Kerberos pre-authentication issues - why now?
Hi all,
We recently put up a new Windows 2003 Active Directory domain controller to replace a de-commissioned Windows 2000 DC. When my VPN users try to authenticate to it using Kerberos, they are getting rejected with a pre-authentication failed error. I know that this is a common issue with the ASA, and TAC has confirmed that there's no solution for it yet. However, we have another W2K3 DC that has never had this issue. So why now? Why this new DC? What's the difference between my DCs where one can authenticate a user with pre-authentication enabled and one can't?
Any help or information that I can get would be helpful.
Thanks,
- Steve
Hi JK,
Thanks for the reply.
Right, I understand that, and TAC directed me to the same document. But we have an existing domain controller that we are currently using the authenicate against; pre-authentication is enabled, and it works fine. It's only the NEW domain controller that has this problem. So I'm trying to figure out what the difference is!
I would rather NOT disable pre-authentication for all VPN users if possible - there are a lot of them and it lessens the security of Active Directory.
Thanks,
- Steve
Similar Messages
-
Kerberos pre-authentication failed
Hi,
I have a customer has the below issue:
After he changed their administrator account password on domain, event ID 4771 is continuously thrown in the security log in DCs. Below is a snapshot:
Also the below email alert from ADManager:
Alert Message:
Login failure for User 'Administrator' in server.domain.local'. Reason: 'Bad password'.
Severity:
Attention
Event Details
Domain
krbtgt/domain.LOCAL
Event Code
16
SID
%{S-1-5-21-428199501-1217283236-4064894256-500}
Client Host Name
Server.domain.local
Event Type
Failure
Remarks
Kerberos pre-authentication failed.
Logon Service
krbtgt/ domain.LOCAL
Domain Controller
DC.domain.local
User Name
Administrator
Client IP Address
IP
Failure Code
0x18
Logon Time
Apr 09,2015 11:42 AM
Failure Reason
Bad password
Record number
2197037173
Event Number
4771
They already changed the password for service accounts running using that admin account with new password. There is no issues in domain other than this, users can login and services are fine. However, account lockout policy is disabled and if it is enabled
I think they will have a huge issue due to this Kerberos authentication failure.
Please help!Hi,
Did you confirm the time sync issue?
The error code 0x25, means Workstation’s clock too far out of sync with the DC’s , so i suggest you could check the time snyc of the computer failing pre-auth with DC firstly.
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4771
Similar threads has been discussed:
https://social.technet.microsoft.com/forums/windowsserver/en-US/245aa714-8f2f-4ea7-b2a1-dd447c02fa93/accounts-lockedout
Regards.
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected] -
Kerberos Pre-Authentication - Security Vulnerabilities
I have an issue with some Java applets locking out AD accounts, or prompting for a password.
The solutions I have, and work, is to check the "Do not require Kerberos preauthentication" located in the user account of Active Directory Users and Computers, or to create a registry DWORD key called allowtgtsessionkey with a value of 1.
This key is located in
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters.
Can you advise by enabling this option or creating the reg key, does this open any security vulnerabilities? I have read on another forum that creating the key on a PC where a users has local admin rights, will be an issue, but was very vague.
Many thanks
LarryHi,
If the issue persists, please:
Find out from which machine/device bad password attempts are generated.
Locate any services/scheduled tasks/disconnected remote desktop connections/scripts/mapped drives which could be storing credentials, then clear stored credentials.
More information for you:
Troubleshooting Account Lockout
https://technet.microsoft.com/en-us/library/cc773155%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396
Account getting locked out
https://social.technet.microsoft.com/Forums/en-US/92454597-b414-4840-82fd-16dd92a1706d/account-getting-locked-out
Account Locked - Event 4771 Failure Code 0x18
https://social.technet.microsoft.com/Forums/windowsserver/en-US/6187d7e2-d38a-4ecd-bf80-12ce3589c8e1/account-locked-event-4771-failure-code-0x18?forum=winserversecurity
Error for Active Directory
https://social.technet.microsoft.com/Forums/windowsserver/en-US/4923356c-1820-4626-83f2-8a57a7c48ccc/error-for-active-directory?forum=winserverDS
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
[email protected] -
DAG Kerberos Authentication Issue Exchange 2010 on 2008R2 Servers
I have 2 Exchange 2010 servers in a DAG. The witness server is in site A along with one the Exchange servers. The second Exchange server is in a DR site. The DAG has been functioning fine for 1.5 yrs. Last weekend after a scheduled reboot of all 3 servers
involved (2 e-mail servers and the witness server), the e-mail server in the DR site cannot gain access to the witness share directory per the failover cluster manager. It says to check to see if the witness directory is on-line, etc... Using pings and
explorer, there is no problem for the DR site e-mail server to contact the witness server and directory. Even restablished the Quorem to the same directory, no issues. Upon doing a network trace though, I am receiving KERBEROS pre-authentication errors when
