title: Single Sign On with weblogic 12c using Kerberoes ( Active Directory and LDAP)
body: <p>I have been trying this since last week but no luck so far.
  Trying to enable SSO using the weblogic12c on windows and AD (using LDAP)</p>
  
  <p>1) Created a brand new user , enabled AES 128 for him
  2) Executed the following commands on AD</p>
  
  <p>setspn -S HTTP/APPDEV2004.domain.com http_weblogic_test</p>
  
  <p>verified the output using the command 
  setspn -l http_weblogic_test
  the output is 
  HTTP/APPDEV2004.domain.com
  HTTP/APPDEV2004</p>
  
  <p>ktpass /out c:\http_weblogic_test.keytab /mapuser http_weblogic_test /princ HTTP/APPDEV2004.domain.com@DOMAIN.COM /pass  /ptype KRB5_NT_PRINCIPAL /crypto All</p>
  
  <p>Now when using the Kinit to verify that the Kerberos ticket is getting generated correctly, It always fails with the exception 
  java -Dsun.security.krb5.debug=true 
  -Djava.security.krb5.conf=c:\windows\krb5.ini sun.security.krb5.internal.tools.Kinit -k
   -t C:\opt\http_weblogic_test.keytab</p>
  
  <pre><code>Exception: krb_error 24 Pre-authentication information was invalid (24) Pre- 
  authentication information was invalid
  KrbException: Pre-authentication information was invalid (24)
      at sun.security.krb5.KrbAsRep.&lt;init&gt;(KrbAsRep.java:76)
      at sun.security.krb5.KrbAsReqBuilder.send(KrbAsReqBuilder.java:316)
      at sun.security.krb5.KrbAsReqBuilder.action(KrbAsReqBuilder.java:361)
      at sun.security.krb5.internal.tools.Kinit.&lt;init&gt;(Kinit.java:219)
      at sun.security.krb5.internal.tools.Kinit.main(Kinit.java:113)
  Caused by: KrbException: Identifier doesn't match expected value (906)
      at sun.security.krb5.internal.KDCRep.init(KDCRep.java:140)
      at sun.security.krb5.internal.ASRep.init(ASRep.java:64)
      at sun.security.krb5.internal.ASRep.&lt;init&gt;(ASRep.java:59)
      at sun.security.krb5.KrbAsRep.&lt;init&gt;(KrbAsRep.java:60)
      ... 4 more
  </code></pre>
  
  <p>However it works perfectly fine when I supply the password from the commandline instead of using the keytab file
  java -Dsun.security.krb5.debug=true 
  -Djava.security.krb5.conf=c:\windows\krb5.ini sun.security.krb5.internal.tools.Kinit</p>
  
  <blockquote>
    <blockquote>
      <blockquote>
        <p>KinitOptions cache name is D:\Users\ayadav\krb5cc_ayadav
        KinitOptions principal name from the cache is :http_weblogic_test@DOAMIN.COM</p>
      </blockquote>
    </blockquote>
  </blockquote>
  
  <p>Principal is http_weblogic_test@DOMAIN.COM
  Password for http_weblogic_test@DOMAIN.COM:
  After entering the passowrd it goes through a series of steps and finally says 
  New ticket is stored in cache file D:\Users\ayadav\krb5cc_ayadav, which I assume is a sign of successful ticket generation, however I am struggling to utilize the keytab file but need to get rid of the  Pre-authentication information was invalid (24).</p>
  
  <p>Update I also used the KTab commmand to generate the keytab file and use that however I am still getting the exception.</p>
  
  <pre><code>java sun.security.krb5.internal.tools.Ktab
  -a http_weblogic_test@DOMAIN.COM &lt;password&gt; 
  -k c:\opt\http_weblogic_test_new.keytab
  
  java sun.security.krb5.internal.tools.Ktab
  -a APPDEV2004.domain.com@DOMAIN.COM &lt;password&gt; 
  -k  c:\http_weblogic_test_new_ktab.keytab
  </code></pre>
  
