Question
NCS
SG
Last activity: 17 Oct 2017 7:18 EDT
JBoss SSO Kerberos Authentication
Hi Team,
Getting below error when trying to using Kerberos Authentication
Hi Team,
Getting below error when trying to using Kerberos Authentication
Failed to get gsscredential from pxRequestor sessioncontext : net.sourceforge.spnego.SpnegoPrincipal
2017-06-11 01:04:41,449 [http-/ Proprietary information hidden:8080-1] [ STANDARD] [ ] [ PegaRULES:07.10] ( internal.mgmt.Executable) ERROR localhost| Proprietary information hidden - Exception
com.pega.pegarules.pub.PRRuntimeException: Failed to get gssCredentials
at com.pegarules.generated.activity.ra_action_pyauthenticationkerberoscredentials_4d97db8ae4d0f62e6833d79293f938f1.step2_circum0(ra_action_pyauthenticationkerberoscredentials_4d97db8ae4d0f62e6833d79293f938f1.java:542)
at com.pegarules.generated.activity.ra_action_pyauthenticationkerberoscredentials_4d97db8ae4d0f62e6833d79293f938f1.perform(ra_action_pyauthenticationkerberoscredentials_4d97db8ae4d0f62e6833d79293f938f1.java:87)
at com.pega.pegarules.session.internal.mgmt.Executable.doActivity(Executable.java:3553)
at com.pega.pegarules.session.internal.mgmt.authentication.AuthenticationUtil.runActivity(AuthenticationUtil.java:209)
at com.pega.pegarules.session.internal.mgmt.authentication.SchemePRCustom.authenticateOperator(SchemePRCustom.java:712)
at com.pega.pegarules.session.internal.mgmt.authentication.Authentication.doAuthentication(Authentication.java:490)
at com.pega.pegarules.session.internal.engineinterface.service.HTTPAuthenticationHandler.performAuthentication(HTTPAuthenticationHandler.java:247)
at com.pega.pegarules.session.internal.engineinterface.service.HTTPAuthenticationHandler.doHttpReqAuthentication(HTTPAuthenticationHandler.java:136)
at com.pega.pegarules.session.internal.engineinterface.service.HttpAPI.handleAuthentication(HttpAPI.java:2128)
at com.pega.pegarules.session.external.engineinterface.service.EngineAPI.activityExecutionProlog(EngineAPI.java:550)
at com.pega.pegarules.session.external.engineinterface.service.EngineAPI.processRequestInner(EngineAPI.java:389)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at com.pega.pegarules.session.internal.PRSessionProviderImpl.performTargetActionWithLock(PRSessionProviderImpl.java:1297)
at com.pega.pegarules.session.internal.PRSessionProviderImpl.doWithRequestorLocked(PRSessionProviderImpl.java:1034)
at com.pega.pegarules.session.internal.PRSessionProviderImpl.doWithRequestorLocked(PRSessionProviderImpl.java:889)
at com.pega.pegarules.session.external.engineinterface.service.EngineAPI.processRequest(EngineAPI.java:331)
at com.pega.pegarules.session.internal.engineinterface.service.HttpAPI.invoke(HttpAPI.java:829)
at com.pega.pegarules.session.internal.engineinterface.etier.impl.EngineImpl._invokeEngine_privact(EngineImpl.java:331)
at com.pega.pegarules.session.internal.engineinterface.etier.impl.EngineImpl.invokeEngine(EngineImpl.java:274)
at com.pega.pegarules.session.internal.engineinterface.etier.impl.EngineImpl.invokeEngine(EngineImpl.java:251)
at com.pega.pegarules.priv.context.JNDIEnvironment.invokeEngineInner(JNDIEnvironment.java:278)
at com.pega.pegarules.priv.context.JNDIEnvironment.invokeEngine(JNDIEnvironment.java:223)
at com.pega.pegarules.web.impl.WebStandardImpl.makeEtierRequest(WebStandardImpl.java:589)
at com.pega.pegarules.web.impl.WebStandardImpl.doPost(WebStandardImpl.java:378)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at com.pega.pegarules.internal.bootstrap.PRBootstrap.invokeMethod(PRBootstrap.java:370)
at com.pega.pegarules.internal.bootstrap.PRBootstrap.invokeMethodPropagatingThrowable(PRBootstrap.java:411)
at com.pega.pegarules.boot.internal.extbridge.AppServerBridgeToPega.invokeMethodPropagatingThrowable(AppServerBridgeToPega.java:224)
at com.pega.pegarules.boot.internal.extbridge.AppServerBridgeToPega.invokeMethod(AppServerBridgeToPega.java:273)
at com.pega.pegarules.internal.web.servlet.WebStandardBoot.doPost(WebStandardBoot.java:121)
at com.pega.pegarules.internal.web.servlet.WebStandardBoot.doGet(WebStandardBoot.java:92)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:734)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:847)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:295)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:231)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:149)