you start the Cluster service on the DR site e-mail server when it tries to contact the witness server:
(1.4 is the Witness server; 6.5 is the e-mail server in the DR site)
Source Destination
192.168.1.4","192.168.6.5","KRB5","319","KRB Error: KRB5KDC_ERR_PREAUTH_REQUIRED"
192.168.6.5","192.168.1.4","TCP","54","26049 > kerberos [FIN, ACK] Seq=235 Ack=266 Win=65792 Len=0"
192.168.6.5","192.168.1.4","TCP","66","26050 > kerberos [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1"
192.168.1.4","192.168.6.5","TCP","60","kerberos > 26049 [ACK] Seq=266 Ack=236 Win=66048 Len=0"
192.168.1.4","192.168.6.5","TCP","60","kerberos > 26049 [RST, ACK] Seq=266 Ack=236 Win=0 Len=0"
192.168.1.4","192.168.6.5","TCP","66","kerberos > 26050 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1406 WS=256 SACK_PERM=1"
192.168.6.5","192.168.1.4","TCP","54","26050 > kerberos [ACK] Seq=1 Ack=1 Win=66048 Len=0"
192.168.6.5","192.168.1.4","KRB5","368","AS-REQ"
192.168.1.4","192.168.6.5","KRB5","282","KRB Error: KRB5KDC_ERR_PREAUTH_FAILED"
192.168.6.5","192.168.1.4","TCP","54","26050 > kerberos [FIN, ACK] Seq=315 Ack=229 Win=65792 Len=0"
192.168.1.4","192.168.6.5","TCP","60","kerberos > 26050 [ACK] Seq=229 Ack=316 Win=66048 Len=0"
192.168.1.4","192.168.6.5","TCP","60","kerberos > 26050 [RST, ACK] Seq=229 Ack=316 Win=0 Len=0"
Thoughts anyone?Hi,
Unfortunately, the available information is not enough to have a clear view of the occurred behavior, it is not an efficient way to work in this community since we may need more resources, for example exchange log, detail cluster log (an application)
dump or ETL trace, which is not appropriate to handle in the community. I‘d like to suggest that you submit a service request to MS Professional tech support service so that a dedicated Support Professional can further assist with this request.
Please visit the below link to see the various paid support options that are available to better meet your needs.
http://support.microsoft.com/default.aspx?id=fh;en-us;offerprophone
Best regards,
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place. -
RDP pre-authentication: what does it actually do?
I'm trying to integrate Forefront TMG and RDS with SecurID authentication. I believe I'm very close to having it working, but I'm hitting a brick wall.
I have "require pre-authentication" set, and "pre-authentication server name" configured, as indicated in so many forum posts and HOWTOs.
No matter what I do, clients receive the error "authentication to the firewall failed due to missing firewall credentials." This is
after they have already successfully authenticated and visited the /RDWeb pages.
Using the TMG logs, procmon, and wireshark, I am 100% certain that no network activity is occurring from the RDP client when this error occurs; this error is being generated entirely on the client side, before it attempts to connect to anything. I understand
that this is what is expected; it is checking for the existence of a cookie.
But the cookie doesn't exist. Why? Because nothing is setting one. The only cookies the client receives during the entire process (logging in to rdweb and trying to launch an app) are the SecurID domain SSO cookie I set in TMG, and the persistent authentication
cookie I also set in TMG. RDweb itself is not issuing any cookie at all.
Can anyone please explain to me, what specific cookie is the RDP client looking for when "require pre-authentication" is enabled? And which component is meant to be setting it?
Obviously I'd be very grateful if anyone can tell me "run this command and it will start working" or whatever, but I'm really hoping to gain an engineering-level understanding of how it's
meant to work ;)
Hi,
Please double check the following article:
Configuring Forefront Threat Management Gateway Integration with RD Gateway Step-by-Step Guide
http://technet.microsoft.com/en-us/library/gg589607(v=ws.10).aspx
On the Forefront TMG server apply the Filter ipv4.address==<your public IP>
When client request of remote desktop is reaching to TMG server, please check if the TMG server is forwarding the packet to RDG server.
Looking forward to your feedback.
Regards,
Dollar Wang
Forum Support
TechNet Subscriber Support
If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback
here.
Technology changes life…… -
Pre-authentication information was invalid (24) authoriazation against AD
Hi all,
im going to be really desperate from this error message during the authentization to the Win2003 server where the Active Directory is running ... Im using Krb5LoginModule.
- Our administrator of the AD service has enabled DES encryption at the tested account.
- Im sure that entered password is correct, because im able to login via this password to our network.
- Entered Kerberos realm is in upper case...in the form (COMPANY.COM)
- Kerberos KDC contains IP adress of the Domain controller.
I really dont know why it doesnt work....:-(( Strange is that if i enable ticketCache to the ability to use the native ticket cache it works fine.....
My code is:
import javax.security.sasl.*;
import java.io.*;
import java.util.*;
import javax.security.auth.Subject;
import com.sun.security.auth.callback.TextCallbackHandler;
* This JaasAcn application attempts to authenticate a user
* and reports whether or not the authentication was successful.
