topic Kerberos SSO (against AD) sometimes fails on Share (4.0.d) in Alfresco Archive https://connect.hyland.com/t5/alfresco-archive/kerberos-sso-against-ad-sometimes-fails-on-share-4-0-d/m-p/279597#M232727 <HTML><HEAD></HEAD><BODY><SPAN>I've recently implemented Kerberos SSO on both CIFS and Share. At first glance everything looks fine, it works smooth.</SPAN><BR /><BR /><SPAN>Until later durring the day, when users starts to be prompted for passwords.</SPAN><BR /><BR /><SPAN>My first instinct is that we're dealing with expired Kerberos tickets. Enabling debugging, yup, it seems so:</SPAN><BR /><PRE class="language-none line-numbers"><CODE><BR />Found ticket for OLEH@MYDOMAIN.LOCAL to go to HTTP/alfresco.local@DOMAIN.LOCAL expiring on Fri May 17 03:47:56 WGST 2013<BR />04:52:06,730&nbsp; DEBUG [site.servlet.SSOAuthenticationFilter] Kerberos logon error<BR />java.lang.IllegalStateException: This ticket is no longer valid<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><SPAN>I restart my borwser and get issued a new ticket and everything is good.</SPAN><BR /><BR /><SPAN>After this I check my ticket with klist. I have a nice valid and renewable ticket that lasts for 10 hours.</SPAN><BR /><BR /><SPAN>1-5 hours later (random, no system in the timeframe) I experience EXACTLY the same thing. Login prompt (windows login, not Share login page). Verify the ticket, it's still valid. I restart the browser and we're good to go again.</SPAN><BR /><BR /><SPAN>However, from the logs it does not say that my ticket is no longer valid, it says:</SPAN><BR /><PRE class="language-none line-numbers"><CODE><BR /><BR />Search Subject for Kerberos V5 ACCEPT cred (HTTP/alfresco.DOMAIN.LOCAL@DOMAIN.LOCAL, sun.security.jgss.krb5.Krb5AcceptCredential)<BR />Found key for HTTP/alfresco.DOMAIN.LOCAL@DOMAIN.LOCAL(23)<BR />Entered Krb5Context.acceptSecContext with state=STATE_NEW<BR />&gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.ArcFourHmacEType<BR />Using builtin default etypes for permitted_enctypes<BR />default etypes for permitted_enctypes: 3 1 23 16 17 18.<BR />&gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.ArcFourHmacEType<BR />&gt;&gt;&gt; Config reset default kdc DOMAIN.LOCAL<BR />replay cache for oleh@DOMAIN.LOCAL is null.<BR />object 0: 1368700723000/198<BR />object 0: 1368700723000/198<BR />&gt;&gt;&gt; KrbApReq: authenticate succeed.<BR />&gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.ArcFourHmacEType<BR />&gt;&gt;&gt;Delegated Creds have pname=oleh@DOMAIN.LOCAL sname=krbtgt/DOMAIN.LOCAL@DOMAIN.LOCAL authtime=null starttime=20130516102536Z endtime=20130516202533ZrenewTill=2013052310253<BR />3Z<BR />Krb5Context setting peerSeqNumber to: 145069278<BR />&gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.ArcFourHmacEType<BR />Krb5Context setting mySeqNumber to: 607740720<BR />Entered Krb5Context.initSecContext with state=STATE_NEW<BR /><BR />Found ticket for HTTP/alfresco.DOMAIN.LOCAL@DOMAIN.LOCAL to go to krbtgt/DOMAIN.LOCAL@DOMAIN.LOCAL expiring on Thu May 16 15:49:24 WGST 2013<BR />Found ticket for OLEH@DOMAIN.LOCAL to go to HTTP/alfresco.DOMAIN.LOCAL@DOMAIN.LOCAL expiring on Thu May 16 15:16:15 WGST 2013<BR /><BR />Service ticket not found in the subject<BR />&gt;&gt;&gt; Credentials acquireServiceCreds: same realm<BR />default etypes for default_tgs_enctypes: 23.