Java NullPointerException when configuring spnego SSO

discuss · May 23, 2018, 3:46am

(from github.com/jfabales)
Hi Fess team,
I was trying to configure spnego SSO, I’ve got my keytab file available and tested ok, auth_login.conf configured properly and I’m getting these errors when starting FESS, can you check?
Here’s my fess_config.properties file:

sso.type=spnego
spnego.logger.level=0
spnego.krb5.conf=krb5-2.conf
spnego.login.conf=auth_login.conf
spnego.preauth.username=fessclient@DOMAIN
spnego.preauth.password=password
spnego.login.client.module=spnego-client
spnego.login.server.module=spnego-server
spnego.allow.basic=true
spnego.allow.unsecure.basic=true
spnego.prompt.ntlm=true
spnego.allow.localhost=true
spnego.allow.delegation=false

2018-05-23 21:50:10,726 [localhost-startStop-1] ERROR Failed to initialize Lasta Di.
org.lastaflute.di.exception.ContainerInitFailureException: Look! Read the message below.
/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
Failed to initialize the container.

[Path]
fess_sso.xml

[Namespace]
null

[Included by]
app.xml
* * * * * * * * * */
	at org.lastaflute.di.core.meta.impl.LaContainerImpl.throwContainerInitFailureException(LaContainerImpl.java:463) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.meta.impl.LaContainerImpl.init(LaContainerImpl.java:415) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.meta.impl.LaContainerImpl.doInit(LaContainerImpl.java:431) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.meta.impl.LaContainerImpl.init(LaContainerImpl.java:413) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.factory.SingletonLaContainerFactory.init(SingletonLaContainerFactory.java:66) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.web.container.WebLastaContainerInitializer.doInitContainer(WebLastaContainerInitializer.java:81) ~[lastaflute-1.0.4.jar:?]
	at org.lastaflute.web.container.WebLastaContainerInitializer.initialize(WebLastaContainerInitializer.java:45) ~[lastaflute-1.0.4.jar:?]
	at org.lastaflute.web.servlet.filter.LastaPrepareFilter.initializeContainer(LastaPrepareFilter.java:136) [lastaflute-1.0.4.jar:?]
	at org.lastaflute.web.servlet.filter.LastaPrepareFilter.init(LastaPrepareFilter.java:94) [lastaflute-1.0.4.jar:?]
	at org.apache.catalina.core.ApplicationFilterConfig.initFilter(ApplicationFilterConfig.java:285) [classes/:?]
	at org.apache.catalina.core.ApplicationFilterConfig.getFilter(ApplicationFilterConfig.java:266) [classes/:?]
	at org.apache.catalina.core.ApplicationFilterConfig.<init>(ApplicationFilterConfig.java:108) [classes/:?]
	at org.apache.catalina.core.StandardContext.filterStart(StandardContext.java:4591) [classes/:?]
	at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5233) [classes/:?]
	at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150) [classes/:?]
	at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1419) [classes/:?]
	at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1409) [classes/:?]
	at java.util.concurrent.FutureTask.run(FutureTask.java:266) [?:1.8.0_162]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_162]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_162]
	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_162]
Caused by: org.lastaflute.di.core.exception.IllegalMethodRuntimeException: [ESSR0060]Can not configure method(init) of org.codelibs.fess.sso.SsoManager, because org.lastaflute.di.core.exception.IllegalMethodRuntimeException: [ESSR0060]Can not configure method(init) of org.codelibs.fess.sso.spnego.SpnegoAuthenticator, because org.codelibs.fess.exception.FessSystemException: Failed to initialize SPNEGO.
	at org.lastaflute.di.core.assembler.AbstractMethodAssembler.invoke(AbstractMethodAssembler.java:61) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.assembler.DefaultInitMethodAssembler.assemble(DefaultInitMethodAssembler.java:40) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.deployer.SingletonComponentDeployer.assemble(SingletonComponentDeployer.java:57) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.deployer.SingletonComponentDeployer.deploy(SingletonComponentDeployer.java:41) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.deployer.SingletonComponentDeployer.init(SingletonComponentDeployer.java:35) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.meta.impl.ComponentDefImpl.init(ComponentDefImpl.java:85) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.meta.impl.LaContainerImpl.doInit(LaContainerImpl.java:434) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.meta.impl.LaContainerImpl.init(LaContainerImpl.java:413) ~[lasta-di-0.7.5.jar:?]
