You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@directory.apache.org by Yu Wei <yu...@hotmail.com> on 2017/02/06 07:45:15 UTC

Failed to setup kerberos with ApacheDS [Client not found in Kerberos database]

Hi Guys,

I tried to setup kerberos with ApacheDS Studio by following the instruction https://directory.apache.org/apacheds/kerberos-ug/4.2-authenticate-studio.html.

I got below errors indicating "Client not found in Kerberos database",


Error while opening connection
 - javax.security.auth.login.LoginException: Client not found in Kerberos database (6) - Client not found in Kerberos database
org.apache.directory.api.ldap.model.exception.LdapException: javax.security.auth.login.LoginException: Client not found in Kerberos database (6) - Client not found in Kerberos database
    at org.apache.directory.ldap.client.api.LdapNetworkConnection.bindAsync(LdapNetworkConnection.java:1671)
    at org.apache.directory.ldap.client.api.LdapNetworkConnection.bind(LdapNetworkConnection.java:1557)
    at org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper$2.run(DirectoryApiConnectionWrapper.java:436)
    at org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.runAndMonitor(DirectoryApiConnectionWrapper.java:1163)
    at org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.doBind(DirectoryApiConnectionWrapper.java:449)
    at org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.bind(DirectoryApiConnectionWrapper.java:295)
    at org.apache.directory.studio.connection.core.jobs.OpenConnectionsRunnable.run(OpenConnectionsRunnable.java:114)
    at org.apache.directory.studio.connection.core.jobs.StudioConnectionJob.run(StudioConnectionJob.java:109)
    at org.eclipse.core.internal.jobs.Worker.run(Worker.java:55)
Caused by: javax.security.auth.login.LoginException: Client not found in Kerberos database (6) - Client not found in Kerberos database
    at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:804)
    at com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:617)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at javax.security.auth.login.LoginContext.invoke(LoginContext.java:755)
    at javax.security.auth.login.LoginContext.access$000(LoginContext.java:195)
    at javax.security.auth.login.LoginContext$4.run(LoginContext.java:682)
    at javax.security.auth.login.LoginContext$4.run(LoginContext.java:680)
    at java.security.AccessController.doPrivileged(Native Method)
    at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)
    at javax.security.auth.login.LoginContext.login(LoginContext.java:587)
    at org.apache.directory.ldap.client.api.LdapNetworkConnection.bindAsync(LdapNetworkConnection.java:1658)
    ... 8 more
Caused by: KrbException: Client not found in Kerberos database (6) - Client not found in Kerberos database
    at sun.security.krb5.KrbAsRep.<init>(KrbAsRep.java:82)
    at sun.security.krb5.KrbAsReqBuilder.send(KrbAsReqBuilder.java:316)
    at sun.security.krb5.KrbAsReqBuilder.action(KrbAsReqBuilder.java:361)
    at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:766)
    ... 21 more
Caused by: KrbException: Identifier doesn't match expected value (906)
    at sun.security.krb5.internal.KDCRep.init(KDCRep.java:140)
    at sun.security.krb5.internal.ASRep.init(ASRep.java:64)
    at sun.security.krb5.internal.ASRep.<init>(ASRep.java:59)
    at sun.security.krb5.KrbAsRep.<init>(KrbAsRep.java:60)
    ... 24 more

javax.security.auth.login.LoginException: Client not found in Kerberos database (6) - Client not found in Kerberos database


How could I fix this problem?


Is launching LDAP/Kerberos server via ApacheDS-Studio ready for production environment? If not so, how could I do?


Actually I setup kerberos server with ApacheDS Studio successfully three weeks ago, however, it failed to work after running the server for several days. Then I want to setup it again and met the above problem.


Thanks,

Jared, (韦煜）
Software developer
Interested in open source software, big data, Linux

Re: Failed to setup kerberos with ApacheDS [Client not found in Kerberos database]

Posted by Stefan Seelmann <ma...@stefan-seelmann.de>.
On 02/06/2017 09:43 AM, Yu Wei wrote:
> Caused by: KrbException: Server not found in Kerberos database (7) - Server not found in Kerberos database
> ...
> Caused by: KrbException: Identifier doesn't match expected value (906)
> ...
> And I also added entries for "services" named "krbtgt" and "ldap".

This may mean that the LDAP service principal's krb5PrincipalName is
wrong. In the documentation it defaults to
"ldap/example.net@EXAMPLE.COM", please make sure to replace
"example.net" with your actual hostname.

> Another strange behavior is that sometimes I couldn't fetch all entries even through ldap connection.

I don't understand, do you get any error?

Kind Regards,
Stefan

Re: Failed to setup kerberos with ApacheDS [Client not found in Kerberos database]

Posted by Yu Wei <yu...@hotmail.com>.
Actually I have created the user and input the correct user name/password.