at org.jboss.as.web.session.ClusteredSessionValve.handleRequest(ClusteredSessionValve.java:134)
at org.jboss.as.web.session.ClusteredSessionValve.invoke(ClusteredSessionValve.java:99)
at org.jboss.as.web.session.JvmRouteValve.invoke(JvmRouteValve.java:92)
at org.jboss.as.web.session.LockingValve.invoke(LockingValve.java:64)
at org.jboss.security.negotiation.NegotiationAuthenticator$WrapperValve.invoke(NegotiationAuthenticator.java:490)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:512)
at org.jboss.as.web.security.SecurityContextAssociationValve.invoke(SecurityContextAssociationValve.java:169)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:150)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:97)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:102)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:344)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:854)
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:653)
at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:926)
at java.lang.Thread.run(Thread.java:745)
Caused by: java.lang.ClassNotFoundException: net.sourceforge.spnego.SpnegoPrincipal
at com.pega.pegarules.internal.bootstrap.phase2.PRBaseLoader.findClass(PRBaseLoader.java:308)
at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
at com.pega.pegarules.internal.bootstrap.phase2.PRBaseLoader.loadClass(PRBaseLoader.java:233)
at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
at com.pega.pegarules.bootstrap.loader.PRAppLoader.loadClass(PRAppLoader.java:791)
at com.pega.pegarules.bootstrap.loader.PRAppLoader.loadClass(PRAppLoader.java:644)
at com.pega.pegarules.exec.internal.util.classloader.PRClassLoaderDB.loadClass(PRClassLoaderDB.java:1086)
at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
at com.pega.pegarules.exec.internal.util.classloader.PRClassLoaderDB$Loader.loadClass(PRClassLoaderDB.java:2156)
at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
at java.lang.Class.forName0(Native Method)
at java.lang.Class.forName(Class.java:264)
at com.pegarules.generated.activity.ra_action_pyauthenticationkerberoscredentials_4d97db8ae4d0f62e6833d79293f938f1.step2_circum0(ra_action_pyauthenticationkerberoscredentials_4d97db8ae4d0f62e6833d79293f938f1.java:531)
***Updated by moderator: Lochan to add SR details***
Accepted Solution
Pegasystems Inc.
US
Upon reviewing the associated SR, it appears that the SR was closed due to no response. If you are still having an issue, please let us know.
Pegasystems Inc.
US
Hello!
I just spoke with one of our SMEs and they suggested that this needs to be an SR. Could you please open an SR on this and reply back here with the SR number so that we can link the SR to this post for you?
Thank you,
Pegasystems Inc.
US
Hi,
I am the SME Marissa talked too. Still want you to add a case but here is some more information.
The caused by in the exception you are getting is:
Caused by: java.lang.ClassNotFoundException: net.sourceforge.spnego.SpnegoPrincipal
Part of using Kerberos authentication in 7.2.2 requires the spnego-r7.jar to be placed within prweb/WEB-INF/lib or for you to modify step 2.
This is documented here: https://collaborate.pega.com/question/sso-using-kerberos-windows-authentication-pega-719-using-spnego
What this does not mention is the usage of spnego-r7.jar jar file. Step 2 of the pyAuthenticationKerberosCredentials activity where the exception is occurring has the following comment:
/*
Below IF block works only for SourceForge SPNEGO implementation. Make sure to copy SourceForge spnego-r7.jar to prweb/WEB-INF/lib location in Tomcat PRWEB application.
If you use different SPNEGO implementation, then change this IF block to work with your SPNEGO implemtation.
*/
NCS
SG
Hi, we are using JBoss Negotiation
JBoss Negotiation is a framework that ships with JBoss EAP 6 that provides an authenticator and JAAS login module to support SPNEGO in JBoss EAP 6.
No where in the (JBoss SSO configuration) document mentioned to use spnego-r7.jar jar file, This jar file is maily if we use SPNEGO SourceForge implementation.