	... 19 more
Caused by: org.lastaflute.di.core.exception.IllegalMethodRuntimeException: [ESSR0060]Can not configure method(init) of org.codelibs.fess.sso.spnego.SpnegoAuthenticator, because org.codelibs.fess.exception.FessSystemException: Failed to initialize SPNEGO.
	at org.lastaflute.di.core.assembler.AbstractMethodAssembler.invoke(AbstractMethodAssembler.java:61) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.assembler.DefaultInitMethodAssembler.assemble(DefaultInitMethodAssembler.java:40) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.deployer.SingletonComponentDeployer.assemble(SingletonComponentDeployer.java:57) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.deployer.SingletonComponentDeployer.deploy(SingletonComponentDeployer.java:41) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.meta.impl.ComponentDefImpl.getComponent(ComponentDefImpl.java:93) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.meta.impl.LaContainerImpl.getComponent(LaContainerImpl.java:102) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.SingletonLaContainer.getComponent(SingletonLaContainer.java:52) ~[lasta-di-0.7.5.jar:?]
	at org.codelibs.fess.util.ComponentUtil.getComponent(ComponentUtil.java:445) ~[classes/:?]
	at org.codelibs.fess.sso.SsoManager.init(SsoManager.java:31) ~[classes/:?]
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_162]
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_162]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_162]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_162]
	at org.lastaflute.di.util.LdiMethodUtil.invoke(LdiMethodUtil.java:49) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.assembler.AbstractMethodAssembler.invoke(AbstractMethodAssembler.java:59) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.assembler.DefaultInitMethodAssembler.assemble(DefaultInitMethodAssembler.java:40) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.deployer.SingletonComponentDeployer.assemble(SingletonComponentDeployer.java:57) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.deployer.SingletonComponentDeployer.deploy(SingletonComponentDeployer.java:41) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.deployer.SingletonComponentDeployer.init(SingletonComponentDeployer.java:35) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.meta.impl.ComponentDefImpl.init(ComponentDefImpl.java:85) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.meta.impl.LaContainerImpl.doInit(LaContainerImpl.java:434) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.meta.impl.LaContainerImpl.init(LaContainerImpl.java:413) ~[lasta-di-0.7.5.jar:?]
	... 19 more
Caused by: org.codelibs.fess.exception.FessSystemException: Failed to initialize SPNEGO.
	at org.codelibs.fess.sso.spnego.SpnegoAuthenticator.init(SpnegoAuthenticator.java:61) ~[classes/:?]
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_162]
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_162]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_162]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_162]
	at org.lastaflute.di.util.LdiMethodUtil.invoke(LdiMethodUtil.java:49) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.assembler.AbstractMethodAssembler.invoke(AbstractMethodAssembler.java:59) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.assembler.DefaultInitMethodAssembler.assemble(DefaultInitMethodAssembler.java:40) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.deployer.SingletonComponentDeployer.assemble(SingletonComponentDeployer.java:57) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.deployer.SingletonComponentDeployer.deploy(SingletonComponentDeployer.java:41) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.meta.impl.ComponentDefImpl.getComponent(ComponentDefImpl.java:93) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.meta.impl.LaContainerImpl.getComponent(LaContainerImpl.java:102) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.SingletonLaContainer.getComponent(SingletonLaContainer.java:52) ~[lasta-di-0.7.5.jar:?]
	at org.codelibs.fess.util.ComponentUtil.getComponent(ComponentUtil.java:445) ~[classes/:?]
	at org.codelibs.fess.sso.SsoManager.init(SsoManager.java:31) ~[classes/:?]
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_162]
