because of a (e instanceof
>>> KdcRecoverableException) check. When I print the stacktrace via a
>>> debugger, I see the following (apologies for the huge stack trace):
>>>
>>> [pool-1-thread-1] INFO
>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found
>>> fast padata and starting to process it.
>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed at
>>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast
>>> (
>>> KdcRequest.java:213)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.request.
>>> KdcRequest.process(KdcRequest.java:170)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
>>> handleMessage(KdcHandler.java:116)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
>>> handleMessage(DefaultKdcHandler.java:67)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
>>> DefaultKdcHandler.java:52)
>>> at
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>>> ThreadPoolExecutor.java:1145)
>>> at
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>>> ThreadPoolExecutor.java:615)
>>> at java.lang.Thread.run(Thread.java:745)
>>> Caused by: java.io.IOException: Unexpected item context [0]
>>> [tag=0xA0, off=0, len=3+198], expecting 0x30 at
>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>>> Asn1Encodeable.java:219)
>>> at org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>>> Asn1Encodeable.java:207)
>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
>>> ... 9 more
>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed at
>>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast
>>> (
>>> KdcRequest.java:213)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.request.
>>> KdcRequest.process(KdcRequest.java:170)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
>>> handleMessage(KdcHandler.java:116)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
>>> handleMessage(DefaultKdcHandler.java:67)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
>>> DefaultKdcHandler.java:52)
>>> at
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>>> ThreadPoolExecutor.java:1145)
>>> at
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>>> ThreadPoolExecutor.java:615)
>>> at java.lang.Thread.run(Thread.java:745)
>>> Caused by: java.io.IOException: Unexpected item context [0]
>>> [tag=0xA0, off=0, len=3+198], expecting 0x30 at
>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>>> Asn1Encodeable.java:219)
>>> at org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>>> Asn1Encodeable.java:207)
>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
>>> ... 9 more
>>>
>>> The client program (and also kinit) were using the krb5.conf that
>>> was auto-generated by the SimpleKdcServer in the workdir, and looked
>>> like the following (I just replaced localhost with the FQDN of my
>>> machine):
>>>
>>> [libdefaults]
>>> kdc_realm = EXAMPLE.COM
>>> default_realm = EXAMPLE.COM
>>> udp_preference_limit = 1
>>> kdc_tcp_port = 60088
>>> #_KDC_UDP_PORT_
>>>
>>> [realms]
>>> EXAMPLE.COM = {
>>> kdc = kdc.example.com:60088
>>> }
>>>
>>> I had also enabled KRB5_TRACE on my client program that was making
>>> the TGS req, and it shows the following:
>>>
>>>
>>> [1588796] 1496515969.488037: ccselect can't find appropriate cache
>>> for server principal myservice/kdc.example.com@ [1588796]
>>> 1496515969.488112: Getting credentials u1@EXAMPLE.COM ->
>>> myservice/kdc.example.com@ using ccache FILE:/tmp/krb5cc_20474
>>> [1588796] 1496515969.488170: Retrieving u1@EXAMPLE.COM ->
>>> myservice/kdc.example.com@ from FILE:/tmp/krb5cc_20474 with result:
>>> -1765328243/Matching credential not found (filename:
>>> /tmp/krb5cc_20474) [1588796] 1496515969.488206: Retrying
>>> u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM with
>>> result: -1765328243/Matching credential not found (filename:
>>> /tmp/krb5cc_20474) [1588796] 1496515969.488214: Server has referral
>>> realm; starting with myservice/kdc.example.com@EXAMPLE.COM
>>> [1588796] 1496515969.488250: Retrieving u1@EXAMPLE.COM -> krbtgt/
>>> EXAMPLE.COM@EXAMPLE.COM from FILE:/tmp/krb5cc_20474 with result:
>>> 0/Success [1588796] 1496515969.488259: Starting with TGT for client
>>> realm:
>>> u1@EXAMPLE.COM -> krbtgt/EXAMPLE.COM@EXAMPLE.COM [1588796]
>>> 1496515969.488266: Requesting tickets for myservice/
>>> kdc.example.com@EXAMPLE.COM, referrals on [1588796]
>>> 1496515969.488298: Generated subkey for TGS request:
>>> aes128-cts/476E
>>> [1588796] 1496515969.488345: etypes requested in TGS request:
>>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
>>> camellia256-cts [1588796] 1496515969.488460: Encoding request body
>>> and padata into FAST request [1588796] 1496515969.488522: Sending
>>> request (835 bytes) to EXAMPLE.COM [1588796] 1496515969.488553:
>>> Resolving hostname kdc.example.com [1588796] 1496515969.488621:
>>> Initiating TCP connection to stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.488682: Sending TCP request to stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.492213: Received answer (134 bytes) from stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.492222: Terminating TCP connection to stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.492292: Response was not from master KDC
>>> [1588796] 1496515969.492309: TGS request result: -1765323383/Unknown
>>> code krcM 137 [1588796] 1496515969.492332: Requesting tickets for
>>> myservice/ kdc.example.com@EXAMPLE.COM, referrals off [1588796]
>>> 1496515969.492351: Generated subkey for TGS request:
>>> aes128-cts/AECC
>>> [1588796] 1496515969.492377: etypes requested in TGS request:
>>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
>>> camellia256-cts [1588796] 1496515969.492430: Encoding request body
>>> and padata into FAST request [1588796] 1496515969.492483: Sending
>>> request (835 bytes) to EXAMPLE.COM [1588796] 1496515969.492493:
>>> Resolving hostname kdc.example.com [1588796] 1496515969.492543:
>>> Initiating TCP connection to stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.492586: Sending TCP request to stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.496886: Received answer (134 bytes) from stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.496894: Terminating TCP connection to stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.496948: Response was not from master KDC
>>> [1588796] 1496515969.496963: TGS request result: -1765323383/Unknown
>>> code krcM 137
>>>
>>>
>>> I've tried the same scenario with the MIT krb5kdc service with the
>>> same principals, and the TGS req is successful, with the trace log:
>>>
>>> [1590761] 1496516355.23070: ccselect module realm chose cache
>>> FILE:/tmp/krb5cc_20474 with client principal u1@EXAMPLE.COM for
>>> server principal myservice/kdc.example.com@EXAMPLE.COM
>>> [1590761] 1496516355.23150: Getting credentials u1@EXAMPLE.COM ->
>>> myservice/ kdc.example.com@EXAMPLE.COM using ccache
>>> FILE:/tmp/krb5cc_20474 [1590761] 1496516355.23212: Retrieving
>>> u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM from
>>> FILE:/tmp/krb5cc_20474 with result:
>>> -1765328243/Matching credential not found (filename:
>>> /tmp/krb5cc_20474) [1590761] 1496516355.23260: Retrieving
>>> u1@EXAMPLE.COM -> krbtgt/ EXAMPLE.COM@EXAMPLE.COM from
>>> FILE:/tmp/krb5cc_20474 with result: 0/Success [1590761]
>>> 1496516355.23269: Starting with
>> TGT for client realm:
>>> u1@EXAMPLE.COM -> krbtgt/EXAMPLE.COM@EXAMPLE.COM [1590761]
>>> 1496516355.23277: Requesting tickets for myservice/
>>> kdc.example.com@EXAMPLE.COM, referrals on [1590761]
>>> 1496516355.23312: Generated subkey for TGS request:
>>> aes256-cts/3F0A
>>> [1590761] 1496516355.23368: etypes requested in TGS request:
>>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
>>> camellia256-cts [1590761] 1496516355.23485: Encoding request body
>>> and padata into FAST request [1590761] 1496516355.23552: Sending
>>> request (933 bytes) to EXAMPLE.COM [1590761] 1496516355.23581:
>>> Resolving hostname kdc.example.com [1590761] 1496516355.23651:
>>> Sending initial UDP request to dgram
>>> 172.17.0.53:88
>>> [1590761] 1496516355.24205: Received answer (912 bytes) from dgram
>>> 172.17.0.53:88
>>> [1590761] 1496516355.24223: Response was not from master KDC
>>> [1590761] 1496516355.24240: Decoding FAST response [1590761]
>>> 1496516355.24334: FAST reply key: aes256-cts/8818 [1590761]
>>> 1496516355.24376: TGS reply is for u1@EXAMPLE.COM -> myservice/
>>> kdc.example.com@EXAMPLE.COM with session key aes256-cts/126E
>>> [1590761] 1496516355.24390: TGS request result: 0/Success [1590761]
>>> 1496516355.24395: Received creds for desired service myservice/
>>> kdc.example.com@EXAMPLE.COM [1590761] 1496516355.24401: Storing
>>> u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM in
>>> FILE:/tmp/krb5cc_20474 [1590761] 1496516355.24517: Retrieving
>>> u1@EXAMPLE.COM -> krbtgt/ EXAMPLE.COM@EXAMPLE.COM from
>>> FILE:/tmp/krb5cc_20474 with result: 0/Success [1590761]
>>> 1496516355.24528: Get cred via TGT krbtgt/ EXAMPLE.COM@EXAMPLE.COM
>>> after requesting krbtgt/EXAMPLE.COM@EXAMPLE.COM (canonicalize off)
>>> [1590761] 1496516355.24546: Generated subkey for TGS request:
>>> aes256-cts/0D91
>>> [1590761] 1496516355.24574: etypes requested in TGS request:
>>> aes256-cts [1590761] 1496516355.24633: Encoding request body and
>>> padata into FAST request [1590761] 1496516355.24689: Sending request
>>> (931 bytes) to EXAMPLE.COM [1590761] 1496516355.24699: Resolving
>>> hostname kdc.example.com [1590761] 1496516355.24750: Sending initial
>>> UDP request to dgram
>>> 172.17.0.53:88
>>> [1590761] 1496516355.25098: Received answer (900 bytes) from dgram
>>> 172.17.0.53:88
>>> [1590761] 1496516355.25115: Response was not from master KDC
>>> [1590761] 1496516355.25127: Decoding FAST response [1590761]
>>> 1496516355.25198: FAST reply key: aes256-cts/03AB [1590761]
>>> 1496516355.25234: TGS reply is for u1@EXAMPLE.COM -> krbtgt/
>>> EXAMPLE.COM@EXAMPLE.COM with session key aes256-cts/A423 [1590761]
>>> 1496516355.25246: Got cred; 0/Success [1590761] 1496516355.25315:
>>> Creating authenticator for u1@EXAMPLE.COM ->
>>> myservice/kdc.example.com@EXAMPLE.COM, seqnum 751690771, subkey
>>> aes256-cts/91D0, session key aes256-cts/126E
>>>
>>>
>>>
>>> My best guess is that maybe I'm missing some configuration steps in
>>> my Java code and that's causing the FAST request to fail. I couldn't
>>> find any code examples for kerby anywhere which can help me with my
>>> use case. Does anyone have any ideas about the above?
>>>
>>> Apologies again for the long email, just wanted to share my trials
>>> so far.
>>> Have a nice weekend.
>>>
>>> Cheers,
>>> Pratyush
>>>
>>
>>
>>
>> --
>> Colm O hEigeartaigh
>>
>> Talend Community Coder
>> http://coders.talend.com
>>
>
--
Marc de Lignie
RE: [Kerby] TGS req failing with "Unexpected item context"
Posted by "Li, Jiajia" <ji...@intel.com>.
Hi all,
I have some fix for this issue, could anyone help me to check it using your test env?
Commit log is:
commit a6224d2cf60e8e18ba5e307f1a4a2bc4c01a55b4
Author: plusplusjiajia <ji...@intel.com>
Date: Wed Jun 14 10:43:46 2017 +0800
Fix DIRKRB-614 and DIRKRB-631.
Thanks
Jiajia
-----Original Message-----
From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
Sent: Thursday, June 8, 2017 8:10 PM
To: kerby@directory.apache.org
Subject: Re: [Kerby] TGS req failing with "Unexpected item context"
Hi Kai,
See, my original logs from both the python client and the KDC at (this link is also present in DIRKRB-631):
http://mail-archives.apache.org/mod_mbox/directory-kerby/201705.mbox/browser
Here, the logs of the python client coincide with Pratyush's report in the current thread. The logs of the KDC coincide with the old
DIRKKRB-614 issue.
I would say all reports are related to the same error, Kerby not being able the decode the FAST OTP requests of MIT Kerberos 1.11+. Also, all are related to a TGS request based on an existing TGT.
Cheers, Marc
Op 06-06-17 om 21:07 schreef Marc de Lignie:
> Dear all,
>
> My bad, it seems I made a separate issue for this, which might add
> more details to DIRKRB-614 and might help you in finding the decode
> error:
>
> https://issues.apache.org/jira/browse/DIRKRB-631
>
> The workaround I mentioned is there, in the comments.
>
> Cheers, Marc
>
>
> Op 06-06-17 om 21:02 schreef Marc de Lignie:
>> Pratjush,
>>
>> I just posted a temporary workaround as a comment below:
>>
>> https://issues.apache.org/jira/browse/DIRKRB-614
>>
>> Cheers, Marc
>>
>>
>> Kai wrote:
>>
>> It seems so and we need to fix it. However, I don't see any obvious
>> cause for it. Hope we can get to this sooner (should be next week)
>> after some deadline is caught. Sorry for the late.
>>
>> Regards,
>> Kai
>>
>> -----Original Message-----
>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
>> Sent: Monday, June 05, 2017 12:04 AM
>> To: kerby@directory.apache.org
>> Subject: Re: [Kerby] TGS req failing with "Unexpected item context"
>>
>> Looks like you're running into this known issue:
>>
>> https://issues.apache.org/jira/browse/DIRKRB-614
>>
>> Colm.
