CAS采用Spnego认证方式通过Kerberos与AD域整合

一：前言

这次主要是介绍如何通过配置，使已经登录到域的域用户，在访问CAS_Client的时候，不需要再次去CAS服务端认证的配置文档。是只针对已经掌握如何配置Windows_AD和CAS_SSO的相关人员。配置Windows_AD和CAS_SSO的方法请参考其它手册，本文不再讲述如何配置Windows_AD和CAS_SSO。

本人所讲述的配置都是在Windows_AD和CAS_SSO已经配置完成的基础上。

       经过测试，无配置经历的开发人员通过此文档都可顺利配置成功。

 

       因时间问题，关于环境的网络拓扑结构就没有画，在这简单描述一下具体的环境：

域控制器一台，CAS服务器一台，客户机一台，如果有条件，可以单独设立一台业务系统主机(CAS_Client)，所有机器均加入域控制器中。

 

具体效果如下：

 

1：用户使用客户机登录到域中，首次访问业务系统(Cas_Client)，无需认证，直接进入业务系统，身份为登录域的账号。

 

2：用户使用客户机登录到本机，首次访问业务系统(Cas_Client)，转向CAS的认证界面(默认的认证方式为表单认证)，输入账号口令后进入业务系统。

 

从这个效果中就可以看出来，CAS与AD集成后，用户只需要认证一次。

CAS版本：3.4.2

 

二：配置域信息

1:域控制器版本

 

本文所提到的AD域环境为WINDOWS2003版本的域控制器

2:在Windows AD中创建用户

A、启动域用户管理：开始→管理工具→Active Director用户和计算机。

B、创建用户：Users→右键→新建→用户。

C、添入要创建的用户信息，比如是“RainTime”：“姓：RainTime；姓名：RainTime；用户登录名：HTTP/RainTime；用户登录名（Windows 2000以前版本）：RainTime”。

D、输入密码，并选择“密码永不过期”，比如是：111111

E、点击确定，完成用户创建。

 

三：配置CAS服务端

1：修改login-webflow.xml配置文件

A、login-webflow.xml在CAS目录下的WEB-INF文件夹下。

B、在此配置文件中加入以下两个标签

 

<action-state id="startAuthenticate">

  <action bean="negociateSpnego" />

  <transition on="success" to="spnego" />

</action-state>

 

<action-state id="spnego">

  <action bean="spnego" />

  <transition on="success" to="sendTicketGrantingTicket" />

  <transition on="error" to="viewLoginForm" />

</action-state>

 

 

 

需要注意的是：如果你使用的是spring-webflow-2.0.xsd，那么应该将<action bean="" />替换为<evaluate expression="" />

 

 C、修改login-webflow.xml的<decision-state id="gatewayRequestCheck">和<decision-state id="renewRequestCheck">两个标签，将两个标签属性中的“viewLoginForm”修改为“startAuthenticate”。

 

2：修改CAS的cas-servlet.xml配置文件

A、cas-servlet.xml在CAS目录下的WEB-INF文件夹下。

B、在cas-servlet.xml文件加入如下图所示的两个标签：

<bean id="negociateSpnego" class="org.jasig.cas.support.spnego.web.flow.SpnegoNegociateCredentialsAction" />

 

<bean id="spnego" class="org.jasig.cas.support.spnego.web.flow.SpnegoCredentialsAction">

                        <property name="centralAuthenticationService" ref="centralAuthenticationService"/>

</bean>

  

 3：修改CAS的deployConfigContextxml配置文件

A、deployerConfigContext.xml在CAS目录下的WEB-INF文件夹下。

B、修改该文件bean标签“authenticationManager”的两个属性“credentialsToPrincipalResolvers”和“authenticationHandlers”。

首先在“credentialsToPrincipalResolvers”属性的list标签中加入一个bean标签：

<bean class="org.jasig.cas.support.spnego.authentication.principal.SpnegoCredentialsToPrincipalResolver" />

 然后在“authenticationHandlers”属性list标签中也加入一个bean标签：

<bean class="org.jasig.cas.support.spnego.authentication.handler.support.JCIFSSpnegoAuthenticationHandler">

