Hi,

We have been using winSSPI.dll on client side from 3.2 package. This dll is not working anymore in JDK 7.

The exception trace as follows :

[DEBUG] Mon Aug 26 14:30:10 CEST 2013 jcsi.kerberos: [init]: OS name = 'Windows 7', version = '6.1'

[DEBUG] Mon Aug 26 14:30:10 CEST 2013 jcsi.kerberos: [init]: isKerberosOS = true, isSessionKeySupported = true

[DEBUG] Mon Aug 26 14:30:10 CEST 2013 jcsi.kerberos: initialize: calling native method ...

[winSSPI.dll] initialize

[winSSPI.dll] initialize: done

[INFO] Mon Aug 26 14:30:10 CEST 2013 jcsi.kerberos: initialize: Successfully initialized Windows SSPI

[DEBUG] Mon Aug 26 14:30:10 CEST 2013 jcsi.kerberos: acquireCredentialsHandle: calling native method ...

[winSSPI.dll] acquireCredentialsHandle

[DEBUG] Mon Aug 26 14:30:10 CEST 2013 jcsi.kerberos: loadCredential: result = 0

Attempting initContext with principal: HTTP/appsec001.gaia.net.intra

initContext failed with principal: HTTP/appsec001.gaia.net.intra error: GSSException: com.dstc.security.kerberos.winSSPI.WinSSPIMechanismFactoryU2S configured by WinSSPIGSS for GSS-API Mechanism Factory cannot be created

Attempting initContext with principal: HOST/appsec001.gaia.net.intra

initContext failed with principal: HOST/appsec001.gaia.net.intra error: GSSException: com.dstc.security.kerberos.winSSPI.WinSSPIMechanismFactoryU2S configured by WinSSPIGSS for GSS-API Mechanism Factory cannot be created

initContext failed with all attempted principals

java.security.PrivilegedActionException: javax.security.auth.login.LoginException: LoginException: java.security.PrivilegedActionException: GSSException: com.dstc.security.kerberos.winSSPI.WinSSPIMechanismFactoryU2S configured by WinSSPIGSS for GSS-API Mechanism Factory cannot be created

          at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:373)

          at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:146)

          at weblogic.security.Security.runAs(Security.java:61)

          at security.role.TestKerberosEJBCall.main(TestKerberosEJBCall.java:32)

Caused by: javax.security.auth.login.LoginException: LoginException: java.security.PrivilegedActionException: GSSException: com.dstc.security.kerberos.winSSPI.WinSSPIMechanismFactoryU2S configured by WinSSPIGSS for GSS-API Mechanism Factory cannot be created

          at com.quest.vsj.weblogic.login.EjbClientKerberosLoginModule.login(EjbClientKerberosLoginModule.java:107)

          at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

          at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)

          at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

          at java.lang.reflect.Method.invoke(Method.java:606)

          at javax.security.auth.login.LoginContext.invoke(LoginContext.java:784)

          at javax.security.auth.login.LoginContext.access$000(LoginContext.java:203)

          at javax.security.auth.login.LoginContext$4.run(LoginContext.java:698)

          at javax.security.auth.login.LoginContext$4.run(LoginContext.java:696)

          at java.security.AccessController.doPrivileged(Native Method)

          at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:695)

          at javax.security.auth.login.LoginContext.login(LoginContext.java:594)

          at security.role.TestKerberosEJBCall$1.run(TestKerberosEJBCall.java:35)

          at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:363)

          ... 3 more

Any ideas if any newer version or patch is supporting both JDK 7 64 & 32 bit ?

Thanks in advance.

I'm look at putting together a solution for a rather complex user-override situation - using the user-override-directory -

I've configured vasd to use the directory - and it appears to do so - however . . .  there is no indication of what order the files in the directory are processed / searched ? I've tried experimenting with file names to see if it's alphanumeric based on file name - however that does not seem the case . . . .

The man pages seem to indicate that the files are processed until a match is reached - if it is . . .  how can I determine the order of file searching ?

eg - If a user two differant overrides defined in two files in the directory - which one is used ?

Added log file showing wierd, unpredictable processing of files

TIA

We have an AD group 'foo'.  User Abe is added to it using AD tools.

