Thanks colm for the clarification and it sounds an issue we need to address. I will investigate it soon.
Sent from iPhone > 在 2017年5月6日，上午2:14，Colm O hEigeartaigh <[email protected]> 写道： > > Hi Kai, > > If I enable UDP with the default Transport, I can get a ticket fine using > kinit. However then the following error pops up in the window I'm running > Kerby in (as a test): > > Exception in thread "Thread-1" java.lang.RuntimeException: Error occured > while checking udp connections > at > org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(KdcNetwork.java:105) > at > org.apache.kerby.kerberos.kerb.transport.KdcNetwork.access$000(KdcNetwork.java:39) > at > org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1.run(KdcNetwork.java:75) > at java.lang.Thread.run(Thread.java:748) > Caused by: java.nio.channels.ClosedChannelException > at > sun.nio.ch.DatagramChannelImpl.ensureOpen(DatagramChannelImpl.java:320) > at sun.nio.ch.DatagramChannelImpl.receive(DatagramChannelImpl.java:331) > at > org.apache.kerby.kerberos.kerb.transport.KdcNetwork.checkUdpMessage(KdcNetwork.java:132) > at > org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run(KdcNetwork.java:101) > > Colm. > > >> On Fri, May 5, 2017 at 5:56 PM, Zheng, Kai <[email protected]> wrote: >> >> Colm, did you see udp problem now instead? I'm a little confused. Udp is >> sure supported but may not be enabled by default, which should be okay, >> imo. Thanks. >> >> Sent from iPhone >> >>> 在 2017年5月6日，上午12:02，Colm O hEigeartaigh <[email protected]> 写道： >>> >>> That's probably it. Why does the default transport not support UDP in >> Kerby? >>> >>> Colm. >>> >>>> On Fri, May 5, 2017 at 4:54 PM, Li, Jiajia <[email protected]> wrote: >>>> >>>> Are you sure add kdc_allow_udp = false in kdc.conf? >>>> >>>> Thanks >>>> Jiajia >>>> >>>> -----Original Message----- >>>> From: Colm O hEigeartaigh [mailto:[email protected]] >>>> Sent: Friday, May 5, 2017 11:41 PM >>>> To: Li, Jiajia <[email protected]> >>>> Cc: [email protected]; Zheng, Kai <[email protected]>; >> mailto: >>>> [email protected] <[email protected]> >>>> Subject: Re: MIT Kerberos compatibility >>>> >>>> Sorry, it was my error, UDP was actually enabled there. But why am I >> still >>>> seeing that error message? >>>> >>>> Colm. >>>> >>>>> On Fri, May 5, 2017 at 4:39 PM, Li, Jiajia <[email protected]> >> wrote: >>>>> >>>>> Hi Colm, >>>>> I also test the Kerby KDC with kerby kint and MIT kinit, and only >>>>> listen the tcp port(disable udp), both got ticket successfully. But I >>>>> don't get the error message. Both krb.conf and kdc.conf should set udp >>>>> to be false, udp is enabled in default. >>>>> >>>>> Thanks >>>>> Jiajia >>>>> >>>>> -----Original Message----- >>>>> From: Colm O hEigeartaigh [mailto:[email protected]] >>>>> Sent: Friday, May 5, 2017 11:34 PM >>>>> To: [email protected] >>>>> Cc: Zheng, Kai <[email protected]>; mailto:[email protected] < >>>>> [email protected]> >>>>> Subject: Re: MIT Kerberos compatibility >>>>> >>>>> Hi Jiajia, >>>>> >>>>> If UDP is disabled and we don't use Netty, I can get a token >>>>> successfully via kinit. However I then see an error message in the >> Kerby >>>> console: >>>>> >>>>> Exception in thread "Thread-1" java.lang.RuntimeException: Error >>>>> occured while checking udp connections >>>>> at >>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run( >>>>> KdcNetwork.java:105) >>>>> at >>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork. >>>>> access$000(KdcNetwork.java:39) >>>>> at >>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1. >>>>> run(KdcNetwork.java:75) >>>>> at java.lang.Thread.run(Thread.java:748) >>>>> Caused by: java.nio.channels.ClosedChannelException >>>>> at >>>>> sun.nio.ch.DatagramChannelImpl.ensureOpen( >> DatagramChannelImpl.java:320) >>>>> at sun.nio.ch.DatagramChannelImpl.receive( >>>>> DatagramChannelImpl.java:331) >>>>> at >>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork. >>>>> checkUdpMessage(KdcNetwork.java:132) >>>>> at >>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run( >>>>> KdcNetwork.java:101) >>>>> >>>>> I'm not sure why we are seeing UDP errors when it's disabled? >>>>> >>>>> Colm. >>>>> >>>>>> On Fri, May 5, 2017 at 3:57 PM, Li, Jiajia <[email protected]> >> wrote: >>>>>> >>>>>> Hi Colm, >>>>>> The shell client can't connect to kdc if the UDP is disabled. >>>>>> We don't use Netty in default. >>>>>> What's your test-cases? The same as the Marc's? >>>>>> >>>>>> Thanks >>>>>> Jiajia >>>>>> >>>>>> -----Original Message----- >>>>>> From: Colm O hEigeartaigh [mailto:[email protected]] >>>>>> Sent: Friday, May 5, 2017 10:09 PM >>>>>> To: [email protected] >>>>>> Cc: Zheng, Kai <[email protected]>; mailto:[email protected] >>>>>> < [email protected]> >>>>>> Subject: Re: MIT Kerberos compatibility >>>>>> >>>>>> Hi Jiajia, >>>>>> >>>>>> What are the issues if UDP is disabled and we don't use Netty? I >>>>>> tried doing this with my own test-cases and it didn't work, so it >>>>>> would be good to get this fixed soon. >>>>>> >>>>>> Colm. >>>>>> >>>>>> On Fri, May 5, 2017 at 2:46 PM, Li, Jiajia <[email protected]> >>>> wrote: >>>>>> >>>>>>> Hi Marc, >>>>>>>>>> - your KRB5 tracing looks quite different. What OS and >>>>>>>>>> mit-kerberos >>>>>>> version did you use? >>>>>>> I use mac os and the python version is 2.7.10 >>>>>>> >>>>>>>>>> - your KRB5 tracing shows UDP comms between kerberos client and >>>>>>>>>> KDC, >>>>>>> despite the allowUDP = false setting >>>>>>>>>> in my test. I did this setting because I get different >>>>>>>>>> problems >>>>>>> without it, see the additional logs below. So, >>>>>>>>>> we must also be aware of networking problems at my side. >>>>>>> I enable the UDP and use netty network, there are some issues if >>>>>>> UDP disabled, you can create a JIRA for this and we can fix this >>>>>>> issue in the next release version. >>>>>>> >>>>>>> The changes in my side as following: >>>>>>> >>>>>>> protected boolean allowUdp() { >>>>>>> return true; >>>>>>> } >>>>>>> @Override >>>>>>> protected void prepareKdc() throws KrbException { >>>>>>> getKdcServer().setInnerKdcImpl( >>>>>>> new NettyKdcServerImpl(getKdcServer().getKdcSetting())); >>>>>>> super.prepareKdc(); >>>>>>> } >>>>>>> >>>>>>> Here is log of MitIssueTest: >>>>>>> [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest >>>>>>> [nioEventLoopGroup-2-1] INFO >>>>>>> io.netty.handler.logging.LoggingHandler >>>>>>> - >>>>>>> [id: 0x2634fe6b] REGISTERED >>>>>>> [nioEventLoopGroup-2-1] INFO >>>>>>> io.netty.handler.logging.LoggingHandler >>>>>>> - >>>>>>> [id: 0x2634fe6b] BIND(0.0.0.0/0.0.0.0:53957) >>>>>>> [nioEventLoopGroup-2-1] INFO >>>>>>> io.netty.handler.logging.LoggingHandler - >>>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] ACTIVE [main] INFO >>>>>>> org.apache.kerby.kerberos.kdc.impl.NettyKdcServerImpl - Netty kdc >>>>>>> server started. >>>>>>> [nioEventLoopGroup-2-1] INFO >>>>>>> io.netty.handler.logging.LoggingHandler >>>>>>> - >>>>>>> [id: 0x2634fe6b, /0:0:0:0:0:0:0:0:53957] RECEIVED: [id: >>>>>>> 0xdac7228b, / >>>>>>> 127.0.0.1:53961 => /127.0.0.1:53957] >>>>>>> [defaultEventExecutorGroup-4-1] INFO >>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest >>>>>>> - AS_REQ ISSUE: authtime 1493991123792,[email protected] for >>>>>>> krbtgt/ [email protected] [main] INFO >>>>>>> org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClien >>>>>>> t >>>>>>> - Send to kdc success. >>>>>>> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase - >>>>>>> Storing the tgt to the credential cache file. >>>>>>> [nioEventLoopGroup-5-1] INFO >>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest >>>>>>> - The preauth data is empty. >>>>>>> [nioEventLoopGroup-5-1] INFO >>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler >>>>>>> - KRB error occurred while processing request:Additional >>>>>>> pre-authentication required [nioEventLoopGroup-5-1] INFO >>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest >>>>>>> - AS_REQ ISSUE: authtime >>>>>>> 1493991123859,test-service/[email protected] >>>>>>> for krbtgt/[email protected] >>>>>>> [nioEventLoopGroup-5-1] INFO >>>>>>> org.apache.kerby.kerberos.kerb.server.request.TgsRequest >>>>>>> - TGS_REQ ISSUE: authtime 1493991142850,drankye for test-service/ >>>>>>> [email protected] >>>>>>> >>>>>>> Thanks >>>>>>> Jiajia >>>>>>> >>>>>>> -----Original Message----- >>>>>>> From: Zheng, Kai >>>>>>> Sent: Friday, May 5, 2017 7:46 PM >>>>>>> To: [email protected]; Li, Jiajia <[email protected]> >>>>>>> Subject: RE: MIT Kerberos compatibility >>>>>>> >>>>>>> Hi Marc, >>>>>>> >>>>>>> Looks like this is quite environment related, could you fire an >>>>>>> issue for this? I would suggest we target it to 1.1.0, which can >>>>>>> be done in >>>>>> June. >>>>>>> >>>>>>> Regards, >>>>>>> Kai >>>>>>> >>>>>>> -----Original Message----- >>>>>>> From: Marc de Lignie [mailto:[email protected]] >>>>>>> Sent: Friday, May 05, 2017 4:44 PM >>>>>>> To: Li, Jiajia <[email protected]> >>>>>>> Cc: [email protected] >>>>>>> Subject: Re: MIT Kerberos compatibility >>>>>>> >>>>>>> Hi Jiajia, >>>>>>> >>>>>>> Great to read that you made progress on this issue and to see a >>>>>>> working config at your side. Below, I list my progress below (with >>>>>>> trunk merged into my MitIssue branch), but I am afraid we are not >>>>>>> done >>>>>> yet. >>>>>>> >>>>>>> Things that stand out: >>>>>>> >>>>>>> - the kdc decoding error is solved, relative to the logs without >>>>>>> your patch >>>>>>> >>>>>>> - your KRB5 tracing looks quite different. What OS and >>>>>>> mit-kerberos version did you use? >>>>>>> >>>>>>> - your KRB5 tracing shows UDP comms between kerberos client and >>>>>>> KDC, despite the allowUDP = false setting in my test. I did this >>>>>>> setting because I get different problems without it, see the >>>>>>> additional logs below. So, we must also be aware of networking >>>> problems at my side. >>>>>>> >>>>>>> - the "Response was not from master KDC" msg is not relevant; it >>>>>>> disappears if you manually add master_kdc to the realms section of >>>>>>> the krb5.conf >>>>>>> >>>>>>> I have no idea how to proceed from here, so that is why I just >>>>>>> document the status at my side and ask about your - apparently >>>>>>> working - >>>>>> config. >>>>>>> >>>>>>> Cheers, Marc >>>>>>> >>>>>>> >>>>>>> KDC logging with allowUDP = false: >>>>>>> >>>>>>> [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest >>>>>>> [pool-1-thread-1] INFO >>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ >>>>> ISSUE: >>>>>>> authtime 1493970789075,[email protected] for >>>>>>> krbtgt/[email protected] [main] INFO >>>>>>> org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClien >>>>>>> t >>>>>>> - Send to kdc success. >>>>>>> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase - >>>>>>> Storing the tgt to the credential cache file. >>>>>>> [pool-1-thread-1] INFO >>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The >>>>>>> preauth data is empty. >>>>>>> [pool-1-thread-1] INFO >>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler >>>>>>> - KRB error occurred while processing request:Additional >>>>>>> pre-authentication required [pool-1-thread-1] INFO >>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ >>>>> ISSUE: >>>>>>> authtime 1493970789108,test-service/[email protected] for krbtgt/ >>>>>>> [email protected] [pool-1-thread-1] INFO >>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest >>>>>>> - Found fast padata and starting to process it. >>>>>>> [pool-1-thread-1] INFO >>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - Found >>>>>>> fast padata and starting to process it. >>>>>>> >>>>>>> Python script KRB5 tracing (MIT Kerberos 1.13.2 of Ubuntu Xenial) >>>>>>> with allowUDP = false: >>>>>>> >>>>>>> $ . >>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/ >>>>>>> kerberos/kerb/server/MitIssueTest.sh >>>>>>> [25281] 1493970797.298753: Retrieving [email protected] from >>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with >>>> result: >>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found >>>>>>> [25281] >>>>>>> 1493970797.298952: Retrieving [email protected] from >>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with >>>> result: >>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found >>>>>>> [25281] >>>>>>> 1493970797.299106: Retrieving [email protected] from >>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with >>>> result: >>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found >>>>>>> [25281] >>>>>>> 1493970797.299213: Retrieving [email protected] from >>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with >>>> result: >>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found >>>>>>> [25281] >>>>>>> 1493970797.299323: Retrieving [email protected] from >>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with >>>> result: >>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found >>>>>>> [25281] >>>>>>> 1493970797.299436: Retrieving [email protected] from >>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with >>>> result: >>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found >>>>>>> [25281] >>>>>>> 1493970797.299545: Retrieving [email protected] from >>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with >>>> result: >>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found >>>>>>> [25281] >>>>>>> 1493970797.299654: Retrieving [email protected] from >>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with >>>> result: >>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found >>>>>>> kerberos.authGSSClientInit successful [25281] 1493970797.299922: >>>>>>> Getting credentials [email protected] -> test-service/localhost@ >>>>>>> using ccache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc >>>>>>> [25281] 1493970797.299945: Retrieving [email protected] -> >>>>>>> test-service/localhost@ from >>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc >>>>>>> with result: >>>>>>> -1765328243/Matching credential not found [25281] 1493970797.299959: >>>>>>> Retrying [email protected] -> test-service/[email protected] with >>>>>> result: >>>>>>> -1765328243/Matching credential not found [25281] 1493970797.299962: >>>>>>> Server has referral realm; starting with >>>>>>> test-service/[email protected] [25281] >>>>>>> 1493970797.299975: Retrieving [email protected] -> >>>>>>> krbtgt/[email protected] from >>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc >>>>>> with result: >>>>>>> 0/Success [25281] 1493970797.299979: Starting with TGT for client >>>>> realm: >>>>>>> [email protected] -> krbtgt/[email protected] [25281] >>>>> 1493970797.299981: >>>>>>> Requesting tickets for test-service/[email protected], referrals >>>>>>> on [25281] 1493970797.299994: Generated subkey for TGS request: >>>>>>> aes128-cts/1B9B [25281] 1493970797.300009: etypes requested in TGS >>>>>> request: >>>>>>> aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, >>>>>>> camellia256-cts [25281] 1493970797.300054: Encoding request body >>>>>>> and padata into FAST request [25281] 1493970797.300080: Sending >>>>>>> request >>>>>>> (823 bytes) to TEST.COM [25281] 1493970797.300091: Resolving >>>>>>> hostname localhost [25281] >>>>>>> 1493970797.300136: Initiating TCP connection to stream >>>>>>> 127.0.0.1:34319 >>>>>>> [25281] 1493970797.300191: Sending TCP request to stream >>>>>>> 127.0.0.1:34319 [25281] 1493970797.303610: Received answer (125 >>>>>>> bytes) from stream >>>>>>> 127.0.0.1:34319 >>>>>>> [25281] 1493970797.303618: Terminating TCP connection to stream >>>>>>> 127.0.0.1:34319 >>>>>>> [25281] 1493970797.553126: Response was not from master KDC >>>>>>> [25281] >>>>>>> 1493970797.553198: TGS request result: -1765323383/Unknown code >>>>>>> krcM >>>>>>> 137 [25281] 1493970797.553234: Requesting tickets for >>>>>>> test-service/ [email protected], referrals off [25281] >>>> 1493970797.553273: >>>>>>> Generated subkey for TGS request: aes128-cts/94C6 [25281] >>>>> 1493970797.553323: >>>>>>> etypes requested in TGS request: aes256-cts, aes128-cts, >>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts [25281] >>>>>>> 1493970797.553436: Encoding request body and padata into FAST >>>>>>> request >>>>>> [25281] 1493970797.553532: >>>>>>> Sending request (823 bytes) to TEST.COM [25281] 1493970797.553567: >>>>>>> Resolving hostname localhost [25281] 1493970797.553745: Initiating >>>>>>> TCP connection to stream >>>>>>> 127.0.0.1:34319 >>>>>>> [25281] 1493970797.553889: Sending TCP request to stream >>>>>>> 127.0.0.1:34319 [25281] 1493970797.558297: Received answer (125 >>>>>>> bytes) from stream >>>>>>> 127.0.0.1:34319 >>>>>>> [25281] 1493970797.558318: Terminating TCP connection to stream >>>>>>> 127.0.0.1:34319 >>>>>>> [25281] 1493970797.561189: Response was not from master KDC >>>>>>> [25281] >>>>>>> 1493970797.561258: TGS request result: -1765323383/Unknown code >>>>>>> krcM >>>>>>> 137 ('First kerberos.authGSSClientStep not successful', >>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide more >>>>>>> information', 851968), ('Unknown code krcM 137', -1765323383))) >>>>>>> >>>>>>> >>>>>>> KDC logging with allowUDP = true: >>>>>>> >>>>>>> [INFO] Running org.apache.kerby.kerberos.kerb.server.MitIssueTest >>>>>>> [pool-1-thread-1] INFO >>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ >>>>> ISSUE: >>>>>>> authtime 1493972505784,[email protected] for >>>>>>> krbtgt/[email protected] [main] INFO >>>>>>> org.apache.kerby.kerberos.kerb.client.impl.DefaultInternalKrbClien >>>>>>> t >>>>>>> - Send to kdc success. >>>>>>> [main] INFO org.apache.kerby.kerberos.kerb.client.KrbClientBase - >>>>>>> Storing the tgt to the credential cache file. >>>>>>> [pool-1-thread-1] INFO >>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest - The >>>>>>> preauth data is empty. >>>>>>> [pool-1-thread-1] INFO >>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler >>>>>>> - KRB error occurred while processing request:Additional >>>>>>> pre-authentication required [pool-1-thread-2] INFO >>>>>>> org.apache.kerby.kerberos.kerb.server.request.AsRequest - AS_REQ >>>>> ISSUE: >>>>>>> authtime 1493972505948,test-service/[email protected] for krbtgt/ >>>>>>> [email protected] Exception in thread "Thread-0" >>>>>>> java.lang.RuntimeException: Error occured while checking udp >>>>> connections >>>>>>> at >>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run( >>>>>>> KdcNetwork.java:105) >>>>>>> at >>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork. >>>>>>> access$000(KdcNetwork.java:39) >>>>>>> at >>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork$1. >>>>>>> run(KdcNetwork.java:75) >>>>>>> at java.lang.Thread.run(Thread.java:748) >>>>>>> Caused by: java.nio.channels.ClosedChannelException >>>>>>> at >>>>>>> sun.nio.ch.DatagramChannelImpl.ensureOpen( >>>>> DatagramChannelImpl.java:320) >>>>>>> at sun.nio.ch.DatagramChannelImpl.receive( >>>>>>> DatagramChannelImpl.java:331) >>>>>>> at >>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork. >>>>>>> checkUdpMessage(KdcNetwork.java:132) >>>>>>> at >>>>>>> org.apache.kerby.kerberos.kerb.transport.KdcNetwork.run( >>>>>>> KdcNetwork.java:101) >>>>>>> ... 3 more >>>>>>> >>>>>>> >>>>>>> krb5.conf: >>>>>>> >>>>>>> [libdefaults] >>>>>>> kdc_realm = TEST.COM >>>>>>> default_realm = TEST.COM >>>>>>> udp_preference_limit = 4096 >>>>>>> kdc_tcp_port = 37080 >>>>>>> kdc_udp_port = 36525 >>>>>>> >>>>>>> [realms] >>>>>>> TEST.COM = { >>>>>>> kdc = localhost:36525 >>>>>>> } >>>>>>> >>>>>>> And port 36525 does not show up in `netstat -l` (while 37080 does) >>>>>>> >>>>>>> >>>>>>> Op 04-05-17 om 14:55 schreef Li, Jiajia: >>>>>>>> Hi Marc, >>>>>>>> I try to run your test(through applying your patch in the trunk) >>>>>>>> , I >>>>>>> think it's success now. Could you take some time to check about it? >>>>>>>> Here is the log: >>>>>>>> >>>>>>>> directory-kerby git:(trunk) ? . >>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerberos >>>>>>>> /k >>>>>>>> er >>>>>>>> b/ >>>>>>>> server/MitIssueTest.sh >>>>>>>> kerberos.authGSSClientInit successful >>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: entypes not >>>>>>>> supported >>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find >>>>>>>> credential for krb5_ccache_conf_data/realm-config@X-CACHECONF: >>>>>>>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc >>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find >>>>>>>> credential for test-service/[email protected] in cache >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc >>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find >>>>>>>> credential for >>>>>>>> krb5_ccache_conf_data/negative-cache/test-service\134/localhost\ >>>>>>>> 13 >>>>>>>> 4@ >>>>>>>> TE >>>>>>>> ST.COM@X-CACHECONF: in cache >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc >>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find >>>>>>>> credential for