CAS Spnego认证异常：Clock Skew Too Great(37)及重复请求问题求助

我们内部有一款应用，通过CAS实现SSO登录LDAP（AD）服务器。正常状态下用户可通过SSO正常登录，但当活跃用户数超过100时，CAS会返回与AD相关的认证错误，必须重启CAS并关闭用户会话才能恢复。目前LUP CAS模块已2.5年未升级，一直维持当前版本运行。

错误日志 #

错误1：时钟偏移过大 #

Caused by: java.lang.reflect.InvocationTargetException
    at jdk.internal.reflect.GeneratedMethodAccessor355.invoke(Unknown Source)
    at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.base/java.lang.reflect.Method.invoke(Method.java:566)
    at jcifs.spnego.Authentication$ServerAction.run(Authentication.java:517)
    at jcifs.spnego.Authentication.processKerberos(Authentication.java:430)
    ... 197 more
Caused by: GSSException: Failure unspecified at GSS-API level (Mechanism level: Clock skew too great (37))
    at java.security.jgss/sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:859)
    at java.security.jgss/sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:361)
    at java.security.jgss/sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:303)
    ... 202 more
Caused by: KrbException: Clock skew too great (37)
    at java.security.jgss/sun.security.krb5.KrbApReq.authenticate(KrbApReq.java:302)
    at java.security.jgss/sun.security.krb5.KrbApReq.<init>(KrbApReq.java:149)
    at java.security.jgss/sun.security.jgss.krb5.InitSecContextToken.<init>(InitSecContextToken.java:139)
    at java.security.jgss/sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:832)
    ... 204 more
jcifs.spnego.AuthenticationException: Error performing Kerberos authentication: java.lang.reflect.InvocationTargetException
    at jcifs.spnego.Authentication.processKerberos(Authentication.java:447)
    at jcifs.spnego.Authentication.processSpnego(Authentication.java:346)
    at jcifs.spnego.Authentication.process(Authentication.java:235)
    at org.apereo.cas.support.spnego.authentication.handler.support.JcifsSpnegoAuthenticationHandler.doAuthentication(JcifsSpnegoAuthenticationHandler.java:72)
    at lup.security.cas.LupActiveDirectorySpnegoAuthenticationHandler.doAuthentication(LupActiveDirectorySpnegoAuthenticationHandler.java:43)
    at org.apereo.cas.authentication.handler.support.AbstractPreAndPostProcessingAuthenticationHandler.authenticate(AbstractPreAndPostProcessingAuthenticationHandler.java:43)
    at jdk.internal.reflect.GeneratedMethodAccessor350.invoke(Unknown Source)
    at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.base/java.lang.reflect.Method.invoke(Method.java:566)

错误2：请求重放 #

Caused by: java.lang.reflect.InvocationTargetException
        at jdk.internal.reflect.GeneratedMethodAccessor315.invoke(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:566)
        at jcifs.spnego.Authentication$ServerAction.run(Authentication.java:517)
        at jcifs.spnego.Authentication.processKerberos(Authentication.java:430)
        ... 197 more
Caused by: GSSException: Failure unspecified at GSS-API level (Mechanism level: Request is a replay (34))
        at java.security.jgss/sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:859)
        at java.security.jgss/sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:361)
        at java.security.jgss/sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:303)
        ... 202 more
Caused by: KrbException: Request is a replay (34)
        at java.security.jgss/sun.security.krb5.internal.rcache.AuthList.put(AuthList.java:88)
        at java.security.jgss/sun.security.krb5.internal.rcache.MemoryCache.checkAndStore(MemoryCache.java:60)
        at java.security.jgss/sun.security.krb5.KrbApReq.authenticate(KrbApReq.java:325)
        at java.security.jgss/sun.security.krb5.KrbApReq.<init>(KrbApReq.java:149)
        at java.security.jgss/sun.security.jgss.krb5.InitSecContextToken.<init>(InitSecContextToken.java:139)
        at java.security.jgss/sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:832)

已尝试的解决措施 #

• 已通过服务器团队协助，使用NTP工具修复AD服务器与应用服务器的时间同步问题，但异常仍间歇性出现
• 重启CAS应用后有时可恢复正常

预期目标 #

实现任意数量用户均可通过SSO正常登录CAS，无认证异常。

内容的提问来源于stack exchange，提问作者rohit0025