1) Can you please suggest what should change in JAVA IF block for JBoss Negotiation
2) in Pega WAR web.xml any servlet mapping should uncomment since all Kerberos related values are commented out. (This one is not specified in the below Pega article)
Hi, we are using JBoss Negotiation
JBoss Negotiation is a framework that ships with JBoss EAP 6 that provides an authenticator and JAAS login module to support SPNEGO in JBoss EAP 6.
No where in the (JBoss SSO configuration) document mentioned to use spnego-r7.jar jar file, This jar file is maily if we use SPNEGO SourceForge implementation.
1) Can you please suggest what should change in JAVA IF block for JBoss Negotiation
2) in Pega WAR web.xml any servlet mapping should uncomment since all Kerberos related values are commented out. (This one is not specified in the below Pega article)
We have observed that Kerberos related mapping are commented in web.xml(7.2.2) do we have to uncomment all those in web.xml . if we are using sourceforge.spnego
<!--
Kerberos settings
-->
<servlet>
<servlet-name>WebKerberos1</servlet-name>
<display-name>WebKerberos1</display-name>
<description>Authentication using Kerberos</description>
<servlet-class>com.pega.pegarules.internal.web.servlet.WebStandardBoot</servlet-class>
<init-param>
<param-name>PegaEtierClass</param-name>
<param-value>com.pega.pegarules.session.internal.engineinterface.service.HttpAPI</param-value>
</init-param>
<init-param>
<param-name>AuthenticationType</param-name>
<param-value>PRCustom</param-value>
</init-param>
<init-param>
<param-name>AuthService</param-name>
<param-value>KerberosAuth</param-value>
</init-param>
<init-param>
<param-name>RuntimeServletName</param-name>
<param-value>PRWebKerberos1</param-value>
</init-param>
<init-param>
<param-name>SecureServletName</param-name>
<param-value>PRWebKerberos1Auth</param-value>
</init-param>
</servlet>
<!--
Kerberos settings
-->
<servlet-mapping>
<servlet-name>WebKerberos1</servlet-name>
<url-pattern>/PRWebKerberos1</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>WebKerberos1</servlet-name>
<url-pattern>/PRWebKerberos1/*</url-pattern>
</servlet-mapping>
<!--
Kerberos settings
-->
<security-constraint>
<web-resource-collection>
<web-resource-name>PRKerberos1</web-resource-name>
<url-pattern>/PRWebKerberos1</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<user-data-constraint>
<description>SSL not required</description>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
<security-constraint>
<web-resource-collection>
<web-resource-name>PRKerberos1</web-resource-name>
<url-pattern>/PRWebKerberos1/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<user-data-constraint>
<description>SSL not required</description>
<transport-guarantee>NONE</transport-guarantee>
</user-data-constraint>
</security-constraint>
<!--
SPNEGO Kerberos filters
-->
<filter>
<filter-name>SpnegoHttpFilter</filter-name>
<filter-class>net.sourceforge.spnego.SpnegoHttpFilter</filter-class>
<init-param>
<param-name>spnego.allow.basic</param-name>
<param-value>true</param-value>
</init-param>
<init-param>
<param-name>spnego.allow.unsecure.basic</param-name>
<param-value>true</param-value>
</init-param>
<init-param>
<param-name>spnego.allow.localhost</param-name>
<param-value>true</param-value>
</init-param>
<init-param>
<param-name>spnego.allow.delegation</param-name>
<param-value>true</param-value>
</init-param>
<init-param>
<param-name>spnego.prompt.ntlm</param-name>
<param-value>true</param-value>
</init-param>
<init-param>
<param-name>spnego.login.client.module</param-name>
<param-value>spnego-client</param-value>
</init-param>
<init-param>
<param-name>spnego.login.server.module</param-name>
<param-value>spnego-server</param-value>
</init-param>
<init-param>
<param-name>spnego.krb5.conf</param-name>
<param-value>krb5.conf</param-value>
</init-param>
<init-param>
<param-name>spnego.login.conf</param-name>
<param-value>login.conf</param-value>
</init-param>
<init-param>
<param-name>spnego.logger.level</param-name>
<param-value>1</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>SpnegoHttpFilter</filter-name>
<url-pattern>/PRWebKerberos1/*</url-pattern>
</filter-mapping>
< /web-app>
Pegasystems Inc.
IN
Hi Sudheesh,
The SR is currently under investigation. We will update this post once a resolution has been agreed upon.
Regards,
Accepted Solution
Pegasystems Inc.
US
Upon reviewing the associated SR, it appears that the SR was closed due to no response. If you are still having an issue, please let us know.