Jetty SPNEGO/SSO gives NPE. Expected cause krn5.ini?

Question

We're facing an issue where Jetty SPNEGO gives an NPE inside SpnegoLoginService.login()
The gssContext.getSrcName() call returns null.

The SPN is: HTTP/machine.dd.aa.net@EE.AA.NET
Must there be a special setup in the KRB5.INI file when dd.aa.net != EE.AA.NET ?

The only clue i found with Google is this warning message from some online source code:

if (gssContext.isEstablished()) {
    if (gssContext.getSrcName() == null) {
        log.warn("GSS Context accepted, but no context initiator recognized. Check your kerberos configuration and reverse DNS lookup configuration");
        return false;
    }

Our client-setup is

Internet-explorer browser, setup for negotiate/spnego
login using Windows SmartCard

Our server-setup is

Java 8u45
Jetty 9
using org.eclipse.jetty.security.SpnegoLoginService

We used java kinit on the server to validate against the keytab and also against the DC. which went ok. Also the reverse DNS zones are working.

is there a possibility that the 'service request token' generated by the client browser (logged in with smartcard) doesn't supply the context initiator / client principle name ?

Thanks

score 0 · Answer 1 · answered Jul 29 '16 at 09:24

The nullpointer was gone when we went from Java 1.8u45 to Java 1.8u60

Turns out the server side didn't check all tickets provided by the client, so didn't find the correct one.

Below the bug entry:
[JDK-8078439] SPNEGO auth fails if client proposes MS krb5 OID

Jetty SPNEGO/SSO gives NPE. Expected cause krn5.ini?

1 Answers1