title: Configuring Tomcat SSO using Kerberos SPNEGO
body: <p>I am trying to configure SSO in Tomcat 9 (with SDK 8) using Kerberos. My environment is all in Windows Server 2016 VMs: 
      -</p>
  
  <ul>
  <li>server2016.forestgump.internal       192.168.44.130 - Active Directory</li>
  <li>windowstomcat.forestgump.internal    192.168.44.135 - Tomcat v9, SDK 8</li>
  <li>WIN-MN3G5OM9U4Q.forestgump.internal  192.168.44.140 - Just client</li>
  </ul>
  
  <p>I went through many tutorials (all slightly different) but still I cannot get my web page, 401 is always waiting for me.</p>
  
  <p>The domain in AD is "FORESTGUMP.INTERNAL" (yeah.. no mistake in spelling forest with a single 'R', just a made-up name at 2am). I created 2 users in this domain </p>
  
  <ul>
  <li>tomcat (technical user, used to log into windowstomcat.forestgump.internal tomcat server). This user has some additional configuration: Password never expires = true, User cannot change password = true, his account supports Kerberos AES128, This account supports Kerberos AES256, Trust this user for delegation to any service (Kerberos only)</li>
  <li>mario (user to log into the domain in the client machine)</li>
  </ul>
  
  <p>I mapped SPN to tomcat user:</p>
  
  <pre><code>setspn -l forestgump.internal\tomcat
          Registered ServicePrincipalNames for CN=tomcat,CN=Users,DC=forestgump,DC=internal:
          HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL
          HTTP/windowstomcat@FORESTGUMP.INTERNAL
          HTTP/windowstomcat
          HTTP/windowstomcat.forestgump.internal
  </code></pre>
  
  <p>I then generated a keytab file:</p>
  
  <pre><code>ktpass /out c:\tomcat.keytab /mapuser TOMCAT@FORESTGUMP.INTERNAL /princ HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL /pass Passw0rd! /kvno 0 -crypto ALL -ptype KRB5_NT_PRINCIPAL
  </code></pre>
  
  <p>And copied this tomcat.keytab the Tomcat server ./tomcat-9/conf and added spnego-r9.jar in c.\tomcat-9\lib</p>
  
  <p>In the tomcat server I created the file ./tomcat-9/conf/krb5.ini</p>
  
  <pre><code>    [libdefaults]
  default_realm = FORESTGUMP.INTERNAL
  default_keytab_name = "C:\opt\tomcat-9\conf\tomcat.keytab"
  default_tkt_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96
  default_tgs_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96
  forwardable=true
  
  [realms]
  forestgump.internal = {
          kdc = server2016.forestgump.internal:88
  }
  
  [domain_realm]
  forestgump.internal= FORESTGUMP.INTERNAL
  .forestgump.internal= FORESTGUMP.INTERNAL
  </code></pre>
  
  <p>and I created the file ./tomcat-9/conf/jass.conf</p>
  
  <pre><code>com.sun.security.jgss.krb5.initiate {
  com.sun.security.auth.module.Krb5LoginModule required
  doNotPrompt=true
  principal="HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL"
  keyTab="c:/opt/tomcat-9/conf/tomcat.keytab"
  useKeyTab=true
  storeKey=true;
  debug=true;
  };
  com.sun.security.jgss.krb5.accept {
  com.sun.security.auth.module.Krb5LoginModule required
  doNotPrompt=true
  principal="HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL"
  keyTab="c:/opt/tomcat-9/conf/tomcat.keytab"
  useKeyTab=true
  storeKey=true;
  debug=true;
  };
  </code></pre>
  
  <p>So far it was pretty consistent in all the tutorials I found. From now on, far west and my lack of knowledge on tomcat and java development didn't help me.
  I changed the default tomcat-9/conf/server.xml adding a Realm for the AD LDAP</p>
  
  <pre><code>      &lt;Realm className="org.apache.catalina.realm.LockOutRealm"&gt;
        &lt;!-- This Realm uses the UserDatabase configured in the global JNDI
           resources under the key "UserDatabase".  Any edits
           that are performed against this UserDatabase are immediately
           available for use by the Realm.  --&gt;
        &lt;Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase" /&gt;
  
