KerberosToken2 Error Question

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

Erik J. - 22 Mar 2005 02:01 GMT

I'm attempting to sign a message with a KerberosToken2 and then call a
service on a Windows XP SP2 machine. The docs say that the MACHINE.CONFIG
file on the Windows XP machine must have the user ID set to "SYSTEM". This
works fine.

But the docs also say that the user ID can be set to a domain account so
long as that account is granted rights to "act as part of the operating
system" in the local security policy. When I try that, the call fails with a
login error.

BTW, if I change the calling program to use the older KerberosToken object,
the call succeeds.

Am I missing some other requirement and are others seeing this problem?
Thanks,

- Erik

Reply to this Message

Dominick Baier [DevelopMentor] - 22 Mar 2005 10:49 GMT

Hello Erik J.,

what service principal name are you using for your domain account??

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

> I'm attempting to sign a message with a KerberosToken2 and then call a
> service on a Windows XP SP2 machine. The docs say that the
[quoted text clipped - 13 lines]
>
> - Erik

Reply to this Message

Erik J. - 22 Mar 2005 17:37 GMT

I'm new to Windows security, but the "TargetPrincipal" value in the
KerberosToken2 object is:

host/erikj@AMERICAS.EPICOR.NET

The line creating the token is

Microsoft.Web.Services2.Security.Tokens.KerberosToken2 kt = new
KerberosToken2("erikj", "AMERICAS");

Thanks very much for any help you can provide.

- Erik

> Hello Erik J.,
>
[quoted text clipped - 21 lines]
> >
> > - Erik

Reply to this Message

Julian Jelfs - 23 Mar 2005 11:27 GMT

I now have pretty much the same problem. I can get the Kerberos sample
working fine but the kerberos2 sample fails saying bad user name or password.
The documentation points me towards the service principle (whatever that is).
The machine I'm hosting the whole thing on is a called flamingo and the
target principal in the token I create is:

FLAMINGO$@ARM.STRATEGICTHOUGHT.CO.UK (don't know where that $ comes from
also is it not supposed to have the word HOST/ at the front?)

When I run SetSpn on the DC like so setspn -l flamingo it tells me I have
the following:

HOST/FLAMINGO
HOST/flamingo.arm.strategicthought.co.uk

and I tried adding

HOST/flamingo@arm.strategicthought.co.uk

I get the feeling that something is not quite right in this area but I don't
really have a clue what I'm doing??? Any help would be greatly appreciated.

Julian.

> I'm new to Windows security, but the "TargetPrincipal" value in the
> KerberosToken2 object is:
[quoted text clipped - 35 lines]
> > >
> > > - Erik

Reply to this Message

Dominick Baier [DevelopMentor] - 23 Mar 2005 11:38 GMT

Hello Erik J.,

create a Service Principal Name for the account the web service is running
under, e.g. WebService/Domain (use the setspn.exe tool for that purpose)

construct the KerberosToken2 with that SPN -

KerberosToken2 kerb = new KerberosToken2("WebService/Domain", true);

i have a sample using KerbTok2 up on my blog - maybe that helps
http://www.leastprivilege.com/PermaLink.aspx?guid=b02570d2-eb14-4dec-a504-1c8732
d69d61

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

> I'm new to Windows security, but the "TargetPrincipal" value in the
> KerberosToken2 object is:
[quoted text clipped - 34 lines]
>>>
>>> - Erik

Reply to this Message

Erik J. - 23 Mar 2005 18:59 GMT

Thanks Dominick. I've run SETSPN to make sure I have an SPN that matches
what's in the KerberosToken2 object (I'm assuming the SPN is not case
sensitive). I also contacted our IT department to set my machine account to
allow delegation as mentioned in the MSDN KB article about troubleshooting
kerberos errors.

On the ASP.NET site, I trapped all exceptions and I am getting this when
receiving the message:

A first chance exception of type 'System.Security.SecurityException'
occurred in microsoft.web.services2.dll

Additional information: The Kerberos credential handle could not be
acquired. The AcquireCredentialsHandle call returned the following error
code: The parameter is incorrect.

Any other ideas? Thanks very much again. This has been very helpful so far.

- Erik

> Hello Erik J.,
>
[quoted text clipped - 50 lines]
> >>>
> >>> - Erik

Reply to this Message

KerberosToken2 Error Question

Free Magazines