I cannot see this user in the group using vastool on Solaris.  And of course the user cannot login.

$ vastool list groups | grep foo

foo:VAS:2010:john.doe@na.company.com,harry.who@na.company.com

$

I've executed vastool flush to no affect.

What am I doing wrong?

I am new to Kerberos.  When attempting to build a Kerberos credential, I call:

com.dstc.security.kerberos.winSSPI.WinSSPIGSSManager.getInstance();

For some people this causes:

Caused by: GSSException: Failure unspecified at GSS-API level

at com.dstc.security.kerberos.winSSPI.WinSSPIGSSManager.<init>(WinSSPIGSSManager.java:86)

at com.dstc.security.kerberos.winSSPI.WinSSPIGSSManager.getInstance(WinSSPIGSSManager.java:109)

... 33 more

Caused by: com.dstc.security.kerberos.winSSPI.SSPIException: WinSSPI not supported on this platform (Windows XP)

at com.dstc.security.kerberos.winSSPI.SSPI.initialize(SSPI.java:304)

at com.dstc.security.kerberos.winSSPI.WinSSPIGSSManager.<init>(WinSSPIGSSManager.java:84)

... 34 more

For others, it works fine.  I have also seen "WinSSPI not supported on this platform (Windows 7)" on Windows 7 machines.

What does that error indicate?  Where can I begin debugging?

I've recently upgraded to Windows 7, and am enjoying the menu of open putty sessions displayed when I hover my mouse over the putty icon in my toolbar.  HOWEVER, one aspect which bothers me is how the menu displays.  Initially it displays a horizontal list of icons for each session, expanding the list up to 10 sessions, after which it tranforms that list to a vertical list of lines in a single window, one line for each session.  My issue is that once the horizontal list exceeds 6 sessions, the session names contained in the icons get truncated from the right to the point that they are no longer unique, rendering them useless.  Consequently, once I open a 7th session, I proceed to open another 4 simply to maintain the usability of my session menu.  Does anyone know a way to customize either the point at which the menu transfers to a horizontal list, or the session name truncation so that it truncates from the left instead of the right?

I hope this is the right community to post this in.

I have a domain that I need to run adprep on, but it errors out with numerous errors like below.

OID "1.3.6.1.1.1.1.0" defined for object CN=Vintela-uidNumber,CN=Schema,CN=Configuration,DC=xxx,DC=xxx,DC=xxx conflicts with the schema extensions needed for Windows 2003.

[Status/Consequence]

Adprep will not extend your existing schema.
[User Action]

Contact the vendor of the application that extended the schema with the OID value "1.3.6.1.1.1.1.0" and resolve this inconsistency.  Then run adprep again.

This domain was 2000 and is now 2003 R2, but I cannot add a DC until I run adprep first.

Is there something that I can do to resolve this?

Mark

Hi all,

- I have  a Web Server configured with 2 Apache Instances, each instance running as different user and port.

- I configured the VAS module for Active Directory Authentication on both instances

- So, now, the problem, is that in one instance the VAS authentication is working really good, and in the otherone,

we're having problems. It's always requesting Credentials when you try to access any websites hosted on this second instances.

The strange thing is that in the first instance, every website is working correctly and it's taking credentials automatically from browser.

Have anyone seen this kind of behavior?

Thanks in advance,

Obed N Munoz

I am working to build the mod_auth_vas module with IBM's IHS 2.0.47.0 version of Apache.  I am using IBM's C compiler as this is the default of the IHS version.  The configure succeeds, but the link fails with the following.

