Kerberos Authentication to FreeIPA - web application error

We're using the sample FreeIPA XML Spring Security file that is included with OpenNMS Horizon.  The changes to applicationContext-spring-security.xml have been made exactly as directed in the sso_freeIPA_kerb_ldap.xml file.

We've added the SPN HTTP/[email protected] to the OpenNMS host in FreeIPA, and used ipa-getkeytab to retrieve the keytab.

Authentication appears to work, as we get an error (Your log-in attempt failed, please try again.  Reason: Kerberos authentication failed) when we use an incorrect user/password.  When we use a correct username/password combination, with a user that is in the opennms_admins or opennms_users groups, the OpenNMS Web User Interface encounters an error.  I've posted a screenshot on imgur: https://imgur.com/a/x7DqdNY.  We can log in with any native OpenNMS accounts without issue; only FreeIPA accounts encounter this issue.

The web interface error:

The OpenNMS Web User Interface Has Experienced an Error
The OpenNMS web UI has encountered an error that it does not know how to handle.
Possible causes could be that the database is not responding, the OpenNMS application has stopped or is not running, or there is an issue with the servlet container.
Please bring this message to the attention of the person responsible for maintaining OpenNMS for your organization, and have him or her check that OpenNMS, the external servlet container (if applicable), and the database are all running without errors.
To reveal details of the error encountered and instructions for reporting it, click here.

Error Details
Please include the information below when reporting problems.

javax.naming.AuthenticationException
	at org.springframework.security.kerberos.client.ldap.KerberosLdapContextSource.login(KerberosLdapContextSource.java:151)
	at org.springframework.security.kerberos.client.ldap.KerberosLdapContextSource.getDirContextInstance(KerberosLdapContextSource.java:110)
	at org.springframework.ldap.core.support.AbstractContextSource.createContext(AbstractContextSource.java:273)
	at org.springframework.ldap.core.support.AbstractContextSource.doGetContext(AbstractContextSource.java:119)
	at org.springframework.ldap.core.support.AbstractContextSource.getReadOnlyContext(AbstractContextSource.java:138)
	at org.springframework.ldap.core.LdapTemplate.executeReadOnly(LdapTemplate.java:791)
	at org.springframework.security.ldap.SpringSecurityLdapTemplate.searchForSingleEntry(SpringSecurityLdapTemplate.java:194)
	at org.springframework.security.ldap.search.FilterBasedLdapUserSearch.searchForUser(FilterBasedLdapUserSearch.java:116)
	at org.opennms.web.springframework.security.KerberosLdapAuthenticationProvider.authenticate(KerberosLdapAuthenticationProvider.java:75)
	at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:156)
	at org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter.attemptAuthentication(UsernamePasswordAuthenticationFilter.java:92)
	at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:211)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
	at org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter.doFilter(AbstractPreAuthenticatedProcessingFilter.java:107)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
	at org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter.doFilter(AbstractPreAuthenticatedProcessingFilter.java:107)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
	at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:110)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
	at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:50)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
	at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
	at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
	at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
	at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160)
	at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
	at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:262)
	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1621)
	at org.springframework.orm.hibernate3.support.OpenSessionInViewFilter.doFilterInternal(OpenSessionInViewFilter.java:231)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1621)
	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:121)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1613)
	at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:541)
	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)
	at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:548)
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:190)
	at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1592)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:188)
	at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1239)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:168)
	at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:481)
	at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1561)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:166)
	at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1141)
	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
	at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:213)
	at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:118)
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
	at org.opennms.netmgt.jetty.MDCHandler.handle(MDCHandler.java:46)
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
	at org.eclipse.jetty.server.Server.handle(Server.java:564)
	at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:320)
	at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:251)
	at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:279)
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:110)
	at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:258)
	at org.eclipse.jetty.io.ssl.SslConnection$3.succeeded(SslConnection.java:147)
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:110)
	at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:124)
	at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:672)
	at org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:590)
	at java.lang.Thread.run(Thread.java:748)

Request Details
Locale 	en_US
Method 	POST
Path Info 	null
Path Info (translated) 	null
Protocol 	HTTP/1.1
URI 	/opennms/errors/unknownexception.jsp
URL 	https://opennms.mydomain.com/opennms/errors/unknownexception.jsp
Scheme 	https
Server Name 	opennms.mydomain.com
Server Port 	443

System Details
OpenNMS Version: 	22.0.0
Java Version: 	1.8.0_144 Oracle Corporation
Java Virtual Machine: 	25.144-b01 Oracle Corporation
Operating System: 	Linux 3.10.0-862.3.3.el7.x86_64 (amd64)
Servlet Container: 	jetty/9.4.2.v20170220 (Servlet Spec 3.1)
User Agent: 	Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0

------------------------------------------

sso_freeIPA_kerb_ldap.xml:
<beans xmlns="http://www.springframework.org/schema/beans"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xmlns:sec="http://www.springframework.org/schema/security"
  xmlns:context="http://www.springframework.org/schema/context"
  xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd
    http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.2.xsd
    http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.2.xsd">