>>
>> On Sat, Jun 3, 2017 at 8:09 PM, pratyush parimal
>> <pratyush.parimal@gmail.com
>>> wrote:
>>
>>> Hi everyone,
>>>
>>> I'm writing a simple Java program that stands up a KDC using the
>>> SimpleKdcServer class, and I'm trying to use it for AS & TGS
>>> operations. Relevant code is below:
>>>
>>> kdc = new SimpleKdcServer();
>>> kdc.setKdcHost("kdc.example.com");
>>> kdc.setKdcPort(60088);
>>> kdc.setKdcRealm("EXAMPLE.COM");
>>>
>>> kdc.setAllowUdp(false);
>>> kdc.setWorkDir(keytabFile.getParentFile());
>>>
>>> kdc.init();
>>>
>>> kdc.createPrincipal("u1@EXAMPLE.COM", "u1pwd");
>>> kdc.createPrincipal("myservice/kdc.example.com@EXAMPLE.COM",
>>> "myservicepwd");
>>>
>>> kdc.start();
>>>
>>> I use kinit to fetch the TGT for my principal "u1" and that's
>>> successful.
>>> However, the subsequent TGS req from my client program fails with
>>> the
>>> error:
>>>
>>> GSSAPI continuation error: Unknown code krcM 137
>>>
>>> . I debugged through the source code for Kerby and saw that the full
>>> exception was not getting thrown because of a (e instanceof
>>> KdcRecoverableException) check. When I print the stacktrace via a
>>> debugger, I see the following (apologies for the huge stack trace):
>>>
>>> [pool-1-thread-1] INFO
>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found
>>> fast padata and starting to process it.
>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed at
>>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast
>>> (
>>> KdcRequest.java:213)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.request.
>>> KdcRequest.process(KdcRequest.java:170)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
>>> handleMessage(KdcHandler.java:116)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
>>> handleMessage(DefaultKdcHandler.java:67)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
>>> DefaultKdcHandler.java:52)
>>> at
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>>> ThreadPoolExecutor.java:1145)
>>> at
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>>> ThreadPoolExecutor.java:615)
>>> at java.lang.Thread.run(Thread.java:745)
>>> Caused by: java.io.IOException: Unexpected item context [0]
>>> [tag=0xA0, off=0, len=3+198], expecting 0x30 at
>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>>> Asn1Encodeable.java:219)
>>> at org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>>> Asn1Encodeable.java:207)
>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
>>> ... 9 more
>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed at
>>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast
>>> (
>>> KdcRequest.java:213)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.request.
>>> KdcRequest.process(KdcRequest.java:170)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
>>> handleMessage(KdcHandler.java:116)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
>>> handleMessage(DefaultKdcHandler.java:67)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
>>> DefaultKdcHandler.java:52)
>>> at
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>>> ThreadPoolExecutor.java:1145)
>>> at
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>>> ThreadPoolExecutor.java:615)
>>> at java.lang.Thread.run(Thread.java:745)
>>> Caused by: java.io.IOException: Unexpected item context [0]
>>> [tag=0xA0, off=0, len=3+198], expecting 0x30 at
>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>>> Asn1Encodeable.java:219)
>>> at org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>>> Asn1Encodeable.java:207)
>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
>>> ... 9 more
>>>
>>> The client program (and also kinit) were using the krb5.conf that
>>> was auto-generated by the SimpleKdcServer in the workdir, and looked
>>> like the following (I just replaced localhost with the FQDN of my
>>> machine):
>>>
>>> [libdefaults]
>>> kdc_realm = EXAMPLE.COM
>>> default_realm = EXAMPLE.COM
>>> udp_preference_limit = 1
>>> kdc_tcp_port = 60088
>>> #_KDC_UDP_PORT_
>>>
>>> [realms]
>>> EXAMPLE.COM = {
>>> kdc = kdc.example.com:60088
>>> }
>>>
>>> I had also enabled KRB5_TRACE on my client program that was making
>>> the TGS req, and it shows the following:
>>>
>>>
>>> [1588796] 1496515969.488037: ccselect can't find appropriate cache
>>> for server principal myservice/kdc.example.com@ [1588796]
>>> 1496515969.488112: Getting credentials u1@EXAMPLE.COM ->
>>> myservice/kdc.example.com@ using ccache FILE:/tmp/krb5cc_20474
>>> [1588796] 1496515969.488170: Retrieving u1@EXAMPLE.COM ->
>>> myservice/kdc.example.com@ from FILE:/tmp/krb5cc_20474 with result:
>>> -1765328243/Matching credential not found (filename:
>>> /tmp/krb5cc_20474) [1588796] 1496515969.488206: Retrying
>>> u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM with
>>> result: -1765328243/Matching credential not found (filename:
>>> /tmp/krb5cc_20474) [1588796] 1496515969.488214: Server has referral
>>> realm; starting with myservice/kdc.example.com@EXAMPLE.COM
>>> [1588796] 1496515969.488250: Retrieving u1@EXAMPLE.COM -> krbtgt/
>>> EXAMPLE.COM@EXAMPLE.COM from FILE:/tmp/krb5cc_20474 with result:
>>> 0/Success [1588796] 1496515969.488259: Starting with TGT for client
>>> realm:
>>> u1@EXAMPLE.COM -> krbtgt/EXAMPLE.COM@EXAMPLE.COM [1588796]
>>> 1496515969.488266: Requesting tickets for myservice/
>>> kdc.example.com@EXAMPLE.COM, referrals on [1588796]
>>> 1496515969.488298: Generated subkey for TGS request:
>>> aes128-cts/476E
>>> [1588796] 1496515969.488345: etypes requested in TGS request:
>>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
>>> camellia256-cts [1588796] 1496515969.488460: Encoding request body
>>> and padata into FAST request [1588796] 1496515969.488522: Sending
>>> request (835 bytes) to EXAMPLE.COM [1588796] 1496515969.488553:
>>> Resolving hostname kdc.example.com [1588796] 1496515969.488621:
>>> Initiating TCP connection to stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.488682: Sending TCP request to stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.492213: Received answer (134 bytes) from stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.492222: Terminating TCP connection to stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.492292: Response was not from master KDC
>>> [1588796] 1496515969.492309: TGS request result: -1765323383/Unknown
>>> code krcM 137 [1588796] 1496515969.492332: Requesting tickets for
>>> myservice/ kdc.example.com@EXAMPLE.COM, referrals off [1588796]
>>> 1496515969.492351: Generated subkey for TGS request:
>>> aes128-cts/AECC
>>> [1588796] 1496515969.492377: etypes requested in TGS request:
>>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
>>> camellia256-cts [1588796] 1496515969.492430: Encoding request body
>>> and padata into FAST request [1588796] 1496515969.492483: Sending
>>> request (835 bytes) to EXAMPLE.COM [1588796] 1496515969.492493:
>>> Resolving hostname kdc.example.com [1588796] 1496515969.492543:
>>> Initiating TCP connection to stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.492586: Sending TCP request to stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.496886: Received answer (134 bytes) from stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.496894: Terminating TCP connection to stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.496948: Response was not from master KDC
>>> [1588796] 1496515969.496963: TGS request result: -1765323383/Unknown
>>> code krcM 137
>>>
>>>
>>> I've tried the same scenario with the MIT krb5kdc service with the
>>> same principals, and the TGS req is successful, with the trace log:
>>>
>>> [1590761] 1496516355.23070: ccselect module realm chose cache
>>> FILE:/tmp/krb5cc_20474 with client principal u1@EXAMPLE.COM for
>>> server principal myservice/kdc.example.com@EXAMPLE.COM
>>> [1590761] 1496516355.23150: Getting credentials u1@EXAMPLE.COM ->
>>> myservice/ kdc.example.com@EXAMPLE.COM using ccache
>>> FILE:/tmp/krb5cc_20474 [1590761] 1496516355.23212: Retrieving
>>> u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM from
>>> FILE:/tmp/krb5cc_20474 with result:
>>> -1765328243/Matching credential not found (filename:
>>> /tmp/krb5cc_20474) [1590761] 1496516355.23260: Retrieving
>>> u1@EXAMPLE.COM -> krbtgt/ EXAMPLE.COM@EXAMPLE.COM from
>>> FILE:/tmp/krb5cc_20474 with result: 0/Success [1590761]
>>> 1496516355.23269: Starting with
>> TGT for client realm:
>>> u1@EXAMPLE.COM -> krbtgt/EXAMPLE.COM@EXAMPLE.COM [1590761]
>>> 1496516355.23277: Requesting tickets for myservice/
>>> kdc.example.com@EXAMPLE.COM, referrals on [1590761]
>>> 1496516355.23312: Generated subkey for TGS request:
>>> aes256-cts/3F0A
>>> [1590761] 1496516355.23368: etypes requested in TGS request:
>>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
>>> camellia256-cts [1590761] 1496516355.23485: Encoding request body
>>> and padata into FAST request [1590761] 1496516355.23552: Sending
>>> request (933 bytes) to EXAMPLE.COM [1590761] 1496516355.23581:
>>> Resolving hostname kdc.example.com [1590761] 1496516355.23651:
>>> Sending initial UDP request to dgram
>>> 172.17.0.53:88
>>> [1590761] 1496516355.24205: Received answer (912 bytes) from dgram
>>> 172.17.0.53:88
>>> [1590761] 1496516355.24223: Response was not from master KDC
>>> [1590761] 1496516355.24240: Decoding FAST response [1590761]
>>> 1496516355.24334: FAST reply key: aes256-cts/8818 [1590761]
>>> 1496516355.24376: TGS reply is for u1@EXAMPLE.COM -> myservice/
>>> kdc.example.com@EXAMPLE.COM with session key aes256-cts/126E
>>> [1590761] 1496516355.24390: TGS request result: 0/Success [1590761]
>>> 1496516355.24395: Received creds for desired service myservice/
>>> kdc.example.com@EXAMPLE.COM [1590761] 1496516355.24401: Storing
>>> u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM in
>>> FILE:/tmp/krb5cc_20474 [1590761] 1496516355.24517: Retrieving
>>> u1@EXAMPLE.COM -> krbtgt/ EXAMPLE.COM@EXAMPLE.COM from
>>> FILE:/tmp/krb5cc_20474 with result: 0/Success [1590761]
>>> 1496516355.24528: Get cred via TGT krbtgt/ EXAMPLE.COM@EXAMPLE.COM
>>> after requesting krbtgt/EXAMPLE.COM@EXAMPLE.COM (canonicalize off)
>>> [1590761] 1496516355.24546: Generated subkey for TGS request:
>>> aes256-cts/0D91
>>> [1590761] 1496516355.24574: etypes requested in TGS request:
>>> aes256-cts [1590761] 1496516355.24633: Encoding request body and
>>> padata into FAST request [1590761] 1496516355.24689: Sending request
>>> (931 bytes) to EXAMPLE.COM [1590761] 1496516355.24699: Resolving
>>> hostname kdc.example.com [1590761] 1496516355.24750: Sending initial
>>> UDP request to dgram
>>> 172.17.0.53:88
>>> [1590761] 1496516355.25098: Received answer (900 bytes) from dgram
>>> 172.17.0.53:88
>>> [1590761] 1496516355.25115: Response was not from master KDC
>>> [1590761] 1496516355.25127: Decoding FAST response [1590761]
>>> 1496516355.25198: FAST reply key: aes256-cts/03AB [1590761]
>>> 1496516355.25234: TGS reply is for u1@EXAMPLE.COM -> krbtgt/
>>> EXAMPLE.COM@EXAMPLE.COM with session key aes256-cts/A423 [1590761]
>>> 1496516355.25246: Got cred; 0/Success [1590761] 1496516355.25315:
>>> Creating authenticator for u1@EXAMPLE.COM ->
>>> myservice/kdc.example.com@EXAMPLE.COM, seqnum 751690771, subkey
>>> aes256-cts/91D0, session key aes256-cts/126E
>>>
>>>
>>>
>>> My best guess is that maybe I'm missing some configuration steps in
>>> my Java code and that's causing the FAST request to fail. I couldn't
>>> find any code examples for kerby anywhere which can help me with my
>>> use case. Does anyone have any ideas about the above?
>>>
>>> Apologies again for the long email, just wanted to share my trials
>>> so far.
>>> Have a nice weekend.
>>>
>>> Cheers,
>>> Pratyush
>>>
>>
>>
>>
>> --
>> Colm O hEigeartaigh
>>
>> Talend Community Coder
>> http://coders.talend.com
>>
>
--
Marc de Lignie
Re: [Kerby] TGS req failing with "Unexpected item context"
Posted by Marc de Lignie <m....@xs4all.nl>.
Hi Kai,
See, my original logs from both the python client and the KDC at (this
link is also present in DIRKRB-631):
http://mail-archives.apache.org/mod_mbox/directory-kerby/201705.mbox/browser
Here, the logs of the python client coincide with Pratyush's report in
the current thread. The logs of the KDC coincide with the old
DIRKKRB-614 issue.
I would say all reports are related to the same error, Kerby not being
able the decode the FAST OTP requests of MIT Kerberos 1.11+. Also, all
are related to a TGS request based on an existing TGT.
Cheers, Marc
Op 06-06-17 om 21:07 schreef Marc de Lignie:
> Dear all,
>
> My bad, it seems I made a separate issue for this, which might add
> more details to DIRKRB-614 and might help you in finding the decode
> error:
>
> https://issues.apache.org/jira/browse/DIRKRB-631
>
> The workaround I mentioned is there, in the comments.