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_162]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_162]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_162]
	at org.lastaflute.di.util.LdiMethodUtil.invoke(LdiMethodUtil.java:49) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.assembler.AbstractMethodAssembler.invoke(AbstractMethodAssembler.java:59) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.assembler.DefaultInitMethodAssembler.assemble(DefaultInitMethodAssembler.java:40) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.deployer.SingletonComponentDeployer.assemble(SingletonComponentDeployer.java:57) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.deployer.SingletonComponentDeployer.deploy(SingletonComponentDeployer.java:41) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.deployer.SingletonComponentDeployer.init(SingletonComponentDeployer.java:35) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.meta.impl.ComponentDefImpl.init(ComponentDefImpl.java:85) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.meta.impl.LaContainerImpl.doInit(LaContainerImpl.java:434) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.meta.impl.LaContainerImpl.init(LaContainerImpl.java:413) ~[lasta-di-0.7.5.jar:?]
	... 19 more
Caused by: java.lang.IllegalArgumentException: Servlet Filter init param(s) in web.xml missing: spnego.krb5.conf
	at org.codelibs.spnego.SpnegoFilterConfig.<init>(SpnegoFilterConfig.java:121) ~[spnego-1.0.jar:?]
	at org.codelibs.spnego.SpnegoFilterConfig.getInstance(SpnegoFilterConfig.java:314) ~[spnego-1.0.jar:?]
	at org.codelibs.fess.sso.spnego.SpnegoAuthenticator.init(SpnegoAuthenticator.java:56) ~[classes/:?]
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_162]
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_162]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_162]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_162]
	at org.lastaflute.di.util.LdiMethodUtil.invoke(LdiMethodUtil.java:49) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.assembler.AbstractMethodAssembler.invoke(AbstractMethodAssembler.java:59) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.assembler.DefaultInitMethodAssembler.assemble(DefaultInitMethodAssembler.java:40) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.deployer.SingletonComponentDeployer.assemble(SingletonComponentDeployer.java:57) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.deployer.SingletonComponentDeployer.deploy(SingletonComponentDeployer.java:41) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.meta.impl.ComponentDefImpl.getComponent(ComponentDefImpl.java:93) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.meta.impl.LaContainerImpl.getComponent(LaContainerImpl.java:102) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.SingletonLaContainer.getComponent(SingletonLaContainer.java:52) ~[lasta-di-0.7.5.jar:?]
	at org.codelibs.fess.util.ComponentUtil.getComponent(ComponentUtil.java:445) ~[classes/:?]
	at org.codelibs.fess.sso.SsoManager.init(SsoManager.java:31) ~[classes/:?]
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_162]
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_162]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_162]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_162]
	at org.lastaflute.di.util.LdiMethodUtil.invoke(LdiMethodUtil.java:49) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.assembler.AbstractMethodAssembler.invoke(AbstractMethodAssembler.java:59) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.assembler.DefaultInitMethodAssembler.assemble(DefaultInitMethodAssembler.java:40) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.deployer.SingletonComponentDeployer.assemble(SingletonComponentDeployer.java:57) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.deployer.SingletonComponentDeployer.deploy(SingletonComponentDeployer.java:41) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.deployer.SingletonComponentDeployer.init(SingletonComponentDeployer.java:35) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.meta.impl.ComponentDefImpl.init(ComponentDefImpl.java:85) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.meta.impl.LaContainerImpl.doInit(LaContainerImpl.java:434) ~[lasta-di-0.7.5.jar:?]
	at org.lastaflute.di.core.meta.impl.LaContainerImpl.init(LaContainerImpl.java:413) ~[lasta-di-0.7.5.jar:?]
	... 19 more