public class JaasSample {
public static void main(String[] args) {
LoginContext lc = null;
java.util.Properties p = new java.util.Properties(System.getProperties());
try
lc = new LoginContext("JaasSample", new TextCallbackHandler());
catch (LoginException le)
System.err.println("Cannot create LoginContext. "
+ le.getMessage());
System.exit(-1);
catch (SecurityException se)
System.err.println("Cannot create LoginContext. "
+ se.getMessage());
System.exit(-1);
catch (Exception e)
System.out.println("Login failer: "+e.getMessage());
try {
lc.login();
Subject subject = lc.getSubject();
Iterator it = subject.getPrincipals().iterator();
while (it.hasNext())
System.out.println("Authenticated: " + it.next().toString());
it = subject.getPublicCredentials(Properties.class).iterator();
while (it.hasNext())
((Properties)it.next()).list(System.out);
lc.logout();
} catch (LoginException le) {
System.err.println("Authentication failed: ");
System.err.println(" " + le.getMessage());
System.exit(-1);
System.out.println("Authentication succeeded!");
}start.bat file:
"c:\Program Files\Java\jdk1.5.0_06\bin\java" -Djava.security.krb5.realm=BERIT.CZ -Djava.security.krb5.kdc=10.1.0.04 -Djava.security.krb5.debug=true -Djava.security.auth.login.config=jaas.conf JaasSample
jaas.conf file:
JaasSample {
com.sun.security.auth.module.Krb5LoginModule required useTicketCache="false" debug="true";
Output is:
c:\JAAS>"c:\Program Files\Java\jdk1.5.0_06\bin\java" -Djava.security.krb5.realm=
BERIT.CZ -Djava.security.krb5.kdc=10.1.0.04 -Djava.security.krb5.debug=true -Dja
va.security.auth.login.config=jaas.conf JaasSample
Debug is true storeKey false useTicketCache false useKeyTab false doNotPrompt f
alse ticketCache is null KeyTab is null refreshKrb5Config is false principal is
null tryFirstPass is false useFirstPass is false storePass is false clearPass is
false
Kerberos username [Kloucek]: User3
Kerberos password for User3: Poiu4566
[Krb5LoginModule] user entered username: User3
principal is [email protected]
Acquire TGT using AS Exchange
EncryptionKey: keyType=3 keyBytes (hex dump)=0000: 13 A1 F4 86 B6 1C BF 85
EncryptionKey: keyType=1 keyBytes (hex dump)=0000: 13 A1 F4 86 B6 1C BF 85
EncryptionKey: keyType=16 keyBytes (hex dump)=0000: 01 58 6E AE EF 25 15 43 F1
2C 40 46 7A 3D 2A B0 .Xn..%.C.,@Fz=*.
0010: 1F 16 9E B6 19 8A 46 68
[Krb5LoginModule] authentication failed
Pre-authentication information was invalid (24)
Authentication failed:
Pre-authentication information was invalid (24)
I tried all tips i found at this forum and other internet resources without luck...:-(((
Please heeeeelp!!!!!!!!!!!!!!!!!I have solve it....The reason of this problem was this:
Im accesing our network via this login properties:
login: My second name
pass: My password
Due to this fact i had entered this login properties into the Kerberos database too..., BUT KERBEROS had been expecting my fully qualified network name which is myfirstname.myseconame@KERBEROS-REALM!!!!!!!!!!!!!!!So after i had entered [email protected] instead of [email protected] it started to work!!!!! I hope this will help many other programmers.... -
Pre-authentication information was invalid (24)
Hi all,
im going to be really desperate from this error message during the authentization to the Win2003 server where the Active Directory is running ... Im using Krb5LoginModule.
- Our administrator of the AD service has enabled DES encryption at the tested account.
- Im sure that entered password is correct, because im able to login via this password to our network.
- Entered Kerberos realm is in upper case...in the form (COMPANY.COM)
- Kerberos KDC contains IP adress of the Domain controller.
I really dont know why it doesnt work....:-(( Strange is that if i enable ticketCache to the ability to use the native ticket cache it works fine.....
My code is:
import javax.security.sasl.*;
import java.io.*;
import java.util.*;
import javax.security.auth.Subject;
import com.sun.security.auth.callback.TextCallbackHandler;
* This JaasAcn application attempts to authenticate a user
* and reports whether or not the authentication was successful.
public class JaasSample {
public static void main(String[] args) {
LoginContext lc = null;
java.util.Properties p = new java.util.Properties(System.getProperties());
try
lc = new LoginContext("JaasSample", new TextCallbackHandler());
catch (LoginException le)
System.err.println("Cannot create LoginContext. "
+ le.getMessage());
System.exit(-1);
catch (SecurityException se)
System.err.println("Cannot create LoginContext. "
+ se.getMessage());
System.exit(-1);
catch (Exception e)
System.out.println("Login failer: "+e.getMessage());
try {
lc.login();
Subject subject = lc.getSubject();
Iterator it = subject.getPrincipals().iterator();
while (it.hasNext())
System.out.println("Authenticated: " + it.next().toString());
it = subject.getPublicCredentials(Properties.class).iterator();
while (it.hasNext())
((Properties)it.next()).list(System.out);
lc.logout();
} catch (LoginException le) {
System.err.println("Authentication failed: ");
System.err.println(" " + le.getMessage());
System.exit(-1);
System.out.println("Authentication succeeded!");
}start.bat file:
"c:\Program Files\Java\jdk1.5.0_06\bin\java" -Djava.security.krb5.realm=BERIT.CZ -Djava.security.krb5.kdc=10.1.0.04 -Djava.security.krb5.debug=true -Djava.security.auth.login.config=jaas.conf JaasSample
jaas.conf file:
JaasSample {
com.sun.security.auth.module.Krb5LoginModule required useTicketCache="false" debug="true";
Output is:
c:\JAAS>"c:\Program Files\Java\jdk1.5.0_06\bin\java" -Djava.security.krb5.realm=
BERIT.CZ -Djava.security.krb5.kdc=10.1.0.04 -Djava.security.krb5.debug=true -Dja
va.security.auth.login.config=jaas.conf JaasSample
Debug is true storeKey false useTicketCache false useKeyTab false doNotPrompt f
alse ticketCache is null KeyTab is null refreshKrb5Config is false principal is
null tryFirstPass is false useFirstPass is false storePass is false clearPass is
false
Kerberos username [Kloucek]: User3
Kerberos password for User3: Poiu4566
[Krb5LoginModule] user entered username: User3
principal is [email protected]
Acquire TGT using AS Exchange
EncryptionKey: keyType=3 keyBytes (hex dump)=0000: 13 A1 F4 86 B6 1C BF 85
EncryptionKey: keyType=1 keyBytes (hex dump)=0000: 13 A1 F4 86 B6 1C BF 85
EncryptionKey: keyType=16 keyBytes (hex dump)=0000: 01 58 6E AE EF 25 15 43 F1
2C 40 46 7A 3D 2A B0 .Xn..%.C.,@Fz=*.
