[GR-44320] Unable to make Kerberos Authenticated http calls due to GSSManager Oid issue #5950

louis2845 · 2023-02-10T02:55:20Z

Issue is caused by #4700

GraalVM and environment:

OS: Linux RHEL 8
GraalVM version 22.3.1 EE
JDK: 17

GSSException: Unsupported mechanism requested: 1.2.840.113554.1.2.2
at java.security.jgss@17.0.6/sun.security.jgss.ProviderList.getMechFactory(ProviderList.java:199)
at java.security.jgss@17.0.6/sun.security.jgss.ProviderList.getMechFactory(ProviderList.java:166)
at java.security.jgss@17.0.6/sun.security.jgss.GSSManagerImpl.getNameElement(GSSManagerImpl.java:183)
at java.security.jgss@17.0.6/sun.security.jgss.GSSNameImpl.getElement(GSSNameImpl.java:469)
at java.security.jgss@17.0.6/sun.security.jgss.GSSNameImpl.init(GSSNameImpl.java:202)
at java.security.jgss@17.0.6/sun.security.jgss.GSSNameImpl.(GSSNameImpl.java:171)
at java.security.jgss@17.0.6/sun.security.jgss.GSSNameImpl.(GSSNameImpl.java:152)
at java.security.jgss@17.0.6/sun.security.jgss.GSSManagerImpl.createName(GSSManagerImpl.java:109)
at java.security.jgss@17.0.6/sun.net.www.protocol.http.spnego.NegotiatorImpl.init(NegotiatorImpl.java:95)
at java.security.jgss@17.0.6/sun.net.www.protocol.http.spnego.NegotiatorImpl.(NegotiatorImpl.java:123)
at java.base@17.0.6/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:499)
at java.base@17.0.6/java.lang.reflect.Constructor.newInstance(Constructor.java:480)
at java.base@17.0.6/sun.net.www.protocol.http.Negotiator.getNegotiator(Negotiator.java:65)
at java.base@17.0.6/sun.net.www.protocol.http.NegotiateAuthentication.isSupported(NegotiateAuthentication.java:120)
at java.base@17.0.6/sun.net.www.protocol.http.AuthenticationHeader.parse(AuthenticationHeader.java:201)
at java.base@17.0.6/sun.net.www.protocol.http.AuthenticationHeader.(AuthenticationHeader.java:144)
at java.base@17.0.6/sun.net.www.protocol.http.AuthenticationHeader.(AuthenticationHeader.java:124)
at java.base@17.0.6/sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1818)
at java.base@17.0.6/sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1589)
at java.base@17.0.6/java.net.URLConnection.getContent(URLConnection.java:753)
at java.base@17.0.6/sun.net.www.protocol.https.HttpsURLConnectionImpl.getContent(HttpsURLConnectionImpl.java:404)

Like the attached issue it is difficult to recreate the environment due to needing to set up an entire Active Directory / Kerberos environment - but the code in the attached issue should recreate the problem

Seems like the code below should populate providers but it doesn't

    public GSSManagerImpl(GSSCaller caller) {
        list = new ProviderList(caller, USE_NATIVE);
    }

The text was updated successfully, but these errors were encountered:

oubidar-Abderrahim · 2023-02-15T14:29:52Z

Hi, Thank you for reporting this issue, please share a complete reproducer of this issue. with steps to reproduce. Thank you

louis2845 · 2023-02-15T14:38:42Z

I think I commented on #4700 that there should be all you need there to recreate the problem. There is a java class and steps to compile it into native. Is there anything else you'd like me to provide?

oubidar-Abderrahim · 2023-02-15T17:08:37Z

Running the Sample class shared on #4700 throws the following

Exception in thread "main" GSSException: Invalid name provided (Mechanism level: KrbException: Cannot locate default realm)
	at java.security.jgss/sun.security.jgss.krb5.Krb5NameElement.getInstance(Krb5NameElement.java:127)
	at java.security.jgss/sun.security.jgss.krb5.Krb5MechFactory.getNameElement(Krb5MechFactory.java:99)
	at java.security.jgss/sun.security.jgss.GSSManagerImpl.getNameElement(GSSManagerImpl.java:184)
	at java.security.jgss/sun.security.jgss.GSSNameImpl.getElement(GSSNameImpl.java:469)
	at java.security.jgss/sun.security.jgss.GSSNameImpl.init(GSSNameImpl.java:202)
	at java.security.jgss/sun.security.jgss.GSSNameImpl.<init>(GSSNameImpl.java:171)
	at java.security.jgss/sun.security.jgss.GSSNameImpl.<init>(GSSNameImpl.java:152)
	at java.security.jgss/sun.security.jgss.GSSManagerImpl.createName(GSSManagerImpl.java:109)
	at Sample.main(Sample.java:7)

which doesn't seem to be a bug on GraalVM.

louis2845 · 2023-02-15T17:34:30Z

I see, I think you may need to specify the krb5 config. Sorry for this, I will get back to you later today

louis2845 · 2023-02-15T20:22:27Z

It seems as though you've actually gotten past the point which is causing an issue for me:

me - > at java.security.jgss/sun.security.jgss.GSSManagerImpl.getNameElement(GSSManagerImpl.java:183)
you -> at java.security.jgss/sun.security.jgss.GSSManagerImpl.getNameElement(GSSManagerImpl.java:184)

Looking at the code provided in the previous ticket:

javac Sample.java
java -agentlib:native-image-agent=config-output-dir=META-INF/native-image Sample
native-image --no-fallback Sample

The middle java call should fail where you are seeing an exception without proper Kerberos configuration.