                        <property name="authentication">

                          <bean class="jcifs.spnego.Authentication" />

                        </property>

                        <property name="principalWithDomainName" value="false" />

                        <property name="NTLMallowed" value="true"/>

      </bean>

 

c、退出authenticationManager，在外层加入一个标签bean:"jcifsConfig "：

<bean name="jcifsConfig" class="org.jasig.cas.support.spnego.authentication.handler.support.JCIFSConfig">

  <property name="jcifsServicePrincipal" value="HTTP/[e-mail]" />

  <property name="jcifsServicePassword" value="the.service.password.here" />

  <property name="kerberosDebug" value="false" />

  <property name="kerberosRealm" value="YOUR.REALM.HERE" />

  <property name="kerberosKdc" value="THE.KDC.IP.HERE" />

  <property name="loginConf" value="/path/to/WEB-INF/login.conf" />

</bean>

 

 

 jcifsServicePrincipal：登录域控制器的完整登录名

 jcifsServicePassword：登录域控制器的密码

  kerberosDebug：是否输出DEBUG信息

 kerberosRealm：域名

 kerberosKdc：Kdc地址（域控制器地址）

 loginconf：login.conf文件的绝对路径

 

  4：创建login.conf配置文件 

jcifs.spnego.initiate {

   com.sun.security.auth.module.Krb5LoginModule required storeKey=true;

};

jcifs.spnego.accept {

   com.sun.security.auth.module.Krb5LoginModule required storeKey=true;

};

 

5：添加所需要的JAR包 

A、将cas-server-3.4.2-release\cas-server-3.4.2\modules目录的cas-server-support-spnego-3.4.2.jar复制到cas\WEB-INF\lib下

B、还需要有两个外部包的支持，“jcifs-1.1.11.jar、jcifs-ext-0.9.4.jar”，将这两个jar包也拷贝到cas\WEB-INF\lib下

 

四：配置客户机

A、   将CAS服务地址配置成可信任站点：“Internet选项→安全→本地Internet→站点→高级” 输入CAS服务地址，如“http://cas.test.com”，点击确定即可。

 

五：测试

使用客户机登录到域中，账号为"RainTime"，密码是“111111”，然后访问业务系统，如果无需认证直接进入业务系统，表明SPNEGO认证已经通过，否则请重新检查整个配置是否无误。

 

 

下一步的工作是配置CAS的X509证书认证和基于CAS认证的FreeRadius认证

 

写这篇文章浪费了一上午时间，不知是这个在线编辑器的问题还是我的浏览器问题，在插入代码后，就不能修改，否则格式就乱了套了，没办法，凑合着看吧。 

 

 

注：罪过罪过，官方提供的资料是在Linux下部署成功的，而CAS的一些配置也是针对linux系统使用的，如果CAS部署在WINDOWS下全完可以不这么麻烦

评论

23 楼 nishiufo 2012-08-02  

张小宇 写道

我看了org.jasig.cas.support.spnego.web.flow.SpnegoCrede
ntialsAction中的源码，应该是因为这一串乱码导致后边的认证无法进行，这一串乱码是从什么地方取到的呢？应该怎么处理一下呢？请指教一二~多谢

       我碰到了和你一样的问题，如何解决的呢？

22 楼 张小宇 2011-10-27  

我看了org.jasig.cas.support.spnego.web.flow.SpnegoCrede
ntialsAction中的源码，应该是因为这一串乱码导致后边的认证无法进行，这一串乱码是从什么地方取到的呢？应该怎么处理一下呢？请指教一二~多谢

21 楼 张小宇 2011-10-27  

对了  还有 我这边找到的token是这些东西：
2011-10-27 18:37:02,484 DEBUG [org.jasig.cas.support.spnego.web.flow.SpnegoCrede
ntialsAction] - <SPNEGO Authorization header found with 1672 bytes>
2011-10-27 18:37:02,484 DEBUG [org.jasig.cas.support.spnego.web.flow.SpnegoCrede
ntialsAction] - <Obtained token: `??+
爞??袪$0"  *咹傳
      *咹嗺


