'Bad Integrated Windows Authentication credentials in Spring (it seems to get wrong token through IE)
I have set an infrastructure with AD + Kerberos + Spring (Security + Kerberos) and there is an issue related to automatically log into the application with IWA:
If Internet Explorer tries to log in automatically (using current logged user + password data), it generates a strange token and therefore, it fails.
Token:
Try to validate Kerberos Token
Negotiate Header was invalid: Negotiate YIGABgYrBgEFBQKgdjB0oDAwLgYKKwYBBAGCNwICCgYJKoZIgvcSAQICBgkqhkiG9xIBAgIGCisGAQQBgjcCAh6iQAQ+TlRMTVNTUAABAAAAl7II4ggACAA2AAAADgAOACgAAAAKAGNFAAAAD1NDSU5GSU5JVFk0Nzk5S0VSQkVST1M=After the first attempt, it prompts the Windows user/password credentials login. Then, after introducing the right user (existing one in AD), it succeeds at the login.
The token is completely different, a valid one:
Negotiate YIIGuQYGKwYBBQUCoIIGrTCCBqmgMDAuBgkqhkiC9xIBAgIGCSqGSIb3EgECAgYKKwYBBAGCNwICHgYKKwYBBAGCNwICCqKCBnMEggZvYIIGawYJKoZIhvcSAQICAQBuggZaMIIGVqADAgEFoQMCAQ6iBwMFACAAAACjggTVYYIE0TCCBM2gAwIBBaEUGxJLRVJCRVJPUy5ST0NIRS5DT02iJTAjoAMCAQKhHDAaGwRIVFRQGxJrZXJiZXJvcy5yb2NoZS5jb22jggSHMIIEg6ADAgEXoQMCAR2iggR1BIIEcSaMbjfbrN2ksR+d104Wf07BTOQdRFaA6dluzn0rDpgrspXtbJ7dhtXzlbBpHcojDzPqce7GBNk1o+JTGuuA/wnM/nTYWkE96KwAhVYJcqVJWzjCGr/aqM0E7SdFFxPZBB2GQG5gShpHkVTkhMfeJUeOBG0Tffy6Qo3/1JT8w3UQm16IkBvGsbZNkOK7Z51EweHx8SzdHmImhXfQRKO31TXOLGQFpOZYkdUH21lwj/B5+RZ8ulBPh+EjdOSidBaKBY1DjTwidwtXVxl0VRwRZtHuDxOwVTqkPRgdm8nP6gims/1qLdFA0WzaG2k0WZj+nuf1oj03bNUOakRBUuXq+4N7MYetswi4XxFP+vHhcPyRf5NAfyd3sJ4vvfiTq28pr39XSejL7nHdP6lO/9y7dY8e3TL9/SC1If8XtiNH24pgJz4Wd4QSfBwKvnKvuKowoBbbG9h98jk4cHf8dRazTwJ9rPs/5oqRoPyXrKxTk03Bw9FJjJSD8ggmd0dQ8KcoenY3V9wIvzeRGONKG63cFJalfD58zCfS3LHHJ1l8HJQJWa6Fb8ZPR/YICiDkYOaXJzepyJCKRgR2stNgZlNGfnsGc0asDLm185Pyb3Eday5SKEBwwSVhkzSaL3c4Lku15vdONeiIxuunHG3uNhtWmq/yIF9GlCRy5+1Xu50AVdQuGvVdHEnJzXvALo5GCVpXGNqEIBwKI7vxfxsMQ08WiNbDhXjeF49EwjIiHi4MG4H4u3NCSWVuKnB0uKhv674xeRyivKGX/7Mrvs5urrI0TXQfe30J+08Or0dOhew+mJVbvuyHcq7Aalp8GM6wrbdONVbolFCNXASEwE3jclslbPcubCQgcj+GiXJxR+j8qjO/hF8l7YjbFGr9h0gCaB0M90RwDTYwQu/Oh68H8sEQGxuuvVHs/wN8Qqs5aOMorcbEpXzVH1iDVsvxXvzNPUaHbN1vwNUhu6oaXcu9RWb80d75cBEF80ecn6uzikK6l5xNSBDlPUCWBEIcNz2GEnRE9W6XcuPvF6QAKWwJDxAKLYTPCKR2CxDZlyaxfEE07n/iWzbEZH/OteVjoRzAtY1GjmxyMlOZaNxsD1ZobEqOqhuevnAqIru+hGVhiWWJNlIf+xctOHD+JBmGEkQEQEfV75pY3PqsUGKvuM23veiIZJW2Jk74XuFpyAdrcWb7SHPxpLCyOqiCGEPenpG6oxJnoy7ihpj9llV3QhKH+FpXes9WTeCJB9x4LfEHvH0mFxICJoMY6UTiuJeBJpBcy85ZHHiJcT9Ao3aO0Q+FgYly0Fx7SUXKp9uzrhvrb7dwPaKUWVPzvS+1KX/9CkH8Y4mCMe0LQL4XF8Te+ECFTaZiap+5YD2+DUQu37FG+5OghXyL3JujMsq9uS6fEk8S92w8jqMsLdoponauE6pXWAh9gAbolHLfTuOBp5se+X2Yj9BApXneXfywZ+tyrkcBaJrB1Uytd2VcIU/AKCNLH+o/9Nmfnfy337I4YrhPO8Zwa3PyTaSCAWYwggFioAMCAReiggFZBIIBVT1Y47P9sOi+tbQymFcVsGsc5pWWuo/Odqa66F0Vg90n9RoEL1C0Jr6J9FHHU3b13Y9+AYo2wcvvz4PJsEHY0jQQmvdkITvDKI5dwh8DNmUUmpIAaHSxQrddljlNGU/KARakGzE+6KCSs3IEri8Az8M76RpJmMBCzjKnMYVQlvVSAqYMt5PMYgqDU1hzlrvFOjziltRbOmhu0Xpcq/sk/CfIlIsq/g6CbiyqCn2mO6tDXUMk/UxJ0+YwT5pP0Q/zaSzTUIUeARe12805l7mEMqjg5htJ62DL8/dhzD6LiYQWHC7F8R61+MCt7pxc6ctUA1V55fZpE/qErRsY+CsdEYLfuJXTm28ZU6kDnj5n8z0V/FXG8bvJS7ye6ej0cp2p/dFb6YXgvnorWJrfV+ukm5EjqIrMsq4fuxJpx6itl3sGaqFG64Q4n8RXnnzP1y3GwH9BGiAJ
Why is it not working from the beginning? Right after opening the browser (IE), it seems there is no Kerberos/AD configuration issue, because the second case, it works.
I have the infrastructure in a Windows Server 2019 and I am logged into the server to perform the tests. I'm not sure if it would affect the testing itself. (maybe this does not make sense at all)
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