Making all in .
make[1]: Entering directory `/home/wpz1599/mod_auth_vas-3.5.3.308'
for f in mod_auth_vas.c compat.h; do \
  cmp ./$f ./$f 2>/dev/null || \
    cp ./$f . ; \
done
/apps/IHS/bin/apxs -c -S CC='/usr/vac/bin/xlc_r' \
        -DHAVE_UNIX_SUEXEC -DMODAUTHVAS_DIAGNOSTIC -DMODAUTHVAS_VERBOSE \
        -DMODAUTHVAS_VERSION='\"3.5.3.308\"' \
        -Wc,-g -Wc,+DAportable \
        -Wc,-I/opt/quest/include \
        -Wl,-bexpall \
        -Wl,-bnolibpath -Wl,-blibpath:/opt/quest/lib:/usr/lib:/lib -Wl,-L/opt/quest/lib -Wl,-lvas -Wl,-L/opt/quest/lib/support -Wl,-lgcc_s \
        -o mod_auth_vas.so \
        -n auth_vas \
        mod_auth_vas.c
/apps/IHS/build/libtool --silent --mode=compile /usr/vac/bin/xlc_r -prefer-pic -O2 -qmaxmem=8192  -U__STR__ -D_THREAD_SAFE -D_USE_IRS -qHALT=E -I/apps/IHS/include  -I/apps/IHS/include   -I/apps/IHS/include  -g +DAportable -I/opt/quest/include -DHAVE_UNIX_SUEXEC -DMODAUTHVAS_DIAGNOSTIC -DMODAUTHVAS_VERBOSE -DMODAUTHVAS_VERSION=\"3.5.3.308\"  -c -o mod_auth_vas.lo mod_auth_vas.c && touch mod_auth_vas.slo
/usr/vac/bin/xlc_r: 1501-228 input file +DAportable not found
"mod_auth_vas.c", line 280.17: 1506-196 (W) Initialization between types "void*" and "unsigned long" is not allowed.
"mod_auth_vas.c", line 284.17: 1506-196 (W) Initialization between types "void*" and "unsigned long" is not allowed.
"mod_auth_vas.c", line 288.17: 1506-196 (W) Initialization between types "void*" and "unsigned long" is not allowed.
"mod_auth_vas.c", line 292.17: 1506-196 (W) Initialization between types "void*" and "unsigned long" is not allowed.
"mod_auth_vas.c", line 296.17: 1506-196 (W) Initialization between types "void*" and "unsigned long" is not allowed.
"mod_auth_vas.c", line 300.17: 1506-196 (W) Initialization between types "void*" and "unsigned long" is not allowed.
"mod_auth_vas.c", line 304.17: 1506-196 (W) Initialization between types "void*" and "unsigned long" is not allowed.
"mod_auth_vas.c", line 308.17: 1506-196 (W) Initialization between types "void*" and "unsigned long" is not allowed.
"mod_auth_vas.c", line 312.17: 1506-196 (W) Initialization between types "void*" and "unsigned long" is not allowed.
"mod_auth_vas.c", line 316.17: 1506-196 (W) Initialization between types "void*" and "unsigned long" is not allowed.
/apps/IHS/build/libtool --silent --mode=link /usr/vac/bin/xlc_r -o mod_auth_vas.so -g +DAportable -I/opt/quest/include -DHAVE_UNIX_SUEXEC -DMODAUTHVAS_DIAGNOSTIC -DMODAUTHVAS_VERBOSE -DMODAUTHVAS_VERSION=\"3.5.3.308\"  -bexpall -bnolibpath -blibpath:/opt/quest/lib:/usr/lib:/lib -L/opt/quest/lib -lvas -L/opt/quest/lib/support -lgcc_s -rpath /apps/IHS/modules -module -avoid-version  -Wl,-brtl  mod_auth_vas.lo
/usr/vac/bin/xlc_r: 1501-228 input file +DAportable not found
ld: 0711-317 ERROR: Undefined symbol: .main
ld: 0711-317 ERROR: Undefined symbol: .ap_log_perror
ld: 0711-317 ERROR: Undefined symbol: .ap_log_assert
ld: 0711-317 ERROR: Undefined symbol: .apr_sockaddr_info_get
ld: 0711-317 ERROR: Undefined symbol: .ap_log_rerror
ld: 0711-317 ERROR: Undefined symbol: .apr_table_do
ld: 0711-317 ERROR: Undefined symbol: .apr_ipsubnet_create
ld: 0711-317 ERROR: Undefined symbol: .apr_ipsubnet_test
ld: 0711-317 ERROR: Undefined symbol: .apr_thread_mutex_unlock
ld: 0711-317 ERROR: Undefined symbol: .apr_thread_mutex_lock
ld: 0711-317 ERROR: Undefined symbol: .apr_uid_get
ld: 0711-317 ERROR: Undefined symbol: .apr_uid_name_get
ld: 0711-317 ERROR: Undefined symbol: ap_set_flag_slot
ld: 0711-317 ERROR: Undefined symbol: ap_set_string_slot
ld: 0711-317 ERROR: Undefined symbol: .apr_pstrdup
ld: 0711-317 ERROR: Undefined symbol: .apr_psprintf
ld: 0711-317 ERROR: Undefined symbol: .ap_hook_post_config
ld: 0711-317 ERROR: Undefined symbol: .ap_hook_child_init
ld: 0711-317 ERROR: Undefined symbol: .ap_hook_auth_checker
ld: 0711-317 ERROR: Undefined symbol: .ap_hook_check_user_id
ld: 0711-317 ERROR: Undefined symbol: .ap_hook_get_suexec_identity
ld: 0711-317 ERROR: Undefined symbol: .ap_hook_fixups
ld: 0711-317 ERROR: Undefined symbol: .apr_thread_mutex_create
ld: 0711-317 ERROR: Undefined symbol: .ap_log_error
ld: 0711-317 ERROR: Undefined symbol: .ap_add_version_component
ld: 0711-317 ERROR: Undefined symbol: .apr_palloc
ld: 0711-317 ERROR: Undefined symbol: apr_pool_cleanup_null
ld: 0711-317 ERROR: Undefined symbol: .apr_pool_cleanup_register
ld: 0711-317 ERROR: Undefined symbol: .apr_table_setn
ld: 0711-317 ERROR: Undefined symbol: .ap_auth_type
ld: 0711-317 ERROR: Undefined symbol: .ap_requires
ld: 0711-317 ERROR: Undefined symbol: .apr_table_get
ld: 0711-317 ERROR: Undefined symbol: .ap_getword_white
ld: 0711-317 ERROR: Undefined symbol: .apr_base64_decode_len
ld: 0711-317 ERROR: Undefined symbol: .apr_base64_decode
ld: 0711-317 ERROR: Undefined symbol: .apr_table_add
ld: 0711-317 ERROR: Undefined symbol: .apr_pstrmemdup
ld: 0711-317 ERROR: Undefined symbol: .ap_custom_response
ld: 0711-317 ERROR: Undefined symbol: .ap_psignature
ld: 0711-317 ERROR: Undefined symbol: .apr_pstrcat
ld: 0711-317 ERROR: Undefined symbol: .apr_table_set
ld: 0711-317 ERROR: Undefined symbol: .ap_getword_conf
ld: 0711-317 ERROR: Undefined symbol: .apr_table_make
ld: 0711-317 ERROR: Undefined symbol: .ap_set_string_slot
ld: 0711-345 Use the -bloadmap or -bnoquiet option to obtain more information.
apxs:Error: Command failed with rc=524288
.
make[1]: *** [mod_auth_vas.so] Error 1
make[1]: Leaving directory `/home/wpz1599/mod_auth_vas-3.5.3.308'
make: *** [all-recursive] Error 1


