jdk8 可以通过kerberos认证，jdk17经过kerberos认证失败
jdk17程序运行错误信息如下
NB: system property to specify the krb5 config: [java.security.krb5.conf]
17.0.11
Debug is true storeKey true useTicketCache true useKeyTab true doNotPrompt true ticketCache is null isInitiator true KeyTab is /Users/mac/save/code/gitee/share-security/src/test/resources/dev.keytab refreshKrb5Config is true principal is dev tryFirstPass is false useFirstPass is false storePass is false clearPass is false
Refreshing Kerberos configuration
Java config name: /Users/mac/save/code/gitee/share-security/src/test/resources/krb5.conf
Loading config file from /Users/mac/save/code/gitee/share-security/src/test/resources/krb5.conf
Loading krb5 profile at /Users/mac/save/code/gitee/share-security/src/test/resources/krb5.conf
logging = {
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
}
libdefaults = {
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
default_realm = EXAMPLE.COM
}
realms = {
EXAMPLE.COM = {
kdc = kerberos.example.com
admin_server = kerberos.example.com
}
}
domain_realm = {
.example.com = EXAMPLE.COM
example.com = EXAMPLE.COM
}
Loaded from Java config
>>> KdcAccessibility: reset
>>> KdcAccessibility: reset
Acquire TGT from Cache
>>>KinitOptions cache name is /tmp/krb5cc_501
>> Acquire default native Credentials
Getting permitted_enctypes from libdefaults
default_enctypes were null, using builtin default etypes for configuration default_tkt_enctypes
default etypes for default_tkt_enctypes: 18 17 20 19.
>>> Found no TGT's in native ccache
Principal is dev@EXAMPLE.COM
null credentials from Ticket Cache
>>> KeyTabInputStream, readName(): EXAMPLE.COM
>>> KeyTabInputStream, readName(): dev
>>> KeyTab: load() entry length: 69; type: 18
>>> KeyTabInputStream, readName(): EXAMPLE.COM
>>> KeyTabInputStream, readName(): dev
>>> KeyTab: load() entry length: 53; type: 17
>>> KeyTabInputStream, readName(): EXAMPLE.COM
>>> KeyTabInputStream, readName(): dev
>>> KeyTab: load() entry length: 61; type: 16
>>> KeyTabInputStream, readName(): EXAMPLE.COM
>>> KeyTabInputStream, readName(): dev
>>> KeyTab: load() entry length: 53; type: 23
>>> KeyTabInputStream, readName(): EXAMPLE.COM
>>> KeyTabInputStream, readName(): dev
>>> KeyTab: load() entry length: 69; type: 26
>>> KeyTabInputStream, readName(): EXAMPLE.COM
>>> KeyTabInputStream, readName(): dev
>>> KeyTab: load() entry length: 53; type: 25
>>> KeyTabInputStream, readName(): EXAMPLE.COM
>>> KeyTabInputStream, readName(): dev
>>> KeyTab: load() entry length: 45; type: 8
>>> KeyTabInputStream, readName(): EXAMPLE.COM
>>> KeyTabInputStream, readName(): dev
>>> KeyTab: load() entry length: 45; type: 3
>>> KeyTabInputStream, readName(): EXAMPLE.COM
>>> KeyTabInputStream, readName(): dev
>>> KeyTabInputStream, readName(): ty-bj02-dev04.example.com
>>> KeyTab: load() entry length: 96; type: 18
>>> KeyTabInputStream, readName(): EXAMPLE.COM
>>> KeyTabInputStream, readName(): dev
>>> KeyTabInputStream, readName(): ty-bj02-dev04.example.com
>>> KeyTab: load() entry length: 80; type: 17
>>> KeyTabInputStream, readName(): EXAMPLE.COM
>>> KeyTabInputStream, readName(): dev
>>> KeyTabInputStream, readName(): ty-bj02-dev04.example.com
>>> KeyTab: load() entry length: 88; type: 16
>>> KeyTabInputStream, readName(): EXAMPLE.COM
>>> KeyTabInputStream, readName(): dev
>>> KeyTabInputStream, readName(): ty-bj02-dev04.example.com
>>> KeyTab: load() entry length: 80; type: 23
>>> KeyTabInputStream, readName(): EXAMPLE.COM
>>> KeyTabInputStream, readName(): dev
>>> KeyTabInputStream, readName(): ty-bj02-dev04.example.com
>>> KeyTab: load() entry length: 96; type: 26
>>> KeyTabInputStream, readName(): EXAMPLE.COM
>>> KeyTabInputStream, readName(): dev
>>> KeyTabInputStream, readName(): ty-bj02-dev04.example.com
>>> KeyTab: load() entry length: 80; type: 25
>>> KeyTabInputStream, readName(): EXAMPLE.COM
>>> KeyTabInputStream, readName(): dev
>>> KeyTabInputStream, readName(): ty-bj02-dev04.example.com
>>> KeyTab: load() entry length: 72; type: 8
>>> KeyTabInputStream, readName(): EXAMPLE.COM
>>> KeyTabInputStream, readName(): dev
>>> KeyTabInputStream, readName(): ty-bj02-dev04.example.com
>>> KeyTab: load() entry length: 72; type: 3
Looking for keys for: dev@EXAMPLE.COM
Found unsupported keytype (3) for dev@EXAMPLE.COM
Found unsupported keytype (8) for dev@EXAMPLE.COM
Found unsupported keytype (25) for dev@EXAMPLE.COM
Found unsupported keytype (26) for dev@EXAMPLE.COM
Found unsupported keytype (23) for dev@EXAMPLE.COM
Found unsupported keytype (16) for dev@EXAMPLE.COM
Added key: 17, version: 9
Added key: 18, version: 9
Looking for keys for: dev@EXAMPLE.COM
Found unsupported keytype (3) for dev@EXAMPLE.COM
Found unsupported keytype (8) for dev@EXAMPLE.COM
Found unsupported keytype (25) for dev@EXAMPLE.COM
Found unsupported keytype (26) for dev@EXAMPLE.COM
Found unsupported keytype (23) for dev@EXAMPLE.COM
Found unsupported keytype (16) for dev@EXAMPLE.COM
Added key: 17, version: 9
Added key: 18, version: 9
Getting permitted_enctypes from libdefaults
default_enctypes were null, using builtin default etypes for configuration default_tkt_enctypes
default etypes for default_tkt_enctypes: 18 17 20 19.