discuss · May 23, 2018, 10:03pm

(from github.com/jfabales)
Emphasis on:

Caused by: java.lang.IllegalArgumentException: Servlet Filter init param(s) in web.xml missing: spnego.krb5.conf

Which implies that I don’t have spnego.krb5.conf property configured and I do.

discuss · May 27, 2018, 8:36pm

(from github.com/marevol)
You need to create krb5.conf.

discuss · May 27, 2018, 10:05pm

(from github.com/jfabales)
Hi,
I created a krb5.conf file and points the config using absolute and relative paths, also made sure that fess has access to the config file.
Here’s what I tried and all returned the same error.

spnego.krb5.conf=krb5.conf
spnego.krb5.conf=/etc/fess/krb5.conf
spnego.krb5.conf="/etc/fess/krb5.conf"

Should the content of the krb5.conf matter? I also tried the format from this but it didn’t work either.
I’ve got docker FESS 12.1.2 by the way.

discuss · May 28, 2018, 3:01am

(from github.com/jfabales)
Here’s my config files for reference
fess_config.properties

sso.type=spnego
spnego.logger.level=1
spnego.krb5.conf=/etc/fess/krb5.conf
spnego.login.conf=/etc/fess/auth_login.conf
spnego.preauth.username=fessclient@company.com
spnego.preauth.password=password
spnego.login.client.module=spnego-client
spnego.login.server.module=spnego-server
spnego.allow.basic=true
spnego.allow.unsecure.basic=true
spnego.prompt.ntlm=false
spnego.allow.localhost=true
spnego.allow.delegation=false

krb5.conf

[libdefaults]
    default_realm = COMPANY.COM
    default_tkt_enctypes = aes128-cts rc4-hmac des3-cbc-sha1 des-cbc-md5 des-cbc-crc
    default_tgs_enctypes = aes128-cts rc4-hmac des3-cbc-sha1 des-cbc-md5 des-cbc-crc
    permitted_enctypes   = aes128-cts rc4-hmac des3-cbc-sha1 des-cbc-md5 des-cbc-crc

[realms]
    COMPANY.COM = {
        kdc = dc01.company.com
        kdc = dc02.company.com
        default_domain = COMPANY.COM
}

[domain_realm]
    .COMPANY.COM = COMPANY.COM

auth_login.conf

spnego-client {
    com.sun.security.auth.module.Krb5LoginModule required
    doNotPrompt=true
    principal="HTTP/HOSTNAME@COMPANY.COM"
    keyTab="/etc/fess/fessclient.keytab"
    storeKey=true
    useKeyTab=true
    isInitiator=false
    refreshKrb5Config=true
    storePass=true;
};
spnego-server {
    com.sun.security.auth.module.Krb5LoginModule required
    doNotPrompt=true
    principal="HTTP/HOSTNAME@COMPANY.COM"
    keyTab="/etc/fess/fessclient.keytab"
    storeKey=true
    useKeyTab=true
    isInitiator=false
    refreshKrb5Config=true
    storePass=true
    debug=true;
};

discuss · May 28, 2018, 9:58pm

(from github.com/jfabales)
There is a workaround for fess to recognise the properties, it is to put the following config into the system.properties file as well as in fess_config.properties file.

spnego.logger.level=1
spnego.krb5.conf=/etc/fess/krb5.conf
spnego.login.conf=/etc/fess/auth_login.conf
spnego.preauth.username=fessclient@company.com
spnego.preauth.password=password
spnego.login.client.module=spnego-client
spnego.login.server.module=spnego-server
spnego.allow.basic=true
spnego.allow.unsecure.basic=true
spnego.prompt.ntlm=false
spnego.allow.localhost=true
spnego.allow.delegation=false

Then it doesn’t complain about the missing spnego.krb5.conf property anymore.

discuss · May 28, 2018, 11:32pm

(from github.com/jfabales)
Now I’m just getting this error in fess.log
[http-nio-8080-exec-1] ERROR HTTP Authorization Header=Negotiate

discuss · May 29, 2018, 8:12am

(from github.com/jfabales)
Looks like I’m getting an authorization header but the checksum fails or it cannot be decrypted. I already got this in my krb5.conf file.

default_tkt_enctypes = aes256-cts-hmac-sha1-96 aes128-cts rc4-hmac des3-cbc-sha1 des-cbc-md5 des-cbc-crc
    default_tgs_enctypes = aes256-cts-hmac-sha1-96 aes128-cts rc4-hmac des3-cbc-sha1 des-cbc-md5 des-cbc-crc
    permitted_enctypes = aes256-cts-hmac-sha1-96 aes128-cts rc4-hmac des3-cbc-sha1 des-cbc-md5 des-cbc-crc