        &lt;Realm className="org.apache.catalina.realm.JNDIRealm" connectionURL="ldap://server2016.forestgump.internal:389" authentication="simple" referrals="follow" connectionName="CN=tomcat,CN=Users,DC=forestgump,DC=internal" connectionPassword="Passw0rd!" userSearch="(sAMAccountName={0})" userBase="CN=Users,DC=forestgump,DC=internal" userSubtree="true" roleSearch="(member={0})" roleName="cn" roleSubtree="true" roleBase="cn=Builtin,DC=forestgump,DC=internal" /&gt;
        &lt;/Realm&gt;
  </code></pre>
  
  <p>I tested the LDAP condiguration with Jxplorer and I can connect to my AD. Not sure if this is necessary at all, only 20% of the tutorials I found mentioned this.</p>
  
  <p>Then I created a simple webapp to test the configuration. The web application has this structure:</p>
  
  <ul>
  <li>TomcatHelloWorld
  
  <ul>
  <li>index.jsp</li>
  <li>web-inf
  
  <ul>
  <li>web.xml</li>
  </ul></li>
  <li>meta-inf
  
  <ul>
  <li>context.xml</li>
  </ul></li>
  </ul></li>
  </ul>
  
  <p>Here files' content</p>
  
  <p>index.jsp</p>
  
  <pre><code>&lt;html&gt;
  &lt;head&gt;
  &lt;meta http-equiv="Content-Type" content="text/html; charset=UTF-8"&gt;
  &lt;title&gt;AUTH test&lt;/title&gt;
  &lt;/head&gt;
  &lt;body&gt;
  &lt;h1&gt;Hello World!&lt;/h1&gt;
  &lt;p&gt;auth type: &lt;%=request.getAuthType()%&gt; &lt;/p&gt;
  &lt;p&gt;remote user: &lt;%=request.getRemoteUser() %&gt; &lt;/p&gt;
  &lt;p&gt;principal: &lt;%=request.getUserPrincipal() %&gt;&lt;/p&gt;
  &lt;p&gt;name: &lt;%= (request.getUserPrincipal()!=null)?request.getUserPrincipal().getName():"NO PRINCIPAL" %&gt;&lt;/p&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>web.xml</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="ISO-8859-1"?&gt;
  &lt;web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
      version="4.0"
      metadata-complete="true"&gt;
  
      &lt;welcome-file-list&gt;
          &lt;welcome-file&gt;index.jsp&lt;/welcome-file&gt;
      &lt;/welcome-file-list&gt;
  
      &lt;security-constraint&gt;
          &lt;web-resource-collection&gt;
              &lt;web-resource-name&gt;Web Resource - Allow GET method&lt;/web-resource-name&gt;
  
              &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  
              &lt;http-method&gt;GET&lt;/http-method&gt;
          &lt;/web-resource-collection&gt;
  
          &lt;auth-constraint&gt;
              &lt;role-name&gt;CN=Users,DC=forestgump,DC=internal&lt;/role-name&gt;
          &lt;/auth-constraint&gt;
      &lt;/security-constraint&gt;
  
      &lt;security-role&gt;
          &lt;role-name&gt;CN=Users,DC=forestgump,DC=internal&lt;/role-name&gt;
      &lt;/security-role&gt;
  
      &lt;login-config&gt;
          &lt;auth-method&gt;SPNEGO&lt;/auth-method&gt;
          &lt;realm-name&gt;FORESTGUMP.INTERNAL&lt;/realm-name&gt;
      &lt;/login-config&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p>context.xml</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;Context antiJARLocking="true" path="/spnego"&gt;
  &lt;!-- valve will be explicitly created when SPNEGO is used,
   this is to declare additional attributes --&gt;
    &lt;Valve className="org.apache.catalina.authenticator.SpnegoAuthenticator" 
    alwaysUseSession="true" cache="true"  /&gt;
  &lt;/Context&gt;
  </code></pre>
  
  <p>In the client vm I used IE, Firefox (configured network.negotiate-auth.delegation-uris = windowstomcat.forestgump.internal and network.negotiate-auth.gsslib = windowstomcat.forestgump.internal) and a Kerberos Authentication Client ( <a href="http://blog.michelbarneveld.nl/michel/archive/2009/12/05/kerberos-authentication-tester.aspx" rel="nofollow noreferrer">http://blog.michelbarneveld.nl/michel/archive/2009/12/05/kerberos-authentication-tester.aspx</a>)</p>
  