  <p>Updates - I am able to get the Kinit run successfully after updating the principal name inside krb5Login.conf to  principal="HTTP/APPDEV2004.domain.com"</p>
  
  <p>After deploying a test application to weblogic I can see the Kinit running to generate the TGT successfully</p>
  
  <p>Response Excerpt </p>
  
  <pre><code>principal is HTTP/APPDEV2004.oriental.com@ORIENTAL.COM
  Will use keytab
  Commit Succeeded 
  
  Found KeyTab http_weblogic_test.keytab for 
  HTTP/APPDEV2004.domain.com@DOMAIN.COM
  Found ticket for HTTP/APPDEV2004.domain.com@DOMAIN.COM to go to 
  krbtgt/DOMAIN.COM@DOMAIN.COM expiring on Wed May 02 03:37:28 CDT 2018
  
  I am using the following properties for the web.xml in the application 
  
  &lt;security-constraint&gt;
      &lt;display-name&gt;AdminAccess&lt;/display-name&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;AllAdminOperations&lt;/web-resource-name&gt;
          &lt;description/&gt;
          &lt;url-pattern&gt;/faces/admin/*&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
          &lt;description&gt;Admin Only Access&lt;/description&gt;
          &lt;role-name&gt;Admin&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
      &lt;user-data-constraint&gt;
          &lt;description&gt;Secured Login&lt;/description&gt;
          &lt;transport-guarantee&gt;CONFIDENTIAL&lt;/transport-guarantee&gt;
      &lt;/user-data-constraint&gt;
  &lt;/security-constraint&gt;
  &lt;security-constraint&gt;
      &lt;display-name&gt;validUser&lt;/display-name&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;application&lt;/web-resource-name&gt;
          &lt;description/&gt;
          &lt;url-pattern&gt;/faces/home/*&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
          &lt;description&gt;Only Registered user can access this&lt;/description&gt;
          &lt;role-name&gt;Basic&lt;/role-name&gt;
          &lt;role-name&gt;Admin&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
  &lt;/security-constraint&gt;
  &lt;login-config&gt;
      &lt;auth-method&gt;Basic&lt;/auth-method&gt;
      &lt;realm-name&gt;**myrealm**&lt;/realm-name&gt;
  &lt;/login-config&gt;
  &lt;security-role&gt;
      &lt;description&gt;Deputy User&lt;/description&gt;
      &lt;role-name&gt;Deputy&lt;/role-name&gt;
  &lt;/security-role&gt;
  &lt;security-role&gt;
      &lt;description&gt;AdminUser&lt;/description&gt;
      &lt;role-name&gt;Admin&lt;/role-name&gt;
  &lt;/security-role&gt;
  
  and my weblogic.xml has 
  &lt;security-role-assignment&gt;
    &lt;role-name&gt;Admin&lt;/role-name&gt;
    &lt;principal-name&gt;Admin&lt;/principal-name&gt;
  &lt;/security-role-assignment&gt;
  &lt;security-role-assignment&gt;
   &lt;role-name&gt;Deputy&lt;/role-name&gt;
   &lt;principal-name&gt;Deputy&lt;/principal-name&gt;
  &lt;/security-role-assignment&gt;
  </code></pre>
  
  <p>I have configures the myrealm in the weblogic server with an ActiveDirectoryProvider (marked as SUFFICIENT) and NegotiateIndentityProviderAsserter (Form based Negotiation is marked disabled)
  However It is still showing the Basic Auth Dialog, and not signing me in.</p>
  
  <p>Update - In the weblogic server debug logs I can see the following exception</p>
  
