Re: [keycloak-user] Kerberos/SPNEGO Problem with Keycloak 3.0.0

bump On Thu, Apr 27, 2017 at 12:35 PM, Hendrik Dev <hendrikdev22(a)gmail.com&gt; wrote: > On Tue, Apr 25, 2017 at 12:56 PM, Marek Posolda <mposolda(a)redhat.com&gt; wrote: >> On 24/04/17 18:55, Hendrik Dev wrote: >>> Hi, >>> >>> I try to get Kerberos/SPNEGO up and running with Keycloak 3.0.0. >>> Purpose is to provide single sign on for users logging in via IE from >>> a windows domain. >>> Keycloak itself is running on centOS, Kerberos server is Active >>> Directory. The setup is working so far because i can login via 'curl >>> --negotiate'. There are also several other java applications running >>> in this environment which are capable of doing SPNEGO over Kerberos >>> authentication successfully. >>> >>> If the user access a Keycloak protected application the SPNEGO login >>> does not work and the Keycloak login page is displayed instead. >>> In the logs i see "Defective token detected (Mechanism level: >>> GSSHeader did not find the right tag)" and thats totally right because >>> the browser sends >>> 'Negotiate: TlRMTVNTUAABAAAAl4II4gAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==' >>> which is a SPENEGO-NTLM token (and not a SPNEGO-Kerberos token). >>> >>> For me it looks like the browser never gets either a >>> 'WWW-Authenticate: Negotiate' header or a 401 status from Keycloak. >>> In other words: The browser seems to never gets challenged to do >>> SPNEGO over Kerberos. >> I will try to summarize if I understand correctly: >> 1) Keycloak sent 401 with "WWW-Authenticate: Negotiate" >> 2) Your browser replied with the SPNEGO-NTLM token like "Authorization: >> Negotiate ntlm-token-is-here" >> 3) Keycloak replied with "WWW-Authenticate: Negotiate >> spnego-token-asking-to-send-kerberos-instead-of-ntlm" >> 4) Your browser didn't reply anything back >> >> Is it correct? > Sorry no. I never see a 401 nor a "WWW-Authenticate: Negotiate" from keycloak. > As i said, the browser does not get a challenge. > > > >> It seems that your browser doesn't have kerberos ticket, hence that's why it >> uses NTLM instead. I think the best would be to fix your environment, so >> that it will send Kerberos token instead of NTLM at the step 2. >> >> Marek >> >>> I already tried to fix it >>> >>> (https://github.com/salyh/keycloak/commit/c860e31a3fe3005b4487363ad2ae25ce...) >>> but this oddly just ends up in a Basic Auth popup from the browser. >>> For the client app the standard flow as well as direct access grants >>> is enabled. >>> >>> Keycloak is deployed as HA with 3 nodes and runs behind a HW >>> loadbalancer and Kerberos is setup within the LDAP Federation () >>> >>> Any ideas? >>> >>> Thanks >>> Hendrik >>> > > > -- > Hendrik Saly (salyh, hendrikdev22) > @hendrikdev22 > PGP: 0x22D7F6EC