API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Sep 18th, 2017
433
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 12.01 KB | None | 0 0
raw download clone embed print report
  1. K/M@EXAMPLE.COM
  2. kadmin/admin@EXAMPLE.COM
  3. kadmin/changepw@EXAMPLE.COM
  4. kadmin/localhost@EXAMPLE.COM
  5. kiprop/localhost@EXAMPLE.COM
  6. krbtgt/EXAMPLE.COM@EXAMPLE.COM
  7. user1/admin@EXAMPLE.COM
  8. user1/user@EXAMPLE.COM
  9.  
  10. package kerby;
  11.  
  12. import java.io.DataInputStream;
  13. import java.io.DataOutputStream;
  14. import java.io.File;
  15. import java.io.FileInputStream;
  16. import java.io.IOException;
  17. import java.net.Socket;
  18. import java.net.UnknownHostException;
  19. import java.security.PrivilegedAction;
  20. import java.util.Properties;
  21. import javax.security.auth.Subject;
  22. import javax.security.auth.login.LoginContext;
  23. import javax.security.auth.login.LoginException;
  24. import org.ietf.jgss.GSSContext;
  25. import org.ietf.jgss.GSSException;
  26. import org.ietf.jgss.GSSManager;
  27. import org.ietf.jgss.GSSName;
  28. import org.ietf.jgss.Oid;
  29.  
  30. public class Client {
  31.  
  32. static Oid krb5Oid;
  33.  
  34. public static void main( String[] args) {
  35.  
  36. // Oid mechanism = use Kerberos V5 as the security mechanism.
  37. try {
  38. krb5Oid = new Oid( "1.2.840.113554.1.2.2");
  39. }
  40. catch (GSSException e) {
  41. System.err.println("Client: Error obtaining Kerberos V5 OID: " + e);
  42. e.printStackTrace();
  43. System.exit(-1);
  44. }
  45.  
  46. // 1. Set up Kerberos properties.
  47. Properties props = new Properties();
  48. try {
  49. props.load( new FileInputStream("client.properties"));
  50. }
  51. catch (IOException e) {
  52. System.err.println("Client: Error opening properties file '"+props+"': " + e);
  53. e.printStackTrace();
  54. System.exit(-1);
  55. }
  56.  
  57. System.setProperty( "sun.security.krb5.debug", "true");
  58. System.setProperty( "java.security.auth.login.config", "./jaas.config");
  59. System.setProperty( "javax.security.auth.useSubjectCredsOnly", "true");
  60. System.setProperty("java.security.krb5.conf", "krb5.ini");
  61. String username = props.getProperty( "client.principal.name");
  62. String password = props.getProperty( "client.password");
  63.  
  64. // 2. Authenticate against the KDC using JAAS and return the Subject.
  65. LoginContext loginCtx = null;
  66. // "Client" references the corresponding JAAS configuration section in the jaas.conf file.
  67. try {
  68. loginCtx = new LoginContext("Client", new Krb5CallbackHandler(username, password));
  69. loginCtx.login();
  70. }
  71. catch ( LoginException e) {
  72. System.err.println("Client: There was an error during the JAAS login: " + e);
  73. e.printStackTrace();
  74. System.exit( -1);
  75. }
  76.  
  77. Subject subject = loginCtx.getSubject();
  78.  
  79. // 3. Connect to service.
  80. String hostName = "127.0.0.1";
  81. int port = 88;
  82. Socket socket = null;
  83. try {
  84. socket = new Socket(hostName,port);
  85. }
  86. catch (UnknownHostException e) {
  87. e.printStackTrace();
  88. System.err.println("Client: There was an error connecting to the server: hostname " + hostName + " not found.");
  89. System.exit( -1);
  90. }
  91. catch (IOException e) {
  92. e.printStackTrace();
  93. System.err.println("Client: There was an error connecting to the server: " + e);
  94. System.exit( -1);
  95. }
  96.  
  97. final DataInputStream inStream;
  98. final DataOutputStream outStream;
  99.  
  100. try {
  101. inStream = new DataInputStream(socket.getInputStream());
  102. outStream = new DataOutputStream(socket.getOutputStream());
  103.  
  104. // 4. Authenticate with service.
  105. String servicePrincipalName = props.getProperty("service.principal.name");
  106. GSSManager manager = GSSManager.getInstance();
  107. GSSName serverName = null;
  108.  
  109. try {
  110. serverName = manager.createName( servicePrincipalName, GSSName.NT_HOSTBASED_SERVICE);
  111. }
  112. catch (GSSException e) {
  113. e.printStackTrace();
  114. System.err.println("Client: There was an error in creating a name for the host-based service that we want to connect to.");
  115. System.exit(-1);
  116. }
  117.  
  118. System.out.println("Client: Initiating security context with serverName " + serverName);
  119.  
  120. try {
  121. final GSSContext context = manager.createContext( serverName,
  122. krb5Oid,
  123. null,
  124. GSSContext.DEFAULT_LIFETIME);
  125.  
  126. // The GSS context initiation has to be performed as a privileged action.