>
> Cheers, Marc
>
>
> Op 06-06-17 om 21:02 schreef Marc de Lignie:
>> Pratjush,
>>
>> I just posted a temporary workaround as a comment below:
>>
>> https://issues.apache.org/jira/browse/DIRKRB-614
>>
>> Cheers, Marc
>>
>>
>> Kai wrote:
>>
>> It seems so and we need to fix it. However, I don't see any obvious
>> cause for it. Hope we can
>> get to this sooner (should be next week) after some deadline is
>> caught. Sorry for the late.
>>
>> Regards,
>> Kai
>>
>> -----Original Message-----
>> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
>> Sent: Monday, June 05, 2017 12:04 AM
>> To: kerby@directory.apache.org
>> Subject: Re: [Kerby] TGS req failing with "Unexpected item context"
>>
>> Looks like you're running into this known issue:
>>
>> https://issues.apache.org/jira/browse/DIRKRB-614
>>
>> Colm.
>>
>> On Sat, Jun 3, 2017 at 8:09 PM, pratyush parimal
>> <pratyush.parimal@gmail.com
>>> wrote:
>>
>>> Hi everyone,
>>>
>>> I'm writing a simple Java program that stands up a KDC using the
>>> SimpleKdcServer class, and I'm trying to use it for AS & TGS
>>> operations. Relevant code is below:
>>>
>>> kdc = new SimpleKdcServer();
>>> kdc.setKdcHost("kdc.example.com");
>>> kdc.setKdcPort(60088);
>>> kdc.setKdcRealm("EXAMPLE.COM");
>>>
>>> kdc.setAllowUdp(false);
>>> kdc.setWorkDir(keytabFile.getParentFile());
>>>
>>> kdc.init();
>>>
>>> kdc.createPrincipal("u1@EXAMPLE.COM", "u1pwd");
>>> kdc.createPrincipal("myservice/kdc.example.com@EXAMPLE.COM",
>>> "myservicepwd");
>>>
>>> kdc.start();
>>>
>>> I use kinit to fetch the TGT for my principal "u1" and that's
>>> successful.
>>> However, the subsequent TGS req from my client program fails with the
>>> error:
>>>
>>> GSSAPI continuation error: Unknown code krcM 137
>>>
>>> . I debugged through the source code for Kerby and saw that the full
>>> exception was not getting thrown because of a (e instanceof
>>> KdcRecoverableException) check. When I print the stacktrace via a
>>> debugger, I see the following (apologies for the huge stack trace):
>>>
>>> [pool-1-thread-1] INFO
>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found
>>> fast padata and starting to process it.
>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed at
>>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast(
>>> KdcRequest.java:213)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.request.
>>> KdcRequest.process(KdcRequest.java:170)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
>>> handleMessage(KdcHandler.java:116)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
>>> handleMessage(DefaultKdcHandler.java:67)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
>>> DefaultKdcHandler.java:52)
>>> at
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>>> ThreadPoolExecutor.java:1145)
>>> at
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>>> ThreadPoolExecutor.java:615)
>>> at java.lang.Thread.run(Thread.java:745)
>>> Caused by: java.io.IOException: Unexpected item context [0]
>>> [tag=0xA0, off=0, len=3+198], expecting 0x30 at
>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>>> Asn1Encodeable.java:219)
>>> at org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>>> Asn1Encodeable.java:207)
>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
>>> ... 9 more
>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed at
>>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast(
>>> KdcRequest.java:213)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.request.
>>> KdcRequest.process(KdcRequest.java:170)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
>>> handleMessage(KdcHandler.java:116)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
>>> handleMessage(DefaultKdcHandler.java:67)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
>>> DefaultKdcHandler.java:52)
>>> at
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>>> ThreadPoolExecutor.java:1145)
>>> at
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>>> ThreadPoolExecutor.java:615)
>>> at java.lang.Thread.run(Thread.java:745)
>>> Caused by: java.io.IOException: Unexpected item context [0]
>>> [tag=0xA0, off=0, len=3+198], expecting 0x30 at
>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>>> Asn1Encodeable.java:219)
>>> at org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>>> Asn1Encodeable.java:207)
>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
>>> ... 9 more
>>>
>>> The client program (and also kinit) were using the krb5.conf that
>>> was auto-generated by the SimpleKdcServer in the workdir, and looked
>>> like the following (I just replaced localhost with the FQDN of my
>>> machine):
>>>
>>> [libdefaults]
>>> kdc_realm = EXAMPLE.COM
>>> default_realm = EXAMPLE.COM
>>> udp_preference_limit = 1
>>> kdc_tcp_port = 60088
>>> #_KDC_UDP_PORT_
>>>
>>> [realms]
>>> EXAMPLE.COM = {
>>> kdc = kdc.example.com:60088
>>> }
>>>
>>> I had also enabled KRB5_TRACE on my client program that was making
>>> the TGS req, and it shows the following:
>>>
>>>
>>> [1588796] 1496515969.488037: ccselect can't find appropriate cache
>>> for server principal myservice/kdc.example.com@ [1588796]
>>> 1496515969.488112: Getting credentials u1@EXAMPLE.COM ->
>>> myservice/kdc.example.com@ using ccache FILE:/tmp/krb5cc_20474
>>> [1588796] 1496515969.488170: Retrieving u1@EXAMPLE.COM ->
>>> myservice/kdc.example.com@ from FILE:/tmp/krb5cc_20474 with result:
>>> -1765328243/Matching credential not found (filename:
>>> /tmp/krb5cc_20474) [1588796] 1496515969.488206: Retrying
>>> u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM with
>>> result: -1765328243/Matching credential not found (filename:
>>> /tmp/krb5cc_20474) [1588796] 1496515969.488214: Server has referral
>>> realm; starting with myservice/kdc.example.com@EXAMPLE.COM
>>> [1588796] 1496515969.488250: Retrieving u1@EXAMPLE.COM -> krbtgt/
>>> EXAMPLE.COM@EXAMPLE.COM from FILE:/tmp/krb5cc_20474 with result:
>>> 0/Success [1588796] 1496515969.488259: Starting with TGT for client
>>> realm:
>>> u1@EXAMPLE.COM -> krbtgt/EXAMPLE.COM@EXAMPLE.COM [1588796]
>>> 1496515969.488266: Requesting tickets for myservice/
>>> kdc.example.com@EXAMPLE.COM, referrals on [1588796]
>>> 1496515969.488298: Generated subkey for TGS request:
>>> aes128-cts/476E
>>> [1588796] 1496515969.488345: etypes requested in TGS request:
>>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
>>> camellia256-cts [1588796] 1496515969.488460: Encoding request body
>>> and padata into FAST request [1588796] 1496515969.488522: Sending
>>> request (835 bytes) to EXAMPLE.COM [1588796] 1496515969.488553:
>>> Resolving hostname kdc.example.com [1588796] 1496515969.488621:
>>> Initiating TCP connection to stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.488682: Sending TCP request to stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.492213: Received answer (134 bytes) from stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.492222: Terminating TCP connection to stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.492292: Response was not from master KDC
>>> [1588796] 1496515969.492309: TGS request result: -1765323383/Unknown
>>> code krcM 137 [1588796] 1496515969.492332: Requesting tickets for
>>> myservice/ kdc.example.com@EXAMPLE.COM, referrals off [1588796]
>>> 1496515969.492351: Generated subkey for TGS request:
>>> aes128-cts/AECC
>>> [1588796] 1496515969.492377: etypes requested in TGS request:
>>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
>>> camellia256-cts [1588796] 1496515969.492430: Encoding request body
>>> and padata into FAST request [1588796] 1496515969.492483: Sending
>>> request (835 bytes) to EXAMPLE.COM [1588796] 1496515969.492493:
>>> Resolving hostname kdc.example.com [1588796] 1496515969.492543:
>>> Initiating TCP connection to stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.492586: Sending TCP request to stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.496886: Received answer (134 bytes) from stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.496894: Terminating TCP connection to stream
>>> 172.17.0.53:60088
>>> [1588796] 1496515969.496948: Response was not from master KDC
>>> [1588796] 1496515969.496963: TGS request result: -1765323383/Unknown
>>> code krcM 137
>>>
>>>
>>> I've tried the same scenario with the MIT krb5kdc service with the
>>> same principals, and the TGS req is successful, with the trace log:
>>>
>>> [1590761] 1496516355.23070: ccselect module realm chose cache
>>> FILE:/tmp/krb5cc_20474 with client principal u1@EXAMPLE.COM for
>>> server principal myservice/kdc.example.com@EXAMPLE.COM
>>> [1590761] 1496516355.23150: Getting credentials u1@EXAMPLE.COM ->
>>> myservice/ kdc.example.com@EXAMPLE.COM using ccache
>>> FILE:/tmp/krb5cc_20474 [1590761] 1496516355.23212: Retrieving
>>> u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM from
>>> FILE:/tmp/krb5cc_20474 with result:
>>> -1765328243/Matching credential not found (filename:
>>> /tmp/krb5cc_20474) [1590761] 1496516355.23260: Retrieving
>>> u1@EXAMPLE.COM -> krbtgt/ EXAMPLE.COM@EXAMPLE.COM from
>>> FILE:/tmp/krb5cc_20474 with result: 0/Success [1590761]
>>> 1496516355.23269: Starting with
>> TGT for client realm:
>>> u1@EXAMPLE.COM -> krbtgt/EXAMPLE.COM@EXAMPLE.COM [1590761]
>>> 1496516355.23277: Requesting tickets for myservice/
>>> kdc.example.com@EXAMPLE.COM, referrals on [1590761]
>>> 1496516355.23312: Generated subkey for TGS request:
>>> aes256-cts/3F0A
>>> [1590761] 1496516355.23368: etypes requested in TGS request:
>>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
>>> camellia256-cts [1590761] 1496516355.23485: Encoding request body
>>> and padata into FAST request [1590761] 1496516355.23552: Sending
>>> request (933 bytes) to EXAMPLE.COM [1590761] 1496516355.23581:
>>> Resolving hostname kdc.example.com [1590761] 1496516355.23651:
>>> Sending initial UDP request to dgram
>>> 172.17.0.53:88
>>> [1590761] 1496516355.24205: Received answer (912 bytes) from dgram
>>> 172.17.0.53:88
>>> [1590761] 1496516355.24223: Response was not from master KDC
>>> [1590761] 1496516355.24240: Decoding FAST response [1590761]
>>> 1496516355.24334: FAST reply key: aes256-cts/8818 [1590761]
>>> 1496516355.24376: TGS reply is for u1@EXAMPLE.COM -> myservice/
>>> kdc.example.com@EXAMPLE.COM with session key aes256-cts/126E
>>> [1590761] 1496516355.24390: TGS request result: 0/Success [1590761]
>>> 1496516355.24395: Received creds for desired service myservice/
>>> kdc.example.com@EXAMPLE.COM [1590761] 1496516355.24401: Storing
>>> u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM in
>>> FILE:/tmp/krb5cc_20474 [1590761] 1496516355.24517: Retrieving
>>> u1@EXAMPLE.COM -> krbtgt/ EXAMPLE.COM@EXAMPLE.COM from
>>> FILE:/tmp/krb5cc_20474 with result: 0/Success [1590761]
>>> 1496516355.24528: Get cred via TGT krbtgt/ EXAMPLE.COM@EXAMPLE.COM
>>> after requesting krbtgt/EXAMPLE.COM@EXAMPLE.COM (canonicalize off)
>>> [1590761] 1496516355.24546: Generated subkey for TGS request:
>>> aes256-cts/0D91
>>> [1590761] 1496516355.24574: etypes requested in TGS request:
>>> aes256-cts [1590761] 1496516355.24633: Encoding request body and
>>> padata into FAST request [1590761] 1496516355.24689: Sending request
>>> (931 bytes) to EXAMPLE.COM [1590761] 1496516355.24699: Resolving
>>> hostname kdc.example.com [1590761] 1496516355.24750: Sending initial
>>> UDP request to dgram
>>> 172.17.0.53:88
>>> [1590761] 1496516355.25098: Received answer (900 bytes) from dgram
>>> 172.17.0.53:88
>>> [1590761] 1496516355.25115: Response was not from master KDC
>>> [1590761] 1496516355.25127: Decoding FAST response [1590761]
>>> 1496516355.25198: FAST reply key: aes256-cts/03AB [1590761]
>>> 1496516355.25234: TGS reply is for u1@EXAMPLE.COM -> krbtgt/
>>> EXAMPLE.COM@EXAMPLE.COM with session key aes256-cts/A423 [1590761]
>>> 1496516355.25246: Got cred; 0/Success [1590761] 1496516355.25315:
>>> Creating authenticator for u1@EXAMPLE.COM ->
>>> myservice/kdc.example.com@EXAMPLE.COM, seqnum 751690771, subkey
>>> aes256-cts/91D0, session key aes256-cts/126E
>>>
>>>
>>>
>>> My best guess is that maybe I'm missing some configuration steps in
>>> my Java code and that's causing the FAST request to fail. I couldn't
>>> find any code examples for kerby anywhere which can help me with my
>>> use case. Does anyone have any ideas about the above?
>>>
>>> Apologies again for the long email, just wanted to share my trials
>>> so far.
>>> Have a nice weekend.