0010: 1F 16 9E B6 19 8A 46 68
[Krb5LoginModule] authentication failed
Pre-authentication information was invalid (24)
Authentication failed:
Pre-authentication information was invalid (24)
I tried all tips i found at this forum and other internet resources without luck...:-(((
Please heeeeelp!!!!!!!!!!!!!!!!!Hi all,
im going to be really desperate from this error message during the authentization to the Win2003 server where the Active Directory is running ... Im using Krb5LoginModule.
- Our administrator of the AD service has enabled DES encryption at the tested account.
- Im sure that entered password is correct, because im able to login via this password to our network.
- Entered Kerberos realm is in upper case...in the form (COMPANY.COM)
- Kerberos KDC contains IP adress of the Domain controller.
I really dont know why it doesnt work....:-(( Strange is that if i enable ticketCache to the ability to use the native ticket cache it works fine.....
My code is:
import javax.security.sasl.*;
import java.io.*;
import java.util.*;
import javax.security.auth.Subject;
import com.sun.security.auth.callback.TextCallbackHandler;
* This JaasAcn application attempts to authenticate a user
* and reports whether or not the authentication was successful.
public class JaasSample {
public static void main(String[] args) {
LoginContext lc = null;
java.util.Properties p = new java.util.Properties(System.getProperties());
try
lc = new LoginContext("JaasSample", new TextCallbackHandler());
catch (LoginException le)
System.err.println("Cannot create LoginContext. "
+ le.getMessage());
System.exit(-1);
catch (SecurityException se)
System.err.println("Cannot create LoginContext. "
+ se.getMessage());
System.exit(-1);
catch (Exception e)
System.out.println("Login failer: "+e.getMessage());
try {
lc.login();
Subject subject = lc.getSubject();
Iterator it = subject.getPrincipals().iterator();
while (it.hasNext())
System.out.println("Authenticated: " + it.next().toString());
it = subject.getPublicCredentials(Properties.class).iterator();
while (it.hasNext())
((Properties)it.next()).list(System.out);
lc.logout();
} catch (LoginException le) {
System.err.println("Authentication failed: ");
System.err.println(" " + le.getMessage());
System.exit(-1);
System.out.println("Authentication succeeded!");
start.bat file:
"c:\Program Files\Java\jdk1.5.0_06\bin\java" -Djava.security.krb5.realm=BERIT.CZ -Djava.security.krb5.kdc=10.1.0.04 -Djava.security.krb5.debug=true -Djava.security.auth.login.config=jaas.conf JaasSample
jaas.conf file:
JaasSample {
com.sun.security.auth.module.Krb5LoginModule required useTicketCache="false" debug="true";
Output is:
c:\JAAS>"c:\Program Files\Java\jdk1.5.0_06\bin\java" -Djava.security.krb5.realm=
BERIT.CZ -Djava.security.krb5.kdc=10.1.0.04 -Djava.security.krb5.debug=true -Dja
va.security.auth.login.config=jaas.conf JaasSample
Debug is true storeKey false useTicketCache false useKeyTab false doNotPrompt f
alse ticketCache is null KeyTab is null refreshKrb5Config is false principal is
null tryFirstPass is false useFirstPass is false storePass is false clearPass is
false
Kerberos username [Kloucek]: User3
Kerberos password for User3: Poiu4566
[Krb5LoginModule] user entered username: User3
principal is [email protected]
Acquire TGT using AS Exchange
EncryptionKey: keyType=3 keyBytes (hex dump)=0000: 13 A1 F4 86 B6 1C BF 85
EncryptionKey: keyType=1 keyBytes (hex dump)=0000: 13 A1 F4 86 B6 1C BF 85
EncryptionKey: keyType=16 keyBytes (hex dump)=0000: 01 58 6E AE EF 25 15 43 F1
2C 40 46 7A 3D 2A B0 .Xn..%.C.,@Fz=*.
0010: 1F 16 9E B6 19 8A 46 68
[Krb5LoginModule] authentication failed
Pre-authentication information was invalid (24)
Authentication failed:
Pre-authentication information was invalid (24)I tried all tips i found at this forum and other internet resources without luck...:-(((
Please heeeeelp!!!!!!!!!!!!!!!!! -
JAAS, AD, Pre-authentication information was invalid (24)
Our application is java based, and we use JAAS to allow authentication for the users though Active Directory.
In particular we alwyas encourage our prospect clients to use Krb5LoginModule.
