Program fails in Krb5LoginModule on Snow Leopard (Mac OS X 10.6)

Question

Hi,
FWIW, I've already file a bug report with Apple for this, but maybe you can help me. We have a program that authenticates against Active Directory using Krb5LoginModule. It's been working for years under Mac OS X, Windows, Linux and FreeBSD, but under Snow Leopard (Mac OS X 10.6), using JRE 1.6.0_15 it fails with the following stack trace:
09:16:36,451 ERROR LoginDialog:225 - Password check failed: java.lang.IllegalArgumentException: EncryptionKey: Key bytes cannot be null!
     at sun.security.krb5.EncryptionKey.<init>(EncryptionKey.java:214)
     at sun.security.krb5.EncryptionKey.acquireSecretKeys(EncryptionKey.java:191)
     at sun.security.krb5.EncryptionKey.acquireSecretKeys(EncryptionKey.java:159)
     at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:665)
     at com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:542)
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
     at java.lang.reflect.Method.invoke(Method.java:597)
     at javax.security.auth.login.LoginContext.invoke(LoginContext.java:769)
     at javax.security.auth.login.LoginContext.access$000(LoginContext.java:186)
     at javax.security.auth.login.LoginContext$4.run(LoginContext.java:683)
     at java.security.AccessController.doPrivileged(Native Method)
     at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)
     at javax.security.auth.login.LoginContext.login(LoginContext.java:579)
     at de.unikoeln.rrz.uklanadmin.services.LoginService.checkPassword(LoginService.java:47)I've read the source and found that pre-auth works. Actually that's all we care about, we don't need the keys at all! But this call in Krb5LoginModule fails:
              // update keys after pre-auth
              encKeys = EncryptionKey.acquireSecretKeys(
               password, principal.getSalt());Please refer to http://openradar.appspot.com/radar?id=76405 for more details.

Answer 1

Thanks. I'd already set debug=true in the config file (and with map.put in your example). Apple does indeed use /Library/Preferences/edu.mit.Kerberos instead of /etc/krb5.conf. I can see that the settings there are picked up by programs I run in the Terminal, e.g. kinit. I'm not so sure they're picked up by the JDK. I have tried to set permitted_enctypes to just des-cbc-crc, but that didn't seem to have any effect.
As for your code example, the result is exactly the same (as I had expected). krb5.initialize() works fine, but in login(), at exactly the same spot in the source, I get exactly the same stack trace. For reference, it's this block in attemptAuthentication():
  669                   // We can't get the key from the keytab so prompt
  670                   if (encKeys == null) {
  671                       promptForPass(getPasswdFromSharedState);
  672  
  673                       encKeys = EncryptionKey.acquireSecretKeys(
  674                           password, principal.getSalt());
  675  
  676                       if (isInitiator) {
  677                           if (debug)
  678                               System.out.println("Acquire TGT using AS Exchange");
  679                           cred = Credentials.acquireTGT(principal,
  680                                                   encKeys, password);
  681                           // update keys after pre-auth
  682                           encKeys = EncryptionKey.acquireSecretKeys(password,
  683                                                           principal.getSalt());
  684                       }
  685                   }The call in line 673 succeeds, but the one in line 682 fails. The reason is in this method:
    182       public static EncryptionKey[] acquireSecretKeys(char[] password,
  183           String salt, boolean pa_exists, int pa_etype, byte[] pa_s2kparams)
  184           throws KrbExceptionThere it's this part:
  204           EncryptionKey[] encKeys = new EncryptionKey[etypes.length];
  205           for (int i = 0; i < etypes.length; i++) {
  206               if (EType.isSupported(etypes)) {
207 encKeys[i] = new EncryptionKey(
208 stringToKey(password, salt, pa_s2kparams, etypes[i]),
209 etypes[i], null);
210 }For one of the values in etype[], the stringToKey method returns null. The source code is taken from OpenJDK. It's not available with Sun's JDK, so I haven't been able to step through that part in the debugger.
Edited by: TyrionLannister on Sep 18, 2009 2:21 AM (corrected a few mistakes)