Tomcat fails to authenticate using spnego, "Cannot locate default realm"
jgss, kerberos, spnego, tomcat
Solution
It could mean two things:-
- Your krb5.conf is misconfigured
- Your tomcat machine is on a realm which does not have a kdc
Here is a sample krb5.conf for reference. Note the fact that in this case, my tomcat hosting machine is on KERBOS.COM
[libdefaults]
default_realm = KERBOS.COM
ticket_lifetime = 36000
[realms]
KERBOS.COM = {
kdc = 10.1.2.3
admin_server = INQS28KERB01
default_domain = KERBOS.COM
}
[domain_realm]
.mycompany.com = KERBOS.COM
[appdefaults]
autologin = true
forward = true
forwardable = true
encrypt = true
For me this works. Please provide your krb5.conf for details. Moreover please also provide the tomcat filter edit you did, it is possible something is wrongly configured there.
Problem
I'm using http://spnego.sourceforge.net/spnego_tomcat.html tutorial to try to config Tomcat to use spnego. Hello_KDC.java worked and I was able to authenticate. And if I use wrong password I get error Exception, so it's working. But when I try to use that tutorial for Tomcat it breaks. Tomcat ROOT/index.jsp gets blank, and when monitoring I see it's returning 404. log\host-manager.2013-02-22.log has the following: ``` Fev 22, 2013 1:39:03 PM org.apache.catalina.core.StandardContext filterStart SEVERE: Exception starting filter SpnegoHttpFilter javax.servlet.ServletException: javax.security.auth.login.LoginException: Cannot locate default realm at net.sourceforge.spnego.SpnegoHttpFilter.init(SpnegoHttpFilter.java:198) at org.apache.catalina.core.ApplicationFilterConfig.initFilter(ApplicationFilterConfig.java:281) at org.apache.catalina.core.ApplicationFilterConfig.getFilter(ApplicationFilterConfig.java:262) at org.apache.catalina.core.ApplicationFilterConfig.<init>(ApplicationFilterConfig.java:107) at org.apache.catalina.core.StandardContext.filterStart(StandardContext.java:4656) at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5309) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150) at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:901) at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:877) at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:633) at org.apache.catalina.startup.HostConfig.deployDirectory(HostConfig.java:1114) at org.apache.catalina.startup.HostConfig$DeployDirectory.run(HostConfig.java:1673) at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) at java.util.concurrent.FutureTask$Sync.innerRun(Unknown Source) at java.util.concurrent.FutureTask.run(Unknown Source) at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) at java.lang.Thread.run(Unknown Source) Caused by: javax.security.auth.login.LoginException: Cannot locate default realm at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Unknown Source) at com.sun.security.auth.module.Krb5LoginModule.login(Unknown Source) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) at java.lang.reflect.Method.invoke(Unknown Source) at javax.security.auth.login.LoginContext.invoke(Unknown Source) at javax.security.auth.login.LoginContext.access$000(Unknown Source) at javax.security.auth.login.LoginContext$4.run(Unknown Source) at javax.security.auth.login.LoginContext$4.run(Unknown Source) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.login.LoginContext.invokePriv(Unknown Source) at javax.security.auth.login.LoginContext.login(Unknown Source) at net.sourceforge.spnego.SpnegoAuthenticator.<init>(SpnegoAuthenticator.java:161) at net.sourceforge.spnego.SpnegoHttpFilter.init(SpnegoHttpFilter.java:196) ... 17 more Caused by: KrbException: Cannot locate default realm at sun.security.krb5.PrincipalName.<init>(Unknown Source) ... 32 more Caused by: KrbException: Cannot locate default realm at sun.security.krb5.Config.getDefaultRealm(Unknown Source) ... 33 more Caused by: KrbException: Generic error (description in e-text) (60) - Unable to locate Kerberos realm at sun.security.krb5.Config.getRealmFromDNS(Unknown Source) ... 34 more ``` That happens during tomcat startup, before any page is loaded from browser. When I try to load page, no log is added. In krb5.conf I tried both hostname and IP and get same error. krb5.conf and login.conf are being located, because if I delete them I get this log: ``` Fev 22, 2013 1:46:05 PM org.apache.catalina.core.StandardContext filterStart SEVERE: Exception starting filter SpnegoHttpFilter java.lang.SecurityException: login.conf (tal arquivo ou diretório não existe) at com.sun.security.auth.login.ConfigFile.<init>(Unknown Source) at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source) at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source) at java.lang.reflect.Constructor.newInstance(Unknown Source) at java.lang.Class.newInstance0(Unknown Source) at java.lang.Class.newInstance(Unknown Source) at javax.security.auth.login.Configuration$3.run(Unknown Source) at javax.security.auth.login.Configuration$3.run(Unknown Source) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.login.Configuration.getConfiguration(Unknown Source) at net.sourceforge.spnego.SpnegoFilterConfig.doClientModule(SpnegoFilterConfig.java:176) at net.sourceforge.spnego.SpnegoFilterConfig.<init>(SpnegoFilterConfig.java:138) at net.sourceforge.spnego.SpnegoFilterConfig.getInstance(SpnegoFilterConfig.java:314) at net.sourceforge.spnego.SpnegoHttpFilter.init(SpnegoHttpFilter.java:193) at org.apache.catalina.core.ApplicationFilterConfig.initFilter(ApplicationFilterConfig.java:281) at org.apache.catalina.core.ApplicationFilterConfig.getFilter(ApplicationFilterConfig.java:262) at org.apache.catalina.core.ApplicationFilterConfig.<init>(ApplicationFilterConfig.java:107) at org.apache.catalina.core.StandardContext.filterStart(StandardContext.java:4656) at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5309) at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150) at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:901) at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:877) at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:633) at org.apache.catalina.startup.HostConfig.deployDirectory(HostConfig.java:1114) at org.apache.catalina.startup.HostConfig$DeployDirectory.run(HostConfig.java:1673) at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) at java.util.concurrent.FutureTask$Sync.innerRun(Unknown Source) at java.util.concurrent.FutureTask.run(Unknown Source) at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) at java.lang.Thread.run(Unknown Source) Caused by: java.io.IOException: login.conf (tal arquivo ou diretório não existe) at com.sun.security.auth.login.ConfigFile.init(Unknown Source) ... 32 more ``` Any idea what may be happening?