I can fix the .apr_ prefixed symbols, but cannot locate the .ap_ prefixed symbols.

Has anyone else encountered this issue?

Hi experts!

I am newbie for VAS.

After installation of  VAS 3.5 on both server(windows server 2003) and client(redhat5.2) according to the manual,

I failed to login the linux client using a Unix enabled domain user :test

I try to run some troubleshooting commands, and get some information as below:

[root@redhat-head ~]# /opt/quest/bin/vastool user checklogin test
WARNING: NSS lookup (getpwnam) for user test failed, this will almost
certainly mean that you will be unable to log in with a username of test.
This should be fixed before worrying about any other failures.
##I checked /etc/nsswith.conf, and found everything is ok.

[root@redhat-head ~]# /opt/quest/bin/vastool nss getpwnam test
ERROR: Could not look up user for name: test, error = 2.

[root@redhat-head ~]# /opt/quest/bin/vastool info domain
test.com

[root@redhat-head ~]#/opt/quest/bin/vastool -u host/ attrs test uidnumber gidnumber unixhomedirectory loginshell userprincipalname DistinguishedName
ginshell userprincipalname DistinguishedName
distinguishedName: CN=test,OU=Unix,DC=pera-test,DC=com
userPrincipalName: test@test.com
uidNumber: 1000
gidNumber: 1000
unixHomeDirectory: /home/test
loginShell: /bin/bash

I can't  find where the problem is.