>>>
>>> Cheers,
>>> Pratyush
>>>
>>
>>
>>
>> --
>> Colm O hEigeartaigh
>>
>> Talend Community Coder
>> http://coders.talend.com
>>
>
--
Marc de Lignie
Re: [Kerby] TGS req failing with "Unexpected item context"
Posted by Marc de Lignie <m....@xs4all.nl>.
Dear all,
My bad, it seems I made a separate issue for this, which might add more
details to DIRKRB-614 and might help you in finding the decode error:
https://issues.apache.org/jira/browse/DIRKRB-631
The workaround I mentioned is there, in the comments.
Cheers, Marc
Op 06-06-17 om 21:02 schreef Marc de Lignie:
> Pratjush,
>
> I just posted a temporary workaround as a comment below:
>
> https://issues.apache.org/jira/browse/DIRKRB-614
>
> Cheers, Marc
>
>
> Kai wrote:
>
> It seems so and we need to fix it. However, I don't see any obvious
> cause for it. Hope we can
> get to this sooner (should be next week) after some deadline is
> caught. Sorry for the late.
>
> Regards,
> Kai
>
> -----Original Message-----
> From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
> Sent: Monday, June 05, 2017 12:04 AM
> To: kerby@directory.apache.org
> Subject: Re: [Kerby] TGS req failing with "Unexpected item context"
>
> Looks like you're running into this known issue:
>
> https://issues.apache.org/jira/browse/DIRKRB-614
>
> Colm.
>
> On Sat, Jun 3, 2017 at 8:09 PM, pratyush parimal
> <pratyush.parimal@gmail.com
>> wrote:
>
>> Hi everyone,
>>
>> I'm writing a simple Java program that stands up a KDC using the
>> SimpleKdcServer class, and I'm trying to use it for AS & TGS
>> operations. Relevant code is below:
>>
>> kdc = new SimpleKdcServer();
>> kdc.setKdcHost("kdc.example.com");
>> kdc.setKdcPort(60088);
>> kdc.setKdcRealm("EXAMPLE.COM");
>>
>> kdc.setAllowUdp(false);
>> kdc.setWorkDir(keytabFile.getParentFile());
>>
>> kdc.init();
>>
>> kdc.createPrincipal("u1@EXAMPLE.COM", "u1pwd");
>> kdc.createPrincipal("myservice/kdc.example.com@EXAMPLE.COM",
>> "myservicepwd");
>>
>> kdc.start();
>>
>> I use kinit to fetch the TGT for my principal "u1" and that's
>> successful.
>> However, the subsequent TGS req from my client program fails with the
>> error:
>>
>> GSSAPI continuation error: Unknown code krcM 137
>>
>> . I debugged through the source code for Kerby and saw that the full
>> exception was not getting thrown because of a (e instanceof
>> KdcRecoverableException) check. When I print the stacktrace via a
>> debugger, I see the following (apologies for the huge stack trace):
>>
>> [pool-1-thread-1] INFO
>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found fast
>> padata and starting to process it.
>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed at
>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
>> at
>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast(
>> KdcRequest.java:213)
>> at
>> org.apache.kerby.kerberos.kerb.server.request.
>> KdcRequest.process(KdcRequest.java:170)
>> at
>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
>> handleMessage(KdcHandler.java:116)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
>> handleMessage(DefaultKdcHandler.java:67)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
>> DefaultKdcHandler.java:52)
>> at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>> ThreadPoolExecutor.java:1145)
>> at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>> ThreadPoolExecutor.java:615)
>> at java.lang.Thread.run(Thread.java:745)
>> Caused by: java.io.IOException: Unexpected item context [0]
>> [tag=0xA0, off=0, len=3+198], expecting 0x30 at
>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>> Asn1Encodeable.java:219)
>> at org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>> Asn1Encodeable.java:207)
>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
>> ... 9 more
>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed at
>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
>> at
>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast(
>> KdcRequest.java:213)
>> at
>> org.apache.kerby.kerberos.kerb.server.request.
>> KdcRequest.process(KdcRequest.java:170)
>> at
>> org.apache.kerby.kerberos.kerb.server.KdcHandler.
>> handleMessage(KdcHandler.java:116)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
>> handleMessage(DefaultKdcHandler.java:67)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
>> DefaultKdcHandler.java:52)
>> at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(
>> ThreadPoolExecutor.java:1145)
>> at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(
>> ThreadPoolExecutor.java:615)
>> at java.lang.Thread.run(Thread.java:745)
>> Caused by: java.io.IOException: Unexpected item context [0]
>> [tag=0xA0, off=0, len=3+198], expecting 0x30 at
>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>> Asn1Encodeable.java:219)
>> at org.apache.kerby.asn1.type.Asn1Encodeable.decode(
>> Asn1Encodeable.java:207)
>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
>> ... 9 more
>>
>> The client program (and also kinit) were using the krb5.conf that was
>> auto-generated by the SimpleKdcServer in the workdir, and looked like
>> the following (I just replaced localhost with the FQDN of my machine):
>>
>> [libdefaults]
>> kdc_realm = EXAMPLE.COM
>> default_realm = EXAMPLE.COM
>> udp_preference_limit = 1
>> kdc_tcp_port = 60088
>> #_KDC_UDP_PORT_
>>
>> [realms]
>> EXAMPLE.COM = {
>> kdc = kdc.example.com:60088
>> }
>>
>> I had also enabled KRB5_TRACE on my client program that was making
>> the TGS req, and it shows the following:
>>
>>
>> [1588796] 1496515969.488037: ccselect can't find appropriate cache
>> for server principal myservice/kdc.example.com@ [1588796]
>> 1496515969.488112: Getting credentials u1@EXAMPLE.COM ->
>> myservice/kdc.example.com@ using ccache FILE:/tmp/krb5cc_20474
>> [1588796] 1496515969.488170: Retrieving u1@EXAMPLE.COM ->
>> myservice/kdc.example.com@ from FILE:/tmp/krb5cc_20474 with result:
>> -1765328243/Matching credential not found (filename:
>> /tmp/krb5cc_20474) [1588796] 1496515969.488206: Retrying
>> u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM with result:
>> -1765328243/Matching credential not found (filename:
>> /tmp/krb5cc_20474) [1588796] 1496515969.488214: Server has referral
>> realm; starting with myservice/kdc.example.com@EXAMPLE.COM
>> [1588796] 1496515969.488250: Retrieving u1@EXAMPLE.COM -> krbtgt/
>> EXAMPLE.COM@EXAMPLE.COM from FILE:/tmp/krb5cc_20474 with result:
>> 0/Success [1588796] 1496515969.488259: Starting with TGT for client
>> realm:
>> u1@EXAMPLE.COM -> krbtgt/EXAMPLE.COM@EXAMPLE.COM [1588796]
>> 1496515969.488266: Requesting tickets for myservice/
>> kdc.example.com@EXAMPLE.COM, referrals on [1588796]
>> 1496515969.488298: Generated subkey for TGS request:
>> aes128-cts/476E
>> [1588796] 1496515969.488345: etypes requested in TGS request:
>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
>> camellia256-cts [1588796] 1496515969.488460: Encoding request body
>> and padata into FAST request [1588796] 1496515969.488522: Sending
>> request (835 bytes) to EXAMPLE.COM [1588796] 1496515969.488553:
>> Resolving hostname kdc.example.com [1588796] 1496515969.488621:
>> Initiating TCP connection to stream
>> 172.17.0.53:60088
>> [1588796] 1496515969.488682: Sending TCP request to stream
>> 172.17.0.53:60088
>> [1588796] 1496515969.492213: Received answer (134 bytes) from stream
>> 172.17.0.53:60088
>> [1588796] 1496515969.492222: Terminating TCP connection to stream
>> 172.17.0.53:60088
>> [1588796] 1496515969.492292: Response was not from master KDC
>> [1588796] 1496515969.492309: TGS request result: -1765323383/Unknown
>> code krcM 137 [1588796] 1496515969.492332: Requesting tickets for
>> myservice/ kdc.example.com@EXAMPLE.COM, referrals off [1588796]
>> 1496515969.492351: Generated subkey for TGS request:
>> aes128-cts/AECC
>> [1588796] 1496515969.492377: etypes requested in TGS request:
>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
>> camellia256-cts [1588796] 1496515969.492430: Encoding request body
>> and padata into FAST request [1588796] 1496515969.492483: Sending
>> request (835 bytes) to EXAMPLE.COM [1588796] 1496515969.492493:
>> Resolving hostname kdc.example.com [1588796] 1496515969.492543:
>> Initiating TCP connection to stream
>> 172.17.0.53:60088
>> [1588796] 1496515969.492586: Sending TCP request to stream
>> 172.17.0.53:60088
>> [1588796] 1496515969.496886: Received answer (134 bytes) from stream
>> 172.17.0.53:60088
>> [1588796] 1496515969.496894: Terminating TCP connection to stream
>> 172.17.0.53:60088
>> [1588796] 1496515969.496948: Response was not from master KDC
>> [1588796] 1496515969.496963: TGS request result: -1765323383/Unknown
>> code krcM 137
>>
>>
>> I've tried the same scenario with the MIT krb5kdc service with the
>> same principals, and the TGS req is successful, with the trace log:
>>
>> [1590761] 1496516355.23070: ccselect module realm chose cache
>> FILE:/tmp/krb5cc_20474 with client principal u1@EXAMPLE.COM for
>> server principal myservice/kdc.example.com@EXAMPLE.COM
>> [1590761] 1496516355.23150: Getting credentials u1@EXAMPLE.COM ->
>> myservice/ kdc.example.com@EXAMPLE.COM using ccache
>> FILE:/tmp/krb5cc_20474 [1590761] 1496516355.23212: Retrieving
>> u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM from
>> FILE:/tmp/krb5cc_20474 with result:
>> -1765328243/Matching credential not found (filename:
>> /tmp/krb5cc_20474) [1590761] 1496516355.23260: Retrieving
>> u1@EXAMPLE.COM -> krbtgt/ EXAMPLE.COM@EXAMPLE.COM from
>> FILE:/tmp/krb5cc_20474 with result: 0/Success [1590761]
>> 1496516355.23269: Starting with
> TGT for client realm:
>> u1@EXAMPLE.COM -> krbtgt/EXAMPLE.COM@EXAMPLE.COM [1590761]
>> 1496516355.23277: Requesting tickets for myservice/
>> kdc.example.com@EXAMPLE.COM, referrals on [1590761] 1496516355.23312:
>> Generated subkey for TGS request:
>> aes256-cts/3F0A
>> [1590761] 1496516355.23368: etypes requested in TGS request:
>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
>> camellia256-cts [1590761] 1496516355.23485: Encoding request body and
>> padata into FAST request [1590761] 1496516355.23552: Sending request
>> (933 bytes) to EXAMPLE.COM [1590761] 1496516355.23581: Resolving
>> hostname kdc.example.com [1590761] 1496516355.23651: Sending initial
>> UDP request to dgram
>> 172.17.0.53:88
>> [1590761] 1496516355.24205: Received answer (912 bytes) from dgram
>> 172.17.0.53:88
>> [1590761] 1496516355.24223: Response was not from master KDC
>> [1590761] 1496516355.24240: Decoding FAST response [1590761]
>> 1496516355.24334: FAST reply key: aes256-cts/8818 [1590761]
>> 1496516355.24376: TGS reply is for u1@EXAMPLE.COM -> myservice/
>> kdc.example.com@EXAMPLE.COM with session key aes256-cts/126E
>> [1590761] 1496516355.24390: TGS request result: 0/Success [1590761]
>> 1496516355.24395: Received creds for desired service myservice/
>> kdc.example.com@EXAMPLE.COM [1590761] 1496516355.24401: Storing
>> u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM in
>> FILE:/tmp/krb5cc_20474 [1590761] 1496516355.24517: Retrieving
>> u1@EXAMPLE.COM -> krbtgt/ EXAMPLE.COM@EXAMPLE.COM from
>> FILE:/tmp/krb5cc_20474 with result: 0/Success [1590761]
>> 1496516355.24528: Get cred via TGT krbtgt/ EXAMPLE.COM@EXAMPLE.COM
>> after requesting krbtgt/EXAMPLE.COM@EXAMPLE.COM (canonicalize off)
>> [1590761] 1496516355.24546: Generated subkey for TGS request:
>> aes256-cts/0D91
>> [1590761] 1496516355.24574: etypes requested in TGS request:
>> aes256-cts [1590761] 1496516355.24633: Encoding request body and
>> padata into FAST request [1590761] 1496516355.24689: Sending request
>> (931 bytes) to EXAMPLE.COM [1590761] 1496516355.24699: Resolving
>> hostname kdc.example.com [1590761] 1496516355.24750: Sending initial
>> UDP request to dgram
>> 172.17.0.53:88
>> [1590761] 1496516355.25098: Received answer (900 bytes) from dgram
>> 172.17.0.53:88
>> [1590761] 1496516355.25115: Response was not from master KDC
>> [1590761] 1496516355.25127: Decoding FAST response [1590761]
>> 1496516355.25198: FAST reply key: aes256-cts/03AB [1590761]
>> 1496516355.25234: TGS reply is for u1@EXAMPLE.COM -> krbtgt/
>> EXAMPLE.COM@EXAMPLE.COM with session key aes256-cts/A423 [1590761]
>> 1496516355.25246: Got cred; 0/Success [1590761] 1496516355.25315:
>> Creating authenticator for u1@EXAMPLE.COM ->
>> myservice/kdc.example.com@EXAMPLE.COM, seqnum 751690771, subkey
>> aes256-cts/91D0, session key aes256-cts/126E
>>
>>
>>
>> My best guess is that maybe I'm missing some configuration steps in
>> my Java code and that's causing the FAST request to fail. I couldn't
>> find any code examples for kerby anywhere which can help me with my
>> use case. Does anyone have any ideas about the above?
