javax.naming.AuthenticationException in GSSAPI

Question

I'm trying to perform NTLM bind using JAVA GSSAPI.

I'm receiving this error:

javax.naming.AuthenticationException: GSSAPI [Root exception is javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided (Mechanism level: Invalid option setting in ticket request. (101))]]

I think (not sure) it worked in the past. To solve other problem, I tried "kinit". From that point is stopped working. I even deleted the cache file (couldn't find kclear in windows) and, still, I have this issue.

How can I solve it?

Clarino

Answer 1

Ok, solved it.

I had

proxiable = true

in my krb5 file.

Removed it and it works!

Clarino

Answer 2

I had the same problem (exactly the same Java error stack) for Kerberos tickets that were not created as Forwardable.

A Kerbros ticket renewal/monitor process was written in Perl and used Authen::Krb5::Easy Perl module and that is ignoring /etc/krb5.conf "forwardable = true" setting.

Rorqual