Any advise?

Thank in advance!

We have an AD group 'foo'.  User Abe is added to it using AD tools.

I cannot see this user in the group using vastool on Solaris.  And of course the user cannot login.

$ vastool list groups | grep foo

foo:VAS:2010:john.doe@na.company.com,harry.who@na.company.com

$

I've executed vastool flush to no affect.

What am I doing wrong?

Hi,

We have been using winSSPI.dll on client side from 3.2 package. This dll is not working anymore in JDK 7.

The exception trace as follows :

[DEBUG] Mon Aug 26 14:30:10 CEST 2013 jcsi.kerberos: [init]: OS name = 'Windows 7', version = '6.1'

[DEBUG] Mon Aug 26 14:30:10 CEST 2013 jcsi.kerberos: [init]: isKerberosOS = true, isSessionKeySupported = true

[DEBUG] Mon Aug 26 14:30:10 CEST 2013 jcsi.kerberos: initialize: calling native method ...

[winSSPI.dll] initialize

[winSSPI.dll] initialize: done

[INFO] Mon Aug 26 14:30:10 CEST 2013 jcsi.kerberos: initialize: Successfully initialized Windows SSPI

[DEBUG] Mon Aug 26 14:30:10 CEST 2013 jcsi.kerberos: acquireCredentialsHandle: calling native method ...

[winSSPI.dll] acquireCredentialsHandle

[DEBUG] Mon Aug 26 14:30:10 CEST 2013 jcsi.kerberos: loadCredential: result = 0

Attempting initContext with principal: HTTP/appsec001.gaia.net.intra

initContext failed with principal: HTTP/appsec001.gaia.net.intra error: GSSException: com.dstc.security.kerberos.winSSPI.WinSSPIMechanismFactoryU2S configured by WinSSPIGSS for GSS-API Mechanism Factory cannot be created

Attempting initContext with principal: HOST/appsec001.gaia.net.intra

initContext failed with principal: HOST/appsec001.gaia.net.intra error: GSSException: com.dstc.security.kerberos.winSSPI.WinSSPIMechanismFactoryU2S configured by WinSSPIGSS for GSS-API Mechanism Factory cannot be created

initContext failed with all attempted principals

java.security.PrivilegedActionException: javax.security.auth.login.LoginException: LoginException: java.security.PrivilegedActionException: GSSException: com.dstc.security.kerberos.winSSPI.WinSSPIMechanismFactoryU2S configured by WinSSPIGSS for GSS-API Mechanism Factory cannot be created

          at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:373)

          at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:146)

          at weblogic.security.Security.runAs(Security.java:61)

          at security.role.TestKerberosEJBCall.main(TestKerberosEJBCall.java:32)

Caused by: javax.security.auth.login.LoginException: LoginException: java.security.PrivilegedActionException: GSSException: com.dstc.security.kerberos.winSSPI.WinSSPIMechanismFactoryU2S configured by WinSSPIGSS for GSS-API Mechanism Factory cannot be created

          at com.quest.vsj.weblogic.login.EjbClientKerberosLoginModule.login(EjbClientKerberosLoginModule.java:107)

          at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

          at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)

          at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

          at java.lang.reflect.Method.invoke(Method.java:606)

          at javax.security.auth.login.LoginContext.invoke(LoginContext.java:784)

          at javax.security.auth.login.LoginContext.access$000(LoginContext.java:203)

          at javax.security.auth.login.LoginContext$4.run(LoginContext.java:698)

          at javax.security.auth.login.LoginContext$4.run(LoginContext.java:696)

          at java.security.AccessController.doPrivileged(Native Method)

          at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:695)

          at javax.security.auth.login.LoginContext.login(LoginContext.java:594)

          at security.role.TestKerberosEJBCall$1.run(TestKerberosEJBCall.java:35)

          at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:363)

          ... 3 more

Any ideas if any newer version or patch is supporting both JDK 7 64 & 32 bit ?

Thanks in advance.