Проблема шифрования единого входа в Windows Active Directory 2012 - PullRequest
Новая
       28

Проблема шифрования единого входа в Windows Active Directory 2012

0 голосов
/ 26 сентября 2018

Мы не можем пройти через систему единого входа, кроме развертывания, включая Oracle Weblogic Server 10.3.6 и Windows 2012 R2 Active Directory, мы успешно внедрили его с Windows 2003 и 2008 R2.Журналы, указывающие на некоторые проблемы с шифрованием RC4, может быть, я ошибаюсь.пожалуйста, посмотрите следующие журналы. 

[GSS LoginConfigImpl]: Trying com.sun.security.jgss.krb5.accept: Found!
Debug is  true storeKey true useTicketCache false useKeyTab true doNotPrompt false ticketCache is null isInitiator true KeyTab is dom1client600.keytab refreshKrb5Config is false principal is HTTP/dom-wln-600@DOM1.COM tryFirstPass is false useFirstPass is false storePass is false clearPass is false
Added key: 17version: 0
Added key: 18version: 0
Added key: 23version: 0
Added key: 3version: 0
Added key: 1version: 0
Ordering keys wrt default_tkt_enctypes list
default etypes for default_tkt_enctypes: 17 18 23.
Added key: 17version: 0
Added key: 18version: 0
Added key: 23version: 0
Added key: 3version: 0
Added key: 1version: 0
Ordering keys wrt default_tkt_enctypes list
default etypes for default_tkt_enctypes: 17 18 23.
default etypes for default_tkt_enctypes: 17 18 23.
>>> KrbAsReq creating message
>>> KrbKdcReq send: kdc=10.30.4.185 TCP:88, timeout=30000, number of retries =3, #bytes=158
>>> KDCCommunication: kdc=10.30.4.185 TCP:88, timeout=30000,Attempt =1, #bytes=158
>>>DEBUG: TCPClient reading 201 bytes
>>> KrbKdcReq send: #bytes read=201
>>>Pre-Authentication Data:
         PA-DATA type = 19
         PA-ETYPE-INFO2 etype = 18, salt = DOMAIN.COMHTTPdom-wln-600, s2kparams = null
         PA-ETYPE-INFO2 etype = 23, salt = null, s2kparams = null

>>>Pre-Authentication Data:
         PA-DATA type = 2
         PA-ENC-TIMESTAMP
>>>Pre-Authentication Data:
         PA-DATA type = 16

>>>Pre-Authentication Data:
         PA-DATA type = 15

>>> KdcAccessibility: remove 10.30.4.185
>>> KDCRep: init() encoding tag is 126 req type is 11
>>>KRBError:
         sTime is Wed Sep 26 06:56:46 BST 2018 1537941406000
         suSec is 910784
         error code is 25
         error Message is Additional pre-authentication required
         realm is DOMAIN.COM
         sname is krbtgt/DOMAIN.COM
         eData provided.
         msgType is 30
>>>Pre-Authentication Data:
         PA-DATA type = 19
         PA-ETYPE-INFO2 etype = 18, salt = DOMAIN.COMHTTPdom-wln-600, s2kparams = null
         PA-ETYPE-INFO2 etype = 23, salt = null, s2kparams = null

>>>Pre-Authentication Data:
         PA-DATA type = 2
         PA-ENC-TIMESTAMP
>>>Pre-Authentication Data:
         PA-DATA type = 16

>>>Pre-Authentication Data:
         PA-DATA type = 15

KrbAsReqBuilder: PREAUTH FAILED/REQ, re-send AS-REQ
default etypes for default_tkt_enctypes: 17 18 23.
Added key: 17version: 0
Added key: 18version: 0
Added key: 23version: 0
Added key: 3version: 0
Added key: 1version: 0
Ordering keys wrt default_tkt_enctypes list
default etypes for default_tkt_enctypes: 17 18 23.
Added key: 17version: 0
Added key: 18version: 0
Added key: 23version: 0
Added key: 3version: 0
Added key: 1version: 0
Ordering keys wrt default_tkt_enctypes list
default etypes for default_tkt_enctypes: 17 18 23.
default etypes for default_tkt_enctypes: 17 18 23.
>>> EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType
>>> KrbAsReq creating message
>>> KrbKdcReq send: kdc=10.30.4.185 TCP:88, timeout=30000, number of retries =3, #bytes=244
>>> KDCCommunication: kdc=10.30.4.185 TCP:88, timeout=30000,Attempt =1, #bytes=244
>>>DEBUG: TCPClient reading 1501 bytes
>>> KrbKdcReq send: #bytes read=1501
>>> KdcAccessibility: remove 10.30.4.185
Added key: 17version: 0
Added key: 18version: 0
Added key: 23version: 0
Added key: 3version: 0
Added key: 1version: 0
Ordering keys wrt default_tkt_enctypes list
default etypes for default_tkt_enctypes: 17 18 23.
>>> EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType
>>> KrbAsRep cons in KrbAsReq.getReply HTTP/dom-wln-600
principal is HTTP/dom-wln-600@DOMAIN.COM
Will use keytab
Added key: 17version: 0
Added key: 18version: 0
Added key: 23version: 0
Added key: 3version: 0
Added key: 1version: 0
Ordering keys wrt default_tkt_enctypes list
default etypes for default_tkt_enctypes: 17 18 23.
Commit Succeeded 

Found KeyTab
Found KerberosKey for HTTP/dom-wln-600@DOMAIN.COM
Found KerberosKey for HTTP/dom-wln-600@DOMAIN.COM
Found KerberosKey for HTTP/dom-wln-600@DOMAIN.COM
Found KerberosKey for HTTP/dom-wln-600@DOMAIN.COM
Found KerberosKey for HTTP/dom-wln-600@DOMAIN.COM
Entered Krb5Context.acceptSecContext with state=STATE_NEW
Added key: 17version: 0
Added key: 18version: 0
Added key: 23version: 0
Added key: 3version: 0
Added key: 1version: 0
Ordering keys wrt default_tkt_enctypes list
default etypes for default_tkt_enctypes: 17 18 23.
EType: sun.security.krb5.internal.crypto.ArcFourHmacEType
...