title: Debug Share SSO setup against Keberos AD
body: <p>I am trying to implement SSO for share using Kerberos AD and followed the directions listed in the official documentation at docs.alfresco.com. I keep getting the following exception</p>
  
  <pre><code>2013-06-20 18:07:37,772  DEBUG [app.servlet.KerberosAuthenticationFilter] [http-80-1] Authentication not required (filter), chaining ...
  2013-06-20 18:07:37,804  DEBUG [app.servlet.KerberosAuthenticationFilter] [http-80-1] Authentication not required (filter), chaining ...
  2013-06-20 18:07:37,819  DEBUG [app.servlet.KerberosAuthenticationFilter] [http-80-1] New Kerberos auth request from X.X.X.X (X.X.X.X:ZZZZ) Checksum failed !
  
  2013-06-05 12:02:30,998  WARN  [site.servlet.KerberosSessionSetupPrivilegedAction] [http-80-3] Caught GSS Error
  GSSException: Failure unspecified at GSS-API level (Mechanism level: Checksum failed)
      at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:741)
      at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:323)
      at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:267)
      ....
  
  Caused by: KrbException: Checksum failed
      at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHmacEType.java:85)
      at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHmacEType.java:77)
      at sun.security.krb5.EncryptedData.decrypt(EncryptedData.java:168)
      at sun.security.krb5.KrbApReq.authenticate(KrbApReq.java:268)
      at sun.security.krb5.KrbApReq.&lt;init&gt;(KrbApReq.java:134)
      at sun.security.jgss.krb5.InitSecContextToken.&lt;init&gt;(InitSecContextToken.java:79)
      at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:724)
      ... 21 more
  Caused by: java.security.GeneralSecurityException: Checksum failed
      at sun.security.krb5.internal.crypto.dk.ArcFourCrypto.decrypt(ArcFourCrypto.java:388)
      at sun.security.krb5.internal.crypto.ArcFourHmac.decrypt(ArcFourHmac.java:74)
      at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHmacEType.java:83)
      ... 27 more
  </code></pre>
  
  <p>Here is are the settings the files, the setting and the respective locations. I have turned on the debugging which printed the messages above. Any suggestions to help fix the issue will be greatly appreciated. We are running 4.0.d community on a Windows 2008 machine.</p>
  
  <p><strong>alfresco-global.properties</strong></p>
  
  <pre><code>### Kerberos SSO ###
  kerberos.authentication.realm=LOCAL.COM
  kerberos.authentication.sso.enabled=true
  kerberos.authentication.authenticateCIFS=false
  kerberos.authentication.user.configEntryName=AlfrescoHTTP
  kerberos.authentication.http.configEntryName=AlfrescoHTTP
  #kerberos.authentication.cifs.configEntryName=AlfrescoCIFS
  kerberos.authentication.stripUsernameSuffix=true
  kerberos.authentication.http.password=password
  kerberos.authentication.cifs.password=password
  kerberos.authentication.browser.ticketLogons=true
  kerberos.authentication.defaultAdministratorUserNames=usera
  </code></pre>
  
  <p><strong>share-config-custom.xml</strong></p>
  
  <pre><code>&lt;config evaluator="string-compare" condition="Kerberos" replace="true"&gt;
      &lt;kerberos&gt;
          &lt;password&gt;password&lt;/password&gt;
          &lt;realm&gt;LOCAL.COM&lt;/realm&gt;
          &lt;endpoint-spn&gt;HTTP/domain@LOCAL.COM&lt;/endpoint-spn&gt;
          &lt;config-entry&gt;ShareHTTP&lt;/config-entry&gt;
      &lt;/kerberos&gt;
  &lt;/config&gt;
  
  &lt;config evaluator="string-compare" condition="Remote"&gt;
        &lt;remote&gt;
      &lt;connector&gt;
              &lt;id&gt;alfrescoCookie&lt;/id&gt;
              &lt;name&gt;Alfresco Connector&lt;/name&gt;
              &lt;description&gt;Connects to an Alfresco instance using cookie-based authentication&lt;/description&gt;
              &lt;class&gt;org.springframework.extensions.webscripts.connector.AlfrescoConnector&lt;/class&gt;
           &lt;/connector&gt;
  
       &lt;endpoint&gt;
              &lt;id&gt;alfresco&lt;/id&gt;
              &lt;name&gt;Alfresco - user access&lt;/name&gt;
              &lt;description&gt;Access to Alfresco Repository WebScripts that require user authentication&lt;/description&gt;
              &lt;connector-id&gt;alfrescoCookie&lt;/connector-id&gt;
              &lt;endpoint-url&gt;http://localhost:80/alfresco/wcs&lt;/endpoint-url&gt;
              &lt;identity&gt;user&lt;/identity&gt;
              &lt;external-auth&gt;true&lt;/external-auth&gt;
           &lt;/endpoint&gt;
        &lt;/remote&gt;
  &lt;/config&gt;
  </code></pre>
  
  <p><strong>java.login.config</strong> at C:\Alfresco\java\jre\lib\security == as described in the documentation but changing the keyTab location to C:/etc/alfresco.keytab</p>
  
  <p>Also modified <strong>java.security</strong> at C:\Alfresco\java\jre\lib\security to point to java.login.config</p>
  
  <p><strong>krb5.ini</strong> at (C:\Windows)</p>
  
  <pre><code>[libdefaults]
   default_realm = LOCAL.COM
   default_tkt_enctypes = rc4-hmac
   default_tgs_enctypes = rc4-hmac 
  
  [realms]
   LOCAL.COM = {
    kdc = machine.local.com
    admin_server = machine.local.com
   }
  
  [domain_realm]
   machine.local.com = LOCAL.COM
   .machine.local.com = LOCAL.COM
  </code></pre>
  
  <p>Any suggestions on how to debug will be greatly appreciated; thank you very much.</p>