>>
>> Apologies again for the long email, just wanted to share my trials so
>> far.
>> Have a nice weekend.
>>
>> Cheers,
>> Pratyush
>>
>
>
>
> --
> Colm O hEigeartaigh
>
> Talend Community Coder
> http://coders.talend.com
>
--
Marc de Lignie
RE: [Kerby] TGS req failing with "Unexpected item context"
Posted by Marc de Lignie <m....@xs4all.nl>.
Pratjush,
I just posted a temporary workaround as a comment below:
https://issues.apache.org/jira/browse/DIRKRB-614
Cheers, Marc
Kai wrote:
It seems so and we need to fix it. However, I don't see any obvious cause for it. Hope we can
get to this sooner (should be next week) after some deadline is caught. Sorry for the late.
Regards,
Kai
-----Original Message-----
From: Colm O hEigeartaigh [mailto:coheigea@apache.org]
Sent: Monday, June 05, 2017 12:04 AM
To: kerby@directory.apache.org
Subject: Re: [Kerby] TGS req failing with "Unexpected item context"
Looks like you're running into this known issue:
https://issues.apache.org/jira/browse/DIRKRB-614
Colm.
On Sat, Jun 3, 2017 at 8:09 PM, pratyush parimal <pratyush.parimal@gmail.com
> wrote:
> Hi everyone,
>
> I'm writing a simple Java program that stands up a KDC using the
> SimpleKdcServer class, and I'm trying to use it for AS & TGS
> operations. Relevant code is below:
>
> kdc = new SimpleKdcServer();
> kdc.setKdcHost("kdc.example.com");
> kdc.setKdcPort(60088);
> kdc.setKdcRealm("EXAMPLE.COM");
>
> kdc.setAllowUdp(false);
> kdc.setWorkDir(keytabFile.getParentFile());
>
> kdc.init();
>
> kdc.createPrincipal("u1@EXAMPLE.COM", "u1pwd");
> kdc.createPrincipal("myservice/kdc.example.com@EXAMPLE.COM",
> "myservicepwd");
>
> kdc.start();
>
> I use kinit to fetch the TGT for my principal "u1" and that's successful.
> However, the subsequent TGS req from my client program fails with the
> error:
>
> GSSAPI continuation error: Unknown code krcM 137
>
> . I debugged through the source code for Kerby and saw that the full
> exception was not getting thrown because of a (e instanceof
> KdcRecoverableException) check. When I print the stacktrace via a
> debugger, I see the following (apologies for the huge stack trace):
>
> [pool-1-thread-1] INFO
> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found fast
> padata and starting to process it.
> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed at
> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
> at
> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast(
> KdcRequest.java:213)
> at
> org.apache.kerby.kerberos.kerb.server.request.
> KdcRequest.process(KdcRequest.java:170)
> at
> org.apache.kerby.kerberos.kerb.server.KdcHandler.
> handleMessage(KdcHandler.java:116)
> at
> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
> handleMessage(DefaultKdcHandler.java:67)
> at
> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> DefaultKdcHandler.java:52)
> at
> java.util.concurrent.ThreadPoolExecutor.runWorker(
> ThreadPoolExecutor.java:1145)
> at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> ThreadPoolExecutor.java:615)
> at java.lang.Thread.run(Thread.java:745)
> Caused by: java.io.IOException: Unexpected item context [0] [tag=0xA0,
> off=0, len=3+198], expecting 0x30 at
> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> Asn1Encodeable.java:219)
> at org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> Asn1Encodeable.java:207)
> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
> ... 9 more
> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed at
> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
> at
> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast(
> KdcRequest.java:213)
> at
> org.apache.kerby.kerberos.kerb.server.request.
> KdcRequest.process(KdcRequest.java:170)
> at
> org.apache.kerby.kerberos.kerb.server.KdcHandler.
> handleMessage(KdcHandler.java:116)
> at
> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.
> handleMessage(DefaultKdcHandler.java:67)
> at
> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(
> DefaultKdcHandler.java:52)
> at
> java.util.concurrent.ThreadPoolExecutor.runWorker(
> ThreadPoolExecutor.java:1145)
> at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(
> ThreadPoolExecutor.java:615)
> at java.lang.Thread.run(Thread.java:745)
> Caused by: java.io.IOException: Unexpected item context [0] [tag=0xA0,
> off=0, len=3+198], expecting 0x30 at
> org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> Asn1Encodeable.java:219)
> at org.apache.kerby.asn1.type.Asn1Encodeable.decode(
> Asn1Encodeable.java:207)
> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
> ... 9 more
>
> The client program (and also kinit) were using the krb5.conf that was
> auto-generated by the SimpleKdcServer in the workdir, and looked like
> the following (I just replaced localhost with the FQDN of my machine):
>
> [libdefaults]
> kdc_realm = EXAMPLE.COM
> default_realm = EXAMPLE.COM
> udp_preference_limit = 1
> kdc_tcp_port = 60088
> #_KDC_UDP_PORT_
>
> [realms]
> EXAMPLE.COM = {
> kdc = kdc.example.com:60088
> }
>
> I had also enabled KRB5_TRACE on my client program that was making the
> TGS req, and it shows the following:
>
>
> [1588796] 1496515969.488037: ccselect can't find appropriate cache for
> server principal myservice/kdc.example.com@ [1588796]
> 1496515969.488112: Getting credentials u1@EXAMPLE.COM ->
> myservice/kdc.example.com@ using ccache FILE:/tmp/krb5cc_20474
> [1588796] 1496515969.488170: Retrieving u1@EXAMPLE.COM ->
> myservice/kdc.example.com@ from FILE:/tmp/krb5cc_20474 with result:
> -1765328243/Matching credential not found (filename:
> /tmp/krb5cc_20474) [1588796] 1496515969.488206: Retrying
> u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM with result:
> -1765328243/Matching credential not found (filename:
> /tmp/krb5cc_20474) [1588796] 1496515969.488214: Server has referral
> realm; starting with myservice/kdc.example.com@EXAMPLE.COM
> [1588796] 1496515969.488250: Retrieving u1@EXAMPLE.COM -> krbtgt/
> EXAMPLE.COM@EXAMPLE.COM from FILE:/tmp/krb5cc_20474 with result:
> 0/Success [1588796] 1496515969.488259: Starting with TGT for client realm:
> u1@EXAMPLE.COM -> krbtgt/EXAMPLE.COM@EXAMPLE.COM [1588796]
> 1496515969.488266: Requesting tickets for myservice/
> kdc.example.com@EXAMPLE.COM, referrals on [1588796] 1496515969.488298:
> Generated subkey for TGS request:
> aes128-cts/476E
> [1588796] 1496515969.488345: etypes requested in TGS request:
> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
> camellia256-cts [1588796] 1496515969.488460: Encoding request body and
> padata into FAST request [1588796] 1496515969.488522: Sending request
> (835 bytes) to EXAMPLE.COM [1588796] 1496515969.488553: Resolving
> hostname kdc.example.com [1588796] 1496515969.488621: Initiating TCP
> connection to stream
> 172.17.0.53:60088
> [1588796] 1496515969.488682: Sending TCP request to stream
> 172.17.0.53:60088
> [1588796] 1496515969.492213: Received answer (134 bytes) from stream
> 172.17.0.53:60088
> [1588796] 1496515969.492222: Terminating TCP connection to stream
> 172.17.0.53:60088
> [1588796] 1496515969.492292: Response was not from master KDC
> [1588796] 1496515969.492309: TGS request result: -1765323383/Unknown
> code krcM 137 [1588796] 1496515969.492332: Requesting tickets for
> myservice/ kdc.example.com@EXAMPLE.COM, referrals off [1588796]
> 1496515969.492351: Generated subkey for TGS request:
> aes128-cts/AECC
> [1588796] 1496515969.492377: etypes requested in TGS request:
> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
> camellia256-cts [1588796] 1496515969.492430: Encoding request body and
> padata into FAST request [1588796] 1496515969.492483: Sending request
> (835 bytes) to EXAMPLE.COM [1588796] 1496515969.492493: Resolving
> hostname kdc.example.com [1588796] 1496515969.492543: Initiating TCP
> connection to stream
> 172.17.0.53:60088
> [1588796] 1496515969.492586: Sending TCP request to stream
> 172.17.0.53:60088
> [1588796] 1496515969.496886: Received answer (134 bytes) from stream
> 172.17.0.53:60088
> [1588796] 1496515969.496894: Terminating TCP connection to stream
> 172.17.0.53:60088
> [1588796] 1496515969.496948: Response was not from master KDC
> [1588796] 1496515969.496963: TGS request result: -1765323383/Unknown
> code krcM 137
>
>
> I've tried the same scenario with the MIT krb5kdc service with the
> same principals, and the TGS req is successful, with the trace log:
>
> [1590761] 1496516355.23070: ccselect module realm chose cache
> FILE:/tmp/krb5cc_20474 with client principal u1@EXAMPLE.COM for server
> principal myservice/kdc.example.com@EXAMPLE.COM
> [1590761] 1496516355.23150: Getting credentials u1@EXAMPLE.COM ->
> myservice/ kdc.example.com@EXAMPLE.COM using ccache
> FILE:/tmp/krb5cc_20474 [1590761] 1496516355.23212: Retrieving
> u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM from
> FILE:/tmp/krb5cc_20474 with result:
> -1765328243/Matching credential not found (filename:
> /tmp/krb5cc_20474) [1590761] 1496516355.23260: Retrieving
> u1@EXAMPLE.COM -> krbtgt/ EXAMPLE.COM@EXAMPLE.COM from
> FILE:/tmp/krb5cc_20474 with result: 0/Success [1590761] 1496516355.23269: Starting with
TGT for client realm:
> u1@EXAMPLE.COM -> krbtgt/EXAMPLE.COM@EXAMPLE.COM [1590761]
> 1496516355.23277: Requesting tickets for myservice/
> kdc.example.com@EXAMPLE.COM, referrals on [1590761] 1496516355.23312:
> Generated subkey for TGS request:
> aes256-cts/3F0A
> [1590761] 1496516355.23368: etypes requested in TGS request:
> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts,
> camellia256-cts [1590761] 1496516355.23485: Encoding request body and
> padata into FAST request [1590761] 1496516355.23552: Sending request
> (933 bytes) to EXAMPLE.COM [1590761] 1496516355.23581: Resolving
> hostname kdc.example.com [1590761] 1496516355.23651: Sending initial
> UDP request to dgram
> 172.17.0.53:88
> [1590761] 1496516355.24205: Received answer (912 bytes) from dgram
> 172.17.0.53:88
> [1590761] 1496516355.24223: Response was not from master KDC [1590761]
> 1496516355.24240: Decoding FAST response [1590761] 1496516355.24334:
> FAST reply key: aes256-cts/8818 [1590761] 1496516355.24376: TGS reply
> is for u1@EXAMPLE.COM -> myservice/ kdc.example.com@EXAMPLE.COM with
> session key aes256-cts/126E [1590761] 1496516355.24390: TGS request
> result: 0/Success [1590761] 1496516355.24395: Received creds for
> desired service myservice/ kdc.example.com@EXAMPLE.COM [1590761]
> 1496516355.24401: Storing u1@EXAMPLE.COM -> myservice/
> kdc.example.com@EXAMPLE.COM in FILE:/tmp/krb5cc_20474 [1590761]
> 1496516355.24517: Retrieving u1@EXAMPLE.COM -> krbtgt/
> EXAMPLE.COM@EXAMPLE.COM from FILE:/tmp/krb5cc_20474 with result:
> 0/Success [1590761] 1496516355.24528: Get cred via TGT krbtgt/
> EXAMPLE.COM@EXAMPLE.COM after requesting
> krbtgt/EXAMPLE.COM@EXAMPLE.COM (canonicalize off) [1590761]
> 1496516355.24546: Generated subkey for TGS request:
> aes256-cts/0D91
> [1590761] 1496516355.24574: etypes requested in TGS request:
> aes256-cts [1590761] 1496516355.24633: Encoding request body and
> padata into FAST request [1590761] 1496516355.24689: Sending request
> (931 bytes) to EXAMPLE.COM [1590761] 1496516355.24699: Resolving
> hostname kdc.example.com [1590761] 1496516355.24750: Sending initial
> UDP request to dgram
> 172.17.0.53:88
> [1590761] 1496516355.25098: Received answer (900 bytes) from dgram
> 172.17.0.53:88
> [1590761] 1496516355.25115: Response was not from master KDC [1590761]
> 1496516355.25127: Decoding FAST response [1590761] 1496516355.25198:
> FAST reply key: aes256-cts/03AB [1590761] 1496516355.25234: TGS reply
> is for u1@EXAMPLE.COM -> krbtgt/ EXAMPLE.COM@EXAMPLE.COM with session
> key aes256-cts/A423 [1590761] 1496516355.25246: Got cred; 0/Success
> [1590761] 1496516355.25315: Creating authenticator for u1@EXAMPLE.COM
> -> myservice/kdc.example.com@EXAMPLE.COM, seqnum 751690771, subkey
> aes256-cts/91D0, session key aes256-cts/126E
>
>
>
> My best guess is that maybe I'm missing some configuration steps in my
> Java code and that's causing the FAST request to fail. I couldn't find
> any code examples for kerby anywhere which can help me with my use
> case. Does anyone have any ideas about the above?