+

?
????       *咹嗺




额。。。复制不上来，就是很长的一串乱码，不知道是从哪里取到的，求解答。

20 楼 张小宇 2011-10-27  

您好！按照您的步骤配置好了，但是tomcat后台报错 具体错误如下：
>>> KdcAccessibility: add 10.133.96.36
jcifs.spnego.AuthenticationException: Error performing Kerberos authentication:
java.lang.reflect.InvocationTargetException
        at jcifs.spnego.Authentication.processKerberos(Authentication.java:447)
        at jcifs.spnego.Authentication.processSpnego(Authentication.java:346)
        at jcifs.spnego.Authentication.process(Authentication.java:235)
        at org.jasig.cas.support.spnego.authentication.handler.support.JCIFSSpne
goAuthenticationHandler.doAuthentication(JCIFSSpnegoAuthenticationHandler.java:5
7)
        at org.jasig.cas.authentication.handler.support.AbstractPreAndPostProces
singAuthenticationHandler.authenticate_aroundBody2(AbstractPreAndPostProcessingA
uthenticationHandler.java:72)
        at org.jasig.cas.authentication.handler.support.AbstractPreAndPostProces
singAuthenticationHandler.authenticate_aroundBody3$advice(AbstractPreAndPostProc
essingAuthenticationHandler.java:44)
        at org.jasig.cas.authentication.handler.support.AbstractPreAndPostProces
singAuthenticationHandler.authenticate(AbstractPreAndPostProcessingAuthenticatio
nHandler.java:1)
        at org.jasig.cas.authentication.AuthenticationManagerImpl.authenticateAn
dObtainPrincipal(AuthenticationManagerImpl.java:78)
        at org.jasig.cas.authentication.AbstractAuthenticationManager.authentica
te_aroundBody0(AbstractAuthenticationManager.java:42)
        at org.jasig.cas.authentication.AbstractAuthenticationManager.authentica
te_aroundBody1$advice(AbstractAuthenticationManager.java:44)
        at org.jasig.cas.authentication.AbstractAuthenticationManager.authentica
te(AbstractAuthenticationManager.java:1)
        at org.jasig.cas.CentralAuthenticationServiceImpl.createTicketGrantingTi
cket_aroundBody10(CentralAuthenticationServiceImpl.java:406)
        at org.jasig.cas.CentralAuthenticationServiceImpl.createTicketGrantingTi
cket_aroundBody11$advice(CentralAuthenticationServiceImpl.java:44)
        at org.jasig.cas.CentralAuthenticationServiceImpl.createTicketGrantingTi
cket(CentralAuthenticationServiceImpl.java:1)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.
java:39)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAcces
sorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:597)
        at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflecti
on(AopUtils.java:307)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJo
inpoint(ReflectiveMethodInvocation.java:183)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(
ReflectiveMethodInvocation.java:150)
        at org.springframework.aop.aspectj.MethodInvocationProceedingJoinPoint.p
roceed(MethodInvocationProceedingJoinPoint.java:80)
        at org.perf4j.aop.AbstractTimingAspect.doPerfLogging(AbstractTimingAspec
t.java:71)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.
java:39)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAcces
sorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:597)
        at org.springframework.aop.aspectj.AbstractAspectJAdvice.invokeAdviceMet
hodWithGivenArgs(AbstractAspectJAdvice.java:622)
        at org.springframework.aop.aspectj.AbstractAspectJAdvice.invokeAdviceMet
hod(AbstractAspectJAdvice.java:611)
        at org.springframework.aop.aspectj.AspectJAroundAdvice.invoke(AspectJAro
undAdvice.java:65)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(
ReflectiveMethodInvocation.java:161)
        at org.springframework.aop.interceptor.ExposeInvocationInterceptor.invok
e(ExposeInvocationInterceptor.java:89)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(
ReflectiveMethodInvocation.java:172)
        at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynami
cAopProxy.java:202)
        at $Proxy13.createTicketGrantingTicket(Unknown Source)
        at org.jasig.cas.web.flow.AbstractNonInteractiveCredentialsAction.doExec
ute(AbstractNonInteractiveCredentialsAction.java:84)
        at org.springframework.webflow.action.AbstractAction.execute(AbstractAct
ion.java:188)
        at org.springframework.webflow.execution.ActionExecutor.execute(ActionEx
ecutor.java:51)
        at org.springframework.webflow.action.EvaluateAction.doExecute(EvaluateA
ction.java:79)
        at org.springframework.webflow.action.AbstractAction.execute(AbstractAct
ion.java:188)
        at org.springframework.webflow.execution.AnnotatedAction.execute(Annotat
edAction.java:145)
        at org.springframework.webflow.execution.ActionExecutor.execute(ActionEx
ecutor.java:51)
        at org.springframework.webflow.engine.ActionState.doEnter(ActionState.ja
va:101)
        at org.springframework.webflow.engine.State.enter(State.java:194)
        at org.springframework.webflow.engine.Transition.execute(Transition.java
:227)
        at org.springframework.webflow.engine.impl.FlowExecutionImpl.execute(Flo
wExecutionImpl.java:391)
        at org.springframework.webflow.engine.impl.RequestControlContextImpl.exe
cute(RequestControlContextImpl.java:214)
        at org.springframework.webflow.engine.TransitionableState.handleEvent(Tr
ansitionableState.java:119)
        at org.springframework.webflow.engine.Flow.handleEvent(Flow.java:555)
        at org.springframework.webflow.engine.impl.FlowExecutionImpl.handleEvent
(FlowExecutionImpl.java:386)
        at org.springframework.webflow.engine.impl.RequestControlContextImpl.han
dleEvent(RequestControlContextImpl.java:210)
        at org.springframework.webflow.engine.ActionState.doEnter(ActionState.ja
va:105)
        at org.springframework.webflow.engine.State.enter(State.java:194)
        at org.springframework.webflow.engine.Transition.execute(Transition.java
:227)