We would
1. add new user to AD , set DES for the account, reset the password
2.
setspn -A host/newUser.DOMAIN.COM newUser
setspn -A HTTP/newUser.DOMAIN.COM newUser
run ktpass
pass the keytab to the server where the server application will be running from and setup there
-Djava.security.auth.login.config=c:\config\config.conf
-Djava.security.realm=DOMANNAME
-Djava.security.kdc=<Ip address of kdc>
where config.conf file would have line
Krb5LoginModule tryFirstPass=true storePass=true storeKey=true useKeyTab=true keyTab="c:\keytab.key";
and it works...
However, I have encountered a situation where the above would return
Pre-authentication information was invalid (24) error.
We have reset the password, re-generate the keytab, it is the same time zone ... and nothing.
Then I asked to have a new user added (just to test it) - and it worked for the new user.
Now - what do I need to do to get to work for the hunders of others?
ThanksSupport for the new Kerberos preauthentication mechanisms is available in Java SE 6.
In addition, the pre-auth support has been backported to J2SE 5.0 Update 8.
Seema -
Good Afternoon,
I am trying to add some code to a custom authentication routine to allow for tracking in the APEX supplied logs. Currently the authentication code processes the Login attempt and either allows access or returns the user back to the login page with a error message in case they entered an invalid username/password.
I had added in each case the required two lines of code:
APEX_UTIL.SET_CUSTOM_AUTH_STATUS('Test Message.. Ignore Me')
APEX_UTIL.SET_AUTHENTICATION_RESULT(1) (Just as a test, will use more accurate values later)
Now when I login with a non-existent user it logs it as a successful login, with NO custom text loaded...
Can anyone suggest an idea here, other than using a custom logging table?
Thank you,
Tony Miller
Webster, TXHi,
I did test set item session state , and it works OK for me.
First I did forgot create that item when there was errors in my test.
Do you have some computations, validations in login page ? Any application process that might run ?
Or do you have any Page Sentry Function, Session Verify Function or Pre-Authentication Process in authentication scheme ?
What is you session not valid in authentication scheme ?
Have you tested your code on apex.oracle.com ?
Br,Jari
Edited by: jarola on Apr 16, 2010 9:25 AM
I did more test.
If you try login with some user name and password
http://apex.oracle.com/pls/otn/f?p=12444
Then you can try login with user EXPIRED and passwd test.
To see access log login with user ACTIVE and passwd test.
Then go page 10 you can see access log
http://apex.oracle.com/pls/otn/f?p=12444:10
My auth function is
create or replace
function custom_auth_2 (p_username in VARCHAR2, p_password in VARCHAR2)
return BOOLEAN
is
l_password varchar2(4000);
l_stored_password varchar2(4000);
l_expires_on date;
l_count number;
begin
-- First, check to see if the user is in the user table
select count(*) into l_count from demo_users where user_name = p_username;
if l_count > 0 then
-- First, we fetch the stored hashed password & expire date
select password, expires_on into l_stored_password, l_expires_on
from demo_users where user_name = p_username;
-- Next, we check to see if the user's account is expired
-- If it is, return FALSE
if l_expires_on > sysdate or l_expires_on is null then
-- If the account is not expired, we have to apply the custom hash
-- function to the password
l_password := custom_hash(p_username, p_password);
-- Finally, we compare them to see if they are the same and return
-- either TRUE or FALSE
0, 'AUTH_SUCCESS',
1, 'AUTH_UNKNOWN_USER',
2, 'AUTH_ACCOUNT_LOCKED',
3, 'AUTH_ACCOUNT_EXPIRED',
4, 'AUTH_PASSWORD_INCORRECT',
5, 'AUTH_PASSWORD_FIRST_USE',
6, 'AUTH_ATTEMPTS_EXCEEDED',
7, 'AUTH_INTERNAL_ERROR',
if l_password = l_stored_password then
APEX_UTIL.SET_CUSTOM_AUTH_STATUS('SUCCEEDED');
APEX_UTIL.SET_AUTHENTICATION_RESULT(0);
return true;
else
APEX_UTIL.SET_CUSTOM_AUTH_STATUS('WRONG_PASSWORD');
APEX_UTIL.SET_AUTHENTICATION_RESULT(4);
APEX_UTIL.SET_SESSION_STATE('LOGIN_MESSAGE','You have entered invalid Username or Password');
return false;
end if;
else
APEX_UTIL.SET_CUSTOM_AUTH_STATUS('ACCOUNT_EXPIRED');
APEX_UTIL.SET_AUTHENTICATION_RESULT(3);
APEX_UTIL.SET_SESSION_STATE('LOGIN_MESSAGE','Your account has been locked');
return false;
end if;
else
-- The username provided is not in the DEMO_USERS table
APEX_UTIL.SET_CUSTOM_AUTH_STATUS('USER_NOT_FOUND');
APEX_UTIL.SET_AUTHENTICATION_RESULT(1);
APEX_UTIL.SET_SESSION_STATE('LOGIN_MESSAGE','You have entered invalid Username or Password');
return false;
end if;
end;I have application item LOGIN_MESSAGE and in login page I did also create before header process.
APEX_APPLICATION.G_NOTIFICATION := :LOGIN_MESSAGE;
:LOGIN_MESSAGE := NULL;To show that item message in notification. It do not affect how auth work.