  127. GSSContext serviceTicket = Subject.doAs( subject, new PrivilegedAction<GSSContext>() {
  128. public GSSContext run() {
  129. try {
  130. context.requestMutualAuth( false);
  131. context.requestCredDeleg( false);
  132.  
  133. int retval;
  134. while(!context.isEstablished()) {
  135. context.initSecContext(inStream,outStream);
  136. }
  137. return context;
  138. }
  139. catch (GSSException e) {
  140. e.printStackTrace();
  141. return null;
  142. }
  143. }
  144. });
  145.  
  146. if (serviceTicket != null) {
  147. System.out.println("Client obtained service ticket for service : " + servicePrincipalName);
  148. }
  149. else {
  150. System.out.println("Client failed to obtain service ticket for service : " + servicePrincipalName);
  151. System.exit(-1);
  152. }
  153. }
  154. catch (GSSException e) {
  155. e.printStackTrace();
  156. System.exit(-1);
  157. }
  158. }
  159. catch ( IOException e) {
  160. e.printStackTrace();
  161. System.err.println( "Client: There was an IO error");
  162. System.exit( -1);
  163. }
  164. }
  165.  
  166. }
  167.  
  168. realm=EXAMPLE.COM
  169. kdc=10.10.21.28
  170. client.principal.name=user1/user@EXAMPLE.COM
  171. client.password=user1
  172. service.principal.name=user1
  173.  
  174. Client {
  175. com.sun.security.auth.module.Krb5LoginModule required
  176. useKeyTab=true
  177. debug=true
  178. useTicketCache=true
  179. ticketCache="/tmp/krb5cc_0";
  180. };
  181.  
  182. [libdefaults]
  183. default_realm = EXAMPLE.COM
  184. dns_lookup_realm = false
  185. dns_lookup_kdc = true
  186. ticket_lifetime = 24h
  187. forwardable = true
  188. udp_preference_limit = 1000000
  189. default_tkt_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1
  190. default_tgs_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1
  191. permitted_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1
  192.  
  193. [realms]
  194. EXAMPLE.COM = {
  195. kdc = 10.10.21.28
  196. admin_server = 10.10.21.28
  197. default_domain = example.com
  198. }
  199.  
  200. [domain_realm]
  201. .example.com = EXAMPLE.COM
  202. example.com = EXAMPLE.COM
  203.  
  204.  
  205. [logging]
  206. default = FILE:/var/log/krb5libs.log
  207. kdc = FILE:/var/log/krb5kdc.log
  208. admin_server = FILE=/var/log/kadm5.log
  209.  
  210. Debug is true storeKey false useTicketCache true useKeyTab true doNotPrompt false ticketCache is /tmp/krb5cc_0 isInitiator true KeyTab is null refreshKrb5Config is false principal is null tryFirstPass is false useFirstPass is false storePass is false clearPass is false
  211. Acquire TGT from Cache
  212. Principal is null
  213. null credentials from Ticket Cache
  214. Java config name: krb5.ini
  215. Loaded from Java config
  216. Looking for keys for: user1/user@EXAMPLE.COM
  217. Key for the principal user1/user@EXAMPLE.COM not available in default key tab
  218. [Krb5LoginModule] user entered username: user1/user@EXAMPLE.COM
  219.  
  220. >>> KdcAccessibility: reset
  221. default etypes for default_tkt_enctypes: 16.
  222. >>> KrbAsReq creating message
  223. >>> KrbKdcReq send: kdc=10.10.21.28 UDP:88, timeout=30000, number of retries =3, #bytes=138
  224. >>> KDCCommunication: kdc=10.10.21.28 UDP:88, timeout=30000,Attempt =1, #bytes=138
  225. >>> KrbKdcReq send: #bytes read=745
  226. >>> KdcAccessibility: remove 10.10.21.28
  227. >>> EType: sun.security.krb5.internal.crypto.Des3CbcHmacSha1KdEType
  228. >>> KrbAsRep cons in KrbAsReq.getReply user1/user
  229. principal is user1/user@EXAMPLE.COM
  230. Commit Succeeded
  231.  
  232. Found ticket for user1/user@EXAMPLE.COM to go to krbtgt/EXAMPLE.COM@EXAMPLE.COM expiring on Tue Sep 19 14:11:17 CEST 2017
  233. Entered Krb5Context.initSecContext with state=STATE_NEW
  234. Found ticket for user1/user@EXAMPLE.COM to go to krbtgt/EXAMPLE.COM@EXAMPLE.COM expiring on Tue Sep 19 14:11:17 CEST 2017
  235. Service ticket not found in the subject
  236. >>> Credentials acquireServiceCreds: same realm
  237. default etypes for default_tgs_enctypes: 16.