<BR />&gt;&gt;&gt; CksumType: sun.security.krb5.internal.crypto.RsaMd5CksumType<BR />&gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.ArcFourHmacEType<BR />&gt;&gt;&gt; KrbKdcReq send: kdc=10.66.60.20 UDP:88, timeout=30000, number of retries =3, #bytes=1627<BR />&gt;&gt;&gt; KDCCommunication: kdc=10.66.60.20 UDP:88, timeout=30000,Attempt =1, #bytes=1627<BR />&gt;&gt;&gt; KrbKdcReq send: #bytes read=116<BR />&gt;&gt;&gt; KrbKdcReq send: #bytes read=116<BR />&gt;&gt;&gt; KDCRep: init() encoding tag is 126 req type is 13<BR />&gt;&gt;&gt;KRBError:<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; sTime is Thu May 16 08:38:43 WGST 2013 1368700723000<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; suSec is 284507<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; error code is 52<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; error Message is Response too big for UDP, retry with TCP<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; realm is DOMAIN.LOCAL<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; sname is HTTP/alfresco.DOMAIN.LOCAL<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; msgType is 30<BR />&gt;&gt;&gt; KrbKdcReq send: kdc=10.66.60.20 TCP:88, timeout=30000, number of retries =3, #bytes=1621<BR />&gt;&gt;&gt;DEBUG: TCPClient reading 1578 bytes<BR />&gt;&gt;&gt; KrbKdcReq send: #bytes read=1578<BR />&gt;&gt;&gt; KrbKdcReq send: #bytes read=1578<BR />&gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.ArcFourHmacEType<BR />&gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.ArcFourHmacEType<BR />&gt;&gt;&gt; KrbApReq: APOptions are 00100000 00000000 00000000 00000000<BR />&gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.ArcFourHmacEType<BR />Krb5Context setting mySeqNumber to: 857087925<BR />Created InitSecContextToken:<BR />0000: 01 00 6E 82 0C 14 30 82&nbsp;&nbsp; 0C 10 A0 03 02 01 05 A1&nbsp; ..n…0………<BR />0010: 03 02 01 0E A2 07 03 05&nbsp;&nbsp; 00 20 00 00 00 A3 82 04&nbsp; ……… ……<BR />0020: FB 61 82 04 F7 30 82 04&nbsp;&nbsp; F3 A0 03 02 01 05 A1 15&nbsp; .a…0……….<BR />0030: 1B 13 4E 55 4B 49 53 53&nbsp;&nbsp; 49 4F 52 46 49 49 54 2E&nbsp; ..DOMAIN.<BR />0040: 49 4E 54 52 41 A2 2E 30&nbsp;&nbsp; 2C A0 03 02 01 00 A1 25&nbsp; INTRA..0,……%<BR />0050: 30 23 1B 04 48 54 54 50&nbsp;&nbsp; 1B 1B 6E 75 6B 69 64 6F&nbsp; 0#..HTTP..alfresc<BR />0060: 63 2E 6E 75 6B 69 73 73&nbsp;&nbsp; 69 6F 72 66 69 69 74 2E&nbsp; o.DOMAIN.<BR />0070: 69 6E 74 72 61 A3 82 04&nbsp;&nbsp; A3 30 82 04 9F A0 03 02&nbsp; local….0……<BR />0080: 01 17 A1 03 02 01 0E A2&nbsp;&nbsp; 82 04 91 04 82 04 8D F7&nbsp; …………….<BR />0090: 22 0C A3 CB 00 21 0F 90&nbsp;&nbsp; 81 A9 9B 5E 1E 43 CD 36&nbsp; "….!…..^.C.6<BR />00A0: 33 F0 93 EC E8 5D E0 55&nbsp;&nbsp; AA 7F A5 AE 34 5E 4F 98&nbsp; 3….].U….4^O.<BR />00B0: F2 EB 80 5C 56 23 D8 3F&nbsp;&nbsp; CF 9F EA 0D 8B 2C E7 73&nbsp; …\V#.?…..,.s<BR />00C0: E4 F5 BB 06 84 56 DA D4&nbsp;&nbsp; 25 EE D4 A8 F0 D4 C5 29&nbsp; …..V..%……)<BR />00D0: 6A 32 2C DD A0 50 1B DD&nbsp;&nbsp; 14 78 CA 98 9B AD 34 B0&nbsp; j2,..P…x….4.<BR />00E0: AF 87 E4 A6 47 BF FF E1&nbsp;&nbsp; EA 14 6A B8 C8 BC D9 EA&nbsp; ….G…..j…..<BR />[a lot more hex code]<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><SPAN>What could cause this? </SPAN><BR /><SPAN>I checked time on the servers and they were NOT in sync. I setup NTP and now they are, but the problem still persists.