Then I tried again and got following exceptions,

Error while opening connection
 - java.security.PrivilegedActionException: org.apache.directory.api.ldap.model.exception.LdapException: javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7) - Server not found in Kerberos database)]
org.apache.directory.api.ldap.model.exception.LdapException: java.security.PrivilegedActionException: org.apache.directory.api.ldap.model.exception.LdapException: javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7) - Server not found in Kerberos database)]
    at org.apache.directory.ldap.client.api.LdapNetworkConnection.bindAsync(LdapNetworkConnection.java:1671)
    at org.apache.directory.ldap.client.api.LdapNetworkConnection.bind(LdapNetworkConnection.java:1557)
    at org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper$2.run(DirectoryApiConnectionWrapper.java:436)
    at org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.runAndMonitor(DirectoryApiConnectionWrapper.java:1163)
    at org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.doBind(DirectoryApiConnectionWrapper.java:449)
    at org.apache.directory.studio.connection.core.io.api.DirectoryApiConnectionWrapper.bind(DirectoryApiConnectionWrapper.java:295)
    at org.apache.directory.studio.connection.core.jobs.OpenConnectionsRunnable.run(OpenConnectionsRunnable.java:114)
    at org.apache.directory.studio.connection.core.jobs.StudioConnectionJob.run(StudioConnectionJob.java:109)
    at org.eclipse.core.internal.jobs.Worker.run(Worker.java:55)
Caused by: java.security.PrivilegedActionException: org.apache.directory.api.ldap.model.exception.LdapException: javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7) - Server not found in Kerberos database)]
    at java.security.AccessController.doPrivileged(Native Method)
    at javax.security.auth.Subject.doAs(Subject.java:422)
    at org.apache.directory.ldap.client.api.LdapNetworkConnection.bindAsync(LdapNetworkConnection.java:1661)
    ... 8 more
Caused by: org.apache.directory.api.ldap.model.exception.LdapException: javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7) - Server not found in Kerberos database)]
    at org.apache.directory.ldap.client.api.LdapNetworkConnection.bindSasl(LdapNetworkConnection.java:4149)
    at org.apache.directory.ldap.client.api.LdapNetworkConnection.access$200(LdapNetworkConnection.java:186)
    at org.apache.directory.ldap.client.api.LdapNetworkConnection$2.run(LdapNetworkConnection.java:1665)
    ... 11 more
Caused by: javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7) - Server not found in Kerberos database)]
    at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:211)
    at org.apache.directory.ldap.client.api.LdapNetworkConnection.bindSasl(LdapNetworkConnection.java:4059)
    ... 13 more
Caused by: GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7) - Server not found in Kerberos database)
    at sun.security.jgss.krb5.Krb5Context.initSecContext(Krb5Context.java:770)
    at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:248)
    at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:179)
    at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:192)
    ... 14 more
Caused by: KrbException: Server not found in Kerberos database (7) - Server not found in Kerberos database
    at sun.security.krb5.KrbTgsRep.<init>(KrbTgsRep.java:73)
    at sun.security.krb5.KrbTgsReq.getReply(KrbTgsReq.java:259)
    at sun.security.krb5.KrbTgsReq.sendAndGetCreds(KrbTgsReq.java:270)
    at sun.security.krb5.internal.CredentialsUtil.serviceCreds(CredentialsUtil.java:302)
    at sun.security.krb5.internal.CredentialsUtil.acquireServiceCreds(CredentialsUtil.java:120)
    at sun.security.krb5.Credentials.acquireServiceCreds(Credentials.java:458)
    at sun.security.jgss.krb5.Krb5Context.initSecContext(Krb5Context.java:693)
    ... 17 more
Caused by: KrbException: Identifier doesn't match expected value (906)
    at sun.security.krb5.internal.KDCRep.init(KDCRep.java:140)
    at sun.security.krb5.internal.TGSRep.init(TGSRep.java:65)
    at sun.security.krb5.internal.TGSRep.<init>(TGSRep.java:60)
    at sun.security.krb5.KrbTgsRep.<init>(KrbTgsRep.java:55)
    ... 23 more

java.security.PrivilegedActionException: org.apache.directory.api.ldap.model.exception.LdapException: javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7) - Server not found in Kerberos database)]


And I also added entries for "services" named "krbtgt" and "ldap".

Another strange behavior is that sometimes I couldn't fetch all entries even through ldap connection.



Thanks,

Jared, (韦煜）
Software developer
Interested in open source software, big data, Linux

________________________________
From: Emmanuel Lécharny <el...@gmail.com>
Sent: Monday, February 6, 2017 4:01:34 PM
To: users@directory.apache.org
Subject: Re: Failed to setup kerberos with ApacheDS [Client not found in Kerberos database]



Le 06/02/2017 à 08:45, Yu Wei a écrit :
> Hi Guys,
>
> I tried to setup kerberos with ApacheDS Studio by following the instruction https://directory.apache.org/apacheds/kerberos-ug/4.2-authenticate-studio.html.
>
> I got below errors indicating "Client not found in Kerberos database",

This error indicates that there is no entry for the user you are trying
to bind with in the LDAP database. Check that first.

--
Emmanuel Lecharny

Symas.com
directory.apache.org

Re: Failed to setup kerberos with ApacheDS [Client not found in Kerberos database]

Posted by Emmanuel Lécharny <el...@gmail.com>.

Le 06/02/2017 à 08:45, Yu Wei a écrit :
> Hi Guys,
>
> I tried to setup kerberos with ApacheDS Studio by following the instruction https://directory.apache.org/apacheds/kerberos-ug/4.2-authenticate-studio.html.
>
> I got below errors indicating "Client not found in Kerberos database",

This error indicates that there is no entry for the user you are trying
to bind with in the LDAP database. Check that first.

-- 
Emmanuel Lecharny

Symas.com
directory.apache.org

Re: Failed to setup kerberos with ApacheDS [Client not found in Kerberos database]

Posted by Stefan Seelmann <ma...@stefan-seelmann.de>.
On 02/06/2017 08:45 AM, Yu Wei wrote:
> Actually I setup kerberos server with ApacheDS Studio successfully three weeks ago, however, it failed to work after running the server for several days. Then I want to setup it again and met the above problem.

Hm, that sounds as your database got currupt. With latest Stuido version
you can try to start the server with "Start and Repair" option in the
Server's view context menu.

HTH.
Stefan