  <pre><code>&lt;&gt; &lt;a71b8914-e309-4c08-97a5-2dcba34ea5be-00000044&gt; &lt;1525358738449&gt; &lt;[severity-value: 128] [rid: 0] [partition-id: 0] [partition-name: DOMAIN] &gt; &lt;BEA-000000&gt; &lt;acceptGssInitContextToken failed
  com.bea.security.utils.kerberos.KerberosException: Defective token detected (Mechanism level: GSSHeader did not find the right tag)
  at com.bea.security.utils.kerberos.KerberosTokenHandler.acceptGssInitContextTokenInDoAs(KerberosTokenHandler.java:396)
  at com.bea.security.utils.kerberos.KerberosTokenHandler.handleInitTokenForMultiKDC(KerberosTokenHandler.java:270)
  at com.bea.security.utils.kerberos.KerberosTokenHandler.access$100(KerberosTokenHandler.java:46)
  at com.bea.security.utils.kerberos.KerberosTokenHandler$2.run(KerberosTokenHandler.java:215)
  at java.security.AccessController.doPrivileged(Native Method)
  at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
  at com.bea.security.utils.kerberos.KerberosTokenHandler.acceptGssInitContextToken(KerberosTokenHandler.java:213)
  at com.bea.security.utils.kerberos.KerberosTokenHandler.acceptGssInitContextToken(KerberosTokenHandler.java:141)
  at com.bea.common.security.internal.utils.negotiate.SPNEGONegotiateToken.getUsername(SPNEGONegotiateToken.java:57)
  at weblogic.security.providers.authentication.NegotiateIdentityAsserterProviderImpl.assertChallengeIdentity(NegotiateIdentityAsserterProviderImpl.java:217)
  at com.bea.common.security.internal.legacy.service.ChallengeIdentityAssertionProviderImpl$ChallengeIdentityAsserterV2Adapter.assertChallengeIdentity(ChallengeIdentityAssertionProviderImpl.java:124)
  at com.bea.common.security.internal.service.ChallengeIdentityAssertionTokenServiceImpl.assertChallengeIdentity(ChallengeIdentityAssertionTokenServiceImpl.java:122)
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  at java.lang.reflect.Method.invoke(Method.java:498)
  at com.bea.common.security.internal.utils.Delegator$ProxyInvocationHandler.invoke(Delegator.java:64)
  at com.sun.proxy.$Proxy56.assertChallengeIdentity(Unknown Source)
  at com.bea.common.security.internal.service.ChallengeIdentityAssertionServiceImpl.assertChallengeIdentity(ChallengeIdentityAssertionServiceImpl.java:114)
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  at java.lang.reflect.Method.invoke(Method.java:498)
  at com.bea.common.security.internal.utils.Delegator$ProxyInvocationHandler.invoke(Delegator.java:64)
  at com.sun.proxy.$Proxy62.assertChallengeIdentity(Unknown Source)
  at com.bea.common.security.internal.service.NegotiateIdentityAsserterServiceImpl$NegotiateHandler.assertChallengeContext(NegotiateIdentityAsserterServiceImpl.java:328)
  at com.bea.common.security.internal.service.NegotiateIdentityAsserterServiceImpl$NegotiateHandler.process(NegotiateIdentityAsserterServiceImpl.java:213)
  at com.bea.common.security.internal.service.NegotiateIdentityAsserterServiceImpl.process(NegotiateIdentityAsserterServiceImpl.java:132)
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  at java.lang.reflect.Method.invoke(Method.java:498)
  at com.bea.common.security.internal.utils.Delegator$ProxyInvocationHandler.invoke(Delegator.java:64)
  at com.sun.proxy.$Proxy63.process(Unknown Source)
  at weblogic.security.providers.authentication.NegotiateIdentityAsserterServletAuthenticationFilter.doFilter(NegotiateIdentityAsserterServletAuthenticationFilter.java:37)
  at weblogic.servlet.security.internal.AuthFilterChain.doFilter(AuthFilterChain.java:34)
  at weblogic.servlet.security.internal.WebAppSecurity$ServletAuthenticationFilterAction.run(WebAppSecurity.java:1106)
  at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:326)
  at weblogic.security.service.SecurityManager.runAsForUserCode(SecurityManager.java:197)