Were you definitely running the native image?

javac Sample.java
native-image --no-fallback Sample
./sample

I've just tried the above and am still seeing:

Exception in thread "main" GSSException: Unsupported mechanism requested: 1.2.840.113554.1.2.2
at java.security.jgss@17.0.6/sun.security.jgss.ProviderList.getMechFactory(ProviderList.java:199)
at java.security.jgss@17.0.6/sun.security.jgss.ProviderList.getMechFactory(ProviderList.java:166)
at java.security.jgss@17.0.6/sun.security.jgss.GSSManagerImpl.getNameElement(GSSManagerImpl.java:183)
at java.security.jgss@17.0.6/sun.security.jgss.GSSNameImpl.getElement(GSSNameImpl.java:469)
at java.security.jgss@17.0.6/sun.security.jgss.GSSNameImpl.init(GSSNameImpl.java:202)
at java.security.jgss@17.0.6/sun.security.jgss.GSSNameImpl.(GSSNameImpl.java:171)
at java.security.jgss@17.0.6/sun.security.jgss.GSSNameImpl.(GSSNameImpl.java:152)
at java.security.jgss@17.0.6/sun.security.jgss.GSSManagerImpl.createName(GSSManagerImpl.java:109)
at Sample.main(Sample.java:9)

oubidar-Abderrahim · 2023-03-01T11:41:10Z

Tracked internally on GR 44320

vjovanov · 2023-10-04T13:02:31Z

Thank you for a great reproducer! To make this work you need to add the flag -H:AdditionalSecurityProviders=sun.security.jgss.SunProvider the image build.

We will work to provide a better user experience around this feature.

autodidacticon · 2023-11-07T04:47:19Z

Thank you for a great reproducer! To make this work you need to add the flag -H:AdditionalSecurityProviders=sun.security.jgss.SunProvider the image build.

We will work to provide a better user experience around this feature.

Where can we find definitive reference to this flag?

vjovanov · 2023-11-14T11:01:16Z

What is a definitive reference? We will document this better in the upcoming releases, but first, we need to revisit the defaults. I feel this one should be included by default.

autodidacticon · 2023-11-20T13:56:34Z

@vjovanov Where is the documentation to the flag -H:AdditionalSecurityProviders?

vjovanov · 2023-11-20T14:57:22Z

I wish I had a good answer. We will be improving this feature for JDK 23. Until then the best I can say is that this is the list of possible values in the JDK is:

['sun.security.provider.Sun', 'sun.security.rsa.SunRsaSign', 'sun.security.ec.SunEC', 'sun.security.ssl.SunJSSE', 'com.sun.crypto.provider.SunJCE', 'sun.security.jgss.SunProvider', 'com.sun.security.sasl.Provider', 'org.jcp.xml.dsig.internal.dom.XMLDSigRI', 'sun.security.smartcardio.SunPCSC', 'sun.security.provider.certpath.ldap.JdkLDAP', 'com.sun.security.sasl.gsskerb.JdkSASL']

I got this by running sun.security.jca.Providers.getProviderList() and inspecting class names.

aanavaneeth · 2024-04-01T08:14:10Z

In my case, graalvm is not respecting sun.security.jgss.native=true. (ref: native gss)

I tried buildArgs.add('-J-Dsun.security.jgss.native=true') and buildArgs.add('-Dsun.security.jgss.native=true') as well.

Logged #8674 for this with more details

vjovanov · 2024-04-01T17:50:07Z

Thank you very much for reporting the issue! We will look into it and see why it happens.

yogeshkumargeek · 2024-10-08T18:29:43Z

Hey @vjovanov , Facing same issue REF while implementing kerberos auth with native image in micronaut.
Can you please here ?
It's been quite some time for this issue .Please expedite this

aanavaneeth · 2024-10-08T18:35:44Z

If we have a way to create the instance of gssmanager by passing the "native" as parameter rather than using jvm arguments can help I guess. That would be a jdk change rather than graalvm. However, graalvm handling this also works. I wish they prioritise this. This is blocking a lot of enterprise software from using graalvm native compilation feature.

vjovanov · 2024-10-09T16:00:17Z

@jovanstevanovic is working in this area now so we should be able to provide a fix in the next release.

aanavaneeth · 2024-10-09T16:01:56Z

Wow that's a great news!! Thank you so much!!

jovanstevanovic · 2024-10-09T21:02:03Z

No worries. I can have a look.

yogeshkumar-1234 · 2024-10-10T09:35:14Z

Hey @vjovanov , is there any alternative present at the moment for this kerberos auth issue in native image ?