org.codelibs.fess.exception.SsoLoginException: HTTP Authorization Header=Negotiate YIIF6AYGKwYBBQUCoIIF3DCCBdigJzAlBgkqhkiG9xIBAgIGBSsFAQUCBgkqhkiC9xIBAgIGBisGAQUCBaKCBasEggWnYIIFowYJKoZIhvcSAQICAQBuggWSMIIFjqADAgEFoQMCAQ6iBwMFAAAAAACjggSOYYIEijCCBIagAwIBBaEOGwxXRVRBRlguQ08uTlqiMDAuoAMCAQOhJzAlGwRIVFRQGx1pbmYtdHYtZmVzczAxLnZtLndldGFmeC5jby5ueqOCBDswggQ3oAMCARKhAwIBAqKCBCkEggQlmw88yjO0CTLa+r4NHHNOOvI0h5B9BZbD/tEOQzWFeyaaHsLAUETohGQTIGSS+0MKx4xf+Z+crg3pbAJrk/oo5IKyy8Vb/rXdlX9m7nKsvWqlAiRFkT/nYVGzuEZ1E+RqG8NLSEOOK0CrYnLDQn9XIDHBNTlQZAOIooaUNWK9AXPE+tMn22xG1Ad4gveA7uuDeQ8nFAwr6a3JpOUTLTarh90wwMwmoTb9EfoGT/13+dih1ryQuKrqMmfwqQki9YrfxPzQj6GcAdd5czV4ewR/NFCjTNZrku+MzD/jtBniYQmAiWY2iZ+/pZGwrss4W+peBSviiQ84QT4YSgMra0FbTHCyu9pkCrsZo8KG/AdfT7x+vNdqERsBNsPA98oP2PasywGF3lnomPDT3Yixqje1HgdKb63EWLbzU+c3mfvhCLpZqBKpWe1akyz3dN9FVVbd+GqmFBNGeHw6qP6R6GLNmtORGZWIkuDbMmL/j5Rmfz5TaX8PXqz58Ad8qHH1B14xptHfjTbnU0xhZcUDv2X/+pnaViXfa6aFaah/zG3y48t9Ylq+SctryWcWB0eziR9XdlSjtZZcORsrH8uXmfom3XmJ2iJw3fMzmi6zktsCdEKNme0iqtBLTEk04Jwq0SyVj5R7PDAr3DCuxVsa+ejunoI0BKO8GFOdMpq1edwJ6UUYzaQmNfKx+27TGAvutm6T1HbOaskoMddzIMP8Tmtw41wabntfBK+/+uuOM7H0WVARRWMVaZ8RLs9ZpbZeJ/ukynrOUbqIbZwVdXwzJbgNxzW/u0QsCmdeihMwBTwksXcY+Pgfs6o0hs0TrNnyv63ayRV9FTRIhNGW2UlLcJtF//V+gET4Wp8dU7KJRjdYrLEXptEvtyzwBC/sQ55Ptx8MOojznLvNR/rh1quySSs9PP9DOSxUt05ZzSlCogTH9tbcCU0umMN0SDHK4yMBjfxqfjQOiliOsoxsuH42qdbSyGkRuicbxhJz94v4qKWEqp27Yb//RieC3YG7Mn8nv4Ah/Tpjh0wbC6pTNfyXy+HhjDlqc2tfNZlTlLGKWKNGcIhcVbXRDNnv3frD6urTjnEsRRSdeZGmSKu3aux2ddCytrVJAguFrIIPgWy3AaRoCbV9u5oCoieN9Qa+RilLH2g3nIzHhjZszP7sxAGVSKXJ7hhSrOsh/jCdS+yKqP6nkTNt8wdxVFLs9gYs2nx+c3D+LgTgbExlFo6pM3bbhgC/IvYatK2xPD0NRQGeohdlaIhmFxtfucf0HCZLIHaSBu676Vio63ES7oVyoFw+zs4LD5KxkhaRk9YuUk/q7LvjIfZjItikLpLsdSPfn0IixQDGt8yG17qmDGIrCgkPhqwiwQzRYnxbR/97uEVDXTtzBM//GgeJeyqmwBYnLhLGlBVUzlzjCFekgeYwgeOgAwIBEqKB2wSB2OxzwuvrnCbz5AzUrOgL3a482d9Y0rqa1WHZPLkwwZwP/eaJnoivYYMRaQw52HO/NAgHpYTJWcMGssvSefW9tTW/ql1DHIY6YQCbAZKsgtpnnD01TNRsjw9dc4LdsDLI/+mqbe+VeV/fQS1/N73yYlBmINS0kOrvlwTBumw/AEAMmcaxZZOesNORjAXCuTTD2C6yMrGqUe70lv6xBWgNCfzk6knaBhGxfG41K4qrux1z54l2CeWhWiB0mGPj8I5iyAKW5oV+vBBRDvk/V5utVcHf8QvMMoM52Q==
	at org.codelibs.fess.sso.spnego.SpnegoAuthenticator.lambda$getLoginCredential$1(SpnegoAuthenticator.java:84)
	at org.dbflute.optional.BaseOptional.callbackMapping(BaseOptional.java:228)
	at org.dbflute.optional.OptionalObject.map(OptionalObject.java:123)
	at org.codelibs.fess.sso.spnego.SpnegoAuthenticator.getLoginCredential(SpnegoAuthenticator.java:73)
	at org.codelibs.fess.sso.SsoManager.getLoginCredential(SsoManager.java:41)
	at org.codelibs.fess.app.web.sso.SsoAction.index(SsoAction.java:44)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at org.lastaflute.web.ruts.GodHandableAction.invokeExecuteMethod(GodHandableAction.java:335)
	at org.lastaflute.web.ruts.GodHandableAction.actuallyExecute(GodHandableAction.java:306)
	at org.lastaflute.web.ruts.GodHandableAction.doExecute(GodHandableAction.java:146)
	at org.lastaflute.web.ruts.GodHandableAction.lambda$transactionalExecute$0(GodHandableAction.java:137)
	at org.lastaflute.db.jta.stage.JTATransactionStage.performTx(JTATransactionStage.java:102)
