title: GSSException when running SPNEGO Kerberos with Integrated Windows Authentication
body: <p>I am trying to setup Kerberos Integrated Windows Authentication using spnego and tomcat.</p>
  
  <p>This is first time I am doing this and have not seen a real enviornment so relying on online documentation mostly the spnego site.
  I am getting below error:</p>
  
  <blockquote>
    <p>GSSException: Failure unspecified at GSS-API level (Mechanism level:
    Invalid Argument (400) Cannot find key of appropriate type to decrypt
    AP REP - RC4 with HMAC)</p>
  </blockquote>
  
  <pre><code>Catalina log shows:
  Jan 30, 2017 10:12:37 AM net.sourceforge.spnego.SpnegoHttpFilter doFilter
  SEVERE: HTTP Authorization Header=Negotiate &lt;edited - actual had a big key&gt;
  Jan 30, 2017 10:41:24 AM org.apache.coyote.AbstractProtocol pause
  INFO: Pausing ProtocolHandler ["http-bio-8443"]
  Jan 30, 2017 10:41:24 AM org.apache.coyote.AbstractProtocol pause
  </code></pre>
  
  <p>Attaching my krb5 and login.conf.</p>
  
  <p><a href="https://1drv.ms/u/s!Ao7EjuPx45ITauPCWypr5lzh09A" rel="nofollow noreferrer">krb5.conf</a>
  <a href="https://1drv.ms/u/s!Ao7EjuPx45ITawyPiD29eaYYmkM" rel="nofollow noreferrer">login.conf</a></p>
  
  <pre><code>KLIST command gives 2 keys:
  CLIENT: B1GYZDM @ test.win.org
  Server: krbtgt/test.win.org @ test.win.org
  KerbTicket Encryption Type: RSADSI RC4-HMAC(NT) 
  
  CLIENT: B1GYZDM @ test.win.org
  Server: krbtgt/test.win.org @ test.win.org
  KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
  </code></pre>
  
  <p>Tomcat is running as local-service. 
  And keytab supports 128 &amp; 256 encryption.</p>
  
  <p>Can you please help me resolve the issue?</p>
  
  <pre><code>KRB5.conf:
  [libdefaults]
  default_tkt_enctypes = aes128-cts aes256-cts
  default_tgs_enctypes = aes128-cts aes256-cts
  permitted_enctypes   = aes128-cts aes256-cts
  
  [realms]
  test.win.org  = {
      kdc = test.win.org 
      default_domain = test.win.org 
  }
  
  [domain_realm]
  test.win.org = test.win.org
  
  
  login.conf:
  spnego-client {
  com.sun.security.auth.module.Krb5LoginModule required;
  };
  
  spnego-server {
  com.sun.security.auth.module.Krb5LoginModule required
  storeKey=true
  useKeyTab=true
  keyTab="file:///E:/Apps/apache-tomcat-7.0.40/bin/test.keytab"
  isInitiator=false;
  };
  
  custom-client {
  com.sun.security.auth.module.Krb5LoginModule required
  storeKey=true
  useKeyTab=true
  keyTab="file:///E:/Apps/apache-tomcat-7.0.40/bin/test.keytab"
  principal=B1ADPST000;
  };
  </code></pre>