0

I try to do real SSO on a windows-client with a java-rich-client to an STS (Secure Token Service).

GSSAPI works but I need to at least do a java kinit in front of the call to aquire a TGT.

I tried a lot of different approaches until now and I'm still failing with my usecase: Real SSO with a Windows-only Java-Client.

Things I tried and work:

  • Browser (Firefox, Chrome, IE..) everyone is working with Negotiate authorization header
  • GSS-API if I manually do the java kinit before (allowtgt-registry entry isn't possible anymore because of active windows credential security)

Things I tried that don't work:

  • Apache WinHttpClient
  • Waffle

I think the flow is not important. The important part is the following:

  1. Request: GET /adfs/ls/wia?client-request-id=UUID
  2. Response: 401 WWW-Authenticate: Negotiate and NTLM
  3. Request: GET /adfs/ls/wia?client-request-id=UUID with header Authorization: Negotiate YIIMWw...
  4. Response: 401 WWW-Authenticate: Negotiate and NTLM

The code I use for waffle (Apache WinHttpClient does nearly the same) only differs from the working GSSAPI solution in these lines:

String SECURITY_PACKAGE = "Negotiate";

byte[] token = WindowsSecurityContextImpl.getCurrent(SECURITY_PACKAGE, "HTTP/mystsserver.my.domain").getToken();

String ticket = Base64.getEncoder().encodeToString(token);
String header = SECURITY_PACKAGE + " " + ticket;

The GSS-API ticket and the SSPI ticket are looking very similar with the same start and the same length but IIS rejects the second one.

My questions now are:

  1. How can I debug this special case on STS?
  2. How can I aquire a token via GSSAPI without calling kinit manually
  3. What am I doing wrong with waffle or WinHTTPClient?

Thanks a lot

Andreas
  • 1
  • 1

1 Answers1

0

The reason why this does not work is "Extended Protection" by Windows Integrated Authentication, or in other words: ChannelBinding.

It can be activated in java with "jdk.https.negotiate.cbt" (never, domain, always).

However, right now I am not able to activate channelbinding and Java native ("sun.security.jgss.native") at the same time.

Another solution would be to set extended protection to none which simple disables this feature. It is another security mechanism against MITM attacks by binding the kerberos token to the certificate of the receiving server.

Andreas
  • 1
  • 1