针对 Kerberos AD 调试共享 SSO 设置

Question

我正在尝试使用 Kerberos AD 实施 SSO 以进行共享，并按照 docs.alfresco.com 上的官方文档中列出的说明进行操作。我不断收到以下异常

2013-06-20 18:07:37,772  DEBUG [app.servlet.KerberosAuthenticationFilter] [http-80-1] Authentication not required (filter), chaining ...
2013-06-20 18:07:37,804  DEBUG [app.servlet.KerberosAuthenticationFilter] [http-80-1] Authentication not required (filter), chaining ...
2013-06-20 18:07:37,819  DEBUG [app.servlet.KerberosAuthenticationFilter] [http-80-1] New Kerberos auth request from X.X.X.X (X.X.X.X:ZZZZ) Checksum failed !

2013-06-05 12:02:30,998  WARN  [site.servlet.KerberosSessionSetupPrivilegedAction] [http-80-3] Caught GSS Error
GSSException: Failure unspecified at GSS-API level (Mechanism level: Checksum failed)
    at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:741)
    at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:323)
    at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:267)
    ....

Caused by: KrbException: Checksum failed
    at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHmacEType.java:85)
    at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHmacEType.java:77)
    at sun.security.krb5.EncryptedData.decrypt(EncryptedData.java:168)
    at sun.security.krb5.KrbApReq.authenticate(KrbApReq.java:268)
    at sun.security.krb5.KrbApReq.<init>(KrbApReq.java:134)
    at sun.security.jgss.krb5.InitSecContextToken.<init>(InitSecContextToken.java:79)
    at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:724)
    ... 21 more
Caused by: java.security.GeneralSecurityException: Checksum failed
    at sun.security.krb5.internal.crypto.dk.ArcFourCrypto.decrypt(ArcFourCrypto.java:388)
    at sun.security.krb5.internal.crypto.ArcFourHmac.decrypt(ArcFourHmac.java:74)
    at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHmacEType.java:83)
    ... 27 more

这里是文件的设置、设置和各自的位置。我已经打开了打印上面消息的调试。任何有助于解决问题的建议将不胜感激。我们在 Windows 2008 机器上运行 4.0.d 社区。​​p>

alfresco-global.properties

### Kerberos SSO ###
kerberos.authentication.realm=LOCAL.COM
kerberos.authentication.sso.enabled=true
kerberos.authentication.authenticateCIFS=false
kerberos.authentication.user.configEntryName=AlfrescoHTTP
kerberos.authentication.http.configEntryName=AlfrescoHTTP
#kerberos.authentication.cifs.configEntryName=AlfrescoCIFS
kerberos.authentication.stripUsernameSuffix=true
kerberos.authentication.http.password=password
kerberos.authentication.cifs.password=password
kerberos.authentication.browser.ticketLogons=true
kerberos.authentication.defaultAdministratorUserNames=usera

share-config-custom.xml

<config evaluator="string-compare" condition="Kerberos" replace="true">
    <kerberos>
        <password>password</password>
        <realm>LOCAL.COM</realm>
        <endpoint-spn>HTTP/domain@LOCAL.COM</endpoint-spn>
        <config-entry>ShareHTTP</config-entry>
    </kerberos>
</config>

<config evaluator="string-compare" condition="Remote">
      <remote>
    <connector>
            <id>alfrescoCookie</id>
            <name>Alfresco Connector</name>
            <description>Connects to an Alfresco instance using cookie-based authentication</description>
            <class>org.springframework.extensions.webscripts.connector.AlfrescoConnector</class>
         </connector>

     <endpoint>
            <id>alfresco</id>
            <name>Alfresco - user access</name>
            <description>Access to Alfresco Repository WebScripts that require user authentication</description>
            <connector-id>alfrescoCookie</connector-id>
            <endpoint-url>http://localhost:80/alfresco/wcs</endpoint-url>
            <identity>user</identity>
            <external-auth>true</external-auth>
         </endpoint>
      </remote>
</config>

java.login.config 在 C:\Alfresco\java\jre\lib\security == 如文档中所述，但将 keyTab 位置更改为 C:/etc/alfresco.keytab

还修改了 C:\Alfresco\java\jre\lib\security 中的 java.security 以指向 java.login.config

krb5.ini 在 (C:\Windows)

[libdefaults]
 default_realm = LOCAL.COM
 default_tkt_enctypes = rc4-hmac
 default_tgs_enctypes = rc4-hmac 

[realms]
 LOCAL.COM = {
  kdc = machine.local.com
  admin_server = machine.local.com
 }

[domain_realm]
 machine.local.com = LOCAL.COM
 .machine.local.com = LOCAL.COM

任何有关如何调试的建议将不胜感激；非常感谢。

Answer 1

如果你提供

-Dsun.security.krb5.debug=true -Dsun.security.jgss.debug=true

在 Alfresco 开始时，你会得到一些调试输出。