It seems work ok -
ACS 5.2 Authentication Issue with Local & Global ADs
Hi I am facing authentication issue with ACS 5.2. Below is AAA flow (EAP-TLS),
- Wireless Users >> Cisco WLC >> ADs <-- everything OK
- Wireless Users >> Cisco WLC >> ACS 5.2 >> ADs <-- problem
Last time I tested with ACS, it worked but didn't do migration as there'll be changes from ADs.
Now my customer wants ACS migration by creating new Group in AD, I also update ACS config.
For the user from the old group, authentication is ok.
For the user from the new group, authentication fails. With subject not found error, showing the user is from the old group.
Seems like ACS is querying from old records (own cache or database). Already restared the ACS but still the same error.
Can anyone advice to troubleshoot the issue?
Note: My customer can only access their local ADs (trusted by Global ADs). Local ADs & ACS are in the same network, ACS should go to local AD first.
How can we check or make sure it?
Thanks ahead,
YeHello,
There is an enhacement request open already:
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCte92062
ACS should be able to query only desired DCs
Symptom:
Currently on 5.0 and 5.1, the ACS queries the DNS with the domain, in order to get a list of all the DCs in the domain and then tries to communicate with all of them.If the connection to even one DC fails, then the ACS connection to the domain is declared as failed.A lot of customers are asking for a change on this behavior.
It should be possible to define which DCs to contact and/or make ACS to interpret DNS Resource Records Registered by the Active Directory Domain Controller to facilitate the location of domain controllers. Active Directory uses service locator, or SRV, records. An SRV record is a new type of DNS record described in RFC 2782, and is used to identify services located on a Transmission Control Protocol/Internet Protocol (TCP/IP) network.
Conditions:
Domain with multiple DCs were some are not accessible from the ACS due to security/geographic constraints.
Workaround:
Make sure ALL DCs are UP and reachable from the ACS.
At the moment, we cannot determine which Domain Controller on the AD the ACS will contact. The enhacement request will include a feature on which we can specify the appropriate the Domain Controllers the ACS should contact on a AD Domain.
Hope this clarifies it.
Regards. -
Wireless Client Authentication issues when roaming Access Points (Local)
I have a Cisco 5508 with Software version 7.4.121.0 and Field Recovery 7.6.101.1.
There are a handful of clients that when roaming between AP's with the same SSID that get an authentication issue and have to restart the wireless to get back on.
From Cisco ISE
Event
5400 Authentication failed
Failure Reason
11514 Unexpectedly received empty TLS message; treating as a rejection by the client
Resolution
Ensure that the client's supplicant does not have any known compatibility issues and that it is properly configured. Also ensure that the ISE server certificate is trusted by the client, by configuring the supplicant with the CA certificate that signed the ISE server certificate. It is strongly recommended to not disable the server certificate validation on the client!
Root cause
While trying to negotiate a TLS handshake with the client, ISE expected to receive a non-empty TLS message or TLS alert message, but instead received an empty TLS message. This could be due to an inconformity in the implementation of the protocol between ISE and the supplicant. For example, it is a known issue that the XP supplicant sends an empty TLS message instead of a non-empty TLS alert message. It might also involve the supplicant not trusting the ISE server certificate for some reason. ISE treated the unexpected message as a sign that the client rejected the tunnel establishment.
I am having a hard time figuring out what is causing this. My assumption is if there were a problem with the Controller or AP configurations then it would happen to everyone. My further assumption is if the client had a problem with their laptop (windows 7) then why does work at other times? So I have checked and the ISE certificate is trusted by client.
Is something happening that the previous access point is holding on to the mac and the return authentication traffic is going to the old AP instead of the new one or something like that which is corrupting the data?
I also had this from Splunk for the same client:
Mar 5 13:44:51 usstlz-piseps01 CISE_Failed_Attempts 0014809622 1 0 2015-03-05 13:44:51.952 +00:00 0865003824 5435 NOTICE RADIUS: NAS conducted several failed authentications of the same scenario
FailureReason="12929 NAS sends RADIUS accounting update messages too frequently"
Any help on this would be appreciated. These error messages give me an idea but doesn't give me the exact answer to why the problem occurred and what needs to be done to fix it.
