SPNEGO vs NTLM issue

Question

Hi,
I'm trying to configure SSO for my web application using IIS as webserver
and the IIS-Weblogic proxy plugin provided by bea. I use Weblogic 8.1 SP4.
I followed the procedure described in the dev2dev documentation and now I am
stuck with a ntlm vs spnego issue.
Here is what I get from a full security debug in my Weblogic log:
<2005-06-09 13 h 50 EDT> <Debug> <SecurityDebug> <000000>
<PrincipalAuthenticator.assertIdentity - Token Type: Authorization>
<2005-06-09 13 h 50 EDT> <Debug> <SecurityDebug> <000000> <Found NTLM token
when expecting SPNEGO>
<2005-06-09 13 h 50 EDT> <Debug> <SecurityDebug> <000000>
<PrincipalAuthenticator.assertIdentity - IdentityAssertionException>
My iis plugin log shows that everything seems to be ok, the client first
receives a 401 response and then sends a [WWW-Authenticate] Negociate
header, including a Kerberos token in base 64. The only problem is that it
seems that this token is ntlm instead of spnego:
Thu Jun 09 13:50:07 2005 WLS info in sendRequest: myweblogicserver.com
recycled? 0
Thu Jun 09 13:50:07 2005 Hdrs from WLS:[WWW-Authenticate]=[Negotiate]
Thu Jun 09 13:50:07 2005 Hdrs to client:[WWW-Authenticate]=[Negotiate]
Thu Jun 09 13:50:07 2005 Going to send headers to the client. Status :401
Unauthorized xxx
Thu Jun 09 13:50:07 2005 Hdrs from client:[Authorization]=[Negotiate
TlRMTVNTUAABAAAAB7IIogYABgAxAAAACQAJACgAAAAFASgKAAAAD1NTUU5UMTY1NlNTUVZJRQ==]
Thu Jun 09 13:50:07 2005 Hdrs to WLS:[Authorization]=[Negotiate
TlRMTVNTUAABAAAAB7IIogYABgAxAAAACQAJACgAAAAFASgKAAAAD1NTUU5UMTY1NlNTUVZJRQ==]
Thu Jun 09 13:50:07 2005 Hdrs from WLS:[WWW-Authenticate]=[Negotiate]
Thu Jun 09 13:50:07 2005 Hdrs to client:[WWW-Authenticate]=[Negotiate]
Thu Jun 09 13:50:07 2005 Going to send headers to the client. Status :401
Unauthorized xxx
as a result of all this, I get a basic authentication prompt when I try to
access my web application.
any help would be greatly appreciated.
Thanks!

Answer 1

Hi,
Thanks for your information. I finally managed to solve my ntlm/spnego
issue. In fact, it seems that I had no problem other than trying to test it
from the same computer on which my WLS is installed. When I invoke my web
application from another computer on the network, I dont get this
ntlm/spnego issue.
But now I have another problem. First, when I try to access my web
application, WLS prompts me (in the server window) for the password of the
SPN account for my server. I though it was supposed to use the keytab file
for it, but anyway, this is maybe a part of my problem.
If I type the correct password, it continues, but I get this chained
exception:
>
GSSException: No valid credentials provided (Mechanism level: Attempt to
obtain new ACCEPT credentials failed!)
Caused by: javax.security.auth.login.LoginException: Pre-authentication
information was invalid (24)
Caused by: KrbException: Pre-authentication information was invalid (24)
Caused by: KrbException: Identifier doesn't match expected value (906)The root cause seems to be "Identifier doesnt match expected value".. I
really dont know what it means. I am still trying to solve this so any help
would be appreciated and I will also post any other information I get on the
subject.
Thanks
<regis piccand> a ?crit dans le message de news:
[email protected]..
Hi,
I am currently trying to achieve the same configuration, and I noticed
that this happens when, in the setup of the Single Passe Negotiate
Identity Asserter, you choose the SPNEGO.AtnAssertion type (which seems to
be here only for compatibility reason - see
http://e-docs.bea.com/wles/docs42/adminguide/providers.html#1150785).
Removing this type helped in my case. However, I am now stuck with a GSS
exception No Valid Credentials provided (see my post at
http://forums.bea.com/bea/thread.jspa?threadID=600004578&tstart=0)
Hope this helps,
Kind regards,
Regis