Skip to main content

developerWorks >  Java technology  >  Forums  >  Java security  >  developerWorks

"Empty key" exception accessing Active Directory over JNDI GSSAPI    Point your RSS reader here for a feed of the latest messages in this thread


Tags for this thread: 

     
 
 
My developerWorks
 Welcome, Guest
Sign in or register
This question is not answered.

Reply to this Thread Reply to this Thread Post New Thread Post New Thread Watch list Watch list Forum settings Forum settings Help Help
Permlink Replies: 1 - Pages: 1 - Last Post: Nov 10, 2009 5:39 PM Last Post By: yodude
yodude

Posts: 39
Registered: Jan 05, 2005 08:25:44 AM
"Empty key" exception accessing Active Directory over JNDI GSSAPI
Posted: Nov 10, 2009 05:35:28 PM 		 
Click to report abuse...   Click to reply to this thread Reply
Hi,
From Windows XP, IBM JDK 5.0, I am trying to access AD over JNDI using GSSAPI but am getting a crypto exception.

I am signed onto the domain and want the Kerberos client to use these existing credentials.

Any help tremendously appreciated.

Here the highlights of my config:

Login code:
LoginContext lc = new LoginContext("GssApiLogin",new MSDomainCallbackHandler());
lc.login();

login.conf:
GssApiLogin {
com.ibm.security.auth.module.Krb5LoginModule required
debug=true
useDefaultCcache=true;
};

Jndi/ldap init:
env.put(Context.SECURITY_AUTHENTICATION,"GSSAPI");
env.put(INITIAL_CONTEXT_FACTORY, DEF_JNDI_FACTORY);
env.put(Context.PROVIDER_URL, url.toString());
env.put( Context.REFERRAL, "follow" );
LdapContext ctx = new InitialLdapContext(env, null);

Exception is thrown when creating the LdapContext.
yodude

Posts: 39
Registered: Jan 05, 2005 08:25:44 AM
Re: "Empty key" exception accessing Active Directory over JNDI GSSAPI
Posted: Nov 10, 2009 05:39:20 PM   in response to: yodude in response to: yodude's post 		 
Click to report abuse...   Click to reply to this thread Reply
here is my trace:

Trace:

JGSS_DBG_CRED JAAS config: debug=true
JGSS_DBG_CRED JAAS config: credsType=initiate only (default)
JGSS_DBG_CRED JAAS config: useDefaultCcache=true
JGSS_DBG_CRED JAAS config: useDefaultKeytab=false (default)
JGSS_DBG_CRED JAAS config: forwardable=false (default)
JGSS_DBG_CRED JAAS config: proxiable=false (default)
JGSS_DBG_CRED JAAS config: noAddress=false (default)
JGSS_DBG_CRED JAAS config: tryFirstPass=false (default)
JGSS_DBG_CRED JAAS config: useFirstPass=false (default)
JGSS_DBG_CRED JAAS config: moduleBanner=false (default)
JGSS_DBG_CRED JAAS config: interactive login? no
JGSS_DBG_CRED Retrieving Kerberos creds from cache for principal=null
JGSS_DBG_CRED Done retrieving Kerberos creds from cache
JGSS_DBG_CRED Login successful
JGSS_DBG_CRED abc@XYZ.COM added to Subject
JGSS_DBG_CRED Kerberos ticket for abc@XYZ.COM added to Subject
JGSS_DBG_CRED No keys to add to Subject for abc@XYZ.IBM.COM

com.ibm.security.krb5.internal.crypto.KrbCryptoException, status code: 0
message: java.lang.IllegalArgumentException: Empty key
at com.ibm.security.krb5.internal.crypto.f.a(f.java:36)
at com.ibm.security.krb5.Checksum.<init>(Checksum.java:116)
at com.ibm.security.krb5.KrbTgsReq.a(KrbTgsReq.java:69)
at com.ibm.security.krb5.KrbTgsReq.<init>(KrbTgsReq.java:5)
at com.ibm.security.krb5.internal.l.b(l.java:5)
at com.ibm.security.krb5.internal.l.a(l.java:62)
at com.ibm.security.krb5.Credentials.acquireServiceCreds(Credentials.java:13)
at com.ibm.security.jgss.mech.krb5.p.a(p.java:265)
at com.ibm.security.jgss.mech.krb5.p.initSecContext(p.java:1121)
at com.ibm.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:207)
at com.ibm.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:245)
at com.ibm.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:163)
at com.sun.jndi.ldap.sasl.LdapSasl.saslBind(LdapSasl.java:120)
at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:229)
at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2672)
at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:310)
at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:190)
at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:208)
at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:151)
at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:81)
at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:679)
at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:259)
at javax.naming.InitialContext.init(InitialContext.java:235)
at javax.naming.ldap.InitialLdapContext.<init>(InitialLdapContext.java:146)
at com.XYZ.createLdapContext(LdapClient.java:110)
snip
Pages: 1
Go Back Back to Thread List
 Tags
Help

Use the search field to find all types of content in My developerWorks with that tag.

Use the slider bar to see more or fewer tags.

Popular tags shows the top tags for this particular type of content or application that you're viewing.

My tags shows your tags for this particular type of content or application that you're viewing.

 
MoreLess 

Update your My developerWorks profile and start connecting with others.

Point your RSS reader here for a feed of the latest messages in all forums