>>> KrbAsReq creating message
>>> KrbKdcReq send: kdc=kerberos.example.com UDP:88, timeout=30000, number of retries =3, #bytes=154
>>> KDCCommunication: kdc=kerberos.example.com UDP:88, timeout=30000,Attempt =1, #bytes=154
>>> KrbKdcReq send: #bytes read=644
>>> KdcAccessibility: remove kerberos.example.com
Looking for keys for: dev@EXAMPLE.COM
Found unsupported keytype (3) for dev@EXAMPLE.COM
Found unsupported keytype (8) for dev@EXAMPLE.COM
Found unsupported keytype (25) for dev@EXAMPLE.COM
Found unsupported keytype (26) for dev@EXAMPLE.COM
Found unsupported keytype (23) for dev@EXAMPLE.COM
Found unsupported keytype (16) for dev@EXAMPLE.COM
Added key: 17, version: 9
Added key: 18, version: 9
>>> EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType
[Krb5LoginModule] authentication failed
Message stream modified (41)
javax.security.auth.login.LoginException: Message stream modified (41)
at jdk.security.auth/com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:789)
at jdk.security.auth/com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:597)
at KerberosTest.testLogin(KerberosTest.java:47)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:568)
at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:59)
at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:56)
at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
at org.junit.runners.ParentRunner$3.evaluate(ParentRunner.java:306)
at org.junit.runners.BlockJUnit4ClassRunner$1.evaluate(BlockJUnit4ClassRunner.java:100)
at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:366)
at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:103)
at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:63)
at org.junit.runners.ParentRunner$4.run(ParentRunner.java:331)
at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:79)
at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:329)
at org.junit.runners.ParentRunner.access$100(ParentRunner.java:66)
at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:293)
at org.junit.runners.ParentRunner$3.evaluate(ParentRunner.java:306)
at org.junit.runners.ParentRunner.run(ParentRunner.java:413)
at org.junit.runner.JUnitCore.run(JUnitCore.java:137)
at com.intellij.junit4.JUnit4IdeaTestRunner.startRunnerWithArgs(JUnit4IdeaTestRunner.java:69)
at com.intellij.rt.junit.IdeaTestRunner$Repeater$1.execute(IdeaTestRunner.java:38)
at com.intellij.rt.execution.junit.TestsRepeater.repeat(TestsRepeater.java:11)
at com.intellij.rt.junit.IdeaTestRunner$Repeater.startRunnerWithArgs(IdeaTestRunner.java:35)
at com.intellij.rt.junit.JUnitStarter.prepareStreamsAndStart(JUnitStarter.java:232)
at com.intellij.rt.junit.JUnitStarter.main(JUnitStarter.java:55)
Caused by: KrbException: Message stream modified (41)
at java.security.jgss/sun.security.krb5.KrbKdcRep.check(KrbKdcRep.java:103)
at java.security.jgss/sun.security.krb5.KrbAsRep.decrypt(KrbAsRep.java:159)
at java.security.jgss/sun.security.krb5.KrbAsRep.decryptUsingKeyTab(KrbAsRep.java:121)
at java.security.jgss/sun.security.krb5.KrbAsReqBuilder.resolve(KrbAsReqBuilder.java:310)
at java.security.jgss/sun.security.krb5.KrbAsReqBuilder.action(KrbAsReqBuilder.java:498)
at jdk.security.auth/com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:761)
... 29 more
删除 krb5.conf 配置文件里的 renew_lifetime = xxx 这行配置即可
