129 questions
1
vote
1
answer
346
views
Unable to make S4u2self and s4u2proxy with keberos constrained delegation
purpose:
to ensure the correct operation of the proxy server. At the same time, I use the JWT token to authenticate incoming requests. It works correctly.
Next, I need to proxy the request by changing ...
- 29
1
vote
1
answer
371
views
How I can generate correct SPNEGO token from existing kerberos token using pyspnego?
I am trying to solve the problem of accessing a service (HTTP) using the kerberos constrained delegation mechanism. It seems that I am forming the kerberos ticket correctly, but at the same time ...
- 29
0
votes
0
answers
57
views
In Kerberos Environment in case of constraint Delegation do we need to pass AuthIdentity to AcquireCredentialsHandle function SSPI
In case of Kerberos constraint delegation do we need to pass AuthIdentity correct credentials to AcquireCredentialsHandle function?
As per my understanding we need to pass AuthIdentity as NULL to
...
- 53
0
votes
0
answers
56
views
Kerberos Authentication is not working using SSPI Wrapper class
I have web application which wanted to authenticate in Kerberos Environment.
I am using SSPI wrapper following is the code which calling the windows api
I am calling IN_SSPIWrapper::Instance()....
- 53
0
votes
0
answers
54
views
Kerberos, delegation, and Active Directory
Situation:
ansible (managed by AWX) <-winRM-> management host <-ADWS-> Active directory
Currently I use credssp as authentication mechanism between Ansible and the management host, and I ...
- 168
0
votes
1
answer
148
views
How to implement unconstrained delegation?
I try to implement unconstrained delegation in my spring boot application. Based on the article:
Client sends 2 tickets to the web server:
TGT + TGS(service ticket)
I've configured wireshark to check ...
- 37.1k
1
vote
1
answer
139
views
Is it possible to get TGT ticket from TGS?
I have the following architecture:
Browser requests TGT ticket
Browser requests TGS ticket(sending TGT as argument of request)
Browser requests WEB server and sends TGS ticket(in HTTP header )
Web-...
- 37.1k
1
vote
0
answers
175
views
Alfresco - Kerberos SSO issue after 10 hours - credentials can not be delegated
we have configured Kerberos SSO in Alfresco Community 7.3 (docker instalation) and everything is working properly. User logs into Windows and gets access to Alfresco Share without a need to enter ...
- 409
0
votes
1
answer
392
views
Kerberos ticket has wrong impersonationlevel after the calling application upgraded from .NET 4.7
A web app "A" is calling a Web API "B" which is calling a Sharepoint site "C". All authenticates with Windows authentication.
When "A" is targeting .NET 4.7.2, ...
0
votes
1
answer
339
views
ASP.NET : impersonation breaks on second website configured on same IIS server involving same "applications" & app pool identity
I have an intranet kerberos double-hop scenario configured for Client -> IIS -> SQL. It uses windows integrated authentication from end to end. It uses (unique) domain accounts for both IIS ...
- 1
1
vote
1
answer
1k
views
Connect to HDFS using ticket cache instead of keytab file
I have two clusters(cluster 1 and cluster 2) and both are secured with kerberos authentication. I can only read the data from both clusters and cannot change configuration files on any of these ...
- 29
3
votes
0
answers
171
views
Spring Security Kerberos - using Authentication from session to make Kerberized calls on behalf of user
I'm trying to implement REST services over LDAP directory. Both have Kerberos-protected access. I already have working code (based on Security Server Spnego and Form Auth Sample sample), which login ...
0
votes
0
answers
534
views
Jobs are failing due to Kerberos issues
I'm getting the following error in my cluster (HDP 3.1, NameNode HA, Kerberos security via AD integration):
23/01/12 05:03:13 INFO HiveMetaStoreClient: HMSC::open(): Could not find delegation token. ...
- 1
1
vote
1
answer
2k
views
SQL Linked Server issue with impersonation and constrained delegation
I am struggling with setting up a SQL Linked server on SQL2017 that uses impersonation with a windows domain account and Kerberos Constrained Delegation.
I have 4 SQL nodes in a cluster and a linked ...
- 98
0
votes
1
answer
3k
views
KRBError: KDC cannot accommodate requested option - when Constrained Delegation is Enabled
Having got an SSO solution fully working using Spnego/Kerberos within a Windows Tomcat environment which allows my windows domain user to be used to make a connection to an IBMi via JTOpen which then ...
- 1