Tomcat Kerberos Spnego authorization not working
<p>I try to configure WebSSO for a Tomcat 7.0.69 with the build-in SPNEGO authenticator over Kerberos. When I access the application, a HTTP BasicAuth Dialog pops up and a debug entry is written in the catalina.out (see below).</p>

<p>My keytab file <em>sso.keytab</em> contains a principal who is registered on my AD-Server (via ktpass.exe &amp; setspn.exe). </p>

<p>I switched on debug-mode for Kerberos, but I cannot find the problem. It simply stops at some point with <em>Entering logout</em>. Do you have any idea, in which step the authentication stops and what could be the reason for that? Any help is appreciated!</p>

<p><strong>catalina.out</strong></p>

<pre><code>Debug is  true storeKey true useTicketCache false useKeyTab true doNotPrompt false ticketCache is null isInitiator true KeyTab is /path/to/tomcat/apache-tomcat-7.0.69/conf/sso.keytab refreshKrb5Config is false principal is HTTP/my.host.com@MY.DOMAIN tryFirstPass is false useFirstPass is false storePass is false clearPass is false
Looking for keys for: HTTP/my.host.com@MY.DOMAIN
Added key: 23version: 0
Looking for keys for: HTTP/my.host.com@MY.DOMAIN
Added key: 23version: 0
default etypes for default_tkt_enctypes: 23 17.
&gt;&gt;&gt; KrbAsReq creating message
&gt;&gt;&gt; KrbKdcReq send: kdc=server001.my.domain UDP:88, timeout=30000, number of retries =3, #bytes=171
&gt;&gt;&gt; KDCCommunication: kdc=server001.my.domain UDP:88, timeout=30000,Attempt =1, #bytes=171
&gt;&gt;&gt; KrbKdcReq send: #bytes read=189
&gt;&gt;&gt;Pre-Authentication Data:
     PA-DATA type = 11
     PA-ETYPE-INFO etype = 23, salt = 

&gt;&gt;&gt;Pre-Authentication Data:
     PA-DATA type = 19
     PA-ETYPE-INFO2 etype = 23, salt = null, s2kparams = null

&gt;&gt;&gt;Pre-Authentication Data:
     PA-DATA type = 2
     PA-ENC-TIMESTAMP
&gt;&gt;&gt;Pre-Authentication Data:
     PA-DATA type = 16

&gt;&gt;&gt;Pre-Authentication Data:
     PA-DATA type = 15

&gt;&gt;&gt; KdcAccessibility: remove server001.my.domain
&gt;&gt;&gt; KDCRep: init() encoding tag is 126 req type is 11
&gt;&gt;&gt;KRBError:
     sTime is Thu Dec 15 15:35:42 CET 2016 1481812542000
     suSec is 830454
     error code is 25
     error Message is Additional pre-authentication required
     sname is krbtgt/MY.DOMAIN@MY.DOMAIN
     eData provided.
     msgType is 30
&gt;&gt;&gt;Pre-Authentication Data:
     PA-DATA type = 11
     PA-ETYPE-INFO etype = 23, salt = 

&gt;&gt;&gt;Pre-Authentication Data:
     PA-DATA type = 19
     PA-ETYPE-INFO2 etype = 23, salt = null, s2kparams = null

&gt;&gt;&gt;Pre-Authentication Data:
     PA-DATA type = 2
     PA-ENC-TIMESTAMP
&gt;&gt;&gt;Pre-Authentication Data:
     PA-DATA type = 16

&gt;&gt;&gt;Pre-Authentication Data:
     PA-DATA type = 15

KrbAsReqBuilder: PREAUTH FAILED/REQ, re-send AS-REQ
default etypes for default_tkt_enctypes: 23 17.
Looking for keys for: HTTP/my.host.com@MY.DOMAIN
Added key: 23version: 0
Looking for keys for: HTTP/my.host.com@MY.DOMAIN
Added key: 23version: 0
default etypes for default_tkt_enctypes: 23 17.
&gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.ArcFourHmacEType
&gt;&gt;&gt; KrbAsReq creating message
&gt;&gt;&gt; KrbKdcReq send: kdc=server001.my.domain UDP:88, timeout=30000, number of retries =3, #bytes=254
&gt;&gt;&gt; KDCCommunication: kdc=server001.my.domain UDP:88, timeout=30000,Attempt =1, #bytes=254
&gt;&gt;&gt; KrbKdcReq send: #bytes read=104
&gt;&gt;&gt; KrbKdcReq send: kdc=server001.my.domain TCP:88, timeout=30000, number of retries =3, #bytes=254
&gt;&gt;&gt; KDCCommunication: kdc=server001.my.domain TCP:88, timeout=30000,Attempt =1, #bytes=254
&gt;&gt;&gt;DEBUG: TCPClient reading 1666 bytes
&gt;&gt;&gt; KrbKdcReq send: #bytes read=1666
&gt;&gt;&gt; KdcAccessibility: remove server001.my.domain
Looking for keys for: HTTP/my.host.com@MY.DOMAIN
Added key: 23version: 0
&gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.ArcFourHmacEType
&gt;&gt;&gt; KrbAsRep cons in KrbAsReq.getReply HTTP/my.host.com
principal is HTTP/my.host.com@MY.DOMAIN
Will use keytab
    [LoginContext]: login success
Commit Succeeded 

