Wildfly 26.1.3 Kerberos/SPNEGO SSO配置校验和失败问题求助

配置Wildfly 26.1.3的Kerberos5、KDC、SPNEGO单点登录（SSO）时，认证过程中出现以下错误：
GSSException: Failure unspecified at GSS-API level (Mechanism level: Checksum failed)

错误日志 #

{"timestamp": "2024-02-23T08:01:00.237+01:00","sequence": 13749,"loggerClassName": "org.jboss.logging.DelegatingBasicLogger","loggerName": "org.wildfly.security.http.spnego","level": "TRACE","message": "Call to acceptSecContext failed.","threadName": "default task-1","threadId": 171,"mdc": {},"ndc": "","hostName": "txxxxxxx-web-7bd785664-fzvn5","processName": "jboss-modules.jar","processId": 215,"stackTrace": ": GSSException: Failure unspecified at GSS-API level (Mechanism level: Checksum failed)\n\tat sun.security.jgss.krb5.Krb5Context.acceptSecSecContext(Krb5Context.java:858)\n\tat sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:342)\n\tat sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:285)\n\tat sun.security.jgss.spnego.SpNegoContext.GSS_acceptSecContext(SpNegoContext.java:909)\n\tat sun.security.jgss.spnego.SpNegoContext.acceptSecContext(SpNegoContext.java:559)\n\tat sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:342)\n\tat sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:285)\n\tat org.wildfly.security.http.spnego.SpnegoAuthenticationMechanism.lambda$evaluateRequest$0(SpnegoAuthenticationMechanism.java:245)\n\tat java.security.AccessController.doPrivileged(Native Method)\n\tat javax.security.auth.Subject.doAs(Subject.java:422)\n\tat org.wildfly.security.http.spnego.SpnegoAuthenticationMechanism.evaluateRequest(SpnegoAuthenticationMechanism.java:245)\n\tat org.wildfly.security.http.util.SetMechanismInformationMechanismFactory$1.evaluateRequest(SetMechanismInformationMechanismFactory.java:119)\n\tat org.wildfly.security.http.util.SocketAddressCallbackServerMechanismFactory$1.evaluateRequest(SocketAddressCallbackServerMechanismFactory.java:82)\n\tat org.wildfly.security.auth.server.SecurityIdentityServerMechanismFactory$1.evaluateRequest(SecurityIdentityServerMechanismFactory.java:85)\n\tat org.wildfly.security.http.HttpAuthenticator$AuthenticationExchange.authenticate(HttpAuthenticator.java:325)\n\tat org.wildfly.security.http.HttpAuthenticator$AuthenticationExchange.access$800(HttpAuthenticator.java:300)\n\tat org.wildfly.security.http.HttpAuthenticator.authenticate(HttpAuthenticator.java:94)\n\tat org.wildfly.elytron.web.undertow.server.SecurityContextImpl.authenticate(SecurityContextImpl.java:107)\n\tat org.wildfly.elytron.web.undertow.server.servlet.ServletSecurityContextImpl.authenticate(ServletSecurityContextImpl.java:115)\n\tat io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:55)\n\tat io.undertow.server.handlers.DisableCacheHandler.handleRequest(DisableCacheHandler.java:33)\n\tat io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)\n\tat io.undertow.security.handlers.AuthenticationConstraintHandler.handleRequest(AuthenticationConstraintHandler.java:53)\n\tat io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)\n\tat io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)\n\tat io.undertow.servlet.handlers.security.ServletSecurityConstraintHandler.handleRequest(ServletSecurityConstraintHandler.java:59)\n\tat io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)\n\tat org.wildfly.elytron.web.undertow.server.servlet.CleanUpHandler.handleRequest(CleanUpHandler.java:38)\n\tat io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)\n\tat org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)\n\tat io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)\n\tat org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)\n\tat io.undertow.servlet.handlers.SendErrorPageHandler.handleRequest(SendErrorPageHandler.java:52)\n\tat io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)\n\tat io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:275)\n\tat io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:79)\n\tat io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:134)\n\tat io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:131)\n\tat io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)\n\tat io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)\n\tat org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1544)\n\tat org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1544)\n\tat org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1544)\n\tat org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1544)\n\tat io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:255)\n\tat io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:79)\n\tat io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:100)\n\tat io.undertow.server.Connectors.executeRootHandler(Connectors.java:387)\n\tat io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:852)\n\tat org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)\n\tat org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1990)\n\tat org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486)\n\tat org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377)\n\tat org.xnio.XnioWorker$WorkerThreadFactory$1$1.run(XnioWorker.java:1282)\n\tat java.lang.Thread.run(Thread.java:750)\nCaused by: KrbException: Checksum failed\n\tat sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHmacEType.java:102)\n\tat sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHmacEType.java:94)\n\tat sun.security.krb5.EncryptedData.decrypt(EncryptedData.java:175)\n\tat sun.security.krb5.KrbApReq.authenticate(KrbApReq.java:281)\n\tat sun.security.krb5.KrbApReq.<init>(KrbApReq.java:149)\n\tat sun.security.jgss.krb5.InitSecContextToken.<init>(InitSecContextToken.java:140)\n\tat sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:831)\n\t... 54 more\nCaused by: java.security.GeneralSecurityException: Checksum failed\n\tat sun.security.krb5.internal.crypto.dk.ArcFourCrypto.decrypt(ArcFourCrypto.java:408)\n\tat sun.security.krb5.internal.crypto.ArcFourHmac.decrypt(ArcFourHmac.java:91)\n\tat sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHmacEType.java:100)\n\t... 60 more\n","label": "value"}