  at weblogic.servlet.provider.WlsSecurityProvider.runAsForUserCode(WlsSecurityProvider.java:203)
  at weblogic.servlet.provider.WlsSubjectHandle.run(WlsSubjectHandle.java:71)
  at weblogic.servlet.security.internal.WebAppSecurity.invokeAuthFilterChain(WebAppSecurity.java:963)
  at weblogic.servlet.security.internal.CertSecurityModule.checkUserPerm(CertSecurityModule.java:99)
  at weblogic.servlet.security.internal.SecurityModule.checkAccess(SecurityModule.java:159)
  at weblogic.servlet.security.internal.SecurityModule.isAuthorized(SecurityModule.java:720)
  at weblogic.servlet.security.internal.WebAppSecurity.checkAccess(WebAppSecurity.java:585)
  at weblogic.servlet.security.internal.WebAppSecurity.checkAccess(WebAppSecurity.java:545)
  at weblogic.servlet.internal.WebAppServletContext.doSecuredExecute(WebAppServletContext.java:2379)
  at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2281)
  at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2259)
  at weblogic.servlet.internal.ServletRequestImpl.runInternal(ServletRequestImpl.java:1691)
  at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1651)
  at weblogic.servlet.provider.ContainerSupportProviderImpl$WlsRequestExecutor.run(ContainerSupportProviderImpl.java:270)
  at weblogic.invocation.ComponentInvocationContextManager._runAs(ComponentInvocationContextManager.java:348)
  at weblogic.invocation.ComponentInvocationContextManager.runAs(ComponentInvocationContextManager.java:333)
  at weblogic.work.LivePartitionUtility.doRunWorkUnderContext(LivePartitionUtility.java:54)
  at weblogic.work.PartitionUtility.runWorkUnderContext(PartitionUtility.java:41)
  at weblogic.work.SelfTuningWorkManagerImpl.runWorkUnderContext(SelfTuningWorkManagerImpl.java:640)
  at weblogic.work.ExecuteThread.execute(ExecuteThread.java:406)
  at weblogic.work.ExecuteThread.run(ExecuteThread.java:346)
  Caused By: GSSException: Defective token detected (Mechanism level: GSSHeader did not find the right tag)
  at sun.security.jgss.GSSHeader.&lt;init&gt;(GSSHeader.java:97)
  at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:306)
  at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:285)
  at com.bea.security.utils.kerberos.KerberosTokenHandler.acceptGssInitContextTokenInDoAs(KerberosTokenHandler.java:310)
  at com.bea.security.utils.kerberos.KerberosTokenHandler.handleInitTokenForMultiKDC(KerberosTokenHandler.java:270)
  at com.bea.security.utils.kerberos.KerberosTokenHandler.access$100(KerberosTokenHandler.java:46)
  at com.bea.security.utils.kerberos.KerberosTokenHandler$2.run(KerberosTokenHandler.java:215)
  at java.security.AccessController.doPrivileged(Native Method)
  at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
  at com.bea.security.utils.kerberos.KerberosTokenHandler.acceptGssInitContextToken(KerberosTokenHandler.java:213)
  at com.bea.security.utils.kerberos.KerberosTokenHandler.acceptGssInitContextToken(KerberosTokenHandler.java:141)
  at com.bea.common.security.internal.utils.negotiate.SPNEGONegotiateToken.getUsername(SPNEGONegotiateToken.java:57)
  at weblogic.security.providers.authentication.NegotiateIdentityAsserterProviderImpl.assertChallengeIdentity(NegotiateIdentityAsserterProviderImpl.java:217)
  at com.bea.common.security.internal.legacy.service.ChallengeIdentityAssertionProviderImpl$ChallengeIdentityAsserterV2Adapter.assertChallengeIdentity(ChallengeIdentityAssertionProviderImpl.java:124)
  at com.bea.common.security.internal.service.ChallengeIdentityAssertionTokenServiceImpl.assertChallengeIdentity(ChallengeIdentityAssertionTokenServiceImpl.java:122)
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  at java.lang.reflect.Method.invoke(Method.java:498)
