Javax.naming.AuthenticationException in GSSAPI

Question

I am trying to bind NTLM using JAVA GSSAPI.

I get this error:

javax.naming.AuthenticationException: GSSAPI [Root exception is javax.security.sasl.SaslException: GSS initiation failed [caused by GSSException: valid credentials not specified (mechanism level: parameter setting in ticket request is incorrect (101))]]

I think (not sure) that he worked in the past. To solve another problem, I tried to throw. From this moment, the work stops. I even deleted the cache file (I could not find kclear in the windows), and yet I have this problem.

How can I solve it?

Answer 1

Ok, I decided.

I had

proxiable = true

in my krb5 file.

Deleted and it works!

Answer 2

Could this help you from Troubleshooting :

Reason: Kerberos requires that the time on KDC and on the client be freely synchronized. (The default is no more than 5 minutes.) If this is not the case, you will get this error.

Solution: Synchronize the clock (or make it a system administrator).

Or

Cause. . This can happen if valid Kerberos credentials are not received. In particular, this happens if you want the main mechanism to receive credentials, but you forgot to specify this by setting the value of the javax.security.auth.useSubjectCredsOnly system property to false (for example, through -Djavax.security.auth.useSubjectCredsOnly = false in your run command).

Solution: Be sure to set the javax.security.auth.useSubjectCredsOnly system value to false if you want the underlying mechanism to receive credentials, and not your application or shell program (for example, the used Login utility in some tutorials) that execute JAAS authentication

Answer 3

I had the same problem (exactly the same Java error stack) for Kerberos tickets that were not created as Forwardable.

The Kerbros ticket update / monitoring process was written in Perl and the Authen :: Krb5 :: Easy Perl module was used, and it ignores the "forwardable = true" / etc / krb 5.conf setting.