	at org.lastaflute.db.jta.stage.JTATransactionStage.lambda$requiresNew$1(JTATransactionStage.java:59)
	at org.lastaflute.di.tx.adapter.JTATransactionManagerAdapter.requiresNew(JTATransactionManagerAdapter.java:73)
	at org.lastaflute.db.jta.stage.JTATransactionStage.requiresNew(JTATransactionStage.java:58)
	at org.lastaflute.db.jta.stage.JTATransactionStage.selectable(JTATransactionStage.java:84)
	at org.lastaflute.web.ruts.GodHandableAction.transactionalExecute(GodHandableAction.java:136)
	at org.lastaflute.web.ruts.GodHandableAction.execute(GodHandableAction.java:117)
	at org.lastaflute.web.ruts.ActionRequestProcessor.performAction(ActionRequestProcessor.java:249)
	at org.lastaflute.web.ruts.ActionRequestProcessor.fire(ActionRequestProcessor.java:185)
	at org.lastaflute.web.ruts.ActionRequestProcessor.process(ActionRequestProcessor.java:118)
	at org.lastaflute.web.servlet.filter.RequestRoutingFilter.processAction(RequestRoutingFilter.java:266)
	at org.lastaflute.web.servlet.filter.RequestRoutingFilter.routingToAction(RequestRoutingFilter.java:218)
	at org.lastaflute.web.servlet.filter.RequestRoutingFilter.lambda$createActionPathHandler$0(RequestRoutingFilter.java:184)
	at org.lastaflute.web.path.ActionPathResolver.actuallyHandleActionPath(ActionPathResolver.java:269)
	at org.lastaflute.web.path.ActionPathResolver.doHandleActionPath(ActionPathResolver.java:144)
	at org.lastaflute.web.path.ActionPathResolver.handleActionPath(ActionPathResolver.java:111)
	at org.lastaflute.web.servlet.filter.RequestRoutingFilter.doFilter(RequestRoutingFilter.java:118)
	at org.lastaflute.web.servlet.filter.LastaToActionFilter.viaEmbeddedFilter(LastaToActionFilter.java:153)
	at org.lastaflute.web.servlet.filter.LastaToActionFilter.viaInsideHookDeque(LastaToActionFilter.java:144)
	at org.lastaflute.web.servlet.filter.LastaToActionFilter.viaInsideHook(LastaToActionFilter.java:128)
	at org.lastaflute.web.servlet.filter.LastaToActionFilter.doFilter(LastaToActionFilter.java:120)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.lastaflute.web.servlet.filter.LastaShowbaseFilter.toNextChain(LastaShowbaseFilter.java:165)
	at org.lastaflute.web.servlet.filter.LastaShowbaseFilter.lambda$viaEmbeddedFilter$1(LastaShowbaseFilter.java:144)
	at org.lastaflute.web.servlet.filter.RequestLoggingFilter.actuallyFilter(RequestLoggingFilter.java:228)
	at org.lastaflute.web.servlet.filter.RequestLoggingFilter.doFilter(RequestLoggingFilter.java:200)
	at org.lastaflute.web.servlet.filter.LastaShowbaseFilter.viaEmbeddedFilter(LastaShowbaseFilter.java:142)
	at org.lastaflute.web.servlet.filter.LastaShowbaseFilter.viaOutsideHookDeque(LastaShowbaseFilter.java:133)
	at org.lastaflute.web.servlet.filter.LastaShowbaseFilter.viaOutsideHook(LastaShowbaseFilter.java:117)
	at org.lastaflute.web.servlet.filter.LastaShowbaseFilter.doFilter(LastaShowbaseFilter.java:109)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.codelibs.fess.filter.WebApiFilter.doFilter(WebApiFilter.java:51)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.lastaflute.web.servlet.filter.LastaPrepareFilter.toNextFilter(LastaPrepareFilter.java:279)