  at com.bea.common.security.internal.utils.Delegator$ProxyInvocationHandler.invoke(Delegator.java:64)
  at com.sun.proxy.$Proxy56.assertChallengeIdentity(Unknown Source)
  at com.bea.common.security.internal.service.ChallengeIdentityAssertionServiceImpl.assertChallengeIdentity(ChallengeIdentityAssertionServiceImpl.java:114)
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  at java.lang.reflect.Method.invoke(Method.java:498)
  at com.bea.common.security.internal.utils.Delegator$ProxyInvocationHandler.invoke(Delegator.java:64)
  at com.sun.proxy.$Proxy62.assertChallengeIdentity(Unknown Source)
  at com.bea.common.security.internal.service.NegotiateIdentityAsserterServiceImpl$NegotiateHandler.assertChallengeContext(NegotiateIdentityAsserterServiceImpl.java:328)
  at com.bea.common.security.internal.service.NegotiateIdentityAsserterServiceImpl$NegotiateHandler.process(NegotiateIdentityAsserterServiceImpl.java:213)
  at com.bea.common.security.internal.service.NegotiateIdentityAsserterServiceImpl.process(NegotiateIdentityAsserterServiceImpl.java:132)
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  at java.lang.reflect.Method.invoke(Method.java:498)
  at com.bea.common.security.internal.utils.Delegator$ProxyInvocationHandler.invoke(Delegator.java:64)
  at com.sun.proxy.$Proxy63.process(Unknown Source)
  at weblogic.security.providers.authentication.NegotiateIdentityAsserterServletAuthenticationFilter.doFilter(NegotiateIdentityAsserterServletAuthenticationFilter.java:37)
  at weblogic.servlet.security.internal.AuthFilterChain.doFilter(AuthFilterChain.java:34)
  at weblogic.servlet.security.internal.WebAppSecurity$ServletAuthenticationFilterAction.run(WebAppSecurity.java:1106)
  at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:326)
  at weblogic.security.service.SecurityManager.runAsForUserCode(SecurityManager.java:197)
  at weblogic.servlet.provider.WlsSecurityProvider.runAsForUserCode(WlsSecurityProvider.java:203)
  at weblogic.servlet.provider.WlsSubjectHandle.run(WlsSubjectHandle.java:71)
  at weblogic.servlet.security.internal.WebAppSecurity.invokeAuthFilterChain(WebAppSecurity.java:963)
  at weblogic.servlet.security.internal.CertSecurityModule.checkUserPerm(CertSecurityModule.java:99)
  at weblogic.servlet.security.internal.SecurityModule.checkAccess(SecurityModule.java:159)
  at weblogic.servlet.security.internal.SecurityModule.isAuthorized(SecurityModule.java:720)
  at weblogic.servlet.security.internal.WebAppSecurity.checkAccess(WebAppSecurity.java:585)
  at weblogic.servlet.security.internal.WebAppSecurity.checkAccess(WebAppSecurity.java:545)
  at weblogic.servlet.internal.WebAppServletContext.doSecuredExecute(WebAppServletContext.java:2379)
  at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2281)
  at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2259)
  at weblogic.servlet.internal.ServletRequestImpl.runInternal(ServletRequestImpl.java:1691)
  at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1651)
  at weblogic.servlet.provider.ContainerSupportProviderImpl$WlsRequestExecutor.run(ContainerSupportProviderImpl.java:270)
  at weblogic.invocation.ComponentInvocationContextManager._runAs(ComponentInvocationContextManager.java:348)
  at weblogic.invocation.ComponentInvocationContextManager.runAs(ComponentInvocationContextManager.java:333)
  at weblogic.work.LivePartitionUtility.doRunWorkUnderContext(LivePartitionUtility.java:54)
  at weblogic.work.PartitionUtility.runWorkUnderContext(PartitionUtility.java:41)
  at weblogic.work.SelfTuningWorkManagerImpl.runWorkUnderContext(SelfTuningWorkManagerImpl.java:640)
  at weblogic.work.ExecuteThread.execute(ExecuteThread.java:406)
  at weblogic.work.ExecuteThread.run(ExecuteThread.java:346)
  </code></pre>