[infinispan-issues] [JBoss JIRA] (ISPN-4288) JGroups kerberos auth is not able to obtain credentials

[Vojtech Juranek (JIRA)]

     [ https://issues.jboss.org/browse/ISPN-4288?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Vojtech Juranek resolved ISPN-4288.
-----------------------------------

    Resolution: Duplicate Issue


This is basically a subset of ISPN-4303, so resolving this one as s duplicate.

> JGroups kerberos auth is not able to obtain credentials
> -------------------------------------------------------
>
>                 Key: ISPN-4288
>                 URL: https://issues.jboss.org/browse/ISPN-4288
>             Project: Infinispan
>          Issue Type: Bug
>          Components: Test Suite - Server
>            Reporter: Vojtech Juranek
>            Assignee: Mircea Markus
>
> When trying to use kerberos for authentication between ISPN nodes (which uses JGroups authentication) I get following exception:
> {noformat}
> Caused by: java.lang.Exception: connecting to channel "clustered" failed
>         at org.jgroups.JChannel._connect(JChannel.java:564)
>         at org.jgroups.JChannel.connect(JChannel.java:288)
>         at org.jgroups.JChannel.connect(JChannel.java:273)
>         at org.infinispan.remoting.transport.jgroups.JGroupsTransport.startJGroupsChannelIfNeeded(JGroupsTransport.java:198)
>         ... 27 more
> Caused by: java.lang.SecurityException: javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)]
>         at org.jgroups.protocols.SASL.down(SASL.java:294)
>         at org.jgroups.protocols.pbcast.STABLE.down(STABLE.java:347)
>         at org.jgroups.protocols.pbcast.ClientGmsImpl.sendJoinMessage(ClientGmsImpl.java:243)
>         at org.jgroups.protocols.pbcast.ClientGmsImpl.joinInternal(ClientGmsImpl.java:124)
>         at org.jgroups.protocols.pbcast.ClientGmsImpl.join(ClientGmsImpl.java:40)
>         at org.jgroups.protocols.pbcast.GMS.down(GMS.java:1082)
>         at org.jgroups.protocols.FlowControl.down(FlowControl.java:340)
>         at org.jgroups.protocols.FlowControl.down(FlowControl.java:340)
>         at org.jgroups.protocols.FRAG2.down(FRAG2.java:136)
>         at org.jgroups.protocols.RSVP.down(RSVP.java:142)
>         at org.jgroups.stack.ProtocolStack.down(ProtocolStack.java:1039)
>         at org.jgroups.JChannel.down(JChannel.java:785)
>         at org.jgroups.JChannel._connect(JChannel.java:558)
>         ... 30 more
> Caused by: javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)]
>         at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:212) [rt.jar:1.7.0_45]
>         at org.jgroups.auth.sasl.SaslClientContext.addHeader(SaslClientContext.java:84)
>         at org.jgroups.protocols.SASL.down(SASL.java:289)
>         ... 42 more
> Caused by: GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)
>         at sun.security.jgss.krb5.Krb5InitCredential.getInstance(Krb5InitCredential.java:147) [rt.jar:1.7.0_45]
>         at sun.security.jgss.krb5.Krb5MechFactory.getCredentialElement(Krb5MechFactory.java:121) [rt.jar:1.7.0_45]
>         at sun.security.jgss.krb5.Krb5MechFactory.getMechanismContext(Krb5MechFactory.java:187) [rt.jar:1.7.0_45]
>         at sun.security.jgss.GSSManagerImpl.getMechanismContext(GSSManagerImpl.java:223) [rt.jar:1.7.0_45]
>         at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:212) [rt.jar:1.7.0_45]
>         at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:179) [rt.jar:1.7.0_45]
>         at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:193) [rt.jar:1.7.0_45]
>         ... 44 more
> {noformat}
> The test and setup can be downloaded [here|https://github.com/vjuranek/infinispan/tree/ISPN-4273]. Not completely sure, if it's a bug or some kerberos setup issue, but it failed also in case when I tried to use already running kerberos (not ApacheDS run in within the test).



--
This message was sent by Atlassian JIRA
(v6.2.3#6260)