        at org.springframework.webflow.engine.DecisionState.doEnter(DecisionStat
e.java:51)
        at org.springframework.webflow.engine.State.enter(State.java:194)
        at org.springframework.webflow.engine.Transition.execute(Transition.java
:227)
        at org.springframework.webflow.engine.DecisionState.doEnter(DecisionStat
e.java:51)
        at org.springframework.webflow.engine.State.enter(State.java:194)
        at org.springframework.webflow.engine.Flow.start(Flow.java:535)
        at org.springframework.webflow.engine.impl.FlowExecutionImpl.start(FlowE
xecutionImpl.java:364)
        at org.springframework.webflow.engine.impl.FlowExecutionImpl.start(FlowE
xecutionImpl.java:222)
        at org.springframework.webflow.executor.FlowExecutorImpl.launchExecution
(FlowExecutorImpl.java:140)
        at org.springframework.webflow.mvc.servlet.FlowHandlerAdapter.handle(Flo
wHandlerAdapter.java:193)
        at org.springframework.web.servlet.DispatcherServlet.doDispatch(Dispatch
erServlet.java:771)
        at org.springframework.web.servlet.DispatcherServlet.doService(Dispatche
rServlet.java:716)
        at org.springframework.web.servlet.FrameworkServlet.processRequest(Frame
workServlet.java:647)
        at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServl
et.java:552)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:621)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:722)
        at org.jasig.cas.web.init.SafeDispatcherServlet.service_aroundBody2(Safe
DispatcherServlet.java:115)
        at org.jasig.cas.web.init.SafeDispatcherServlet.service_aroundBody3$advi
ce(SafeDispatcherServlet.java:44)
        at org.jasig.cas.web.init.SafeDispatcherServlet.service(SafeDispatcherSe
rvlet.java:1)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Appl
icationFilterChain.java:304)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationF
ilterChain.java:210)
        at com.github.inspektr.common.web.ClientInfoThreadLocalFilter.doFilter(C
lientInfoThreadLocalFilter.java:46)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Appl
icationFilterChain.java:243)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationF
ilterChain.java:210)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperV
alve.java:224)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextV
alve.java:175)
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(Authentica
torBase.java:472)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.j
ava:164)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.j
ava:100)
        at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:
929)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineVal
ve.java:118)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.jav
a:405)
        at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java
:279)
        at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(
AbstractProtocol.java:515)
        at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoin
t.java:302)
        at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExec
utor.java:886)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor
.java:908)
        at java.lang.Thread.run(Thread.java:662)
Caused by: java.lang.reflect.InvocationTargetException
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.
java:39)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAcces
sorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:597)
        at jcifs.spnego.Authentication.processKerberos(Authentication.java:426)
        ... 91 more
Caused by: javax.security.auth.login.LoginException: Receive timed out
        at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Kr
b5LoginModule.java:700)
        at com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.ja
va:542)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.
java:39)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAcces
sorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:597)
        at javax.security.auth.login.LoginContext.invoke(LoginContext.java:769)
        at javax.security.auth.login.LoginContext.access$000(LoginContext.java:1
86)
        at javax.security.auth.login.LoginContext$4.run(LoginContext.java:683)
        at java.security.AccessController.doPrivileged(Native Method)
        at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:6
80)
        at javax.security.auth.login.LoginContext.login(LoginContext.java:579)
        ... 96 more
Caused by: java.net.SocketTimeoutException: Receive timed out
        at java.net.PlainDatagramSocketImpl.receive0(Native Method)
        at java.net.PlainDatagramSocketImpl.receive(PlainDatagramSocketImpl.java
:145)
        at java.net.DatagramSocket.receive(DatagramSocket.java:725)
        at sun.security.krb5.internal.UDPClient.receive(UDPClient.java:77)
        at sun.security.krb5.KrbKdcReq$KdcCommunication.run(KrbKdcReq.java:352)
        at java.security.AccessController.doPrivileged(Native Method)
        at sun.security.krb5.KrbKdcReq.send(KrbKdcReq.java:266)
        at sun.security.krb5.KrbKdcReq.send(KrbKdcReq.java:174)
        at sun.security.krb5.KrbKdcReq.send(KrbKdcReq.java:147)
        at sun.security.krb5.KrbAsReq.send(KrbAsReq.java:433)
        at sun.security.krb5.Credentials.sendASRequest(Credentials.java:400)
        at sun.security.krb5.Credentials.acquireTGT(Credentials.java:350)
        at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Kr
b5LoginModule.java:662)
        ... 107 more
2011-10-27 18:16:46,500 DEBUG [org.jasig.cas.support.spnego.web.flow.SpnegoCrede
ntialsAction] - <Unable to obtain the output token required.>
2011-10-27 18:16:46,500 DEBUG [org.jasig.cas.support.spnego.web.flow.SpnegoCrede
ntialsAction] - <Setting HTTP Status to 401>
不知道您能给解答下不？