>
> Apologies again for the long email, just wanted to share my trials so far.
> Have a nice weekend.
>
> Cheers,
> Pratyush
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
Re: MIT Kerberos compatibility
Posted by Marc de Lignie <m....@xs4all.nl>.
Hi Jiajia and Kai,
Puzzled by the fact that the Mit Kerberos over python service ticket
request works on Jiajia's system but not on mine. I attempted to request
the service ticket with Mit Kerberos's kinit tool and .... it worked.
This means that my issue probably lies in the kerberos python wrapper
around the Mit Kerberos shared libs (or in the way how I use it). I
tried both with the Debian python-kerberos package,
https://pypi.python.org/pypi/kerberos and with
https://pypi.python.org/pypi/pykerberos/1.1.14, neither of which got the
ticket. This still makes me curious where Mac-OS gets its python
kerberos package from :-)
Here, the kinit shell commands to reproduce my test.
cd $PROJECTROOT
WORKDIR=kerby-kerb/kerb-kdc-test/target/tmp
export KRB5_CONFIG=$WORKDIR/krb5.conf
export KRB5CCNAME=$WORKDIR/test-tkt.cc
export KRB5_TRACE=/dev/stdout
$ kinit -S test-service/localhost
[3141] 1494161999.566468: Getting initial credentials for drankye@TEST.COM
[3141] 1494161999.566835: Setting initial creds service to
test-service/localhost
[3141] 1494161999.566952: Sending request (168 bytes) to TEST.COM
[3141] 1494161999.566997: Resolving hostname localhost
[3141] 1494161999.567467: Sending initial UDP request to dgram
127.0.0.1:45527
[3141] 1494161999.573494: Received answer (555 bytes) from dgram
127.0.0.1:45527
[3141] 1494161999.576791: Response was not from master KDC
[3141] 1494161999.576822: Salt derived from principal: TEST.COMdrankye
[3141] 1494161999.576824: Getting AS key, salt "TEST.COMdrankye", params ""
Password for drankye@TEST.COM:
[3141] 1494162015.450071: AS key obtained from gak_fct: aes128-cts/0548
[3141] 1494162015.450101: Decrypted AS reply; session key is:
aes128-cts/4EFE
[3141] 1494162015.450103: FAST negotiation: unavailable
[3141] 1494162015.450112: Initializing
FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with default princ
drankye@TEST.COM
[3141] 1494162015.450305: Storing drankye@TEST.COM ->
test-service/localhost@TEST.COM in
FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
$ klist
Ticket cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
Default principal: drankye@TEST.COM
Valid starting Expires Service principal
07-05-17 14:59:59 08-05-17 14:59:59 test-service/localhost@TEST.COM
renew until 08-05-17 14:59:59
What is also notable here is that the TestKdc only produces one log message:
[nioEventLoopGroup-5-1] INFO
org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ ISSUE:
authtime 1494164956766,drankye@TEST.COM for test-service/localhost@TEST.COM
while in the error situation from python it produces (and not the AS_REQ
line):
[nioEventLoopGroup-5-1] INFO
org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found fast
padata and starting to process it.
[nioEventLoopGroup-5-1] INFO
org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found fast
padata and starting to process it.
Note also that kinit requires to give the password while in the python
testcase it is attempted to use the tgt from the credential cache.
Maybe it also useful to restate my target: I want to authenticate a
python client towards a service using GSSAPI with SASL (the service
being gremlin-server from the Apache Tinkerpop project). So I want to
get the service ticket using GSSAPI and an existing tgt from the
credential cache.
Any additional hints are welcome, good luck with the Kerby GA release.
Marc
Op 05-05-17 om 22:12 schreef Marc de Lignie:
> Hi Jiajia,
>
> Thanks for the netty config option. This indeed helped to get rid of
> the udp errors, but did not help in getting the service ticket (final
> error message remains the same).
>
> I also noticed that I get the same error from the python console
> whether I specify the right service name or some service name for
> which no service principal exists in the TestKdc.
>
> I did not succeed in getting mvn tst to print the debug logging of the
> various kdc classes involved.
>
> Did you check with klist whether drankye's credential cache contains
> the service ticket for test-service?
>
> Cheers, Marc
>
>
> Op 04-05-17 om 14:55 schreef Li, Jiajia:
>> Hi Marc,
>> I try to run your test(through applying your patch in the trunk) , I
>> think it's success now. Could you take some time to check about it?
>> Here is the log:
>>
>> directory-kerby git:(trunk) ✗ .
>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/server/MitIssueTest.sh
>> kerberos.authGSSClientInit successful
>> 2017-05-04T20:44:06 set-error: -1765328234: entypes not supported
>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>> for krb5_ccache_conf_data/realm-config@X-CACHECONF: in cache
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>> for test-service/localhost@TEST.COM in cache
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>> for
>> krb5_ccache_conf_data/negative-cache/test-service\134/localhost\134@TEST.COM@X-CACHECONF:
>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>> for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF: in cache
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>> for krb5_ccache_conf_data/sitename@X-CACHECONF: in cache
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>> for test-service/localhost@TEST.COM in cache
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>> des-cbc-md5-deprecated not supported
>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>> des-cbc-md4-deprecated not supported
>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>> des-cbc-crc-deprecated not supported
>> 2017-05-04T20:44:06 Trying to find service kdc for realm TEST.COM
>> flags 0
>> 2017-05-04T20:44:06 configuration file for realm TEST.COM found
>> 2017-05-04T20:44:06 submissing new requests to new host
>> 2017-05-04T20:44:06 host_create: setting hostname localhost
>> 2017-05-04T20:44:06 connecting to host: udp ::1:52534 (localhost)
>> tid: 00000001
>> 2017-05-04T20:44:06 host_create: setting hostname localhost
>> 2017-05-04T20:44:06 Queuing host in future (in 3s), its the 2 address
>> on the same name: udp 127.0.0.1:52534 (localhost) tid: 00000002
>> 2017-05-04T20:44:06 writing packet: udp ::1:52534 (localhost) tid:
>> 00000001
>> 2017-05-04T20:44:06 reading packet: udp ::1:52534 (localhost) tid:
>> 00000001
>> 2017-05-04T20:44:06 host completed: udp ::1:52534 (localhost) tid:
>> 00000001
>> 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0 hosts 1
>> packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814 tid: 00000002
>> 2017-05-04T20:44:06 tkt: extract key 17/763641F3
>> 2017-05-04T20:44:06 set-error: -1765328353: Decrypt integrity check
>> failed for checksum type hmac-sha1-96-aes128, key type
>> aes128-cts-hmac-sha1-96
>> 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
>> 2017-05-04T20:44:06 krb5_get_credentials_with_flags: TEST.COM wc:
>> 0.050317
>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>> for krb5_ccache_conf_data/realm-config@X-CACHECONF: in cache
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential
>> for
>> krb5_ccache_conf_data/time-offset/test-service\134/localhost\134@TEST.COM@X-CACHECONF:
>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> 2017-05-04T20:44:06 Setting up PFS for auth context
>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>> des-cbc-md5-deprecated not supported
>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>> des-cbc-md4-deprecated not supported
>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type
>> des-cbc-crc-deprecated not supported
>> First kerberos.authGSSClientStep successful
>>
>> Thanks
>> Jiajia
>>
>> -----Original Message-----
>> From: Zheng, Kai [mailto:kai.zheng@intel.com]
>> Sent: Wednesday, May 3, 2017 7:29 PM
>> To: kerby@directory.apache.org
>> Subject: RE: MIT Kerberos compatibility
>>
>> Hi Marc,
>>
>> In case you're not aware of this, please check out the latest fix
>> made by Jiajia. We thought your case may be different, but would be
>> good to have a check before we can repeat/fix your case. Thanks.
>> https://issues.apache.org/jira/browse/DIRKRB-625
>>
>> Regards,
>> Kai
>>
>> -----Original Message-----
>> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
>> Sent: Sunday, April 30, 2017 7:45 PM
>> To: kerby@directory.apache.org
>> Subject: Re: MIT Kerberos compatibility
>>
>> Hi Kai,
>>
>> The terminal output below is for the latest MIT Kerberos 1.15.1
>> (locally built on Ubuntu Xenial). Before that, I also tested with the
>> default Xenial MIT Kerberos packages (1.13.2), with the same result.
>> I did not try earlier MIT Kerberos versions.
>>
>> Marc
>>
>> Op 29-04-17 om 21:42 schreef Marc de Lignie:
>>> Hi Kai,
>>>
>>> Thanks for the response. I prepared a minimal config that reproduces
>>> my problem.
>>>
>>> You can fetch the branch/commit from:
>>> https://github.com/vtslab/directory-kerby/commits/MitIssue
>>>
>>> This is relative to RC2, but I also tried this on trunk for my actual
>>> project.
>>>
>>> This config produces the debug and error messages below.
>>>
>>> 1. For the terminal with the bash + python script $ klist Ticket
>>> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>> Default principal: drankye@TEST.COM
>>>
>>> Valid starting Expires Service principal
>>> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/TEST.COM@TEST.COM
>>> renew until 29-04-17 21:07:39
>>>
>>> $ .
>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/
>>> server/MitIssueTest.sh [15538] 1493491231.917606: Retrieving
>>> drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0,
>>> enctype 0) with result:
>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [15538]
>>> 1493491231.917827: Retrieving drankye@TEST.COM from
>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>>> kerberos.authGSSClientInit successful [15538] 1493491231.918185:
>>> Getting credentials drankye@TEST.COM -> test-service/localhost@ using
>>> ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>>> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
>>> test-service/localhost@ from
>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>>> -1765328243/Matching credential not found (filename:
>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
>>> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
>>> test-service/localhost@TEST.COM with result: -1765328243/Matching
>>> credential not found (filename:
>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
>>> [15538] 1493491231.918229: Server has referral realm; starting with
>>> test-service/localhost@TEST.COM [15538] 1493491231.918278: Retrieving
>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM from
>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>>> 0/Success
>>> [15538] 1493491231.918281: Starting with TGT for client realm:
>>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
>>> 1493491231.918301: Requesting tickets for
>>> test-service/localhost@TEST.COM, referrals on [15538]
>>> 1493491231.918326: Generated subkey for TGS request:
>>> aes128-cts/FA30
>>> [15538] 1493491231.918359: etypes requested in TGS request:
>>> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1,
>>> rc4-hmac, camellia128-cts, camellia256-cts [15538] 1493491231.918484:
>>> Encoding request body and padata into FAST request [15538]
>>> 1493491231.918541: Sending request (836 bytes) to TEST.COM [15538]
>>> 1493491231.918597: Resolving hostname localhost [15538]
>>> 1493491231.918703: Initiating TCP connection to stream
>>> 127.0.0.1:44292
>>> [15538] 1493491231.918777: Sending TCP request to stream
>>> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error receiving from
>>> stream
>>> 127.0.0.1:44292: 104/Connection reset by peer [15538]
>>> 1493491231.922812: Terminating TCP connection to stream
>>> 127.0.0.1:44292
>>> [15538] 1493491231.922858: Sending initial UDP request to dgram
>>> 127.0.0.1:44292
>>> ('First kerberos.authGSSClientStep not successful',
>>> GSSError(('Unspecified GSS failure. Minor code may provide more
>>> information', 851968), ("Cannot contact any KDC for realm 'TEST.COM'",
>>> -1765328228)))
>>>
>>> 2. For the terminal that runs mvn clean test -Dtest=MitIssueTest
>>> Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
>>> 2017-04-29 21:07:39,182 DEBUG [main] backend.AbstractIdentityBackend:
>>> initialize called
>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
>>> getIdentity called, principalName = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
>>> getIdentity failed, principalName = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>>> addIdentity successful, principalName = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>>> getIdentity called, principalName = kadmin/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>>> getIdentity failed, principalName = kadmin/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,213 DEBUG [main] backend.AbstractIdentityBackend:
>>> addIdentity successful, principalName = kadmin/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,216 DEBUG [main] backend.AbstractIdentityBackend:
>>> start called
>>> 2017-04-29 21:07:39,232 DEBUG [main] backend.AbstractIdentityBackend:
>>> addIdentity successful, principalName =
>>> test-service/localhost@TEST.COM
>>> 2017-04-29 21:07:39,425 DEBUG [main] backend.AbstractIdentityBackend:
>>> addIdentity successful, principalName = drankye@TEST.COM
>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>>> = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1] request.KdcRequest:
>>> Client entry is empty.
>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> drankye@TEST.COM
>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>>> = drankye@TEST.COM
>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>>> = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>> disconnecting abnormally java.io.EOFException
>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>>> at
>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
>>>
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>>>
>>> at java.lang.Thread.run(Thread.java:748)
>>> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase: Storing the
>>> tgt to the credential cache file.
>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
>>> getIdentity called, principalName = test-service/localhost@TEST.COM
>>> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
>>> getIdentity successful, principalName =
>>> test-service/localhost@TEST.COM
>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>>> = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1] request.KdcRequest:
>>> Client entry is empty.
>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> test-service/localhost@TEST.COM
>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>>> = test-service/localhost@TEST.COM
>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>>> = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1] request.KdcRequest:
>>> The preauth data is empty.