krb5_ccache_conf_data/lkdc-hostname@X-CACHECONF: >>>>>>>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc >>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find >>>>>>>> credential for krb5_ccache_conf_data/sitename@X-CACHECONF: in >>>>>>>> cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc >>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find >>>>>>>> credential for test-service/[email protected] in cache >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc >>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type >>>>>>>> des-cbc-md5-deprecated not supported >>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type >>>>>>>> des-cbc-md4-deprecated not supported >>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type >>>>>>>> des-cbc-crc-deprecated not supported >>>>>>>> 2017-05-04T20:44:06 Trying to find service kdc for realm >>>>>>>> TEST.COM flags 0 >>>>>>>> 2017-05-04T20:44:06 configuration file for realm TEST.COM found >>>>>>>> 2017-05-04T20:44:06 submissing new requests to new host >>>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost >>>>>>>> 2017-05-04T20:44:06 connecting to host: udp ::1:52534 >>>>>>>> (localhost) >>>>> tid: >>>>>>>> 00000001 >>>>>>>> 2017-05-04T20:44:06 host_create: setting hostname localhost >>>>>>>> 2017-05-04T20:44:06 Queuing host in future (in 3s), its the 2 >>>>>>>> address on the same name: udp 127.0.0.1:52534 (localhost) tid: >>>>>>>> 00000002 >>>>>>>> 2017-05-04T20:44:06 writing packet: udp ::1:52534 (localhost) tid: >>>>>>>> 00000001 >>>>>>>> 2017-05-04T20:44:06 reading packet: udp ::1:52534 (localhost) tid: >>>>>>>> 00000001 >>>>>>>> 2017-05-04T20:44:06 host completed: udp ::1:52534 (localhost) tid: >>>>>>>> 00000001 >>>>>>>> 2017-05-04T20:44:06 krb5_sendto_context TEST.COM done: 0 hosts 1 >>>>>>>> packets 1 wc: 0.048927 nr: 0.000932 kh: 0.000814 tid: 00000002 >>>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/763641F3 >>>>>>>> 2017-05-04T20:44:06 set-error: -1765328353: Decrypt integrity >>>>>>>> check failed for checksum type hmac-sha1-96-aes128, key type >>>>>>>> aes128-cts-hmac-sha1-96 >>>>>>>> 2017-05-04T20:44:06 tkt: extract key 17/3084A95C >>>>>>>> 2017-05-04T20:44:06 krb5_get_credentials_with_flags: TEST.COM wc: >>>>>>>> 0.050317 >>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find >>>>>>>> credential for krb5_ccache_conf_data/realm-config@X-CACHECONF: >>>>>>>> in cache FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc >>>>>>>> 2017-05-04T20:44:06 set-error: -1765328243: Did not find >>>>>>>> credential for >>>>>>>> krb5_ccache_conf_data/time-offset/test-service\134/ >>>>> localhost\134@TEST. >>>>>>>> COM@X-CACHECONF: in cache >>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc >>>>>>>> 2017-05-04T20:44:06 Setting up PFS for auth context >>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type >>>>>>>> des-cbc-md5-deprecated not supported >>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type >>>>>>>> des-cbc-md4-deprecated not supported >>>>>>>> 2017-05-04T20:44:06 set-error: -1765328234: Encryption type >>>>>>>> des-cbc-crc-deprecated not supported First >>>>>>>> kerberos.authGSSClientStep successful >>>>>>>> >>>>>>>> Thanks >>>>>>>> Jiajia >>>>>>>> >>>>>>>> -----Original Message----- >>>>>>>> From: Zheng, Kai [mailto:[email protected]] >>>>>>>> Sent: Wednesday, May 3, 2017 7:29 PM >>>>>>>> To: [email protected] >>>>>>>> Subject: RE: MIT Kerberos compatibility >>>>>>>> >>>>>>>> Hi Marc, >>>>>>>> >>>>>>>> In case you're not aware of this, please check out the latest >>>>>>>> fix made >>>>>>> by Jiajia. We thought your case may be different, but would be >>>>>>> good to have a check before we can repeat/fix your case. Thanks. >>>>>>>> https://issues.apache.org/jira/browse/DIRKRB-625 >>>>>>>> >>>>>>>> Regards, >>>>>>>> Kai >>>>>>>> >>>>>>>> -----Original Message----- >>>>>>>> From: Marc de Lignie [mailto:[email protected]] >>>>>>>> Sent: Sunday, April 30, 2017 7:45 PM >>>>>>>> To: [email protected] >>>>>>>> Subject: Re: MIT Kerberos compatibility >>>>>>>> >>>>>>>> Hi Kai, >>>>>>>> >>>>>>>> The terminal output below is for the latest MIT Kerberos 1.15.1 >>>>>>>> (locally >>>>>>> built on Ubuntu Xenial). Before that, I also tested with the >>>>>>> default Xenial MIT Kerberos packages (1.13.2), with the same >>>>>>> result. I did not try earlier MIT Kerberos versions. >>>>>>>> >>>>>>>> Marc >>>>>>>> >>>>>>>> Op 29-04-17 om 21:42 schreef Marc de Lignie: >>>>>>>>> Hi Kai, >>>>>>>>> >>>>>>>>> Thanks for the response. I prepared a minimal config that >>>>>>>>> reproduces my problem. >>>>>>>>> >>>>>>>>> You can fetch the branch/commit from: >>>>>>>>> https://github.com/vtslab/directory-kerby/commits/MitIssue >>>>>>>>> >>>>>>>>> This is relative to RC2, but I also tried this on trunk for my >>>>>>>>> actual project. >>>>>>>>> >>>>>>>>> This config produces the debug and error messages below. >>>>>>>>> >>>>>>>>> 1. For the terminal with the bash + python script $ klist >>>>>>>>> Ticket >>>>>>>>> cache: FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc >>>>>>>>> Default principal: [email protected] >>>>>>>>> >>>>>>>>> Valid starting Expires Service principal >>>>>>>>> 29-04-17 21:07:39 30-04-17 05:07:39 krbtgt/[email protected] >>>>>>>>> renew