19 楼 zdx3578 2011-03-09  

后续错误记录到我博客看吧

18 楼 雨辰RainTime 2011-03-08  

zdx3578 写道

C:\Users\Administrator>ktpass.exe /out spn.keytab /princ HTTP/test.zdxcas.com@BQ
.TEST /pass * /mapuser [e-mail] /ptype KRB5_NT_PRINCIPAL /crypto RC4-HMAC-NT


C:\Users\Administrator>ktpass.exe /out spn.keytab /princ HTTP/test.zdxcas.com@BQ
.TEST /pass 123qweGHJOII /mapuser [e-mail] /ptype KRB5_NT_PRINCIPAL /crypto RC4-HMAC-NT


每个命令生成的文件传到linux给cas的kerberos使用都ok（前提是2008 ad上使用下面的命令。。。/pass 123qweGHJOII /。。。。。。），ad上只要是上面的命令执行 就都不行 kerberos 24   KRB Error: error code is 24 error Message is Pre-authentication information was invalid  错误

这两个命令对生成的文件是一样的，但是对ad的结果却不同！

17 楼 zdx3578 2011-03-08  

C:\Users\Administrator>ktpass.exe /out spn.keytab /princ HTTP/test.zdxcas.com@BQ
.TEST /pass * /mapuser [e-mail] /ptype KRB5_NT_PRINCIPAL /crypto RC4-HMAC-NT