  <bean id="kerberosAuthenticationProvider"
    class="org.opennms.web.springframework.security.KerberosLdapAuthenticationProvider">
    <property name="kerberosClient">
      <bean class="org.springframework.security.kerberos.authentication.sun.SunJaasKerberosClient">
        <property name="debug" value="true"/>
      </bean>
    </property>
    <property name="ldapUserSearch" ref="kerberosLdapUserSearch"/>
    <property name="ldapAuthoritiesPopulator" ref="kerberosUserGroupLdapAuthoritiesPopulator"/>
  </bean>

  <bean id="kerberosServiceAuthenticationProvider"
    class="org.opennms.web.springframework.security.KerberosServiceLdapAuthenticationProvider">
    <property name="ticketValidator">
      <bean
        class="org.springframework.security.kerberos.authentication.sun.SunJaasKerberosTicketValidator">
        <!-- Name of the Kerberos service principal designated for the OpenNMS webapp -->
        <property name="servicePrincipal" value="HTTP/[email protected]" />
        <!-- Location of the Kerberos keytab file. Must be of the form file:/path/to/keytab -->
        <property name="keyTabLocation" value="file:/opt/opennms/etc/HTTP_opennms.mydomain.com.keytab" />
        <property name="debug" value="true" />
      </bean>
    </property>
    <property name="ldapUserSearch" ref="kerberosLdapUserSearch"/>
    <property name="ldapAuthoritiesPopulator" ref="kerberosUserGroupLdapAuthoritiesPopulator"/>
  </bean>

  <bean id="spnegoEntryPoint"
    class="org.springframework.security.kerberos.web.authentication.SpnegoEntryPoint" >
    <constructor-arg value="/login.jsp" />
  </bean>

  <bean id="spnegoAuthenticationProcessingFilter"
    class="org.springframework.security.kerberos.web.authentication.SpnegoAuthenticationProcessingFilter">
    <property name="authenticationManager" ref="authenticationManager" />
  </bean>

  <bean id="kerberosLdapContextSource"
    class="org.springframework.security.kerberos.client.ldap.KerberosLdapContextSource">
    <constructor-arg>
      <list>
        <!-- List one or more of your LDAP servers here -->
        <!-- <value>ldaps://mydomain.com:636/</value> -->
        <value>ldaps://freeipaserver1.mydomain.com:636/</value>
        <value>ldaps://freeipaserver2.mydomain.com:636/</value>
      </list>
    </constructor-arg>
    <!-- Base DN for LDAP searches. Every group below is relative to this. -->
    <constructor-arg value="dc=entegrus,dc=net" />
    <property name="loginConfig" ref="ldapLoginConfig" />
  </bean>

  <bean id="ldapLoginConfig"
    class="org.springframework.security.kerberos.client.config.SunJaasKrb5LoginConfig">
    <!-- Name of the Kerberos service principal designated for the OpenNMS webapp -->
    <property name="servicePrincipal" value="HTTP/[email protected]" />
    <!-- Location of the Kerberos keytab file. Must be of the form file:/path/to/keytab -->
    <property name="keyTabLocation" value="file:/opt/opennms/etc/HTTP_opennms.mydomain.com.keytab" />
    <property name="debug" value="true" />
    <property name="isInitiator" value="true" />
  </bean>

  <bean id="kerberosLdapUserSearch" class="org.springframework.security.ldap.search.FilterBasedLdapUserSearch">
    <!-- Search base for looking up users in the LDAP directory -->
    <constructor-arg index="0" value="cn=users,cn=accounts" />
    <!-- Search filter for user lookups -->
    <constructor-arg index="1" value="(uid={0})" />
    <constructor-arg index="2" ref="kerberosLdapContextSource" />
    <property name="searchSubtree" value="true" />
  </bean>

  <bean id="kerberosUserGroupLdapAuthoritiesPopulator" class="org.opennms.web.springframework.security.UserGroupLdapAuthoritiesPopulator">
    <constructor-arg ref="kerberosLdapContextSource" />
    <!-- Search base for looking up groups in the LDAP directory -->
    <constructor-arg value="cn=groups,cn=accounts" />
    <property name="searchSubtree" value="true" />
    <property name="convertToUpperCase" value="true" />
    <property name="groupRoleAttribute" value="cn" />
    <!-- Search filter for groups -->
    <property name="groupSearchFilter" value="member={0}" />
    <property name="groupToRoleMap">
      <map>
        <entry>
          <!-- Name of the LDAP group for normal (non-admin) OpenNMS users -->
          <key><value>opennms_users</value></key>
          <list>
            <value>ROLE_USER</value>
            <!-- <value>ROLE_DASHBOARD</value> -->
          </list>
        </entry>
        <entry>
          <!-- Name of the LDAP group for OpenNMS administrators -->
          <key><value>opennms_admins</value></key>
          <list>
            <value>ROLE_USER</value>
            <value>ROLE_ADMIN</value>
          </list>
        </entry>
      </map>
    </property>
  </bean>

</beans>

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/index.php/Mailing_List_FAQ

opennms-discuss mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-discuss