{"action":"created","issue":{"url":"https://api.github.com/repos/dblock/waffle/issues/268","labels_url":"https://api.github.com/repos/dblock/waffle/issues/268/labels{/name}","comments_url":"https://api.github.com/repos/dblock/waffle/issues/268/comments","events_url":"https://api.github.com/repos/dblock/waffle/issues/268/events","html_url":"https://github.com/dblock/waffle/issues/268","id":112181898,"number":268,"title":"Error logging in user: The handle specified is invalid","user":{"login":"thisusernameisfree","id":942240,"avatar_url":"https://avatars.githubusercontent.com/u/942240?v=3","gravatar_id":"","url":"https://api.github.com/users/thisusernameisfree","html_url":"https://github.com/thisusernameisfree","followers_url":"https://api.github.com/users/thisusernameisfree/followers","following_url":"https://api.github.com/users/thisusernameisfree/following{/other_user}","gists_url":"https://api.github.com/users/thisusernameisfree/gists{/gist_id}","starred_url":"https://api.github.com/users/thisusernameisfree/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thisusernameisfree/subscriptions","organizations_url":"https://api.github.com/users/thisusernameisfree/orgs","repos_url":"https://api.github.com/users/thisusernameisfree/repos","events_url":"https://api.github.com/users/thisusernameisfree/events{/privacy}","received_events_url":"https://api.github.com/users/thisusernameisfree/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/dblock/waffle/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-10-19T16:26:16Z","updated_at":"2015-10-20T11:24:07Z","closed_at":null,"body":"I'm trying to set up windows authentication with waffle, and it works fine as long as I use LOCAL SYSTEM and NETWORK SERVICE account. But if I switch to the domain account I'm getting \"The handle specified is invalid\" error. \r\n\r\nI tried to configure SPNs on AD server but it doesn't help. I also enabled Kerberos delegation for that server, and for that account.\r\nC:\\Users\\Administrator>setspn -l dbadmin\r\nRegistered ServicePrincipalNames for CN=dbadmin,CN=Users,DC=blah,DC=com:\r\n        HTTP/Unicorn\r\n        HTTP/Unicorn.blah.com\r\n\r\nHere is the log with errors:\r\n```\r\n2015-10-19 19:13:14,825 DEBUG [http-nio-8085-exec-4] [waffle.servlet.NegotiateSecurityFilter] [::] -- GET /idp/login, contentlength: -1\r\n2015-10-19 19:13:14,825 DEBUG [http-nio-8085-exec-4] [waffle.servlet.NegotiateSecurityFilter] [::] -- authorization required\r\n2015-10-19 19:13:14,856 DEBUG [http-nio-8085-exec-5] [waffle.servlet.NegotiateSecurityFilter] [::] -- GET /idp/login, contentlength: -1\r\n2015-10-19 19:13:14,856 DEBUG [http-nio-8085-exec-5] [waffle.servlet.spi.NegotiateSecurityFilterProvider] [::] -- security package: Negotiate, connection id: fe80:0:0:0:852:798e:74de:9d1e%12:50469\r\n2015-10-19 19:13:14,856 DEBUG [http-nio-8085-exec-5] [waffle.servlet.spi.NegotiateSecurityFilterProvider] [::] -- token buffer: 119 byte(s)\r\n2015-10-19 19:13:14,859 DEBUG [http-nio-8085-exec-5] [waffle.servlet.spi.NegotiateSecurityFilterProvider] [::] -- continue token: oYHWMIHToAMKAQGhDAYKKwYBBAGCNwICCqKBvQSBuk5UTE1TU1AAAgAAAAgACAA4AAAAFcKJ4ngIGibaBiMXILPmHCYAAAB6AHoAQAAAAAYDgCUAAAAPQgBMAEEASAACAAgAQgBMAEEASAABAA4AVQBOAEkAQwBPAFIATgAEABAAYgBsAGEAaAAuAGMAbwBtAAMAIABVAG4AaQBjAG8AcgBuAC4AYgBsAGEAaAAuAGMAbwBtAAUAEABiAGwAYQBoAC4AYwBvAG0ABwAIAE/a+g6JCtEBAAAAAA==\r\n2015-10-19 19:13:14,859 DEBUG [http-nio-8085-exec-5] [waffle.servlet.spi.NegotiateSecurityFilterProvider] [::] -- continue required: true\r\n2015-10-19 19:13:14,862 DEBUG [http-nio-8085-exec-6] [waffle.servlet.NegotiateSecurityFilter] [::] -- GET /idp/login, contentlength: -1\r\n2015-10-19 19:13:14,862 DEBUG [http-nio-8085-exec-6] [waffle.servlet.spi.NegotiateSecurityFilterProvider] [::] -- security package: Negotiate, connection id: fe80:0:0:0:852:798e:74de:9d1e%12:50469\r\n2015-10-19 19:13:14,862 DEBUG [http-nio-8085-exec-6] [waffle.servlet.spi.NegotiateSecurityFilterProvider] [::] -- token buffer: 121 byte(s)\r\n2015-10-19 19:13:14,871 WARN  [http-nio-8085-exec-6] [waffle.servlet.NegotiateSecurityFilter] [::] -- error logging in user: com.sun.jna.platform.win32.Win32Exception: The handle specified is invalid\r\n```\r\nI think I'm missing something but I can't figure out what, is there any other privileges I need to give that service account? I made it as local administrator to eliminate possible issues on local machine where the service is running.\r\n\r\nAs a result I'm getting a popup window prompting to enter my credentials. When I enter user and password - I'm successfully logged in. I also don't experience any problems If I remove Negotiate from protocols and keep only NTLM."},"comment":{"url":"https://api.github.com/repos/dblock/waffle/issues/comments/149532098","html_url":"https://github.com/dblock/waffle/issues/268#issuecomment-149532098","issue_url":"https://api.github.com/repos/dblock/waffle/issues/268","id":149532098,"user":{"login":"thisusernameisfree","id":942240,"avatar_url":"https://avatars.githubusercontent.com/u/942240?v=3","gravatar_id":"","url":"https://api.github.com/users/thisusernameisfree","html_url":"https://github.com/thisusernameisfree","followers_url":"https://api.github.com/users/thisusernameisfree/followers","following_url":"https://api.github.com/users/thisusernameisfree/following{/other_user}","gists_url":"https://api.github.com/users/thisusernameisfree/gists{/gist_id}","starred_url":"https://api.github.com/users/thisusernameisfree/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thisusernameisfree/subscriptions","organizations_url":"https://api.github.com/users/thisusernameisfree/orgs","repos_url":"https://api.github.com/users/thisusernameisfree/repos","events_url":"https://api.github.com/users/thisusernameisfree/events{/privacy}","received_events_url":"https://api.github.com/users/thisusernameisfree/received_events","type":"User","site_admin":false},"created_at":"2015-10-20T11:24:07Z","updated_at":"2015-10-20T11:24:07Z","body":"Here is a more detailed log with error I'm getting:\r\n```\r\n2015-10-20 14:15:54,431 DEBUG [http-nio-8085-exec-4] [waffle.servlet.NegotiateSecurityFilter] [::] -- GET /idp/login, contentlength: -1\r\n2015-10-20 14:15:55,572 DEBUG [http-nio-8085-exec-4] [waffle.servlet.NegotiateSecurityFilter] [::] -- authorization required\r\n2015-10-20 14:15:55,806 DEBUG [http-nio-8085-exec-5] [waffle.servlet.NegotiateSecurityFilter] [::] -- GET /idp/login, contentlength: -1\r\n2015-10-20 14:15:55,830 DEBUG [http-nio-8085-exec-5] [waffle.servlet.spi.NegotiateSecurityFilterProvider] [::] -- security package: Negotiate, connection id: 10.136.41.130:50091\r\n2015-10-20 14:15:55,856 DEBUG [http-nio-8085-exec-5] [waffle.servlet.spi.NegotiateSecurityFilterProvider] [::] -- token buffer: 119 byte(s)\r\n2015-10-20 14:15:56,339 DEBUG [http-nio-8085-exec-5] [waffle.servlet.spi.NegotiateSecurityFilterProvider] [::] -- continue