    [LoginContext]: commit success
Found KeyTab /path/to/tomcat/apache-tomcat-7.0.69/conf/sso.keytab for HTTP/my.host.com@MY.DOMAIN
Found KeyTab /path/to/tomcat/apache-tomcat-7.0.69/conf/sso.keytab for HTTP/my.host.com@MY.DOMAIN
Found ticket for HTTP/my.host.com@MY.DOMAIN to go to krbtgt/MY.DOMAIN@MY.DOMAIN expiring on Fri Dec 16 01:35:42 CET 2016
Entered SpNegoContext.acceptSecContext with state=STATE_NEW
SpNegoContext.acceptSecContext: receiving token = a0 82 13 79 30 82 13 75 a0 30 30 2e 06 09 2a 86 48 86 f7 12 01 02 02 
SpNegoToken NegTokenInit: reading Mechanism Oid = 1.2.840.113554.1.2.2
SpNegoToken NegTokenInit: reading Mechanism Oid = 1.2.840.48018.1.2.2
SpNegoToken NegTokenInit: reading Mechanism Oid = 1.3.6.1.4.1.311.2.2.30
SpNegoToken NegTokenInit: reading Mechanism Oid = 1.3.6.1.4.1.311.2.2.10
SpNegoToken NegTokenInit: reading Mech Token
SpNegoContext.acceptSecContext: received token of type = SPNEGO NegTokenInit
SpNegoContext: negotiated mechanism = 1.2.840.113554.1.2.2
Entered Krb5Context.acceptSecContext with state=STATE_NEW
Looking for keys for: HTTP/my.host.com@MY.DOMAIN
Added key: 23version: 0
        [Krb5LoginModule]: Entering logout
        [Krb5LoginModule]: logged out Subject
    [LoginContext]: logout success
</code></pre>

<p>the <em>recieved token</em> is a lot longer, I shortened it</p>

<p><strong>krb5.ini</strong></p>

<pre><code>[libdefaults]
    default_realm = MY.DOMAIN
    default_keytab_name = FILE:/path/to/tomcat/apache-tomcat-7.0.69/conf/sso.keytab
    default_tkt_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96
    default_tgs_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96
    permitted_enctypes   = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96

[realms]
    MY.DOMAIN  = {
        kdc = server001.my.domain
        admin_server = server001.my.domain
        default_domain = MY.DOMAIN
}

[domain_realm]
    .my.domain = MY.DOMAIN
    my.domain = MY.DOMAIN
</code></pre>

<p><strong>jaas.conf</strong></p>

<pre><code>spnego-client {
    com.sun.security.auth.module.Krb5LoginModule required;
};

spnego-server {
    com.sun.security.auth.module.Krb5LoginModule required
    storeKey=true
    useKeyTab=true
    keyTab="/path/to/tomcat/apache-tomcat-7.0.69/conf/sso.keytab"
    principal="HTTP/my.host.com@MY.DOMAIN"
    debug=true;
};
</code></pre>

<p><strong>web.xml</strong></p>

<pre><code>&lt;login-config&gt;
  &lt;auth-method&gt;SPNEGO&lt;/auth-method&gt;
&lt;/login-config&gt;

&lt;security-constraint&gt;
  &lt;web-resource-collection&gt;
    &lt;web-resource-name&gt;SSO Login&lt;/web-resource-name&gt;
    &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/web-resource-collection&gt;
  &lt;auth-constraint&gt;
    &lt;role-name&gt;*&lt;/role-name&gt;
  &lt;/auth-constraint&gt;
&lt;/security-constraint&gt;
</code></pre>

<p><strong>Architecture</strong></p>

<ul>
<li>AD Server Windows Server 2016</li>
<li>Application-Server Unix-Redhat6 with Oracle JVM and Tomcat 7.0.69</li>
<li>Client Windows 10 with Internet Explorer 11</li>
</ul>