当前krb5.conf配置 #

[libdefaults]

	default_realm = ABCD.XYZ
	dns_lookup_kdc = true
	dns_lookup_realm = true
	default_tkt_enctypes = AES256-CTS-HMAC-SHA1-96 AES128-CTS-HMAC-SHA1-96 des3-cbc-sha1 rc4-hmac des-cbc-md5 des3-cbc-sha1-kd rc4-hmac-md5
	default_tgs_enctypes = AES256-CTS-HMAC-SHA1-96 AES128-CTS-HMAC-SHA1-96 des3-cbc-sha1 rc4-hmac des-cbc-md5 des3-cbc-sha1-kd rc4-hmac-md5
	permitted_enctypes = AES256-CTS-HMAC-SHA1-96 AES128-CTS-HMAC-SHA1-96 des3-cbc-sha1 rc4-hmac des-cbc-md5 des3-cbc-sha1-kd rc4-hmac-md5

	allow_weak_crypto = true
	udp_preference_limit = 1
	ticket_lifetime = 24h  
	renew_lifetime = 7d  
	forwardable = true  
	rdns = false  
	pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt  
	default_ccache_name = KEYRING:persistent:%{uid} 

已尝试的额外配置 #

kdc_req_checksum_type = 1
safe_checksum_type = 1
ap_req_checksum_type = 1

排查建议 #

• 验证服务账户密钥一致性：使用ktutil工具检查keytab文件内的SPN条目，确保与Wildfly配置的服务SPN完全匹配，且密钥生成时使用的加密类型包含在default_tgs_enctypes列表中。
• 清理Kerberos缓存：删除服务器上的Kerberos缓存（如KEYRING:persistent:%{uid}），避免旧票据干扰认证流程。
• 调整加密类型优先级：将强加密类型（AES256、AES128）放在default_tkt_enctypes和default_tgs_enctypes的最前面，优先使用强算法，减少弱加密类型导致的兼容性问题。示例：

  default_tkt_enctypes = AES256-CTS-HMAC-SHA1-96 AES128-CTS-HMAC-SHA1-96 des3-cbc-sha1
  default_tgs_enctypes = AES256-CTS-HMAC-SHA1-96 AES128-CTS-HMAC-SHA1-96 des3-cbc-sha1
  permitted_enctypes = AES256-CTS-HMAC-SHA1-96 AES128-CTS-HMAC-SHA1-96 des3-cbc-sha1
  

• 检查时钟同步：确保Wildfly服务器与KDC的时间差在5分钟以内，Kerberos对时钟偏差敏感，超出范围会导致校验失败。
• 查看KDC日志：检查KDC服务器端的认证日志，确认是否存在SPN匹配错误、密钥不匹配或加密类型协商失败的记录。
• 移除手动校验和配置：删除kdc_req_checksum_type、safe_checksum_type、ap_req_checksum_type这三个手动配置，让系统自动协商合适的校验和类型，手动指定可能与KDC或客户端不兼容。

内容的提问来源于stack exchange，提问作者Malaiselvan