Questions tagged [spnego]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
31 views

Windows Kerberos authentication and network protocols/ports

Got the following question. I have a windows forest A with a root domain A. A web server in domain A has a proper setup SPN. A user comes from another forest/domain, where a 2way transitive forest ...
Ronald Top's user avatar
0 votes
1 answer
114 views

Cross-realm Kerberos/SPNEGO configuration with multiple domain controllers and multiple application servers

I am currently struggling to scale my one-to-one simple Kerberos/SPNEGO configuration for multi-server environment and looking for some help. Let's say I have two Active Directory domains and two ...
nknikita's user avatar
0 votes
0 answers
101 views

Kerberos SPNEGO negotiation with OIDC under FastAPI REST application?

We have a REST-based application (non-browser application) that uses Kerberos-based SPNEGO authentication, and which has been working with Flask. We want to convert this application to run under ...
HippoMan's user avatar
  • 220
1 vote
0 answers
725 views

SSO not working between a browser and a Keycloak using an user federation with kerberos integration to a windows AD

I am trying to get SSO working using a browser(Chrome or firefox) and keycloak configured with an user federation AD Domain(kerberos is configured). First I present the overview of what I have and ...
Afonso R.'s user avatar
0 votes
1 answer
1k views

Windows Authentication with OpenID Connect (OIDC) with Active Directory (AD FS)?

This is NOT about Azure, but about an on-premises offline Microsoft Active Directory system, based on Windows 2016/2019. Our website uses OpenID with Microsoft Active Directory, but we want the user ...
Lars D's user avatar
  • 282
0 votes
1 answer
173 views

OpenCms: Kerberos SSO authentication with httpd+Tomcat

I have a standalone httpd+Tomcat 8.5.65 installation on OpenJDK 11 with OpenCms 11.0.2 for my client's internal website. They have a LDAP network and they're requesting the automated logon using ...
user3804769's user avatar
0 votes
1 answer
171 views

Subversion repository throws HTTP 403 Bad Request when accessed via https & Kerberos (Windwos Integrated) authentication

We encountered this problem with different versions of OS & Subversion on the server side, the following details being the same: We used https protocol to access the SVN repositories. We used ...
Attila Csipak's user avatar
0 votes
0 answers
3k views

The Kerberos client received a KRB_AP_ERR_MODIFIED error from server

I have a situation where Kerberos authentication is failing. I have checked that the SPN is registered under the correct AD user account that runs the service that needs to use Kerberos to ...
Ringo's user avatar
  • 119
1 vote
1 answer
644 views

Kerberos - TCP client wants 1195725856 bytes, cap is 1048572

I'm having some difficulties debugging this error. I'm running nginx as an api gateway built to make a sub-request to kerberos whenever an endpoint gets called using the SPNEGO method. But whenever I ...
Kenpachi's user avatar
1 vote
1 answer
4k views

WebSphere SPNEGO - Cannot get credential from JAAS Subject for principal

PROBLEM I get an error trying to enable SPNEGO on the WebSphere application server (WAS ND, single node) 9.0.0.7 . I have succeeded on another server, but for this one I can't find the problem. I ...
nize's user avatar
  • 121
1 vote
2 answers
933 views

Machine Account Password Resets on server and invalid Kerberos tickets on client

According to this TechNet article https://blogs.technet.microsoft.com/askds/2009/02/15/machine-account-password-process-2/ Machine Accounts (Computer Objects) reset internal passwords every 30 days. ...
arainchi's user avatar
  • 141
1 vote
3 answers
11k views

Httpd LimitRequestFieldSize not taken into account

I have a problem configuring httpd to accept large SPNEGO authentication headers. The request work fine with Authorization header line of up to at least 5674 bytes but break with Authorization header ...
Sefa's user avatar
  • 111
2 votes
0 answers
856 views

Delegation works on some browsers but not on others

I've been trying to make Kerberos delegation work across all browsers, but I'm having no luck. I'm running a Java web server on Linux and Windows. Firefox (64 bit) on Linux: Receive the ticket and ...
DetriusXii's user avatar
0 votes
1 answer
668 views

Shibboleth SPNEGOAuthnConfiguration in CentOS server

I have requirement were the user's were already joined to domain logged in using the same credential from ldap server, they don't want to enter it again to login into shibboleth SSO, so I searched ...
CoolMonster's user avatar
10 votes
2 answers
672 views

Is this Kerberos/AD setup possible?

We have a slightly complicated IDAM setup: I.e. the end user's machine and browser sit in one network with the parent AD, and our Jetty-based application and the AD that it can talk to (local AD) sit ...
Rob Grant's user avatar
  • 103
0 votes
2 answers
882 views

gssapi/kerberos/active directory/ubuntu - Wrong principal in request

I'm trying to setup a Clientserver with a Webservice to which Users of an Active Directory should be able to login with SSO. I'm using SPNEGO with Kerberos on a Ubuntu 14.04 Server and nginx proxy to ...
Sky's user avatar
  • 11
1 vote
0 answers
311 views

JBoss SPNEGO Authentication Renewing Server Kerberos Tickets

We have successfully configured SPNEGO with our webapp on JBoss EAP 6.2, Windows Server 2008, and IE10 using JBoss Negotiation. What is best operational practice for renewing the ticket issued to ...
praspa's user avatar
  • 111
2 votes
2 answers
2k views

Adding new SPNs to existing service ids

We have a tomcat server using spring-security kerberos to authenticate users to the webpage against active directory. There are around 25 domain controllers. The site has two CNAME based DNS aliases....
jmh's user avatar
  • 146
4 votes
2 answers
2k views

Multiple SPNEGO authenticated web servers on one host name

I was trying to set up a Java service using the SPNEGO servlet filter and a listen port of 8080 for authentication on a host that is also running web applications hosted in IIS7. I followed the ...
themel's user avatar
  • 284
2 votes
1 answer
6k views

NTLM token sent instead of Kerberos ticket

I am trying to implement kerberos SSO in our network using spnego on a tomcat server. We have created an account (TCNKRBGINA) on the domain for the preauthentication, and setspn'ed it to the http ...
Maurice Perry's user avatar
0 votes
1 answer
4k views

Tomcat SPNEGO authentication against Active Directory not working

I'm trying to authenticate against AD using the http://spnego.sourceforge.net component with tomcat. I've created my SPN's "setspn.exe -A HTTP/servername SVCTomcat" & "setspn.exe -A HTTP/...
Michael Henry's user avatar