Below are listed some problems that may occur when attempting a login, and suggestions for solving them.
Configurable Kerberos Settings: The Kerberos Key Distribution Center (KDC) name and realm settings are provided in the Kerberos configuration file or via the system properties
java.security.krb5.realm.A boolean option
refreshKrb5Configcan be specified in the entry for
Krb5LoginModulein the JAAS configuration file. If this option is set to
true, then the configuration values will be refreshed before the login method of the
When switching Kerberos configurations, it is REQUIRED that
refreshKrb5Configshould be set to
true.Failure to set this value can lead to unexpected results.
java.lang.SecurityException at javax.security.auth.login.Configuration.getConfiguration
Cause: There was a problem processing the JAAS login configuration file, possibly due to a syntax error in the file.
Solution: Check the configuration file carefully for errors. See Appendix B: JAAS Login Configuration File for information about the syntax required in the login configuration file.
javax.security.auth.login.LoginException: KrbException: Pre-authentication information was invalid (24) - Preauthentication failed
Cause 1: The password entered is incorrect.
Solution 1: Verify the password.
Cause 2: If you are using the keytab to get the key (e.g., by setting the
truein the Krb5LoginModule entry in the JAAS login configuration file), then the key might have changed since you updated the keytab.
Solution 2: Consult your Kerberos documentation to generate a new keytab and use that keytab.
Cause 3: Clock skew - If the time on the KDC and on the client differ significantly (typically 5 minutes), this error can be returned.
Solution 3: Synchronize the clocks (or have a system administrator do so).Cause 4: The Kerberos realm name is not all uppercase.
Solution 4: Make the Kerberos realm name all uppercase. Note: It is recommended to have all uppercase realm names. See Naming Conventions for Realm Names and Hostnames.
GSSException: No valid credentials provided (Mechanism level: Attempt to obtain new INITIATE credentials failed! (null)) . . . Caused by: javax.security.auth.login.LoginException: Clock skew too great
Cause: Kerberos requires the time on the KDC and on the client to be loosely synchronized. (The default is within 5 minutes.) If that's not the case, you will get this error.
Solution: Synchronize the clocks (or have a system administrator do so).
javax.security.auth.login.LoginException: KrbException: Null realm name (601) - default realm not specified
Cause: The default realm is not specified in the Kerberos configuration file
krb5.conf(if used), provided as a part of the user name, or specified via the
Solution: Verify that your Kerberos configuration file (if used) contains an entry specifying the default realm, or directly specify it by setting the value of the
java.security.krb5.realmsystem property and/or including it in your user name when authenticating using Kerberos.
javax.security.auth.login.LoginException: java.net.SocketTimeoutException: Receive timed out
Solution: Verify that the Kerberos KDC is up and running.
GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos Ticket)
Cause: This may occur if no valid Kerberos credentials are obtained. In particular, this occurs if you want the underlying mechanism to obtain credentials but you forgot to indicate this by setting the
javax.security.auth.useSubjectCredsOnlysystem property value to
false(for example via
-Djavax.security.auth.useSubjectCredsOnly=falsein your execution command).
Solution: Be sure to set the
javax.security.auth.useSubjectCredsOnlysystem property value to
falseif you want the underlying mechanism to obtain credentials, rather than your application or a wrapper program (such as the Login utility used by some of the tutorials) performing authentication using JAAS.
javax.security.auth.login.LoginException: Could not load configuration file <krb5.conf> (No such file or directory)
Cause: The tutorials' sample execution commands specify the default Kerberos realm and KDC by setting values for the
java.security.krb5.kdcsystem properties. If you like, you can instead have a
krb5.confKerberos configuration file used. Such a file includes information about what the default realm and KDC are. To use a
krb5.conffile, you either set the system property
java.security.krb5.conf(instead of the
kdcproperties) to specify the location of the file or you don't set any of these properties and therefore an attempt is made to locate the
krb5.conffile in a default location. You will get the error "Could not load configuration file <krb5.conf> (No such file or directory)" if the file could not be found.
Solution: Verify that the Kerberos configuration file
krb5.confis available and readable. Check Kerberos Requirements for information about how to specify the location of the
krb5.conffile and where such a file is searched for by default if you don't explicitly indicate the location.
javax.security.auth.login.LoginException: KrbException: KDC has no support for encryption type (14) - KDC has no support for encryption type
Cause 1: Your KDC does not support the encryption type requested.
Solution 1: Oracle’s implementation of Kerberos supports the following encryption types:
Applications can select the desired encryption type by specifying following tags in the Kerberos Configuration file
[libdefaults] default_tkt_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1 default_tgs_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1 permitted_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1
If not specified, then the default value is:
aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 des3-cbc-sha1 arcfour-hmac-md5
krb5.confis set to true, then
des-cbc-md5are also supported.
Cause 2: This exception is thrown when using native ticket cache on some Windows platforms. Microsoft has added a new feature in which they no longer export the session keys for Ticket-Granting Tickets (TGTs). As a result, the native TGT obtained on Windows has an "empty" session key and null EType.
Solution 2: You need to update the Windows registry to disable this new feature. The registry key
allowtgtsessionkeyshould be added – and set correctly – to allow session keys to be sent in the Kerberos Ticket-Granting Ticket.
See Registry Key to Allow Session Keys to Be Sent in Kerberos Ticket-Granting-Ticket from Microsoft Support for more information. Usually, the following is the required registry setting:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters Value Name: allowtgtsessionkey Value Type: REG_DWORD Value: 0x01 ( default is 0 )
By default, the value is 0; setting it to "0x01" allows a session key to be included in the TGT.
KDC reply did not match expectations
Cause: The KDC sent a response that cannot be understood by the client.
Solution: Verify that you have set correctly all the
krb5.conffile configuration parameters and consult your KDC vendor's guide.
A debugging mode can be enabled by setting the system property
sun.security.krb5.debugto "true". This setting allows you to follow the program's execution of the Kerberos V5 protocol.