[IMPORTANT] Kerberos Issue : Pre Authentication failed (Error Code 24) with SAM account / No error with UPN account

[Douglas E. Engert]

Hello,
I'm a Business Intelligence consultant working on Business Objects
products and the last one: BusinessObjects Enterprise XI Release 2 (BOE
XI-R2).
The BOE XI-R2 product allows to set up Active Directory, LDAP, NT
authentications mechanisms (and also additionally SSO).
I have to set up Single Sign On on BOE XI-R2 products and I did it
successfully several times (on LDAP, AD and NT).
On a specific project, the SSO (using Kerberos with Active Directory)
does not work and we have difficulties to identify why it is not
working...
The Kerberos authentication is done through a JVM (1.4.2) and we can
test it using "kinit" utility. We setup the krb5.ini and all files
correctly.
[logging]
default = CONSOLE
kdc = CONSOLE
admin_server = CONSOLE
[libdefaults]
default_realm = DBB.INT.DEXWIRED.NET
dns_lookup_kdc = true
dns_lookup_realm = true
kdc_timeout = 30000
[realms]
DBB.INT.DEXWIRED.NET = {
kdc = DLU0SINF001P.DBB.INT.DEXWIRED.NET
default_domain = DBB.INT.DEXWIRED.NET
}
Note: We try to use logging with this syntax : default =
FILE:C:/WINNT/default.log, but no logs were generated ! And CONSOLE
outputs nothing on Windows.
If we use kinit with a SAM account, we get an error code 24 (pre
authentication failed).
If we use kinit with an UPN account (for the same user account), we
succeed to authenticate a user.
Can you give me some information about how is done the authentication
mechanism.

This sounds like the problem with Java 1.4 assuming it know
the "salt" to use for a user, and taking a short cut with the
Kerberos protocol, skipping the first step of asking the KDC for
any pre-auth parameters including the salt assuming it knew the salt.
The salt for DES is the realm concatenated with the principle name
components as of the last time the password was changed. The salt is
concatenated with the password as input to a string-to-key function
to get a key. The client and server do need to use the same salt.

Google for java pre-auth

http://www.webservertalk.com/archive213-2005-8-1171299.html

Is that possible to specify to the JVM that we want to authenticate
users with SAM rather UPN, and How ?
Have you any idea and suggestions, please ?

I believe it is fixed in 1.6

Thanks for your help.
Regards,
Bruno.
--------------------------------------
http://www.dexia.be/maildisclaimer.htm
--------------------------------------
________________________________________________
https://mailman.mit.edu/mailman/listinfo/kerberos

[Danny Mayer]

Hello,
I'm a Business Intelligence consultant working on Business Objects
products and the last one: BusinessObjects Enterprise XI Release 2 (BOE
XI-R2).
The BOE XI-R2 product allows to set up Active Directory, LDAP, NT
authentications mechanisms (and also additionally SSO).
I have to set up Single Sign On on BOE XI-R2 products and I did it
successfully several times (on LDAP, AD and NT).
On a specific project, the SSO (using Kerberos with Active Directory)
does not work and we have difficulties to identify why it is not
working...
The Kerberos authentication is done through a JVM (1.4.2) and we can
test it using "kinit" utility. We setup the krb5.ini and all files
correctly.
[logging]
default = CONSOLE
kdc = CONSOLE
admin_server = CONSOLE
[libdefaults]
default_realm = DBB.INT.DEXWIRED.NET
dns_lookup_kdc = true
dns_lookup_realm = true
kdc_timeout = 30000
[realms]
DBB.INT.DEXWIRED.NET = {
kdc = DLU0SINF001P.DBB.INT.DEXWIRED.NET
default_domain = DBB.INT.DEXWIRED.NET
}
Note: We try to use logging with this syntax : default =
FILE:C:/WINNT/default.log, but no logs were generated ! And CONSOLE
outputs nothing on Windows.

This is a system directory so you need to make sure the account that's
running this has write access to that directory. A better strategy is to
create a different directory like C:\Kerberos and set the permissions on
that directory to allow the application to write there. You really
shouldn't be writing to WINNT at all.

Danny