ThanksFurther detail From ISE for the failure:
11001
Received RADIUS Access-Request
11017
RADIUS created a new session
15049
Evaluating Policy Group
15008
Evaluating Service Selection Policy
15048
Queried PIP
15048
Queried PIP
15004
Matched rule
15048
Queried PIP
15048
Queried PIP
15004
Matched rule
11507
Extracted EAP-Response/Identity
12500
Prepared EAP-Request proposing EAP-TLS with challenge
11006
Returned RADIUS Access-Challenge
11001
Received RADIUS Access-Request
11018
RADIUS is re-using an existing session
12301
Extracted EAP-Response/NAK requesting to use PEAP instead
12300
Prepared EAP-Request proposing PEAP with challenge
11006
Returned RADIUS Access-Challenge
11001
Received RADIUS Access-Request
11018
RADIUS is re-using an existing session
12302
Extracted EAP-Response containing PEAP challenge-response and accepting PEAP as negotiated
12318
Successfully negotiated PEAP version 0
12800
Extracted first TLS record; TLS handshake started
12805
Extracted TLS ClientHello message
12806
Prepared TLS ServerHello message
12807
Prepared TLS Certificate message
12810
Prepared TLS ServerDone message
12305
Prepared EAP-Request with another PEAP challenge
11006
Returned RADIUS Access-Challenge
11001
Received RADIUS Access-Request
11018
RADIUS is re-using an existing session
12304
Extracted EAP-Response containing PEAP challenge-response
12305
Prepared EAP-Request with another PEAP challenge
11006
Returned RADIUS Access-Challenge
11001
Received RADIUS Access-Request
11018
RADIUS is re-using an existing session
12304
Extracted EAP-Response containing PEAP challenge-response
12305
Prepared EAP-Request with another PEAP challenge
11006
Returned RADIUS Access-Challenge
11001
Received RADIUS Access-Request
11018
RADIUS is re-using an existing session
12304
Extracted EAP-Response containing PEAP challenge-response
12305
Prepared EAP-Request with another PEAP challenge
11006
Returned RADIUS Access-Challenge
11001
Received RADIUS Access-Request
11018
RADIUS is re-using an existing session
12304
Extracted EAP-Response containing PEAP challenge-response
12305
Prepared EAP-Request with another PEAP challenge
11006
Returned RADIUS Access-Challenge
11001
Received RADIUS Access-Request
11018
RADIUS is re-using an existing session
12304
Extracted EAP-Response containing PEAP challenge-response
12305
Prepared EAP-Request with another PEAP challenge
11006
Returned RADIUS Access-Challenge
11001
Received RADIUS Access-Request
11018
RADIUS is re-using an existing session
12304
Extracted EAP-Response containing PEAP challenge-response
12305
Prepared EAP-Request with another PEAP challenge
11006
Returned RADIUS Access-Challenge
11001
Received RADIUS Access-Request
11018
RADIUS is re-using an existing session
12304
Extracted EAP-Response containing PEAP challenge-response
11514
Unexpectedly received empty TLS message; treating as a rejection by the client
12512
Treat the unexpected TLS acknowledge message as a rejection from the client
11504
Prepared EAP-Failure
11003
Returned RADIUS Access-Reject -
Error with Pre-Authentication for Windows Desktop SSO
When I try to use the windows desktop sso module created in the Access Manager I get an error in the amAuthWindowsDesktopSSO file, but I don't know what I'm doing erroneous. It's not an access manager problem, I can't get kinit to work either. I think I'm following the directions correctly from the manual.
Are these ktpass commands setup right?
The Windows AD administrator created the accounts:
C:\>ktpass -princ HOST/[email protected] -pass amdev -mapuser AD\amdev$ -out amdev.keytab
Targeting domain controller: dc2.ad.tcpip.com
Successfully mapped HOST/amdev.tcpip.com to AMDEV$.
WARNING: Account AMDEV$ is not a user account (uacflags=0x1021).
WARNING: Resetting AMDEV$'s password may cause authentication problems if AMDEV$ is being used as a server.
Reset AMDEV$'s password [y/n]? y
Key created.
Output keytab to amdev.keytab:
Keytab version: 0x502
keysize 56 HOST/[email protected] ptype 1 (KRB5_NT_PRINCIPAL) vno 3 etype 0x3 (DES-CBC-MD5) keylength 8 (0x023efe
3e6846d3cd)
Account AMDEV$ has been set for DES-only encryption.
C:\>ktpass -princ HTTP/[email protected] -pass amdev -mapuser AD\amdev$ -out amdev-http.keytab
Targeting domain controller: dc2.ad.tcpip.com
Successfully mapped HTTP/amdev.tcpip.com to AMDEV$.
WARNING: Account AMDEV$ is not a user account (uacflags=0x201021).
WARNING: Resetting AMDEV$'s password may cause authentication problems if AMDEV$ is being used as a server.
Reset AMDEV$'s password [y/n]? y
Key created.
Output keytab to amdev-http.keytab:
Keytab version: 0x502
keysize 56 HTTP/[email protected] ptype 1 (KRB5_NT_PRINCIPAL) vno 4 etype 0x3 (DES-CBC-MD5) keylength 8 (0x45201c
f4d3ec43e6)
Account AMDEV$ has been set for DES-only encryption.
C:\>I can read the keys with ktutil.
ktutil: rkt amdev-http.keytab
ktutil: list
slot KVNO Principal
1 4 HTTP/[email protected]
ktutil: rkt amdev.keytab
ktutil: list
slot KVNO Principal
1 4 HTTP/[email protected]
2 3 HOST/[email protected]
ktutil: wkt amdev2.keytabI then try to do a kinit with the principal:
kinit -k -t amdev2.keytab HTTP/[email protected]
kinit(v5): Preauthentication failed while getting initial credentialsAccess Manager reports similar problem on access:
01/17/2007 10:23:56:699 AM CST: Thread[service-j2ee-2,5,main]
Stack trace:
javax.security.auth.login.LoginException: Pre-authentication information was invalid (24)
at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:652)
at com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:512)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:585)
. . .Something deep, dark, and inside Kerberos way outside of my knowledge base was the problem.
I could always get a kinit with the HTTP/amdev.tcpip.com service to work. I never got the keytabs from the output of ktpass to operate. I used ktutil to create keytab entries all in vain, kinit using the keytab always resulted in a PA error, although the time clocks are setup the same.
The AD administrator created the account, this time as a user account, not a machine account, and the keytabs from the Windows domain controller finally worked.
