Malformed PAC logon info on new KerberosToken

问题

I'm using the code here to get authentication information from a Kerberos token. In there I've configured the domainUsername and domainUserPassword and just ran it as specified in the readme.md.

Then, from a browser that is in the AD domain, I connect to http://server:8080/spnego and I see on the opened page my username@domain. The page should also contain the SID of the AD groups to which my user belongs.

Looking at the server logs, I see:

org.jaaslounge.decoding.DecodingException: Malformed PAC logon info.
    at org.jaaslounge.decoding.pac.PacLogonInfo.<init>(PacLogonInfo.java:209)
    at org.jaaslounge.decoding.pac.Pac.<init>(Pac.java:45)
    at org.jaaslounge.decoding.kerberos.KerberosPacAuthData.<init>(KerberosPacAuthData.java:13)
    at org.jaaslounge.decoding.kerberos.KerberosAuthData.parse(KerberosAuthData.java:21)
    at org.jaaslounge.decoding.kerberos.KerberosRelevantAuthData.<init>(KerberosRelevantAuthData.java:41)
    at org.jaaslounge.decoding.kerberos.KerberosAuthData.parse(KerberosAuthData.java:18)
    at org.jaaslounge.decoding.kerberos.KerberosEncData.<init>(KerberosEncData.java:136)
    at org.jaaslounge.decoding.kerberos.KerberosTicket.<init>(KerberosTicket.java:103)
    at org.jaaslounge.decoding.kerberos.KerberosApRequest.<init>(KerberosApRequest.java:62)
    at org.jaaslounge.decoding.kerberos.KerberosToken.<init>(KerberosToken.java:52)
    at com.example.ManualSpnegoNegotiateServlet.attemptNegotiation(ManualSpnegoNegotiateServlet.java:271)

Line 271 is the following

KerberosToken token = new KerberosToken(kerberosTokenData, keys);

That error message is too vague. I've no idea how to continue and I get the same error from different clients.

Does anyone have any tip about this?

回答1:

I've figured this one out myself. It turns out that the message "Malformed PAC logon info" is actually correct. The code failed when it was trying to get the "Resource groups data".

Initially I thought that the PAC_LOGON_INFO structure has changed since the last jaaslounge implementation was written (somewhere in 2010). I thought that because the MS-PAC specification does not mention it at all.

Actually, the problem is coming from a completely different place: the KDC. It's running on a Win Server 2012, version in which Microsoft added by default resource SID Compression.

There you have it, if you turn off resource SID Compression on the KDC, everything will start working (no need to touch anything else, i.e. the version of jaaslounge or to patch hava with an unlimited JCE policy).

来源：https://stackoverflow.com/questions/28221440/malformed-pac-logon-info-on-new-kerberostoken

标签

java

kerberos

jaas