C:\Users\Administrator>ktpass.exe /out spn.keytab /princ HTTP/test.zdxcas.com@BQ
.TEST /pass 123qweGHJOII /mapuser [e-mail] /ptype KRB5_NT_PRINCIPAL /crypto RC4-HMAC-NT


每个命令生成的文件传到linux给cas的kerberos使用都ok（前提是2008 ad上使用下面的命令。。。/pass 123qweGHJOII /。。。。。。），ad上只要是上面的命令执行 就都不行 kerberos 24   KRB Error: error code is 24 error Message is Pre-authentication information was invalid  错误

这两个命令对生成的文件是一样的，但是对ad的结果却不同！

16 楼 zdx3578 2011-03-07  

C:\Users\Administrator>ktpass.exe /out spn.keytab /princ HTTP/test.zdxcas.com@BQ
.TEST /pass * /mapuser [e-mail] /ptype KRB5_NT_PRINCIPAL /crypto RC4-HMAC-NT

--
这样的命令手动输入密码就24 错误

--
C:\Users\Administrator>ktpass.exe /out spn.keytab /princ HTTP/test.zdxcas.com@BQ
.TEST /pass 123qweGHJOII /mapuser [e-mail] /ptype KRB5_NT_PRINCIPAL /crypto RC4-HMAC-NT
密码在命令里写好不手动输入后生产的keytab文件就ok，使用这样的文件就完成ok，一起顺利，域用户打开firefox后ie后cas server 自动登录完成。

zdx3578 写道

KRB Error: error code is 24 error Message is Pre-authentication information was invalid ？

问题原因应该是
Cause 2: If you are using the keytab to get the key (e.g., by setting the useKeyTab option to true in the Krb5LoginModule entry in the JAAS login configuration file), then the key might have changed since you updated the keytab.

    Solution 2: Consult your Kerberos documentation to generate a new keytab and use that keytab.

    Cause 4: The Kerberos realm name is not all uppercase.

    Solution 4: Make the Kerberos realm name all uppercase. Note: It is recommended to have all uppercase realm names. For details, refer to the Naming Conventions for the Realm Names and Hostnames section of this tutorial.

15 楼 zdx3578 2011-03-07  

http://www.xioxu.com/?p=325006
# javax.security.auth.login.LoginException: KrbException: Pre-authentication information was invalid (24) - Preauthentication failed

    Cause 1: The password entered is incorrect.

    Solution 1: Verify the password.

    Cause 2: If you are using the keytab to get the key (e.g., by setting the useKeyTab option to true in the Krb5LoginModule entry in the JAAS login configuration file), then the key might have changed since you updated the keytab.

    Solution 2: Consult your Kerberos documentation to generate a new keytab and use that keytab.

    Cause 3: Clock skew - If the time on the KDC and on the client differ significanlty (typically 5 minutes), this error can be returned.

    Solution 3: Synchronize the clocks (or have a system administrator do so).
    Cause 4: The Kerberos realm name is not all uppercase.

    Solution 4: Make the Kerberos realm name all uppercase. Note: It is recommended to have all uppercase realm names. For details, refer to the Naming Conventions for the Realm Names and Hostnames section of this tutorial.


还是没解决掉！
  

14 楼 zdx3578 2011-03-07  

KRB Error: error code is 24 error Message is Pre-authentication information was invalid ？

13 楼 zdx3578 2011-03-07  

官方例子：
https://wiki.jasig.org/display/CASC/Saml11TicketValidationFilter+Example
https://wiki.jasig.org/display/CASC/JA-SIG+Java+Client+Simple+WebApp+Sample

12 楼 zdx3578 2011-03-05  

-rwxr-xr-x 1 zdx zdx 86635 2011-03-05 03:10 cas-client-core-3.2.0.jar*
-rwxr-xr-x 1 zdx zdx 12160 2011-03-05 03:10 cas-client-integration-tomcat-common-3.2.0.jar*
-rwxr-xr-x 1 zdx zdx 20191 2011-03-05 03:10 cas-client-integration-tomcat-v6-3.2.0.jar*
-rwxr-xr-x 1 zdx zdx 52915 2011-03-05 03:10 commons-logging-1.1.jar*