  <p>Result always 401 from browser and 500 from the Kerberos tester.</p>
  
  <p>What is really frustrating is that I cannot see any error in tomcat or in AD. In tomcat I even added debug statement at startup (set CATALINA_OPTS= -Dsun.security.krb5.debug=true -Dsun.security.jgss.debug=true -Dsun.security.spnego.debug=true).</p>
  
  <p>catalina.log is superclean
  localhost.log has a couple of exceptions (when I test with Kerberos client and get 500)</p>
  
  <pre><code>08-May-2020 14:51:46.294 SEVERE [http-nio-8080-exec-4] org.apache.catalina.core.StandardHostValve.invoke Exception Processing /TomcatHelloWorld/
      java.lang.SecurityException: java.io.IOException: Configuration Error:
      Line 8: expected [controlFlag]
          at sun.security.provider.ConfigFile$Spi.&lt;init&gt;(ConfigFile.java:137)
          at sun.security.provider.ConfigFile.&lt;init&gt;(ConfigFile.java:102)
          at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
          at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
          at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
          at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
          at java.lang.Class.newInstance(Class.java:442)
          at javax.security.auth.login.Configuration$2.run(Configuration.java:255)
          at javax.security.auth.login.Configuration$2.run(Configuration.java:247)
          at java.security.AccessController.doPrivileged(Native Method)
          at javax.security.auth.login.Configuration.getConfiguration(Configuration.java:246)
          at javax.security.auth.login.LoginContext$1.run(LoginContext.java:245)
          at javax.security.auth.login.LoginContext$1.run(LoginContext.java:243)
          at java.security.AccessController.doPrivileged(Native Method)
          at javax.security.auth.login.LoginContext.init(LoginContext.java:243)
          at javax.security.auth.login.LoginContext.&lt;init&gt;(LoginContext.java:348)
          at org.apache.catalina.authenticator.SpnegoAuthenticator.doAuthenticate(SpnegoAuthenticator.java:196)
          at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:631)
          at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)
          at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
          at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:690)
          at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
          at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
          at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:373)
          at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
          at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868)
          at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1590)
          at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
          at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
          at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
          at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
          at java.lang.Thread.run(Thread.java:748)
      Caused by: java.io.IOException: Configuration Error:
      Line 8: expected [controlFlag]
          at sun.security.provider.ConfigFile$Spi.ioException(ConfigFile.java:666)
          at sun.security.provider.ConfigFile$Spi.match(ConfigFile.java:572)
          at sun.security.provider.ConfigFile$Spi.parseLoginEntry(ConfigFile.java:454)
          at sun.security.provider.ConfigFile$Spi.readConfig(ConfigFile.java:427)
          at sun.security.provider.ConfigFile$Spi.init(ConfigFile.java:329)
          at sun.security.provider.ConfigFile$Spi.init(ConfigFile.java:271)
          at sun.security.provider.ConfigFile$Spi.&lt;init&gt;(ConfigFile.java:135)
          ... 31 more
  </code></pre>
  
  <p>This is definitely related to my webapp, but I can't identify what is causing the error.</p>
  
  <p>Any help would greatly help my mental sanity.
  Cheers.</p>
  
  <p>After the suggestion to remove the semicolon in the configuration file, I moved on and now getting some interesting exceptions:</p>
  
