<html><body><div style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000"><div data-marker="__QUOTED_TEXT__"><div style="color: #000000; font-family: arial,helvetica,sans-serif; font-size: 12pt;" data-mce-style="color: #000000; font-family: arial,helvetica,sans-serif; font-size: 12pt;"><div>Hi, I'm trying to help a Weblogic admin trying to enable SSO using IPA as a backend in AD trust, and I'm not anywhere near a Java or Weblogic man.<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>The ticket looks OK, and I can kinit it.<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>Klist shows:<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div># klist -ke sso.keytab <br>Keytab name: FILE:sso.keytab<br>KVNO Principal<br>---- --------------------------------------------------------------------------<br> 3 HTTP/ssotst01pack.lx.dr.dk@LX.DR.DK (aes256-cts-hmac-sha1-96) <br> 3 HTTP/ssotst01pack.lx.dr.dk@LX.DR.DK (aes128-cts-hmac-sha1-96) <br> 3 HTTP/ssotst01pack.lx.dr.dk@LX.DR.DK (des3-cbc-sha1) <br> 3 HTTP/ssotst01pack.lx.dr.dk@LX.DR.DK (arcfour-hmac)</div><div><br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>Ticket is exported without the need for pre-auth.<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>I have made a pretty basic krb5.conf for use with Weblogic:<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div> [libdefaults]<br> default_realm = LX.DR.DK<br> permitted_enctypes = aes256-cts-hmac-sha1-96 aes256-cts <br> default_tgs_enctypes = aes256-cts-hmac-sha1-96 aes256-cts <br> default_tkt_enctypes = aes256-cts-hmac-sha1-96 aes256-cts <br> dns_lookup_realm = false<br> dns_lookup_kdc = false<br> noaddresses = true<br> [realms]<br> LX.DR.DK = {<br> kdc = ipa01.lx.dr.dk<br> }<br> [domain_realm]<br> .lx.dr.dk = LX.DR.DK<br> lx.dr.dk = LX.DR.DK</div><div><br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>When trying to authenticate on web-ui I see:<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>krb5kdc.log on IPA server shows:<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>Feb 27 11:06:44 ipa01.lx.dr.dk krb5kdc[3349](info): AS_REQ (2 etypes {18 18}) 10.80.17.50: ISSUE: authtime 1488190004, etypes {rep=18 tkt=18 ses=18}, HTTP/ssotst01pack.lx.dr.dk@LX.DR.DK for krbtgt/LX.DR.DK@LX.DR.DK<br>Feb 27 11:06:44 ipa01.lx.dr.dk krb5kdc[3349](info): AS_REQ (2 etypes {18 18}) 10.80.17.50: ISSUE: authtime 1488190004, etypes {rep=18 tkt=18 ses=18}, HTTP/ssotst01pack.lx.dr.dk@LX.DR.DK for krbtgt/LX.DR.DK@LX.DR.DK<br>Feb 27 11:06:44 ipa01.lx.dr.dk krb5kdc[3353](info): AS_REQ (2 etypes {18 18}) 10.80.17.50: ISSUE: authtime 1488190004, etypes {rep=18 tkt=18 ses=18}, HTTP/ssotst01pack.lx.dr.dk@LX.DR.DK for krbtgt/LX.DR.DK@LX.DR.DK<br>Feb 27 11:06:44 ipa01.lx.dr.dk krb5kdc[3353](info): AS_REQ (2 etypes {18 18}) 10.80.17.50: ISSUE: authtime 1488190004, etypes {rep=18 tkt=18 ses=18}, HTTP/ssotst01pack.lx.dr.dk@LX.DR.DK for krbtgt/LX.DR.DK@LX.DR.DK<br>Feb 27 11:06:44 ipa01.lx.dr.dk krb5kdc[3353](info): AS_REQ (2 etypes {18 18}) 10.80.17.50: ISSUE: authtime 1488190004, etypes {rep=18 tkt=18 ses=18}, HTTP/ssotst01pack.lx.dr.dk@LX.DR.DK for krbtgt/LX.DR.DK@LX.DR.DK</div><div><br></div><div>Java shows:<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>[2017-02-22T14:17:06.666+01:00] [oam_server1] [ERROR] [] [oracle.oam.engine.authn] [tid: [ACTIVE].ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: <anonymous>] [ecid: 236b75b1bd93b747:4e356648:15a65f5a492:-8000-00000000000000db,0] [APP: oam_server#11.1.2.0.0] Failure unspecified at GSS-API level (Mechanism level: Specified version of key is not available (44))[[<br>GSSException: Failure unspecified at GSS-API level (Mechanism level: Specified version of key is not available (44))</div><div><br data-mce-bogus="1"></div><div>(Not same time, I know. Log files from different days).<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>From what I can see on the krb5 log it tries to make 5 auth requests, but fails with "Specified version of key is not available", however, they are.... I have already verified this and tried exporting new ones just to make sure.<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>The unlimited encryption package have been added to Java.<br></div><div><br></div><div>Does these errors mean anything for some expert on this list, as i'm starting to run out of ideas...... <br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>-- <br></div><div><p style="margin: 5px 0px 0px; font-family: arial,verdana,sans-serif; font-size: 12px;" data-mce-style="margin: 5px 0px 0px; font-family: arial,verdana,sans-serif; font-size: 12px;">Med venlig hilsen</p><p style="margin: 10px 0px 0px; font-family: arial,verdana,sans-serif; font-size: 14px;" data-mce-style="margin: 10px 0px 0px; font-family: arial,verdana,sans-serif; font-size: 14px;"><b>Troels Hansen</b></p><p style="margin: 3px 0px 0px; font-family: arial,verdana,sans-serif; font-size: 12px;" data-mce-style="margin: 3px 0px 0px; font-family: arial,verdana,sans-serif; font-size: 12px;">Systemkonsulent</p><p style="margin: 4px 2px 0px 0px; color: #4c4c4c; font-family: arial,verdana,sans-serif; font-size: 14px; font-weight: bold;" data-mce-style="margin: 4px 2px 0px 0px; color: #4c4c4c; font-family: arial,verdana,sans-serif; font-size: 14px; font-weight: bold;">Casalogic A/S</p><div><img saveddisplaymode="" src="http://www.casalogic.dk/signatur/casalogic_green_spacer_line.png" data-mce-src="http://www.casalogic.dk/signatur/casalogic_green_spacer_line.png" border="0"></div><p style="margin: 5px 0px 0px; font-family: arial,verdana,sans-serif; font-size: 12px;" data-mce-style="margin: 5px 0px 0px; font-family: arial,verdana,sans-serif; font-size: 12px;">T (+45) 70 20 10 63</p><p style="margin: 5px 0px 0px; font-family: arial,verdana,sans-serif; font-size: 12px;" data-mce-style="margin: 5px 0px 0px; font-family: arial,verdana,sans-serif; font-size: 12px;">M (+45) 22 43 71 57</p><div><a title="Download vCard" href="http://www.casalogic.dk/signatur/th.vcf" target="_blank" data-mce-href="http://www.casalogic.dk/signatur/th.vcf"><img saveddisplaymode="" src="http://www.casalogic.dk/signatur/vcard_download_small.png" data-mce-src="http://www.casalogic.dk/signatur/vcard_download_small.png" border="0"></a> <a title="Follow us on LinkedIn" href="http://www.linkedin.com/company/67524" target="_blank" data-mce-href="http://www.linkedin.com/company/67524"><img saveddisplaymode="" src="http://www.casalogic.dk/signatur/linkedin_logo_20x20.png" data-mce-src="http://www.casalogic.dk/signatur/linkedin_logo_20x20.png" border="0"></a> <a title="Follow us on Twitter" href="http://twitter.com/casalogic" target="_blank" data-mce-href="http://twitter.com/casalogic"><img saveddisplaymode="" src="http://www.casalogic.dk/signatur/twitter_logo_20x20.png" data-mce-src="http://www.casalogic.dk/signatur/twitter_logo_20x20.png" border="0"></a><br></div><div>Red Hat, SUSE, VMware, Citrix, Novell, Yellowfin BI, EnterpriseDB, Sophos og meget mere.<br></div></div></div><br></div></div></body></html>