Problem configuration spnego tomcat 8 java 8 redhat 8

[former_member905929]

Hello

I have redhat 8 tomcat 8 java 8 in a openshift

We created a keytab ktpass -out c:\tomcat.keytab -mapuser XXXXXXXXX@cartoons.com -princ HTTP/web-denuncias-uatf2.apps.c1-ocp.altemista.cartoons.com@cartoons.com -pass XXXXXXXXXXXXXXXXXXXXXX KRB5_NT_PRINCIPAL -crypto AES128-SHA1 -kvno 0

In the pod we have the next configuration: krb5.conf as config map

[libdefaults]

default_realm = CARTOONS.COM

default_tkt_enctypes = aes256-cts-hmac-sha1-96 aes256-cts aes128-cts-hmac-sha1-96 aes128-cts rc4-hmac des3-cbc-sha1 des-cbc-md5 des-cbc-crc arcfour-hmac-md5

arcfour-hmac default_tgs_enctypes = aes256-cts-hmac-sha1-96 aes256-cts aes128-cts-hmac-sha1-96 aes128-cts rc4-hmac des3-cbc-sha1 des-cbc-md5 des-cbc-crc arcfour-hmac-md5

arcfour-hmac permitted_enctypes = aes256-cts-hmac-sha1-96 aes256-cts aes128-cts-hmac-sha1-96 caes128-cts rc4-hmac des3-cbc-sha1 des-cbc-md5 des-cbc-crc arcfour-hmac-md5 arcfour-hmac

[realms]

LOCAL.NETWORK = { kdc = cartoons.com default_domain = CARTOONS.COM }

[domain_realm]

.LOCAL.NETWORK = CARTOONS.COM

login.conf as config map

spnego-client

{ com.sun.security.auth.module.Krb5LoginModule required; };

spnego-server

{ com.sun.security.auth.module.Krb5LoginModule required useKeyTab=true useTicketCache=true refreshKrb5Config=true storeKey=true isInitiator=false doNotPrompt=true keyTab="/etc/krb5.keytab/..data/krb5.keytab" principal=""; };

web.xml section spengo

And we get the error

<code><filter>
    <filter-name>SpnegoHttpFilter</filter-name>
    <filter-class>net.sourceforge.spnego.SpnegoHttpFilter</filter-class>
    <init-param>
        <param-name>spnego.allow.basic</param-name>
        <param-value>false</param-value>
    </init-param>
    <init-param>
        <param-name>spnego.allow.localhost</param-name>
        <param-value>true</param-value>
    </init-param>
    <init-param>
        <param-name>spnego.allow.unsecure.basic</param-name>
        <param-value>true</param-value>
    </init-param>
    <init-param>
        <param-name>spnego.login.client.module</param-name>
        <param-value>spnego-client</param-value>
    </init-param>
    <init-param>
        <param-name>spnego.krb5.conf</param-name>
        <param-value>/etc/krb5.conf</param-value>
    </init-param>
    <init-param>
        <param-name>spnego.login.conf</param-name>
        <param-value>/usr/local/tomcat/conf/login.conf</param-value>
    </init-param>
    <init-param>
        <param-name>spnego.preauth.username</param-name>
        <param-value>usr_tomcat_denun</param-value>
    </init-param>
    <init-param>
        <param-name>spnego.preauth.password</param-name>
        <param-value>B47415VF92a4Ae6a9ee4919d7c9_3Q19</param-value>
    </init-param>
    <init-param>
        <param-name>spnego.login.server.module</param-name>
        <param-value>spnego-server</param-value>
    </init-param>
    <init-param>
        <param-name>spnego.prompt.ntlm</param-name>
        <param-value>false</param-value>
    </init-param>
    <init-param>
        <param-name>spnego.logger.level</param-name>
        <param-value>1</param-value>
    </init-param>
 </filter>

 <filter-mapping>
      <filter-name>SpnegoHttpFilter</filter-name>
      <url-pattern>/*.jsp</url-pattern>
  </filter-mapping>
Error:


2022-03-04 20:37:11,470 [localhost-startStop-1] ERROR org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/]- Exception starting filter SpnegoHttpFilter
javax.servlet.ServletException: javax.security.auth.login.LoginException: java.lang.IllegalArgumentException: Empty nameString not allowed
	at sun.security.krb5.PrincipalName.validateNameStrings(PrincipalName.java:179)
	at sun.security.krb5.PrincipalName.<init>(PrincipalName.java:402)
	at sun.security.krb5.PrincipalName.<init>(PrincipalName.java:477)
	at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:651)
	at com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:618)

When the tomcat start I gives the error that Spnego HttpFitlter in wrong

But I have the same configuration in versions much older than these and It works fine

Can you help me, please

[Former Member]

I suggest you post exactly what the complete error message is.

[former_member905929]

Sorry

I are right the error is

2022-03-04 20:37:11,470 [localhost-startStop-1] ERROR org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/]- Exception starting filter SpnegoHttpFilter

javax.servlet.ServletException: javax.security.auth.login.LoginException: java.lang.IllegalArgumentException: Empty nameString not allowed

at sun.security.krb5.PrincipalName.validateNameStrings(PrincipalName.java:179)

at sun.security.krb5.PrincipalName.<init>(PrincipalName.java:402)

at sun.security.krb5.PrincipalName.<init>(PrincipalName.java:477)

at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:651)

at com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:618)

[Martina_K]

Hello Dani,

In which of SAP's products is this used? Maybe you can add the respective tag to your question.

Thanks,

Martina