Terrible error with kerberos, win2003 - Checksum failed!

Question

Now i'm trying to use CAS SSO with kerberos for authentication.
I done all settings by instruction, see this tutorial http://www.ja-sig.org/wiki/display/CASUM/SPNEGO.
So, the error is: Failure unspecified at GSS-API level (Mechanism level: Checksum failed).
I guess, there is a problem with encryption type, but i don't know how to resolve it. Please help
My stacktrace shown below:
Caused by: GSSException: Failure unspecified at GSS-API level (Mechanism level:
Checksum failed)
        at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:
741)
        at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java
:323)
        at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java
:267)
        ... 75 more
Caused by: KrbException: Checksum failed
        at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHma
cEType.java:85)
        at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHma
cEType.java:77)
        at sun.security.krb5.EncryptedData.decrypt(EncryptedData.java:168)
        at sun.security.krb5.KrbApReq.authenticate(KrbApReq.java:267)
        at sun.security.krb5.KrbApReq.<init>(KrbApReq.java:134)
        at sun.security.jgss.krb5.InitSecContextToken.<init>(InitSecContextToken
.java:79)
        at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:
724)
        ... 77 more
Caused by: java.security.GeneralSecurityException: Checksum failed
        at sun.security.krb5.internal.crypto.dk.ArcFourCrypto.decrypt(ArcFourCry
pto.java:388)
        at sun.security.krb5.internal.crypto.ArcFourHmac.decrypt(ArcFourHmac.jav
a:74)
        at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHma
cEType.java:83)
        ... 83 more

Answer 1

Thank you for advice, my friend.
I have analyzed info in TGS-REQ request, but i could not find any SPN in it.
Please see this screenshot and say me: where is needed SPN in ticket?
Here is my full configuration:
[logging]
[libdefaults]
ticket_lifetime = 24000
default_realm = MYCORP.KUBA
dns_lookup_kdc = true
dns_lookup_realm = true
default_tkt_enctypes = rc4-hmac des3-hmac-sha1 des-cbc-crc
default_tgs_enctypes = rc4-hmac des3-hmac-sha1 des-cbc-crc
[realms]
MYCORP.KUBA = {
kdc = mycorp.kuba:88
admin_server = mycorp.kuba:749
default_domain = mycorp.kuba
[domain_realm]
.mycorp.kuba = MYCORP.KUBA
mycorp.kuba = MYCORP.KUBA
[domain_realm]
.mycorp.kuba = MYCORP.KUBA
[appdefaults]
autologin = true
forward = true
forwardable = true
encrypt = true
<bean class="org.jasig.cas.support.spnego.authentication.handler.support.JCIFSConfig"
          p:jcifsDomainController="xxx"
          p:jcifsNetbiosWins="xxx"
          p:jcifsServicePrincipal="HTTP/MYUSER.mycorp.kuba"
          p:jcifsServicePassword="secret"
          p:useSubjectCredsOnly="true"
          p:kerberosDebug="true"
          p:kerberosRealm="MYCORP.KUBA"
          p:kerberosKdc="xxx"
          p:kerberosConf="c:/winnt/krb5.conf"
          p:loginConf="C:/mypath/WEB-INF/login.conf"
     />
jcifs.spnego.initiate {
   com.sun.security.auth.module.Krb5LoginModule
   required
   debug=true
   realm="MYCORP.KUBA"
   principal="HTTP/MYUSER.mycorp.kuba"
   storeKey=true
   doNotPrompt=false
   client=true
   refreshKrb5Config=true
   storePass=true
   isInitiator=false
   useKeyTab=true
   useTicketCache=false
   keyTab="c:\a.keytab"
jcifs.spnego.accept {
   com.sun.security.auth.module.Krb5LoginModule
   required
   debug=true
   realm="MYCORP.KUBA"
   principal="HTTP/MYUSER.mycorp.kuba"
   storeKey=true
   doNotPrompt=false
   client=true
   refreshKrb5Config=true
   storePass=true
   isInitiator=false
   useKeyTab=true
   useTicketCache=false
   keyTab="c:\a.keytab"
setspn -A HTTP/MYUSER.mycorp.kuba myuser
ktpass -out a.keytab -princ HTTP/[email protected] -pass secret -mapuser [email protected] -ptype krb5_nt_principal -crypto RC4-HMAC-NTWhat is wrong with it? Please correct it if you can?