Spring Security: "GSSHeader did not find the right tag" about kerb4j HOT 2 OPEN

Kerberos erros can be misleading.

I would say that following lines look suspicious:

            <property name="servicePrincipal" value="HTTP/[email protected]"/>
            <property name="keyTabLocation" value="file:C:\Temp\foobar.keytab"/>

Say you have an AD account for your server called srv_server
DNS name of your server (A-record ideally) is foo.bar and your srv_server account has HTTP/foo.bar SPN associated with it.

In this case you should create keytab for account srv_server (it's case sensitive; you wouldn't get an error when creating keytab if you mess up something) and use srv_server as servicePrincipal property.

Hope it helps.

from kerb4j.

@bedrin thanks for the help.

one more question: so the srv_server is the name of the account, and the servicePrincipal's value should be srv_server as well?

            <property name="servicePrincipal" value="srv_server"/> <!-- as here -->

with this setup I got the following stacktrace:

Stack trace:
javax.security.auth.login.LoginException: Unable to obtain password from user
     at com.sun.security.auth.module.Krb5LoginModule.promptForPass(Krb5LoginModule.java:856)
...

Edit:
If I list the keytab file it contains the following info:

$ java sun.security.krb5.internal.tools.Klist -k -t /c/Temp/app.keytab
 
Key tab: C:/Temp/app.keytab, 5 entries found.
 
[1] Service principal: HTTP/[email protected]
         KVNO: 5
         Time stamp: Jan 01, 1970 01:00:00
[2] Service principal: HTTP/[email protected]
         KVNO: 5
         Time stamp: Jan 01, 1970 01:00:00
[3] Service principal: HTTP/[email protected]
         KVNO: 5
         Time stamp: Jan 01, 1970 01:00:00
[4] Service principal: HTTP/[email protected]
         KVNO: 5
         Time stamp: Jan 01, 1970 01:00:00
[5] Service principal: HTTP/[email protected]
         KVNO: 5
         Time stamp: Jan 01, 1970 01:00:00

from kerb4j.