  <pre><code>11-May-2020 14:38:55.976 INFO [main] org.apache.catalina.startup.Catalina.start Server startup in [897] milliseconds
  Debug is  true storeKey true useTicketCache false useKeyTab true doNotPrompt true ticketCache is null isInitiator true KeyTab is c:/opt/tomcat-9/conf/tomcat.keytab refreshKrb5Config is false principal is HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL tryFirstPass is false useFirstPass is false storePass is false clearPass is false
  &gt;&gt;&gt; KeyTabInputStream, readName(): FORESTGUMP.INTERNAL
  &gt;&gt;&gt; KeyTabInputStream, readName(): HTTP
  &gt;&gt;&gt; KeyTabInputStream, readName(): windowstomcat.forestgump.internal
  &gt;&gt;&gt; KeyTab: load() entry length: 85; type: 1
  &gt;&gt;&gt; KeyTabInputStream, readName(): FORESTGUMP.INTERNAL
  &gt;&gt;&gt; KeyTabInputStream, readName(): HTTP
  &gt;&gt;&gt; KeyTabInputStream, readName(): windowstomcat.forestgump.internal
  &gt;&gt;&gt; KeyTab: load() entry length: 85; type: 3
  &gt;&gt;&gt; KeyTabInputStream, readName(): FORESTGUMP.INTERNAL
  &gt;&gt;&gt; KeyTabInputStream, readName(): HTTP
  &gt;&gt;&gt; KeyTabInputStream, readName(): windowstomcat.forestgump.internal
  &gt;&gt;&gt; KeyTab: load() entry length: 93; type: 23
  &gt;&gt;&gt; KeyTabInputStream, readName(): FORESTGUMP.INTERNAL
  &gt;&gt;&gt; KeyTabInputStream, readName(): HTTP
  &gt;&gt;&gt; KeyTabInputStream, readName(): windowstomcat.forestgump.internal
  &gt;&gt;&gt; KeyTab: load() entry length: 109; type: 18
  &gt;&gt;&gt; KeyTabInputStream, readName(): FORESTGUMP.INTERNAL
  &gt;&gt;&gt; KeyTabInputStream, readName(): HTTP
  &gt;&gt;&gt; KeyTabInputStream, readName(): windowstomcat.forestgump.internal
  &gt;&gt;&gt; KeyTab: load() entry length: 93; type: 17
  Looking for keys for: HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL
  Java config name: C:\opt\tomcat-9\conf\krb5.ini
  Loaded from Java config
  Added key: 17version: 0
  Added key: 18version: 0
  Added key: 23version: 0
  Found unsupported keytype (3) for HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL
  Found unsupported keytype (1) for HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL
  &gt;&gt;&gt; KdcAccessibility: reset
  Looking for keys for: HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL
  Added key: 17version: 0
  Added key: 18version: 0
  Added key: 23version: 0
  Found unsupported keytype (3) for HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL
  Found unsupported keytype (1) for HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL
  default etypes for default_tkt_enctypes: 23 18 17.
  &gt;&gt;&gt; KrbAsReq creating message
  getKDCFromDNS using UDP
  &gt;&gt;&gt; KrbKdcReq send: kdc=server2016.forestgump.internal. UDP:88, timeout=30000, number of retries =3, #bytes=190
  &gt;&gt;&gt; KDCCommunication: kdc=server2016.forestgump.internal. UDP:88, timeout=30000,Attempt =1, #bytes=190
  &gt;&gt;&gt; KrbKdcReq send: #bytes read=238
  &gt;&gt;&gt;Pre-Authentication Data:
           PA-DATA type = 19
           PA-ETYPE-INFO2 etype = 18, salt = FORESTGUMP.INTERNALHTTPwindowstomcat.forestgump.internal, s2kparams = null
           PA-ETYPE-INFO2 etype = 23, salt = null, s2kparams = null
  
  &gt;&gt;&gt;Pre-Authentication Data:
           PA-DATA type = 2
           PA-ENC-TIMESTAMP
  &gt;&gt;&gt;Pre-Authentication Data:
           PA-DATA type = 16
  
  &gt;&gt;&gt;Pre-Authentication Data:
           PA-DATA type = 15
  
  &gt;&gt;&gt; KdcAccessibility: remove server2016.forestgump.internal.:88
  &gt;&gt;&gt; KDCRep: init() encoding tag is 126 req type is 11
  &gt;&gt;&gt;KRBError:
           sTime is Mon May 11 14:39:04 NZST 2020 1589164744000
           suSec is 480933
           error code is 25
           error Message is Additional pre-authentication required
           sname is krbtgt/FORESTGUMP.INTERNAL@FORESTGUMP.INTERNAL
           eData provided.
           msgType is 30
  &gt;&gt;&gt;Pre-Authentication Data:
           PA-DATA type = 19
           PA-ETYPE-INFO2 etype = 18, salt = FORESTGUMP.INTERNALHTTPwindowstomcat.forestgump.internal, s2kparams = null
           PA-ETYPE-INFO2 etype = 23, salt = null, s2kparams = null
  