jovanstevanovic · 2024-10-15T10:31:48Z

@yogeshkumar-1234 the solution in the comment does not help you?

aanavaneeth · 2024-10-15T10:43:05Z

I tried it sometimes back. It didn't work for me. I can check once again.

yogeshkumar-1234 · 2024-10-15T15:53:06Z

@jovanstevanovic It didn't work for me > @yogeshkumar-1234 the solution in the comment does not help you?

jovanstevanovic · 2024-10-16T15:31:20Z

Okay, just to double-check.

louis2845 added bug native-image labels Feb 10, 2023

oubidar-Abderrahim self-assigned this Feb 15, 2023

oubidar-Abderrahim mentioned this issue Feb 15, 2023

native-image does not populate GSS Oid mechanisms #4700

Closed

louis2845 mentioned this issue Mar 1, 2023

GraalVM native-image kerberos authentication issue #5941

Closed

oubidar-Abderrahim assigned vjovanov and unassigned oubidar-Abderrahim Feb 5, 2024

oubidar-Abderrahim changed the title ~~Unable to make Kerberos Authenticated http calls due to GSSManager Oid issue~~ [GR-44320] Unable to make Kerberos Authenticated http calls due to GSSManager Oid issue Mar 12, 2024

vjovanov assigned jovanstevanovic and unassigned vjovanov Oct 9, 2024

vjovanov added this to the 24.2.0 Release (March 18, 2025) milestone Oct 9, 2024

linghengqian mentioned this issue Oct 10, 2024

Support using DIGEST-MD5 as the SASL mechanism for ElasticJob CoordinatorRegistryCenter under GraalVM Native Image apache/shardingsphere-elasticjob#2428

Draft

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[GR-44320] Unable to make Kerberos Authenticated http calls due to GSSManager Oid issue #5950

[GR-44320] Unable to make Kerberos Authenticated http calls due to GSSManager Oid issue #5950

louis2845 commented Feb 10, 2023 •

edited

Loading

oubidar-Abderrahim commented Feb 15, 2023

louis2845 commented Feb 15, 2023

oubidar-Abderrahim commented Feb 15, 2023

louis2845 commented Feb 15, 2023

louis2845 commented Feb 15, 2023

oubidar-Abderrahim commented Mar 1, 2023

vjovanov commented Oct 4, 2023 •

edited

Loading

autodidacticon commented Nov 7, 2023 •

edited

Loading

vjovanov commented Nov 14, 2023

autodidacticon commented Nov 20, 2023

vjovanov commented Nov 20, 2023

aanavaneeth commented Apr 1, 2024 •

edited

Loading

vjovanov commented Apr 1, 2024

yogeshkumargeek commented Oct 8, 2024 •

edited

Loading

aanavaneeth commented Oct 8, 2024

vjovanov commented Oct 9, 2024

aanavaneeth commented Oct 9, 2024

jovanstevanovic commented Oct 9, 2024

yogeshkumar-1234 commented Oct 10, 2024

jovanstevanovic commented Oct 15, 2024

aanavaneeth commented Oct 15, 2024

yogeshkumar-1234 commented Oct 15, 2024 •

edited

Loading

jovanstevanovic commented Oct 16, 2024

[GR-44320] Unable to make Kerberos Authenticated http calls due to GSSManager Oid issue #5950

[GR-44320] Unable to make Kerberos Authenticated http calls due to GSSManager Oid issue #5950

Comments

louis2845 commented Feb 10, 2023 • edited Loading

oubidar-Abderrahim commented Feb 15, 2023

louis2845 commented Feb 15, 2023

oubidar-Abderrahim commented Feb 15, 2023

louis2845 commented Feb 15, 2023

louis2845 commented Feb 15, 2023

oubidar-Abderrahim commented Mar 1, 2023

vjovanov commented Oct 4, 2023 • edited Loading

autodidacticon commented Nov 7, 2023 • edited Loading

vjovanov commented Nov 14, 2023

autodidacticon commented Nov 20, 2023

vjovanov commented Nov 20, 2023

aanavaneeth commented Apr 1, 2024 • edited Loading

vjovanov commented Apr 1, 2024

yogeshkumargeek commented Oct 8, 2024 • edited Loading

aanavaneeth commented Oct 8, 2024

vjovanov commented Oct 9, 2024

aanavaneeth commented Oct 9, 2024

jovanstevanovic commented Oct 9, 2024

yogeshkumar-1234 commented Oct 10, 2024

jovanstevanovic commented Oct 15, 2024

aanavaneeth commented Oct 15, 2024

yogeshkumar-1234 commented Oct 15, 2024 • edited Loading

jovanstevanovic commented Oct 16, 2024

louis2845 commented Feb 10, 2023 •

edited

Loading

vjovanov commented Oct 4, 2023 •

edited

Loading

autodidacticon commented Nov 7, 2023 •

edited

Loading

aanavaneeth commented Apr 1, 2024 •

edited

Loading

yogeshkumargeek commented Oct 8, 2024 •

edited

Loading

yogeshkumar-1234 commented Oct 15, 2024 •

edited

Loading