我写客户端代码为Windows Kerberos身份验证与服务(日志代码省略):电话GSSContext.initSecContext失败间歇性:收到超时
System.setProperty("javax.security.auth.useSubjectCredsOnly", "false");
// System.setProperty("sun.security.krb5.debug", "true");
Package thisPkg = AuthHelper.class.getPackage();
String configPath = Util.getConfigPath(thisPkg, "jaas.conf");
System.setProperty("java.security.auth.login.config", "=" + configPath);
GSSManager manager = GSSManager.getInstance();
GSSName peerName = manager.createName(spn, GSSName.NT_HOSTBASED_SERVICE);
GSSContext context = manager.createContext(peerName, null, null,
GSSContext.DEFAULT_LIFETIME);
context.requestMutualAuth(true); // required
context.requestCredDeleg(true); // required for publish
byte[] serverTokenBytes = new byte[0];
while (!context.isEstablished()) {
byte[] clientTokenBytes = context.initSecContext(serverTokenBytes, 0,
serverTokenBytes.length);
if (clientTokenBytes != null)
socket.send(createClientMessage(clientTokenBytes));
if (context.isEstablished()) break;
Message message = socket.receive();
String serverToken = message.getFirst("SERVERTOKEN").toString();
serverTokenBytes = Base64.decodeBase64(serverToken);
}
凡jaas.conf
只包含:
sp {
com.sun.security.auth.module.Krb5LoginModule required debug=true;
};
我也根据需要设置了allowtgtsessionkey
注册表项,并安装了JCE Unlimited Strength Jurisdiction Policy Files 7。
该代码有时起作用(即建立了相互认证);然而,有时它被卡住了,而在第一次调用GSSContext.initSecContext
,大约一分钟后抛出异常:
Exception in thread "main" GSSException: No valid credentials provided (Mechanism level: Receive timed out)
...
Caused by: java.net.SocketTimeoutException: Receive timed out
...
当我启用Kerberos调试输出(通过取消注释上面的第二线),我可以看到该协议有时卡在行:
getKDCFromDNS using UDP
A Java Kerberos troubleshooting website表明,这是与Kerberos身份验证服务器的问题,但我知道,服务器启动并运行,因为我们有在C#编写类似的代码(使用。 NET库),永远不会卡住。
如果您,您的管理员必须修复DNS。 – 2013-03-19 18:23:22