5

After setting our domain users to support AES encryption for Kerberos tokens (Windows Server 2008R2), on a web-application server side we get the following exception:

GSSException: Failure unspecified at GSS-API level (Mechanism level: Encryption type AES256CTS mode with HMAC SHA1-96 is not supported/enabled)

Strangely we have Java 6 (1.6.0_27) , which means that AES should be supported, according to this document: http://docs.oracle.com/javase/6/docs/technotes/guides/security/jgss/jgss-features.html

Any ideas what's missing in our web-application or Java, or third parties? We are using Spring security Kerberos extension (with minimal code modifications to fit into our current Spring 2.x version and additional authentication requirements).

1

1 Answer 1

16

EDIT (2017-05-06): upcoming JDK versions will have this included. Only a config parameter needs to be set, see JDK-8157561.

Follow this link - Java SE Downloads, scroll down and download the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files for your specific JDK version and follow the process in this tutorial titled: 5.4.2. Kerberos and Unlimited Strength Policy.

The basic steps are as follows:

  1. locate your JDK's security directory (showing Unix below):

    $ locate 'jre/lib/security' | grep 'lib/security$'
    /usr/java/jdk1.7.0_17/jre/lib/security
    /usr/lib/jvm/java-1.5.0-gcj-1.5.0.0/jre/lib/security
    /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/lib/security
    /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.9.x86_64/jre/lib/security
    
  2. Noting the above, we need to add the downloaded JCE .jar files to /usr/java/jdk1.7.0_17/jre/lib/security.

  3. The JCE .zip file includes the following (showing JDK 1.7's JCE):

    $ ls -l UnlimitedJCEPolicy
    total 16
    -rw-rw-r-- 1 root root 2500 May 31  2011 local_policy.jar
    -rw-r--r-- 1 root root 7289 May 31  2011 README.txt
    -rw-rw-r-- 1 root root 2487 May 31  2011 US_export_policy.jar
    
  4. These are the bundled versions with the JDK (again 1.7):

    $ ls -l /usr/java/jdk1.7.0_17/jre/lib/security/*.jar
    -rw-r--r--. 1 root root 2865 Mar  1  2013 /usr/java/jdk1.7.0_17/jre/lib/security/local_policy.jar
    -rw-r--r--. 1 root root 2397 Mar  1  2013 /usr/java/jdk1.7.0_17/jre/lib/security/US_export_policy.jar
    
  5. We need to move these out of the way and replace them with the included versions in the JCE .zip file. I typically do the following:

    $ pushd /usr/java/jdk1.7.0_17/jre/lib/security/
    /usr/java/jdk1.7.0_17/jre/lib/security ~
    
    $ mkdir limited
    $ mv *.jar limited/
    
    $ cp ~/UnlimitedJCEPolicy/*.jar .
    $ ls -l *.jar
    -rw-r--r-- 1 root root 2500 Jun 25 12:50 local_policy.jar
    -rw-r--r-- 1 root root 2487 Jun 25 12:50 US_export_policy.jar
    
  6. Restart anything that's making use of JDK (Tomcat, etc.).

5
  • I will try it, but to be clear: I thought it applies to JDK/JRE 5.0, not 6. Am I mistaken here?
    – Art Licis
    Oct 18, 2012 at 13:57
  • I commented before I downloaded 'Unlimited Strength Jurisdiction Policy Files' and read the readme.txt file. Thank you so much!
    – Art Licis
    Oct 18, 2012 at 13:59
  • 1
    Have not yet tested (no access to network any more today), but I already see it should work. Any chance you might know which encryption Windows Server 2008 R2 uses by default when both AES encryption checkboxes (128bit and 256bit) are unchecked in User Account properties?
    – Art Licis
    Oct 18, 2012 at 14:35
  • I guess when the client advertises RC4-HMAc, AES128 and AES256, the KDC will/should pick the best. You can verify that by sniffing the traffic with Wireshark.
    – Michael-O
    Oct 18, 2012 at 18:42
  • 1
    This shouldn't be needed anymore as of Java 8u161. oracle.com/technetwork/java/javase/… Jan 18, 2018 at 7:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.