</SPAN><BR /><BR /><SPAN>I also experience that I have to restart Share every 10 hours, after the Kerberos ticket for my AlfrescoHTTP expires,</SPAN><BR /><SPAN>it can't renew it. </SPAN><BR /><BR /><SPAN>It only seems to be a problem with Share. Alfresco explorer and CIFS works just fine.</SPAN><BR /><BR /><SPAN>Any pointers could be most welcome!</SPAN><BR /><BR /><SPAN>More details about my setup:</SPAN><BR /><SPAN>Alfresco 4.0.d</SPAN><BR /><SPAN>Win 2008 r2 server (AD)</SPAN><BR /><BR /><SPAN>Alfresco config:</SPAN><BR /><PRE class="language-none line-numbers"><CODE><BR />kerberos.authentication.realm=DOMAIN.LOCAL<BR />kerberos.authentication.sso.enabled=true<BR />kerberos.authentication.authenticateCIFS=true<BR />kerberos.authentication.user.configEntryName=Alfresco<BR />kerberos.authentication.cifs.configEntryName=AlfrescoCIFS<BR />kerberos.authentication.http.configEntryName=AlfrescoHTTP<BR />kerberos.authentication.stripUsernameSuffix=true<BR />kerberos.authentication.cifs.password=[pass]<BR />kerberos.authentication.http.password=[pass]<BR />kerberos.authentication.defaultAdministratorUserNames=oleh<BR />authentication.chain=kerberos1:kerberos,ldap1:ldap<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><SPAN>share-config-custom.xml:</SPAN><BR /><PRE class="language-none line-numbers"><CODE><BR />&nbsp;&nbsp; &lt;config evaluator="string-compare" condition="Kerberos" replace="true"&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;kerberos&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;password&gt;[pass]&lt;/password&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;realm&gt;DOMAIN.LOCAL&lt;/realm&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;endpoint-spn&gt;HTTP/alfresco.domain.local@DOMAIN.LOCAL&lt;/endpoint-spn&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;config-entry&gt;ShareHTTP&lt;/config-entry&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/kerberos&gt;<BR />&nbsp;&nbsp; &lt;/config&gt;<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /></BODY></HTML> Fri, 17 May 2013 08:02:34 GMT oleh 2013-05-17T08:02:34Z Kerberos SSO (against AD) sometimes fails on Share (4.0.d) https://connect.hyland.com/t5/alfresco-archive/kerberos-sso-against-ad-sometimes-fails-on-share-4-0-d/m-p/279597#M232727 I've recently implemented Kerberos SSO on both CIFS and Share. At first glance everything looks fine, it works smooth.Until later durring the day, when users starts to be prompted for passwords.My first instinct is that we're dealing with expired Kerberos tickets. Enabling debugging, yup, it seems s Fri, 17 May 2013 08:02:34 GMT https://connect.hyland.com/t5/alfresco-archive/kerberos-sso-against-ad-sometimes-fails-on-share-4-0-d/m-p/279597#M232727 oleh 2013-05-17T08:02:34Z Re: Kerberos SSO (against AD) sometimes fails on Share (4.0.d) https://connect.hyland.com/t5/alfresco-archive/kerberos-sso-against-ad-sometimes-fails-on-share-4-0-d/m-p/279598#M232728 <HTML><HEAD></HEAD><BODY><P>Is there anyone who has solved this problem?</P><P><BR />Thanks.</P></BODY></HTML> Mon, 25 Mar 2019 09:57:19 GMT https://connect.hyland.com/t5/alfresco-archive/kerberos-sso-against-ad-sometimes-fails-on-share-4-0-d/m-p/279598#M232728 mvlcek 2019-03-25T09:57:19Z