>>> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1] server.KdcHandler: KRB
>>> error occurred while processing request:Additional pre-authentication
>>> required
>>> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>> disconnecting abnormally java.io.EOFException
>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>>> at
>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
>>>
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>>>
>>> at java.lang.Thread.run(Thread.java:748)
>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>>> = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1] request.KdcRequest:
>>> Client entry is empty.
>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> test-service/localhost@TEST.COM
>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>>> = test-service/localhost@TEST.COM
>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>>> = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>> disconnecting abnormally java.io.EOFException
>>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>>> at
>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
>>>
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>>>
>>> at java.lang.Thread.run(Thread.java:748)
>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>>> krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
>>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>>> = krbtgt/TEST.COM@TEST.COM
>>> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1] request.KdcRequest:
>>> Found fast padata and start to process it.
>>> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
>>> impl.DefaultKdcHandler: Error occured while processing request:
>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
>>> at
>>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
>>> at
>>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
>>> at
>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast(KdcRequest.java:208)
>>>
>>> at
>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.process(KdcRequest.java:168)
>>>
>>> at
>>> org.apache.kerby.kerberos.kerb.server.KdcHandler.handleMessage(KdcHandler.java:115)
>>>
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.handleMessage(DefaultKdcHandler.java:67)
>>>
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:52)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>>>
>>> at java.lang.Thread.run(Thread.java:748)
>>> Caused by: java.io.IOException: Unexpected item context [0] [tag=0xA0,
>>> off=0, len=3+207], expecting 0x30
>>> at
>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(Asn1Encodeable.java:210)
>>>
>>> at
>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(Asn1Encodeable.java:197)
>>>
>>> at
>>> org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
>>> ... 9 more
>>> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
>>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>>> disconnecting abnormally
>>> java.net.SocketException: Socket closed
>>> at java.net.SocketInputStream.socketRead0(Native Method)
>>> at
>>> java.net.SocketInputStream.socketRead(SocketInputStream.java:116)
>>> at java.net.SocketInputStream.read(SocketInputStream.java:171)
>>> at java.net.SocketInputStream.read(SocketInputStream.java:141)
>>> at java.net.SocketInputStream.read(SocketInputStream.java:224)
>>> at java.io.DataInputStream.readInt(DataInputStream.java:387)
>>> at
>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
>>>
>>> at
>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>>>
>>> at
>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>>>
>>> at java.lang.Thread.run(Thread.java:748)
>>>
>>> In a FreeIPA environment these python lines "just" work.
>>>
>>> Any suggestions are welcome!
>>>
>>> Marc
>>>
>>>
>> --
>> Marc de Lignie
>>
>
--
Marc de Lignie
Re: MIT Kerberos compatibility
Posted by Marc de Lignie <m....@xs4all.nl>.
Hi Jiajia,
Thanks for the netty config option. This indeed helped to get rid of the
udp errors, but did not help in getting the service ticket (final error
message remains the same).
I also noticed that I get the same error from the python console whether
I specify the right service name or some service name for which no
service principal exists in the TestKdc.
I did not succeed in getting mvn tst to print the debug logging of the
various kdc classes involved.
Did you check with klist whether drankye's credential cache contains the
service ticket for test-service?
Cheers, Marc
Op 04-05-17 om 14:55 schreef Li, Jiajia:
> Hi Marc,
> I try to run your test(through applying your patch in the trunk) , I think it's success now. Could you take some time to check about it?
> Here is the log:
>
> directory-kerby git:(trunk) ✗ . kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/server/MitIssueTest.sh
> kerberos.authGSSClientInit successful
> 2017-05-04T20:44:06 set-error: -1765328234: entypes not supported
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential for krb5_ccache_conf_data/realm-config@X-CACHECONF: in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential for test-service/localhost@TEST.COM in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential for krb5_ccache_conf_data/negative-cache/test-service\134/localhost\134@TEST.COM@X-CACHECONF: in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF: in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential for krb5_ccache_conf_data/sitename@X-CACHECONF: in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential for test-service/localhost@TEST.COM in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type des-cbc-md5-deprecated not supported
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type des-cbc-md4-deprecated not supported
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type des-cbc-crc-deprecated not supported
> 2017-05-04T20:44:06 Trying to find service kdc for realm TEST.COM flags 0
> 2017-05-04T20:44:06 configuration file for realm TEST.COM found
> 2017-05-04T20:44:06 submissing new requests to new host
> 2017-05-04T20:44:06 host_create: setting hostname localhost
> 2017-05-04T20:44:06 connecting to host: udp ::1:52534 (localhost) tid: 00000001
> 2017-05-04T20:44:06 host_create: setting hostname localhost
> 2017-05-04T20:44:06 Queuing host in future (in 3s), its the 2 address on the same name: udp 127.0.0.1:52534 (localhost) tid: 00000002
> 2017-05-04T20:44:06 writing packet: udp ::1:52534 (localhost) tid: 00000001
> 2017-05-04T20:44:06 reading packet: udp ::1:52534 (localhost) tid: 00000001
> 2017-05-04T20:44:06 host completed: udp ::1:52534 (localhost) tid: 00000001
> 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0 hosts 1 packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814 tid: 00000002
> 2017-05-04T20:44:06 tkt: extract key 17/763641F3
> 2017-05-04T20:44:06 set-error: -1765328353: Decrypt integrity check failed for checksum type hmac-sha1-96-aes128, key type aes128-cts-hmac-sha1-96
> 2017-05-04T20:44:06 tkt: extract key 17/3084A95C
> 2017-05-04T20:44:06 krb5_get_credentials_with_flags: TEST.COM wc: 0.050317
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential for krb5_ccache_conf_data/realm-config@X-CACHECONF: in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 set-error: -1765328243: Did not find credential for krb5_ccache_conf_data/time-offset/test-service\134/localhost\134@TEST.COM@X-CACHECONF: in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> 2017-05-04T20:44:06 Setting up PFS for auth context
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type des-cbc-md5-deprecated not supported
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type des-cbc-md4-deprecated not supported
> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type des-cbc-crc-deprecated not supported
> First kerberos.authGSSClientStep successful
>
> Thanks
> Jiajia
>
> -----Original Message-----
> From: Zheng, Kai [mailto:kai.zheng@intel.com]
> Sent: Wednesday, May 3, 2017 7:29 PM
> To: kerby@directory.apache.org
> Subject: RE: MIT Kerberos compatibility
>
> Hi Marc,
>
> In case you're not aware of this, please check out the latest fix made by Jiajia. We thought your case may be different, but would be good to have a check before we can repeat/fix your case. Thanks.
> https://issues.apache.org/jira/browse/DIRKRB-625
>
> Regards,
> Kai
>
> -----Original Message-----
> From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
> Sent: Sunday, April 30, 2017 7:45 PM
> To: kerby@directory.apache.org
> Subject: Re: MIT Kerberos compatibility
>
> Hi Kai,
>
> The terminal output below is for the latest MIT Kerberos 1.15.1 (locally built on Ubuntu Xenial). Before that, I also tested with the default Xenial MIT Kerberos packages (1.13.2), with the same result. I did not try earlier MIT Kerberos versions.
>
> Marc
>
> Op 29-04-17 om 21:42 schreef Marc de Lignie:
>> Hi Kai,
>>
>> Thanks for the response. I prepared a minimal config that reproduces
>> my problem.
>>
>> You can fetch the branch/commit from:
>> https://github.com/vtslab/directory-kerby/commits/MitIssue
>>
>> This is relative to RC2, but I also tried this on trunk for my actual
>> project.
>>
>> This config produces the debug and error messages below.
>>
>> 1. For the terminal with the bash + python script $ klist Ticket
>> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> Default principal: drankye@TEST.COM
>>
>> Valid starting Expires Service principal
>> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/TEST.COM@TEST.COM
>> renew until 29-04-17 21:07:39
>>
>> $ .
>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/
>> server/MitIssueTest.sh [15538] 1493491231.917606: Retrieving
>> drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0,
>> enctype 0) with result:
>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [15538]
>> 1493491231.917827: Retrieving drankye@TEST.COM from
>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
>> kerberos.authGSSClientInit successful [15538] 1493491231.918185:
>> Getting credentials drankye@TEST.COM -> test-service/localhost@ using
>> ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
>> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
>> test-service/localhost@ from
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>> -1765328243/Matching credential not found (filename:
>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
>> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
>> test-service/localhost@TEST.COM with result: -1765328243/Matching
>> credential not found (filename:
>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
>> [15538] 1493491231.918229: Server has referral realm; starting with
>> test-service/localhost@TEST.COM [15538] 1493491231.918278: Retrieving
>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM from
>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
>> 0/Success
>> [15538] 1493491231.918281: Starting with TGT for client realm:
>> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
>> 1493491231.918301: Requesting tickets for
>> test-service/localhost@TEST.COM, referrals on [15538]
>> 1493491231.918326: Generated subkey for TGS request:
>> aes128-cts/FA30
>> [15538] 1493491231.918359: etypes requested in TGS request:
>> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1,
>> rc4-hmac, camellia128-cts, camellia256-cts [15538] 1493491231.918484:
>> Encoding request body and padata into FAST request [15538]
>> 1493491231.918541: Sending request (836 bytes) to TEST.COM [15538]
>> 1493491231.918597: Resolving hostname localhost [15538]
>> 1493491231.918703: Initiating TCP connection to stream
>> 127.0.0.1:44292
>> [15538] 1493491231.918777: Sending TCP request to stream
>> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error receiving from
>> stream
>> 127.0.0.1:44292: 104/Connection reset by peer [15538]
>> 1493491231.922812: Terminating TCP connection to stream
>> 127.0.0.1:44292
>> [15538] 1493491231.922858: Sending initial UDP request to dgram
>> 127.0.0.1:44292
>> ('First kerberos.authGSSClientStep not successful',
>> GSSError(('Unspecified GSS failure. Minor code may provide more
>> information', 851968), ("Cannot contact any KDC for realm 'TEST.COM'",
>> -1765328228)))
>>
>> 2. For the terminal that runs mvn clean test -Dtest=MitIssueTest
>> Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
>> 2017-04-29 21:07:39,182 DEBUG [main] backend.AbstractIdentityBackend:
>> initialize called
>> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity called, principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity failed, principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>> addIdentity successful, principalName = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity called, principalName = kadmin/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity failed, principalName = kadmin/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,213 DEBUG [main] backend.AbstractIdentityBackend:
>> addIdentity successful, principalName = kadmin/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,216 DEBUG [main] backend.AbstractIdentityBackend:
>> start called
>> 2017-04-29 21:07:39,232 DEBUG [main] backend.AbstractIdentityBackend:
>> addIdentity successful, principalName =
>> test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,425 DEBUG [main] backend.AbstractIdentityBackend:
>> addIdentity successful, principalName = drankye@TEST.COM
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>> = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1] request.KdcRequest:
>> Client entry is empty.
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> drankye@TEST.COM
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>> = drankye@TEST.COM
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>> = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>> disconnecting abnormally java.io.EOFException
>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
>> at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>> at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>> at java.lang.Thread.run(Thread.java:748)
>> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase: Storing the
>> tgt to the credential cache file.
>> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity called, principalName = test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
>> getIdentity successful, principalName =
>> test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>> = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1] request.KdcRequest:
>> Client entry is empty.
>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>> = test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>> = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1] request.KdcRequest:
>> The preauth data is empty.
>> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1] server.KdcHandler: KRB
>> error occurred while processing request:Additional pre-authentication
>> required
>> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>> disconnecting abnormally java.io.EOFException
>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
>> at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>> at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>> at java.lang.Thread.run(Thread.java:748)
>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>> = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1] request.KdcRequest:
>> Client entry is empty.
>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>> = test-service/localhost@TEST.COM
>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>> = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>> disconnecting abnormally java.io.EOFException
>> at java.io.DataInputStream.readInt(DataInputStream.java:392)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
>> at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>> at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>> at java.lang.Thread.run(Thread.java:748)
>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity called, principalName =
>> krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
>> backend.AbstractIdentityBackend: getIdentity successful, principalName
>> = krbtgt/TEST.COM@TEST.COM
>> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1] request.KdcRequest:
>> Found fast padata and start to process it.
>> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
>> impl.DefaultKdcHandler: Error occured while processing request:
>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
>> at
>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast(KdcRequest.java:208)
>> at
>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.process(KdcRequest.java:168)
>> at
>> org.apache.kerby.kerberos.kerb.server.KdcHandler.handleMessage(KdcHandler.java:115)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.handleMessage(DefaultKdcHandler.java:67)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:52)
>> at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>> at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>> at java.lang.Thread.run(Thread.java:748)
>> Caused by: java.io.IOException: Unexpected item context [0] [tag=0xA0,
>> off=0, len=3+207], expecting 0x30
>> at
>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(Asn1Encodeable.java:210)
>> at
>> org.apache.kerby.asn1.type.Asn1Encodeable.decode(Asn1Encodeable.java:197)
>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
>> ... 9 more
>> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
>> impl.DefaultKdcHandler: Transport or decoding error occurred,
>> disconnecting abnormally
>> java.net.SocketException: Socket closed
>> at java.net.SocketInputStream.socketRead0(Native Method)
>> at java.net.SocketInputStream.socketRead(SocketInputStream.java:116)
>> at java.net.SocketInputStream.read(SocketInputStream.java:171)
>> at java.net.SocketInputStream.read(SocketInputStream.java:141)
>> at java.net.SocketInputStream.read(SocketInputStream.java:224)
>> at java.io.DataInputStream.readInt(DataInputStream.java:387)
>> at
>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
>> at
>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
>> at
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>> at
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>> at java.lang.Thread.run(Thread.java:748)
>>
>> In a FreeIPA environment these python lines "just" work.