token: oYHWMIHToAMKAQGhDAYKKwYBBAGCNwICCqKBvQSBuk5UTE1TU1AAAgAAAAgACAA4AAAAFcKJ4kL4Rn8V+6bSkE9bhN0AAAB6AHoAQAAAAAYDgCUAAAAPQgBMAEEASAACAAgAQgBMAEEASAABAA4AVQBOAEkAQwBPAFIATgAEABAAYgBsAGEAaAAuAGMAbwBtAAMAIABVAG4AaQBjAG8AcgBuAC4AYgBsAGEAaAAuAGMAbwBtAAUAEABiAGwAYQBoAC4AYwBvAG0ABwAIAPmzybAoC9EBAAAAAA==\r\n2015-10-20 14:15:56,340 DEBUG [http-nio-8085-exec-5] [waffle.servlet.spi.NegotiateSecurityFilterProvider] [::] -- continue required: true\r\n2015-10-20 14:15:56,582 DEBUG [http-nio-8085-exec-6] [waffle.servlet.NegotiateSecurityFilter] [::] -- GET /idp/login, contentlength: -1\r\n2015-10-20 14:15:56,582 DEBUG [http-nio-8085-exec-6] [waffle.servlet.spi.NegotiateSecurityFilterProvider] [::] -- security package: Negotiate, connection id: 10.136.41.130:50091\r\n2015-10-20 14:15:56,588 DEBUG [http-nio-8085-exec-6] [waffle.servlet.spi.NegotiateSecurityFilterProvider] [::] -- token buffer: 121 byte(s)\r\n2015-10-20 14:15:56,938 WARN  [http-nio-8085-exec-6] [waffle.servlet.NegotiateSecurityFilter] [::] -- error logging in user: com.sun.jna.platform.win32.Win32Exception: The handle specified is invalid\r\n2015-10-20 14:15:56,939 TRACE [http-nio-8085-exec-6] [waffle.servlet.NegotiateSecurityFilter] [::] -- {}\r\njava.io.IOException: com.sun.jna.platform.win32.Win32Exception: The handle specified is invalid\r\n\tat waffle.servlet.spi.SecurityFilterProviderCollection.doFilter(SecurityFilterProviderCollection.java:150)\r\n\tat waffle.servlet.NegotiateSecurityFilter.doFilter(NegotiateSecurityFilter.java:123)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)\r\n\tat org.eclipse.alf.security.sso.server.federationserver.filter.LoginRedirectFilter.doFilter(LoginRedirectFilter.java:164)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)\r\n\tat org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)\r\n\tat org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220)\r\n\tat org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)\r\n\tat org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:170)\r\n\tat org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)\r\n\tat org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)\r\n\tat org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:423)\r\n\tat org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1079)\r\n\tat org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:625)\r\n\tat org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1760)\r\n\tat org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1719)\r\n\tat java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)\r\n\tat java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)\r\n\tat org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\r\n\tat java.lang.Thread.run(Thread.java:745)\r\nCaused by: com.sun.jna.platform.win32.Win32Exception: The handle specified is invalid\r\n\tat waffle.windows.auth.impl.WindowsAuthProviderImpl.acceptSecurityToken(WindowsAuthProviderImpl.java:140)\r\n\tat waffle.servlet.spi.NegotiateSecurityFilterProvider.doFilter(NegotiateSecurityFilterProvider.java:144)\r\n\tat waffle.servlet.spi.SecurityFilterProviderCollection.doFilter(SecurityFilterProviderCollection.java:148)\r\n\t... 20 more\r\n```\r\n\r\nI have also enabled Kerberos logging but I don't see any errors in event viewer both on AD and local server. It looks like the token I supply cannot be accepted for some reason. Could it still be an issue with SPNs?"}}