If anyone knows the difference between machine and user accounts are in AD, I would be obliged for his/her explanation. The UPN and SPN look the same in the directory. I'm at a loss. However, very glad to finally have this working. -
Pre-authentication failed in krb
Hi All,
Wee also facing the same issue, but in a different way.
our java application accepts first 100(around) krb auth requests and the rest of the requests are droped out, during the droping it simply show the message like pre-authentication failed
What is doubt is, do we have any constraint on number of concurrent access in krb?
im using tomcat and casified sakai with apache2Hi All,
Wee also facing the same issue, but in a different way.
our java application accepts first 100(around) krb auth requests and the rest of the requests are droped out, during the droping it simply show the message like pre-authentication failed
What is doubt is, do we have any constraint on number of concurrent access in krb?
im using tomcat and casified sakai with apache2 -
Pre-authentication ACL disconnects
Hi,
We have a Guest WLAN where an pre authentication ACL is configured. It works but the client gets disconnected after a while. The session time-out / idle time out etc. is configured on a higher value than the actuel disconnect (+/- 15min) takes place.
When the client is authenticated (and does not use the pre auth ACL) the client doesn't get disconnected.
It seems like the same issue as the following threads but it doesn't state a solution :
https://supportforums.cisco.com/message/3687872#3687872
https://supportforums.cisco.com/message/3424053
I'm running code 7.4.110.0
any ideas ?Hi,
If clients are in Webauth_Reqd state, no matter if they are active or idle, the clients will get de-authenticated after a web-auth required timeout period (for example, 300 seconds and this time is non-user configurable). All traffic from the client (allowed via Pre-Auth ACL) will be disrupted. If the client associates again, it will move back to the Webauth_Reqd state.
There is an enhancement request filed esp. for your situation with Pre-auth ACL.
CSCtj32812 DHCP Option to mitigate the problem of guest client rejoining network
https://tools.cisco.com/bugsearch/bug/CSCtj32812
Regards
Dont forget to rate helpful posts -
Invoking webservice-Authentication issue
Hi All,
I need a help to solve the given below issue.
Scenario is to use the Webservice concept for the integration between non SAP system ( webservice) with the non SAP System( webservice) via PI using SOAP Adapter.
I have generated the WSDL file from PI and given it to the Source System.When I tried testing with the SOAP Client (Altova XML Spy) to PI , the establishment of connection is fine for HTTP (the userID and Password is given in the prompt window of XMLSpy tool).Getting the message as "Webservice has sent an empty response".
But the problem occur when the Java Client tries to invoke the webservice from their desktop(within the network).
Error message from Java client while connecting is given below( pasted few lines):
org.apache.commons.httpclient.auth.AuthChallengeProcessor selectAuthScheme
INFO: basic authentication scheme selected
Jan 15, 2008 9:56:13 AM org.apache.commons.httpclient.HttpMethodDirector processWWWAuthChallenge
INFO: No credentials available for BASIC 'XISOAPApps'@192.85.27.136:50800
Jan 15, 2008 9:56:13 AM org.codehaus.xfire.transport.http.HttpChannel sendViaClient
I also tried giving the user ID and Password in the URL of SOAP Address .But still it did not work out.I have gone through so many blogs ( How to remove the authentication in sender SOAP Adapter).But that option is not accepted as we are changing the SAP Standard code.
I would like to know whether the user/password authentication is to be done in the visual administrator in PI or Java webclient should write any code from their side for authentication ( user Id/Password).
If the code is to be written in Java ,Can you give me the piece of code written for authentication.
Right now I am only testing the interface between the Source and the PI System.
Please provide your assistance.
Regards
B.DheepaThe Java Cient has to provide the user name and password.
You can use the folowing snippet
connection = url.openConnection();
if( connection instanceof HttpURLConnection )
((HttpURLConnection)connection).setRequestMethod("POST");
connection.setRequestProperty("Content-Type","text/xml");
connection.setDoOutput(true);
String password = User + ":" + Password ;
String encodedPassword = new String(new BASE64Encoder().encode(password.getBytes()));
connection.setRequestProperty ("Authorization", "Basic " + encodedPassword);
connection.connect();
Please award points if you find the message useful
Edited by: Kanwaljit Singh on Jan 22, 2008 11:03 PM
Maybe you are looking for
-
Error when trying to create a web service from a wsdl file using jdeveloper
Hello, I'm using the latest jdeveloper and jdk 6 update 20 on solaris sparc 10. When I'm trying to create a web service from a wsdl on the java EE 1.5 platform i get the following error: Validation failed: java.lang.NoSuchMethodException: com.sun.too
-
Error when run crystal report with store procedure in JSP
I try to run report which is developed by crystal report XI and store procedure (SQL 2005) with JSP. But it occurs error that is "com.crystaldecisions.reports.reportengineinterface.JPEReportSource - failed to process getPage request: No results were
-
XL reporter to show zero rather than #Ref for account section with no value
Hi, Customer is using 2007A PL30. They do not want Profit&Loss and Balance Sheet to show if the account is having zero value. Eg. Subsection of P&L report Payroll Salary 0.00 Bonus 0.00 Casula wages
-
Solaris 10 - print services not running
Hi One of our servers has just been upgraded from Solaris 9 to 10 but we are having problems getting the lp scheduler to start. We have tried starting the service manually by issuing *'svcadm -v enable application/print/server'* which returns '*svc:/
-
Is fallback to rtmfp via server a valid approach?
Hi, We are in the process of moving from Cirrus to own FMS 5 server ( upgraded from 3.5 ). Would love to reap UDP related benefits even in case we have to fallback to server due to NAT issues. I see this work in general, however, one client is behind