  &gt;&gt;&gt;Pre-Authentication Data:
           PA-DATA type = 2
           PA-ENC-TIMESTAMP
  &gt;&gt;&gt;Pre-Authentication Data:
           PA-DATA type = 16
  
  &gt;&gt;&gt;Pre-Authentication Data:
           PA-DATA type = 15
  
  KrbAsReqBuilder: PREAUTH FAILED/REQ, re-send AS-REQ
  default etypes for default_tkt_enctypes: 23 18 17.
  Looking for keys for: HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL
  Added key: 17version: 0
  Added key: 18version: 0
  Added key: 23version: 0
  Found unsupported keytype (3) for HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL
  Found unsupported keytype (1) for HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL
  Looking for keys for: HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL
  Added key: 17version: 0
  Added key: 18version: 0
  Added key: 23version: 0
  Found unsupported keytype (3) for HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL
  Found unsupported keytype (1) for HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL
  default etypes for default_tkt_enctypes: 23 18 17.
  &gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType
  &gt;&gt;&gt; KrbAsReq creating message
  getKDCFromDNS using UDP
  &gt;&gt;&gt; KrbKdcReq send: kdc=server2016.forestgump.internal. UDP:88, timeout=30000, number of retries =3, #bytes=279
  &gt;&gt;&gt; KDCCommunication: kdc=server2016.forestgump.internal. UDP:88, timeout=30000,Attempt =1, #bytes=279
  &gt;&gt;&gt; KrbKdcReq send: #bytes read=110
  &gt;&gt;&gt; KrbKdcReq send: kdc=server2016.forestgump.internal. TCP:88, timeout=30000, number of retries =3, #bytes=279
  &gt;&gt;&gt; KDCCommunication: kdc=server2016.forestgump.internal. TCP:88, timeout=30000,Attempt =1, #bytes=279
  &gt;&gt;&gt;DEBUG: TCPClient reading 1694 bytes
  &gt;&gt;&gt; KrbKdcReq send: #bytes read=1694
  &gt;&gt;&gt; KdcAccessibility: remove server2016.forestgump.internal.:88
  Looking for keys for: HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL
  Added key: 17version: 0
  Added key: 18version: 0
  Added key: 23version: 0
  Found unsupported keytype (3) for HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL
  Found unsupported keytype (1) for HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL
  &gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType
  &gt;&gt;&gt; KrbAsRep cons in KrbAsReq.getReply HTTP/windowstomcat.forestgump.internal
  principal is HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL
  Will use keytab
  Commit Succeeded
  
