Keycloak Kerberos认证报错：无法找到合适密钥解密AP-REQ

环境 #

• Keycloak 23.04，运行在CentOS 9
• 认证后端为Windows Active Directory

错误日志 #

Debug is  true storeKey true useTicketCache false useKeyTab true doNotPrompt true ticketCache is null isInitiator false KeyTab is /root/key2.keytab refreshKrb5Config is false principal is HTTP/server_dns@KERBEROS_REALM tryFirstPass is false useFirstPass is false storePass is false clearPass is false
 principal is HTTP/server_dns@KERBEROS_REALM
 Will use keytab
 Commit Succeeded
 2024-05-21 10:10:36,396 WARN  [org.keycloak.federation.kerberos.impl.SPNEGOAuthenticator] (executor-thread-184) SPNEGO login failed: java.security.PrivilegedActionException: GSSException: Failure unspecified at GSS-API level (Mechanism level: Invalid argument (400) - Cannot find key of appropriate type to decrypt AP-REQ - AES256 CTS mode with HMAC SHA1-96)
at java.base/java.security.AccessController.doPrivileged(AccessController.java:716)
at java.base/javax.security.auth.Subject.doAs(Subject.java:439)
at org.keycloak.federation.kerberos.impl.SPNEGOAuthenticator.authenticate(SPNEGOAuthenticator.java:69)
at org.keycloak.storage.ldap.LDAPStorageProvider.authenticate(LDAPStorageProvider.java:757)
at org.keycloak.storage.UserStorageManager.getUserByCredential(UserStorageManager.java:153)
at org.keycloak.models.cache.infinispan.UserCacheSession.getUserByCredential(UserCacheSession.java:551)
at org.keycloak.authentication.authenticators.browser.SpnegoAuthenticator.authenticate(SpnegoAuthenticator.java:88)
at org.keycloak.authentication.DefaultAuthenticationFlow.processSingleFlowExecutionModel(DefaultAuthenticationFlow.java:445)
at org.keycloak.authentication.DefaultAuthenticationFlow.processFlow(DefaultAuthenticationFlow.java:271)
at org.keycloak.authentication.AuthenticationProcessor.authenticateOnly(AuthenticationProcessor.java:1028)
at org.keycloak.authentication.AuthenticationProcessor.authenticate(AuthenticationProcessor.java:885)
at org.keycloak.protocol.AuthorizationEndpointBase.handleBrowserAuthenticationRequest(AuthorizationEndpointBase.java:153)
at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.buildAuthorizationCodeAuthorizationResponse(AuthorizationEndpoint.java:337)
at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.process(AuthorizationEndpoint.java:202)
at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.buildGet(AuthorizationEndpoint.java:113)
at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint$quarkusrestinvoker$buildGet_4b690b27439f19dd29733dc5fd4004f24de0adb6.invoke(Unknown Source)
at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29)
at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:141)
at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:145)
at io.quarkus.vertx.core.runtime.VertxCoreRecorder$14.runWith(VertxCoreRecorder.java:576)
at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:29)
at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:29)
at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
at java.base/java.lang.Thread.run(Thread.java:842)
 Caused by: GSSException: Failure unspecified at GSS-API level (Mechanism level: Invalid argument (400) - Cannot find key of appropriate type to decrypt AP-REQ - AES256 CTS mode with HMAC SHA1-96)
at java.security.jgss/sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:864)
at java.security.jgss/sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:361)
at java.security.jgss/sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:303)
at java.security.jgss/sun.security.jgss.spnego.SpNegoContext.GSS_acceptSecContext(SpNegoContext.java:908)
at java.security.jgss/sun.security.jgss.spnego.SpNegoContext.acceptSecContext(SpNegoContext.java:555)
at java.security.jgss/sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:361)
at java.security.jgss/sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:303)
at org.keycloak.federation.kerberos.impl.SPNEGOAuthenticator.establishContext(SPNEGOAuthenticator.java:168)
at org.keycloak.federation.kerberos.impl.SPNEGOAuthenticator$AcceptSecContext.run(SPNEGOAuthenticator.java:131)
at org.keycloak.federation.kerberos.impl.SPNEGOAuthenticator$AcceptSecContext.run(SPNEGOAuthenticator.java:121)
at java.base/java.security.AccessController.doPrivileged(AccessController.java:712)
... 25 more
 Caused by: KrbException: Invalid argument (400) - Cannot find key of appropriate type to decrypt AP-REQ - AES256 CTS mode with HMAC SHA1-96

已完成的排查步骤 #

• 使用ktpass命令生成keytab：

  ktpass -princ HTTP/server_dns@KERBEROS_REALM -mapuser kerberos_user -pass mypassword -out key.keytab -crypto aes256-sha1 -ptype KRB5_NT_PRINCIPAL
  

  后续尝试过-crypto all参数重新生成keytab，问题依旧
• 本地执行kinit -kt keycloak.keytab HTTP/server_dns@KERBEROS_REALM可成功获取Kerberos令牌
• 域控制器日志及Wireshark抓包显示Kerberos审计流程成功
• 通过klist -etk keycloak.keytab确认keytab包含AES256加密类型
• 核对KVNO与AD用户的msDS-KeyVersionNumber属性，二者数值一致

排查建议 #

• 检查JCE权限配置：确认CentOS 9上的OpenJDK已启用无限制加密策略。查看/etc/java/java-11-openjdk/security/java.security文件，确保crypto.policy=unlimited（OpenJDK 8u161+及更高版本默认开启，但仍需确认）
• 修正keytab文件权限：当前keytab位于/root目录，Keycloak运行用户（通常是keycloak）无读取权限。将keytab移动到Keycloak可访问的目录（如/opt/keycloak/conf），并修改权限：

  mv /root/key.keytab /opt/keycloak/conf/
  chown keycloak:keycloak /opt/keycloak/conf/key.keytab
  chmod 600 /opt/keycloak/conf/key.keytab
  

• 调整krb5.conf加密配置：在/etc/krb5.conf的[libdefaults]段添加以下配置，确保默认加密类型包含AES256：

  default_tkt_enctypes = aes256-sha1 aes128-sha1 rc4-hmac
  default_tgs_enctypes = aes256-sha1 aes128-sha1 rc4-hmac
  permitted_enctypes = aes256-sha1 aes128-sha1 rc4-hmac
  

• 确认AD用户加密权限：在AD用户属性的「账户」选项卡中，勾选「使用Kerberos AES 256位加密」选项，确保用户支持AES256加密
• 核对Keycloak配置：确认Keycloak的Kerberos/SPNEGO设置中，principal、keytab路径、realm名称（注意Kerberos realm通常为大写）与实际配置完全一致

内容的提问来源于stack exchange，提问作者sorrysalmon