>>
>> Any suggestions are welcome!
>>
>> Marc
>>
>>
> --
> Marc de Lignie
>
--
Marc de Lignie
RE: MIT Kerberos compatibility
Posted by "Li, Jiajia" <ji...@intel.com>.
Hi Marc,
I try to run your test(through applying your patch in the trunk) , I think it's success now. Could you take some time to check about it?
Here is the log:
directory-kerby git:(trunk) ✗ . kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/server/MitIssueTest.sh
kerberos.authGSSClientInit successful
2017-05-04T20:44:06 set-error: -1765328234: entypes not supported
2017-05-04T20:44:06 set-error: -1765328243: Did not find credential for krb5_ccache_conf_data/realm-config@X-CACHECONF: in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
2017-05-04T20:44:06 set-error: -1765328243: Did not find credential for test-service/localhost@TEST.COM in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
2017-05-04T20:44:06 set-error: -1765328243: Did not find credential for krb5_ccache_conf_data/negative-cache/test-service\134/localhost\134@TEST.COM@X-CACHECONF: in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
2017-05-04T20:44:06 set-error: -1765328243: Did not find credential for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF: in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
2017-05-04T20:44:06 set-error: -1765328243: Did not find credential for krb5_ccache_conf_data/sitename@X-CACHECONF: in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
2017-05-04T20:44:06 set-error: -1765328243: Did not find credential for test-service/localhost@TEST.COM in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
2017-05-04T20:44:06 set-error: -1765328234: Encryption type des-cbc-md5-deprecated not supported
2017-05-04T20:44:06 set-error: -1765328234: Encryption type des-cbc-md4-deprecated not supported
2017-05-04T20:44:06 set-error: -1765328234: Encryption type des-cbc-crc-deprecated not supported
2017-05-04T20:44:06 Trying to find service kdc for realm TEST.COM flags 0
2017-05-04T20:44:06 configuration file for realm TEST.COM found
2017-05-04T20:44:06 submissing new requests to new host
2017-05-04T20:44:06 host_create: setting hostname localhost
2017-05-04T20:44:06 connecting to host: udp ::1:52534 (localhost) tid: 00000001
2017-05-04T20:44:06 host_create: setting hostname localhost
2017-05-04T20:44:06 Queuing host in future (in 3s), its the 2 address on the same name: udp 127.0.0.1:52534 (localhost) tid: 00000002
2017-05-04T20:44:06 writing packet: udp ::1:52534 (localhost) tid: 00000001
2017-05-04T20:44:06 reading packet: udp ::1:52534 (localhost) tid: 00000001
2017-05-04T20:44:06 host completed: udp ::1:52534 (localhost) tid: 00000001
2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0 hosts 1 packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814 tid: 00000002
2017-05-04T20:44:06 tkt: extract key 17/763641F3
2017-05-04T20:44:06 set-error: -1765328353: Decrypt integrity check failed for checksum type hmac-sha1-96-aes128, key type aes128-cts-hmac-sha1-96
2017-05-04T20:44:06 tkt: extract key 17/3084A95C
2017-05-04T20:44:06 krb5_get_credentials_with_flags: TEST.COM wc: 0.050317
2017-05-04T20:44:06 set-error: -1765328243: Did not find credential for krb5_ccache_conf_data/realm-config@X-CACHECONF: in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
2017-05-04T20:44:06 set-error: -1765328243: Did not find credential for krb5_ccache_conf_data/time-offset/test-service\134/localhost\134@TEST.COM@X-CACHECONF: in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
2017-05-04T20:44:06 Setting up PFS for auth context
2017-05-04T20:44:06 set-error: -1765328234: Encryption type des-cbc-md5-deprecated not supported
2017-05-04T20:44:06 set-error: -1765328234: Encryption type des-cbc-md4-deprecated not supported
2017-05-04T20:44:06 set-error: -1765328234: Encryption type des-cbc-crc-deprecated not supported
First kerberos.authGSSClientStep successful
Thanks
Jiajia
-----Original Message-----
From: Zheng, Kai [mailto:kai.zheng@intel.com]
Sent: Wednesday, May 3, 2017 7:29 PM
To: kerby@directory.apache.org
Subject: RE: MIT Kerberos compatibility
Hi Marc,
In case you're not aware of this, please check out the latest fix made by Jiajia. We thought your case may be different, but would be good to have a check before we can repeat/fix your case. Thanks.
https://issues.apache.org/jira/browse/DIRKRB-625
Regards,
Kai
-----Original Message-----
From: Marc de Lignie [mailto:m.c.delignie@xs4all.nl]
Sent: Sunday, April 30, 2017 7:45 PM
To: kerby@directory.apache.org
Subject: Re: MIT Kerberos compatibility
Hi Kai,
The terminal output below is for the latest MIT Kerberos 1.15.1 (locally built on Ubuntu Xenial). Before that, I also tested with the default Xenial MIT Kerberos packages (1.13.2), with the same result. I did not try earlier MIT Kerberos versions.
Marc
Op 29-04-17 om 21:42 schreef Marc de Lignie:
>
> Hi Kai,
>
> Thanks for the response. I prepared a minimal config that reproduces
> my problem.
>
> You can fetch the branch/commit from:
> https://github.com/vtslab/directory-kerby/commits/MitIssue
>
> This is relative to RC2, but I also tried this on trunk for my actual
> project.
>
> This config produces the debug and error messages below.
>
> 1. For the terminal with the bash + python script $ klist Ticket
> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> Default principal: drankye@TEST.COM
>
> Valid starting Expires Service principal
> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/TEST.COM@TEST.COM
> renew until 29-04-17 21:07:39
>
> $ .
> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos/kerb/
> server/MitIssueTest.sh [15538] 1493491231.917606: Retrieving
> drankye@TEST.COM from FILE:/etc/krb5/user/1000/client.keytab (vno 0,
> enctype 0) with result:
> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found [15538]
> 1493491231.917827: Retrieving drankye@TEST.COM from
> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with result:
> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found
> kerberos.authGSSClientInit successful [15538] 1493491231.918185:
> Getting credentials drankye@TEST.COM -> test-service/localhost@ using
> ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc
> [15538] 1493491231.918210: Retrieving drankye@TEST.COM ->
> test-service/localhost@ from
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
> -1765328243/Matching credential not found (filename:
> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> [15538] 1493491231.918226: Retrying drankye@TEST.COM ->
> test-service/localhost@TEST.COM with result: -1765328243/Matching
> credential not found (filename:
> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc)
> [15538] 1493491231.918229: Server has referral realm; starting with
> test-service/localhost@TEST.COM [15538] 1493491231.918278: Retrieving
> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM from
> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result:
> 0/Success
> [15538] 1493491231.918281: Starting with TGT for client realm:
> drankye@TEST.COM -> krbtgt/TEST.COM@TEST.COM [15538]
> 1493491231.918301: Requesting tickets for
> test-service/localhost@TEST.COM, referrals on [15538]
> 1493491231.918326: Generated subkey for TGS request:
> aes128-cts/FA30
> [15538] 1493491231.918359: etypes requested in TGS request:
> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, des3-cbc-sha1,
> rc4-hmac, camellia128-cts, camellia256-cts [15538] 1493491231.918484:
> Encoding request body and padata into FAST request [15538]
> 1493491231.918541: Sending request (836 bytes) to TEST.COM [15538]
> 1493491231.918597: Resolving hostname localhost [15538]
> 1493491231.918703: Initiating TCP connection to stream
> 127.0.0.1:44292
> [15538] 1493491231.918777: Sending TCP request to stream
> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error receiving from
> stream
> 127.0.0.1:44292: 104/Connection reset by peer [15538]
> 1493491231.922812: Terminating TCP connection to stream
> 127.0.0.1:44292
> [15538] 1493491231.922858: Sending initial UDP request to dgram
> 127.0.0.1:44292
> ('First kerberos.authGSSClientStep not successful',
> GSSError(('Unspecified GSS failure. Minor code may provide more
> information', 851968), ("Cannot contact any KDC for realm 'TEST.COM'",
> -1765328228)))
>
> 2. For the terminal that runs mvn clean test -Dtest=MitIssueTest
> Running org.apache.kerby.kerberos.kerb.server.MitIssueTest
> 2017-04-29 21:07:39,182 DEBUG [main] backend.AbstractIdentityBackend:
> initialize called
> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
> getIdentity called, principalName = krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,195 DEBUG [main] backend.AbstractIdentityBackend:
> getIdentity failed, principalName = krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
> addIdentity successful, principalName = krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
> getIdentity called, principalName = kadmin/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,212 DEBUG [main] backend.AbstractIdentityBackend:
> getIdentity failed, principalName = kadmin/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,213 DEBUG [main] backend.AbstractIdentityBackend:
> addIdentity successful, principalName = kadmin/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,216 DEBUG [main] backend.AbstractIdentityBackend:
> start called
> 2017-04-29 21:07:39,232 DEBUG [main] backend.AbstractIdentityBackend:
> addIdentity successful, principalName =
> test-service/localhost@TEST.COM
> 2017-04-29 21:07:39,425 DEBUG [main] backend.AbstractIdentityBackend:
> addIdentity successful, principalName = drankye@TEST.COM
> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity called, principalName =
> krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity successful, principalName
> = krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1] request.KdcRequest:
> Client entry is empty.
> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity called, principalName =
> drankye@TEST.COM
> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity successful, principalName
> = drankye@TEST.COM
> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity called, principalName =
> krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity successful, principalName
> = krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1]
> impl.DefaultKdcHandler: Transport or decoding error occurred,
> disconnecting abnormally java.io.EOFException
> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> at
> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
> at
> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
> at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> at java.lang.Thread.run(Thread.java:748)
> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase: Storing the
> tgt to the credential cache file.
> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
> getIdentity called, principalName = test-service/localhost@TEST.COM
> 2017-04-29 21:07:39,491 DEBUG [main] backend.AbstractIdentityBackend:
> getIdentity successful, principalName =
> test-service/localhost@TEST.COM
> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity called, principalName =
> krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity successful, principalName
> = krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1] request.KdcRequest:
> Client entry is empty.
> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity called, principalName =
> test-service/localhost@TEST.COM
> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity successful, principalName
> = test-service/localhost@TEST.COM
> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity called, principalName =
> krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity successful, principalName
> = krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1] request.KdcRequest:
> The preauth data is empty.
> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1] server.KdcHandler: KRB
> error occurred while processing request:Additional pre-authentication
> required
> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1]
> impl.DefaultKdcHandler: Transport or decoding error occurred,
> disconnecting abnormally java.io.EOFException
> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> at
> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
> at
> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
> at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> at java.lang.Thread.run(Thread.java:748)
> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity called, principalName =
> krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity successful, principalName
> = krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1] request.KdcRequest:
> Client entry is empty.
> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity called, principalName =
> test-service/localhost@TEST.COM
> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity successful, principalName
> = test-service/localhost@TEST.COM
> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity called, principalName =
> krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity successful, principalName
> = krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1]
> impl.DefaultKdcHandler: Transport or decoding error occurred,
> disconnecting abnormally java.io.EOFException
> at java.io.DataInputStream.readInt(DataInputStream.java:392)
> at
> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
> at
> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
> at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> at java.lang.Thread.run(Thread.java:748)
> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity called, principalName =
> krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1]
> backend.AbstractIdentityBackend: getIdentity successful, principalName
> = krbtgt/TEST.COM@TEST.COM
> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1] request.KdcRequest:
> Found fast padata and start to process it.
> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1]
> impl.DefaultKdcHandler: Error occured while processing request:
> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed
> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:85)
> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:70)
> at
> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFindFast(KdcRequest.java:208)
> at
> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.process(KdcRequest.java:168)
> at
> org.apache.kerby.kerberos.kerb.server.KdcHandler.handleMessage(KdcHandler.java:115)
> at
> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.handleMessage(DefaultKdcHandler.java:67)
> at
> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:52)
> at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> at java.lang.Thread.run(Thread.java:748)
> Caused by: java.io.IOException: Unexpected item context [0] [tag=0xA0,
> off=0, len=3+207], expecting 0x30
> at
> org.apache.kerby.asn1.type.Asn1Encodeable.decode(Asn1Encodeable.java:210)
> at
> org.apache.kerby.asn1.type.Asn1Encodeable.decode(Asn1Encodeable.java:197)
> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec.java:83)
> ... 9 more
> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1]
> impl.DefaultKdcHandler: Transport or decoding error occurred,
> disconnecting abnormally
> java.net.SocketException: Socket closed
> at java.net.SocketInputStream.socketRead0(Native Method)
> at java.net.SocketInputStream.socketRead(SocketInputStream.java:116)
> at java.net.SocketInputStream.read(SocketInputStream.java:171)
> at java.net.SocketInputStream.read(SocketInputStream.java:141)
> at java.net.SocketInputStream.read(SocketInputStream.java:224)
> at java.io.DataInputStream.readInt(DataInputStream.java:387)
> at
> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport.receiveMessage(KrbTcpTransport.java:54)
> at
> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.run(DefaultKdcHandler.java:46)
> at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> at java.lang.Thread.run(Thread.java:748)
>
> In a FreeIPA environment these python lines "just" work.
>
> Any suggestions are welcome!
>
> Marc
>
>
--
Marc de Lignie