	at org.lastaflute.web.servlet.filter.LastaPrepareFilter.viaHotdeploy(LastaPrepareFilter.java:242)
	at org.lastaflute.web.servlet.filter.LastaPrepareFilter.viaLastaDiContext(LastaPrepareFilter.java:229)
	at org.lastaflute.web.servlet.filter.LastaPrepareFilter.doFilter(LastaPrepareFilter.java:202)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.codelibs.fess.filter.EncodingFilter.doFilter(EncodingFilter.java:119)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:199)
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:478)
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140)
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81)
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87)
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342)
	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:803)
	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868)
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1459)
	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
	at java.lang.Thread.run(Thread.java:748)
Caused by: GSSException: Failure unspecified at GSS-API level (Mechanism level: Checksum failed)
	at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:856)
	at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:342)
	at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:285)
	at sun.security.jgss.spnego.SpNegoContext.GSS_acceptSecContext(SpNegoContext.java:906)
	at sun.security.jgss.spnego.SpNegoContext.acceptSecContext(SpNegoContext.java:556)
	at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:342)
	at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:285)
	at org.codelibs.spnego.SpnegoAuthenticator.doSpnegoAuth(SpnegoAuthenticator.java:442)
	at org.codelibs.spnego.SpnegoAuthenticator.authenticate(SpnegoAuthenticator.java:281)
	at org.codelibs.fess.sso.spnego.SpnegoAuthenticator.lambda$getLoginCredential$1(SpnegoAuthenticator.java:80)
	... 74 more
Caused by: KrbException: Checksum failed
	at sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType.decrypt(Aes256CtsHmacSha1EType.java:102)
	at sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType.decrypt(Aes256CtsHmacSha1EType.java:94)
	at sun.security.krb5.EncryptedData.decrypt(EncryptedData.java:175)
	at sun.security.krb5.KrbApReq.authenticate(KrbApReq.java:281)
	at sun.security.krb5.KrbApReq.<init>(KrbApReq.java:149)
	at sun.security.jgss.krb5.InitSecContextToken.<init>(InitSecContextToken.java:108)
	at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:829)
	... 83 more
Caused by: java.security.GeneralSecurityException: Checksum failed
	at sun.security.krb5.internal.crypto.dk.AesDkCrypto.decryptCTS(AesDkCrypto.java:451)
	at sun.security.krb5.internal.crypto.dk.AesDkCrypto.decrypt(AesDkCrypto.java:272)
	at sun.security.krb5.internal.crypto.Aes256.decrypt(Aes256.java:76)
	at sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType.decrypt(Aes256CtsHmacSha1EType.java:100)
	... 89 more

discuss · May 30, 2018, 11:51pm

(from github.com/jfabales)
This is now resolved.

discuss · August 27, 2018, 7:43am

(from github.com/gopalkrishnams)
@jfabales, i have same issue, can you let me know what did you do to solve checksum failed issue.