“Defective token detected” error (NTLM not Kerberos) with Kerberos/Spring Security/IE/Active Directory

by

This can happen when you are running the client and server on the same machine. When you use IE to talk to the machine running tomcat ensure that these are distinct machines.

Additionally you need to ensure that the server machine is joined to the domain specified in the keytab (testdomain.ourcompany.co.uk) or you might drop back to NTLM. Your keytab can still work even if your server is on a machine not joined to the domain (you’ll see the nice keytab decrypt that you showed), but IE can get confused and not do the correct thing.

AD only really likes to speak arcfour-hmac for Server 2003 so you need to ensure that you set this up correctly in your krb5.ini file.

You can correctly create the keytab like this:

C:\>ktpass -princ HTTP/[email protected] -mapuser [email protected] -crypto RC4-HMAC-NT -ptype K
RB5_NT_PRINCIPAL -pass * -out ourweb.keytab
Targeting domain controller: test-dc.ourcompany.co.uk
Using legacy password setting method
Successfully mapped HTTP/[email protected] to ourweb.testdomain.ourcompany.co.uk.
Key created.
Output keytab to ourweb.keytab:
Keytab version: 0x502
keysize 75 HTTP/[email protected] ptype 1 (KRB5_NT_PRINCIPAL)
vno 3 etype 0x17 (RC4-HMAC) keylength 16 (0x0fd0e500225c4fca9a63a9998b17ca32)

I did not see that you had set up a krb5.ini file. You will need to have that set correctly on your server machine (default location C:\WINDOWS\krb5.ini):

[domain_realm]  
    .testdomain.ourcompany.co.uk = TESTDOMAIN.OURCOMPANY.CO.UK
    testdomain.ourcompany.co.uk = TESTDOMAIN.OURCOMPANY.CO.UK

[libdefaults]   
    default_realm = TESTDOMAIN.OURCOMPANY.CO.UK
    permitted_enctypes = aes128-cts aes256-cts arcfour-hmac-md5 
    default_tgs_enctypes = aes128-cts aes256-cts arcfour-hmac-md5 
    default_tkt_enctypes = aes128-cts aes256-cts arcfour-hmac-md5 

[realms]    
VERDAD.LOCAL = {        
    kdc = test-dc.ourcompany.co.uk  
    admin_server = test-dc.ourcompany.co.uk
    default_domain = TESTDOMAIN.OURCOMPANY.CO.UK
}

You might also need to set the following properties (if you are trying to run this from an IDE):

<systemProperties>
  <java.security.krb5.kdc>test-dc.ourcompany.co.uk</java.security.krb5.kdc>
  <java.security.krb5.realm>TESTDOMAIN.OURCOMPANY.CO.UK</java.security.krb5.realm>
</systemProperties>

I was using the org.codehaus.mojo plugin for maven which sets these in the pom file like this:

<build>
  <plugins>
    <plugin>
      <groupId>org.codehaus.mojo</groupId>
      <artifactId>tomcat-maven-plugin</artifactId>
      <configuration>
        <server>tomcat-development-server</server>
        <port>8080</port>
        <path>/SecurityTest</path>
        <systemProperties>
          <java.security.krb5.kdc>test-dc.ourcompany.co.uk</java.security.krb5.kdc
          <java.security.krb5.realm>TESTDOMAIN.OURCOMPANY.CO.UK</java.security.krb5.realm>
        </systemProperties>
      </configuration>
    </plugin>
  </plugins>
</build>

More Related Contents:

  1. Spring Security : Multiple HTTP Config not working
  2. Filter invoke twice when register as Spring bean
  3. Spring security CORS Filter
  4. How to create custom methods for use in spring security expression language annotations
  5. When using Spring Security, what is the proper way to obtain current username (i.e. SecurityContext) information in a bean?
  6. Configuring Spring Security 3.x to have multiple entry points
  7. Spring Boot 2.0.x disable security for certain profile
  8. How to disable spring security for particular url
  9. Difference between Role and GrantedAuthority in Spring Security
  10. How to enable HTTP response caching in Spring Boot
  11. RESTful Authentication via Spring
  12. 401 instead of 403 with Spring Boot 2
  13. How to redirect to the homepage if the user accesses the login page after being logged in?
  14. Spring webSecurity.ignoring() doesn’t ignore custom filter
  15. Multiple WebSecurityConfigurerAdapter in spring boot for multiple patterns
  16. Java SPNEGO Authentication & Kerberos Constrained Delegation (KCD) to backend service
  17. Unit testing with Spring Security
  18. spring web, security + web.xml + mvc dispatcher + Bean is created twice
  19. Spring Security, secured and none secured access
  20. Skipping Kerberos authentication prompts with JSch [duplicate]
  21. How to use new PasswordEncoder from Spring Security
  22. How to connect with Java into Active Directory
  23. How to test spring-security-oauth2 resource server security?
  24. Spring REST security – Secure different URLs differently
  25. What does Cookie CsrfTokenRepository.withHttpOnlyFalse () do and when to use it?
  26. Single role multiple IP addresses in Spring Security configuration
  27. Spring Security HTTP Basic Authentication
  28. disabling spring security in spring boot app [duplicate]
  29. Spring Boot Microservices – Spring Security – ServiceTest and ControllerTest for JUnit throwing java.lang.StackOverflowError
  30. Custom Authentication Manager with Spring Security and Java Configuration

Leave a Comment