11 楼 zdx3578 2011-03-04  

http://192.168.245.139:8443/          第二次犯这个傻了

10 楼 zdx3578 2011-03-04  

http://192.168.245.139:8443/   

9 楼 zdx3578 2011-03-04  




zdx3578 写道

8443 ssl 访问出现：  页面左上角几个乱码 




啥原因？

使用http 访问 8443端口！！！！ 

8 楼 zdx3578 2011-03-04  

8443 ssl 访问出现：




啥原因？

7 楼 zdx3578 2011-03-04  

tomcat 证书：：：：：：：：：的一种方式

Tomcat can use two different implementations of SSL:

    * the JSSE implementation provided as part of the Java runtime (since 1.4)
    * the APR implementation, which uses the OpenSSL engine by default.





[系统维护] Linux 生成SSL证书 供 nginx使用
这里说下Linux 系统怎么通过openssl命令生成 证书。

首先执行如下命令生成一个key

openssl genrsa -des3 -out ssl.key 1024

然后他会要求你输入这个key文件的密码。不推荐输入。因为以后要给nginx使用。每次reload nginx配置时候都要你验证这个PAM密码的。

由于生成时候必须输入密码。你可以输入后 再删掉。

mv ssl.key xxx.key
openssl rsa -in xxx.key -out ssl.key
rm xxx.key

然后根据这个key文件生成证书请求文件

openssl req -new -key ssl.key -out ssl.csr

以上命令生成时候要填很多东西 一个个看着写吧（可以随便，毕竟这是自己生成的证书）

最后根据这2个文件生成crt证书文件

openssl x509 -req -days 365 -in ssl.csr -signkey ssl.key -out ssl.crt

这里365是证书有效期 推荐3650哈哈。这个大家随意。最后使用到的文件是key和crt文件。

在需要使用证书的nginx配置文件的server节点里加入以下配置就可以了。

ssl on;
ssl_certificate /home/ssl.crt;
ssl_certificate_key /home/ssl.key;
ssl_session_timeout 5m;
ssl_protocols SSLv2 SSLv3 TLSv1;
ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
ssl_prefer_server_ciphers on;

然后重启nginx就大功告成了。

6 楼 zdx3578 2011-03-04  

zdx3578 写道

keytool生成根证书时出现如下错误：

keytool错误:java.io.IOException:keystore was tampered with,or password was incorrect

原因是在你的home目录下是否还有.keystore存在。如果存在那么把他删除掉，后再执行

或者删除"%JAVA_HOME%/JRE/LIB/SECURITY/CACERTS 再执行

这个方法有效

使用keytool工具删除证书时出现java.io.IOException: Keystore was tampered with, or password was incorrect 异常的解决办法：

对于很多服务器比如glassfish或者tomcat之类的，在证书过期，我们需要删除时，需要输入保护密码，默认的就是changeit，输入这个密码就可以了。

密码就是changeit

5 楼 zdx3578 2011-03-04  

keytool生成根证书时出现如下错误：

keytool错误:java.io.IOException:keystore was tampered with,or password was incorrect

原因是在你的home目录下是否还有.keystore存在。如果存在那么把他删除掉，后再执行

或者删除"%JAVA_HOME%/JRE/LIB/SECURITY/CACERTS 再执行

这个方法有效

4 楼 zdx3578 2011-03-04  

zdx3578 写道

cas-server-uber-webapp-3.4.6 部署这个包应该不错，这个里面包含东西多

A、将cas-server-3.4.2-release\cas-server-3.4.2\modules目录的cas-server-support-spnego-3.4.2.jar复制到cas\WEB-INF\lib下

B、还需要有两个外部包的支持，“jcifs-1.1.11.jar、jcifs-ext-0.9.4.jar”，将这两个jar包也拷贝到cas\WEB-INF\lib下

包括这3个包等等其他包   cas-server-uber-webap