  238. >>> CksumType: sun.security.krb5.internal.crypto.RsaMd5CksumType
  239. >>> EType: sun.security.krb5.internal.crypto.Des3CbcHmacSha1KdEType
  240. >>> KrbKdcReq send: kdc=10.10.21.28 UDP:88, timeout=30000, number of retries =3, #bytes=655
  241. >>> KDCCommunication: kdc=10.10.21.28 UDP:88, timeout=30000,Attempt =1, #bytes=655
  242. >>> KrbKdcReq send: #bytes read=175
  243. >>> KdcAccessibility: remove 10.10.21.28
  244. >>> KDCRep: init() encoding tag is 126 req type is 13
  245. >>>KRBError:
  246. cTime is Mon Nov 17 18:35:19 CET 2031 1952703319000
  247. sTime is Mon Sep 18 14:11:18 CEST 2017 1505736678000
  248. suSec is 62666
  249. error code is 7
  250. error Message is Server not found in Kerberos database
  251. cname is user1/user@EXAMPLE.COM
  252. sname is user1/port-maier@EXAMPLE.COM
  253. msgType is 30
  254. KrbException: Server not found in Kerberos database (7) - LOOKING_UP_SERVER
  255. at sun.security.krb5.KrbTgsRep.<init>(KrbTgsRep.java:73)
  256. at sun.security.krb5.KrbTgsReq.getReply(KrbTgsReq.java:259)
  257. at sun.security.krb5.KrbTgsReq.sendAndGetCreds(KrbTgsReq.java:270)
  258. at sun.security.krb5.internal.CredentialsUtil.serviceCreds(CredentialsUtil.java:302)
  259. at sun.security.krb5.internal.CredentialsUtil.acquireServiceCreds(CredentialsUtil.java:120)
  260. at sun.security.krb5.Credentials.acquireServiceCreds(Credentials.java:458)
  261. at sun.security.jgss.krb5.Krb5Context.initSecContext(Krb5Context.java:693)
  262. at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:248)
  263. at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:179)
  264. at kerby.Clientkdc$1.run(Clientkdc.java:110)
  265. at kerby.Clientkdc$1.run(Clientkdc.java:1)
  266. at java.security.AccessController.doPrivileged(Native Method)
  267. at javax.security.auth.Subject.doAs(Subject.java:360)
  268. at kerby.Clientkdc.initiateSecurityContext(Clientkdc.java:103)
  269. at kerby.Clientkdc.main(Clientkdc.java:53)
  270. Caused by: KrbException: Identifier doesn't match expected value (906)
  271. at sun.security.krb5.internal.KDCRep.init(KDCRep.java:140)
  272. at sun.security.krb5.internal.TGSRep.init(TGSRep.java:65)
  273. at sun.security.krb5.internal.TGSRep.<init>(TGSRep.java:60)
  274. at sun.security.krb5.KrbTgsRep.<init>(KrbTgsRep.java:55)
  275. ... 14 more
  276. GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7) - LOOKING_UP_SERVER)
  277. at sun.security.jgss.krb5.Krb5Context.initSecContext(Krb5Context.java:770)
  278. at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:248)
  279. at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:179)
  280. at kerby.Clientkdc$1.run(Clientkdc.java:110)
  281. at kerby.Clientkdc$1.run(Clientkdc.java:1)
  282. at java.security.AccessController.doPrivileged(Native Method)
  283. at javax.security.auth.Subject.doAs(Subject.java:360)
  284. at kerby.Clientkdc.initiateSecurityContext(Clientkdc.java:103)
  285. at kerby.Clientkdc.main(Clientkdc.java:53)
  286. Caused by: KrbException: Server not found in Kerberos database (7) - LOOKING_UP_SERVER
  287. at sun.security.krb5.KrbTgsRep.<init>(KrbTgsRep.java:73)
  288. at sun.security.krb5.KrbTgsReq.getReply(KrbTgsReq.java:259)
  289. at sun.security.krb5.KrbTgsReq.sendAndGetCreds(KrbTgsReq.java:270)
  290. at sun.security.krb5.internal.CredentialsUtil.serviceCreds(CredentialsUtil.java:302)
  291. at sun.security.krb5.internal.CredentialsUtil.acquireServiceCreds(CredentialsUtil.java:120)
  292. at sun.security.krb5.Credentials.acquireServiceCreds(Credentials.java:458)
  293. at sun.security.jgss.krb5.Krb5Context.initSecContext(Krb5Context.java:693)
  294. ... 8 more
  295. Caused by: KrbException: Identifier doesn't match expected value (906)
  296. at sun.security.krb5.internal.KDCRep.init(KDCRep.java:140)
  297. at sun.security.krb5.internal.TGSRep.init(TGSRep.java:65)
  298. at sun.security.krb5.internal.TGSRep.<init>(TGSRep.java:60)
  299. at sun.security.krb5.KrbTgsRep.<init>(KrbTgsRep.java:55)
  300. ... 14 more
  301. Exception in thread "main" java.lang.NullPointerException
  302. at java.io.ByteArrayInputStream.<init>(ByteArrayInputStream.java:106)
  303. at sun.misc.CharacterEncoder.encode(CharacterEncoder.java:188)
  304. at kerby.Clientkdc.encodeAndWriteTicketToDisk(Clientkdc.java:126)
  305. at kerby.Clientkdc.main(Clientkdc.java:55)
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!