  Search Subject for SPNEGO ACCEPT cred (&lt;&lt;DEF&gt;&gt;, sun.security.jgss.spnego.SpNegoCredElement)
  Search Subject for Kerberos V5 ACCEPT cred (&lt;&lt;DEF&gt;&gt;, sun.security.jgss.krb5.Krb5AcceptCredential)
  Found KeyTab c:\opt\tomcat-9\conf\tomcat.keytab for HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL
  Found KeyTab c:\opt\tomcat-9\conf\tomcat.keytab for HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL
  Found ticket for HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL to go to krbtgt/FORESTGUMP.INTERNAL@FORESTGUMP.INTERNAL expiring on Tue May 12 00:39:04 NZST 2020
  Entered SpNegoContext.acceptSecContext with state=STATE_NEW
  SpNegoContext.acceptSecContext: receiving token = a0 8..
  SpNegoToken NegTokenInit: reading Mechanism Oid = 1.2.840.113554.1.2.2
  SpNegoToken NegTokenInit: reading Mechanism Oid = 1.2.840.48018.1.2.2
  SpNegoToken NegTokenInit: reading Mechanism Oid = 1.3.6.1.4.1.311.2.2.30
  SpNegoToken NegTokenInit: reading Mechanism Oid = 1.3.6.1.4.1.311.2.2.10
  SpNegoToken NegTokenInit: reading Mech Token
  SpNegoContext.acceptSecContext: received token of type = SPNEGO NegTokenInit
  SpNegoContext: negotiated mechanism = 1.2.840.113554.1.2.2
  Entered Krb5Context.acceptSecContext with state=STATE_NEW
  Looking for keys for: HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL
  Added key: 17version: 0
  Added key: 18version: 0
  Added key: 23version: 0
  Found unsupported keytype (3) for HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL
  Found unsupported keytype (1) for HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL
  &gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType
  Using builtin default etypes for permitted_enctypes
  default etypes for permitted_enctypes: 18 17 16 23.
  &gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType
  MemoryCache: add 1589164744/000073/52EB3DFA8A4B8EADDCE4B0019A0968EE/Administrator@FORESTGUMP.INTERNAL to Administrator@FORESTGUMP.INTERNAL|HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL
  &gt;&gt;&gt; KrbApReq: authenticate succeed.
  &gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType
  &gt;&gt;&gt;Delegated Creds have pname=Administrator@FORESTGUMP.INTERNAL sname=krbtgt/FORESTGUMP.INTERNAL@FORESTGUMP.INTERNAL authtime=null starttime=20200511023904Z endtime=20200511123904ZrenewTill=20200518023904Z
  Krb5Context setting peerSeqNumber to: 1464367068
  &gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType
  Krb5Context setting mySeqNumber to: 206741889
  ...
  Search Subject for Kerberos V5 INIT cred (&lt;&lt;DEF&gt;&gt;, sun.security.jgss.krb5.Krb5InitCredential)
  Found ticket for HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL to go to krbtgt/FORESTGUMP.INTERNAL@FORESTGUMP.INTERNAL expiring on Tue May 12 00:39:04 NZST 2020
  Entered Krb5Context.initSecContext with state=STATE_NEW
  Found ticket for HTTP/windowstomcat.forestgump.internal@FORESTGUMP.INTERNAL to go to krbtgt/FORESTGUMP.INTERNAL@FORESTGUMP.INTERNAL expiring on Tue May 12 00:39:04 NZST 2020
  Service ticket not found in the subject
  &gt;&gt;&gt; Credentials acquireServiceCreds: same realm
  default etypes for default_tgs_enctypes: 23 18 17.
  &gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.ArcFourHmacEType
  &gt;&gt;&gt; CksumType: sun.security.krb5.internal.crypto.HmacMd5ArcFourCksumType
  &gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.ArcFourHmacEType
  getKDCFromDNS using UDP
  &gt;&gt;&gt; KrbKdcReq send: kdc=server2016.forestgump.internal. TCP:88, timeout=30000, number of retries =3, #bytes=1622
  &gt;&gt;&gt; KDCCommunication: kdc=server2016.forestgump.internal. TCP:88, timeout=30000,Attempt =1, #bytes=1622
  &gt;&gt;&gt;DEBUG: TCPClient reading 1598 bytes
  &gt;&gt;&gt; KrbKdcReq send: #bytes read=1598
  &gt;&gt;&gt; KdcAccessibility: remove server2016.forestgump.internal.:88
  &gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.ArcFourHmacEType
  &gt;&gt;&gt; KrbApReq: APOptions are 00100000 00000000 00000000 00000000
  &gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.ArcFourHmacEType
  Krb5Context setting mySeqNumber to: 905416011
  Created InitSecContextToken:
  0000: 01 00 6E 82 05 DF 30 82   05 DB A0 03 02 01 05 A1  ..n...0.........
  .....
  05D0: BE 28 08 00 6F FC 45 DC   0D 90 93 E9 60 46 CC 81  .(..o.E.....`F..
  05E0: 51 D8 99 06 16                                     Q....
  
  Entered Krb5Context.initSecContext with state=STATE_IN_PROCESS
  &gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.ArcFourHmacEType
  Krb5Context setting peerSeqNumber to: 1474518462
                  [Krb5LoginModule]: Entering logout
                  [Krb5LoginModule]: logged out Subject
  </code></pre>
  
  <p>I added 256 support in Kerberos Server:</p>
  
  <pre><code>ksetup /setenctypeattr FQDN&gt;forestgump.internal RC4-HMAC-MD5 AES128-CTS-HMAC-SHA1-96 AES256-CTS-HMAC-SHA1-96
  </code></pre>
  
  <p>and users accounts (tomcat and mario) have support for Kerberos 128/256 bit encryption.</p>
  
  <p>Can't pinpoint the configuration error</p>