until 29-04-17 21:07:39 >>>>>>>>> >>>>>>>>> $ . >>>>>>>>> kerby-kerb/kerb-kdc-test/src/test/java/org/apache/kerby/kerbero >>>>>>>>> s/ ke rb / server/MitIssueTest.sh [15538] 1493491231.917606: >>>>>>>>> Retrieving [email protected] from >>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with >>>>>>>>> result: >>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found >>>>>>>>> [15538] >>>>>>>>> 1493491231.917827: Retrieving [email protected] from >>>>>>>>> FILE:/etc/krb5/user/1000/client.keytab (vno 0, enctype 0) with >>>>>> result: >>>>>>>>> 2/Key table file '/etc/krb5/user/1000/client.keytab' not found >>>>>>>>> kerberos.authGSSClientInit successful [15538] 1493491231.918185: >>>>>>>>> Getting credentials [email protected] -> test-service/localhost@ >>>>>>>>> using ccache >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc >>>>>>>>> [15538] 1493491231.918210: Retrieving [email protected] -> >>>>>>>>> test-service/localhost@ from >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result: >>>>>>>>> -1765328243/Matching credential not found (filename: >>>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc) >>>>>>>>> [15538] 1493491231.918226: Retrying [email protected] -> >>>>>>>>> test-service/[email protected] with result: >>>>>>>>> -1765328243/Matching credential not found (filename: >>>>>>>>> kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc) >>>>>>>>> [15538] 1493491231.918229: Server has referral realm; starting >>>>>>>>> with test-service/[email protected] [15538] 1493491231.918278: >>>>>>>>> Retrieving [email protected] -> krbtgt/[email protected] from >>>>>>>>> FILE:kerby-kerb/kerb-kdc-test/target/tmp/test-tkt.cc with result: >>>>>>>>> 0/Success >>>>>>>>> [15538] 1493491231.918281: Starting with TGT for client realm: >>>>>>>>> [email protected] -> krbtgt/[email protected] [15538] >>>>>>>>> 1493491231.918301: Requesting tickets for >>>>>>>>> test-service/[email protected], referrals on [15538] >>>>>>>>> 1493491231.918326: Generated subkey for TGS request: >>>>>>>>> aes128-cts/FA30 >>>>>>>>> [15538] 1493491231.918359: etypes requested in TGS request: >>>>>>>>> aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, >>>>>>>>> des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts >>>>>>>>> [15538] >>>>> 1493491231.918484: >>>>>>>>> Encoding request body and padata into FAST request [15538] >>>>>>>>> 1493491231.918541: Sending request (836 bytes) to TEST.COM >>>>>>>>> [15538] >>>>>>>>> 1493491231.918597: Resolving hostname localhost [15538] >>>>>>>>> 1493491231.918703: Initiating TCP connection to stream >>>>>>>>> 127.0.0.1:44292 >>>>>>>>> [15538] 1493491231.918777: Sending TCP request to stream >>>>>>>>> 127.0.0.1:44292 [15538] 1493491231.922803: TCP error receiving >>>>>>>>> from stream >>>>>>>>> 127.0.0.1:44292: 104/Connection reset by peer [15538] >>>>>>>>> 1493491231.922812: Terminating TCP connection to stream >>>>>>>>> 127.0.0.1:44292 >>>>>>>>> [15538] 1493491231.922858: Sending initial UDP request to dgram >>>>>>>>> 127.0.0.1:44292 >>>>>>>>> ('First kerberos.authGSSClientStep not successful', >>>>>>>>> GSSError(('Unspecified GSS failure. Minor code may provide >>>>>>>>> more information', 851968), ("Cannot contact any KDC for realm >>>>>>>>> 'TEST.COM'", >>>>>>>>> -1765328228))) >>>>>>>>> >>>>>>>>> 2. For the terminal that runs mvn clean test >>>>>>>>> -Dtest=MitIssueTest Running >>>>>>>>> org.apache.kerby.kerberos.kerb.server.MitIssueTest >>>>>>>>> 2017-04-29 21:07:39,182 DEBUG [main] backend. >>>>> AbstractIdentityBackend: >>>>>>>>> initialize called >>>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend. >>>>> AbstractIdentityBackend: >>>>>>>>> getIdentity called, principalName = krbtgt/[email protected] >>>>>>>>> 2017-04-29 21:07:39,195 DEBUG [main] backend. >>>>> AbstractIdentityBackend: >>>>>>>>> getIdentity failed, principalName = krbtgt/[email protected] >>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend. >>>>> AbstractIdentityBackend: >>>>>>>>> addIdentity successful, principalName = >>>>>>>>> krbtgt/[email protected] >>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend. >>>>> AbstractIdentityBackend: >>>>>>>>> getIdentity called, principalName = kadmin/[email protected] >>>>>>>>> 2017-04-29 21:07:39,212 DEBUG [main] backend. >>>>> AbstractIdentityBackend: >>>>>>>>> getIdentity failed, principalName = kadmin/[email protected] >>>>>>>>> 2017-04-29 21:07:39,213 DEBUG [main] backend. >>>>> AbstractIdentityBackend: >>>>>>>>> addIdentity successful, principalName = >>>>>>>>> kadmin/[email protected] >>>>>>>>> 2017-04-29 21:07:39,216 DEBUG [main] backend. >>>>> AbstractIdentityBackend: >>>>>>>>> start called >>>>>>>>> 2017-04-29 21:07:39,232 DEBUG [main] backend. >>>>> AbstractIdentityBackend: >>>>>>>>> addIdentity successful, principalName = >>>>>>>>> test-service/[email protected] >>>>>>>>> 2017-04-29 21:07:39,425 DEBUG [main] backend. >>>>> AbstractIdentityBackend: >>>>>>>>> addIdentity successful, principalName = [email protected] >>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1] >>>>>>>>> backend.AbstractIdentityBackend: getIdentity called, >>>>>>>>> principalName = krbtgt/[email protected] >>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1] >>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful, >>>>>>>>> principalName = krbtgt/[email protected] >>>>>>>>> 2017-04-29 21:07:39,465 INFO [pool-1-thread-1] >>>> request.KdcRequest: >>>>>>>>> Client entry is empty. >>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1] >>>>>>>>> backend.AbstractIdentityBackend: getIdentity called, >>>>>>>>> principalName = [email protected] >>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1] >>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful, >>>>>>>>> principalName = [email protected] >>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1] >>>>>>>>> backend.AbstractIdentityBackend: getIdentity called, >>>>>>>>> principalName = krbtgt/[email protected] >>>>>>>>> 2017-04-29 21:07:39,465 DEBUG [pool-1-thread-1] >>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful, >>>>>>>>> principalName = krbtgt/[email protected] >>>>>>>>> 2017-04-29 21:07:39,476 DEBUG [pool-1-thread-1] >>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error occurred, >>>>>>>>> disconnecting abnormally java.io.EOFException >>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392) >>>>>>>>> at >>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport. >>>>>>> receiveMessage(KrbTcpTransport.java:54) >>>>>>>>> at >>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru >>>>>>>>> n( >>>>>>> DefaultKdcHandler.java:46) >>>>>>>>> at >>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker( >>>>>>> ThreadPoolExecutor.java:1142) >>>>>>>>> at >>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run( >>>>>>> ThreadPoolExecutor.java:617) >>>>>>>>> at java.lang.Thread.run(Thread.java:748) >>>>>>>>> 2017-04-29 21:07:39,477 INFO [main] client.KrbClientBase: >>>>>>>>> Storing the tgt to the credential cache file. >>>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend. >>>>> AbstractIdentityBackend: >>>>>>>>> getIdentity called, principalName = >>>>>>>>> test-service/[email protected] >>>>>>>>> 2017-04-29 21:07:39,491 DEBUG [main] backend. >>>>> AbstractIdentityBackend: >>>>>>>>> getIdentity successful, principalName = >>>>>>>>> test-service/[email protected] >>>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1] >>>>>>>>> backend.AbstractIdentityBackend: getIdentity called, >>>>>>>>> principalName = krbtgt/[email protected] >>>>>>>>> 2017-04-29 21:07:39,498 DEBUG [pool-1-thread-1] >>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful, >>>>>>>>> principalName = krbtgt/[email protected] >>>>>>>>> 2017-04-29 21:07:39,498 INFO [pool-1-thread-1] >>>> request.KdcRequest: >>>>>>>>> Client entry is empty. >>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1] >>>>>>>>> backend.AbstractIdentityBackend: getIdentity called, >>>>>>>>> principalName = test-service/[email protected] >>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1] >>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful, >>>>>>>>> principalName = test-service/[email protected] >>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1] >>>>>>>>> backend.AbstractIdentityBackend: getIdentity called, >>>>>>>>> principalName = krbtgt/[email protected] >>>>>>>>> 2017-04-29 21:07:39,499 DEBUG [pool-1-thread-1] >>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful, >>>>>>>>> principalName = krbtgt/[email protected] >>>>>>>>> 2017-04-29 21:07:39,499 INFO [pool-1-thread-1] >>>> request.KdcRequest: >>>>>>>>> The preauth data is empty. >>>>>>>>> 2017-04-29 21:07:39,501 INFO [pool-1-thread-1] server.KdcHandler: >>>>>>>>> KRB error occurred while processing request:Additional >>>>>>>>> pre-authentication required >>>>>>>>> 2017-04-29 21:07:39,502 DEBUG [pool-1-thread-1] >>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error occurred, >>>>>>>>> disconnecting abnormally java.io.EOFException >>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392) >>>>>>>>> at >>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport. >>>>>>> receiveMessage(KrbTcpTransport.java:54) >>>>>>>>> at >>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru >>>>>>>>> n( >>>>>>> DefaultKdcHandler.java:46) >>>>>>>>> at >>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker( >>>>>>> ThreadPoolExecutor.java:1142) >>>>>>>>> at >>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run( >>>>>>> ThreadPoolExecutor.java:617) >>>>>>>>> at java.lang.Thread.run(Thread.java:748) >>>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1] >>>>>>>>> backend.AbstractIdentityBackend: getIdentity called, >>>>>>>>> principalName = krbtgt/[email protected] >>>>>>>>> 2017-04-29 21:07:39,505 DEBUG [pool-1-thread-1] >>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful, >>>>>>>>> principalName = krbtgt/[email protected] >>>>>>>>> 2017-04-29 21:07:39,505 INFO [pool-1-thread-1] >>>> request.KdcRequest: >>>>>>>>> Client entry is empty. >>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1] >>>>>>>>> backend.AbstractIdentityBackend: getIdentity called, >>>>>>>>> principalName = test-service/[email protected] >>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1] >>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful, >>>>>>>>> principalName = test-service/[email protected] >>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1] >>>>>>>>> backend.AbstractIdentityBackend: getIdentity called, >>>>>>>>> principalName = krbtgt/[email protected] >>>>>>>>> 2017-04-29 21:07:39,506 DEBUG [pool-1-thread-1] >>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful, >>>>>>>>> principalName = krbtgt/[email protected] >>>>>>>>> 2017-04-29 21:07:39,510 DEBUG [pool-1-thread-1] >>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error occurred, >>>>>>>>> disconnecting abnormally java.io.EOFException >>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:392) >>>>>>>>> at >>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport. >>>>>>> receiveMessage(KrbTcpTransport.java:54) >>>>>>>>> at >>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru >>>>>>>>> n( >>>>>>> DefaultKdcHandler.java:46) >>>>>>>>> at >>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker( >>>>>>> ThreadPoolExecutor.java:1142) >>>>>>>>> at >>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run( >>>>>>> ThreadPoolExecutor.java:617) >>>>>>>>> at java.lang.Thread.run(Thread.java:748) >>>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1] >>>>>>>>> backend.AbstractIdentityBackend: getIdentity called, >>>>>>>>> principalName = krbtgt/[email protected] >>>>>>>>> 2017-04-29 21:07:55,602 DEBUG [pool-1-thread-1] >>>>>>>>> backend.AbstractIdentityBackend: getIdentity successful, >>>>>>>>> principalName = krbtgt/[email protected] >>>>>>>>> 2017-04-29 21:07:55,602 INFO [pool-1-thread-1] >>>> request.KdcRequest: >>>>>>>>> Found fast padata and start to process it. >>>>>>>>> 2017-04-29 21:07:55,603 ERROR [pool-1-thread-1] >>>>>>>>> impl.DefaultKdcHandler: Error occured while processing request: >>>>>>>>> org.apache.kerby.kerberos.kerb.KrbException: Decoding failed >>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec. >>>>>>> java:85) >>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec. >>>>>>> java:70) >>>>>>>>> at >>>>>>>>> org.apache.kerby.kerberos.kerb.server.request.KdcRequest.kdcFin >>>>>>>>> dF >>>>>>>>> as >>>>>>>>> t( >>>>>>> KdcRequest.java:208) >>>>>>>>> at >>>>>>>>> org.apache.kerby.kerberos.kerb.server.request. >>>>>>> KdcRequest.process(KdcRequest.java:168) >>>>>>>>> at >>>>>>>>> org.apache.kerby.kerberos.kerb.server.KdcHandler. >>>>>>> handleMessage(KdcHandler.java:115) >>>>>>>>> at >>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler. >>>>>>> handleMessage(DefaultKdcHandler.java:67) >>>>>>>>> at >>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru >>>>>>>>> n( >>>>>>> DefaultKdcHandler.java:52) >>>>>>>>> at >>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker( >>>>>>> ThreadPoolExecutor.java:1142) >>>>>>>>> at >>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run( >>>>>>> ThreadPoolExecutor.java:617) >>>>>>>>> at java.lang.Thread.run(Thread.java:748) >>>>>>>>> Caused by: java.io.IOException: Unexpected item context [0] >>>>>>>>> [tag=0xA0, off=0, len=3+207], expecting 0x30 >>>>>>>>> at >>>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode( >>>>>>> Asn1Encodeable.java:210) >>>>>>>>> at >>>>>>>>> org.apache.kerby.asn1.type.Asn1Encodeable.decode( >>>>>>> Asn1Encodeable.java:197) >>>>>>>>> at org.apache.kerby.kerberos.kerb.KrbCodec.decode(KrbCodec. >>>>>>> java:83) >>>>>>>>> ... 9 more >>>>>>>>> 2017-04-29 21:07:55,604 DEBUG [pool-1-thread-1] >>>>>>>>> impl.DefaultKdcHandler: Transport or decoding error occurred, >>>>>>>>> disconnecting abnormally >>>>>>>>> java.net.SocketException: Socket closed >>>>>>>>> at java.net.SocketInputStream.socketRead0(Native Method) >>>>>>>>> at java.net.SocketInputStream.socketRead(SocketInputStream. >>>>>>> java:116) >>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java: >>>> 171) >>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java: >>>> 141) >>>>>>>>> at java.net.SocketInputStream.read(SocketInputStream.java: >>>> 224) >>>>>>>>> at java.io.DataInputStream.readInt(DataInputStream.java:387) >>>>>>>>> at >>>>>>>>> org.apache.kerby.kerberos.kerb.transport.KrbTcpTransport. >>>>>>> receiveMessage(KrbTcpTransport.java:54) >>>>>>>>> at >>>>>>>>> org.apache.kerby.kerberos.kerb.server.impl.DefaultKdcHandler.ru >>>>>>>>> n( >>>>>>> DefaultKdcHandler.java:46) >>>>>>>>> at >>>>>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker( >>>>>>> ThreadPoolExecutor.java:1142) >>>>>>>>> at >>>>>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run( >>>>>>> ThreadPoolExecutor.java:617) >>>>>>>>> at java.lang.Thread.run(Thread.java:748) >>>>>>>>> >>>>>>>>> In a FreeIPA environment these python lines "just" work. >>>>>>>>> >>>>>>>>> Any suggestions are welcome! >>>>>>>>> >>>>>>>>> Marc >>>>>>>>> >>>>>>>>> >>>>>>>> -- >>>>>>>> Marc de Lignie >>>>>>>> >>>>>>> >>>>>>> -- >>>>>>> Marc de Lignie >>>>>>> >>>>>>> >>>>>> >>>>>> >>>>>> -- >>>>>> Colm O hEigeartaigh >>>>>> >>>>>> Talend Community Coder >>>>>> http://coders.talend.com >>>>>> >>>>> >>>>> >>>>> >>>>> -- >>>>> Colm O hEigeartaigh >>>>> >>>>> Talend Community Coder >>>>> http://coders.talend.com >>>>> >>>> >>>> >>>> >>>> -- >>>> Colm O hEigeartaigh >>>> >>>> Talend Community Coder >>>> http://coders.talend.com >>>> >>> >>> >>> >>> -- >>> Colm O hEigeartaigh >>> >>> Talend Community Coder >>> http://coders.talend.com >> >> > > > -- > Colm O hEigeartaigh > > Talend Community Coder > http://coders.talend.com
