Hello, there.
We are doing PoC on 6.4 build in Kerberos Auth for elasticsearch.
Here is a problem I have ran into with trying to set it up (please help me understand what is happening here):
my Kerberos part of elasticsearch.yml file
xpack.security.authc.realms:
realm0:
type: kerberos
order: 0
keytab.path: /etc/elasticsearch/client/SUPER_SECRET_ID.ktf
krb.debug: true
enabled: true
remove_realm_name: falseI can not share my krb5.conf file, that is also in my elasticsearch directory, but that krb5 works fine with other applications, so I do not think the issue is in it.
Essentially here is the problem (that is the error in http client):
{
"error": {
"root_cause": [{
"type": "security_exception",
"reason": "Failure unspecified at GSS-API level (Mechanism level: Checksum failed)",
"header": {
"WWW-Authenticate": ["Basic realm=\"security\" charset=\"UTF-8\"", "Negotiate", "Bearer realm=\"security\""]
}
}],
"type": "security_exception",
"reason": "Failure unspecified at GSS-API level (Mechanism level: Checksum failed)",
"caused_by": {
"type": "g_s_s_exception",
"reason": "Failure unspecified at GSS-API level (Mechanism level: Checksum failed)",
"caused_by": {
"type": "krb_crypto_exception",
"reason": "Checksum failed",
"caused_by": {
"type": "general_security_exception",
"reason": "Checksum failed"
}
}
},
"header": {
"WWW-Authenticate": ["Basic realm=\"security\" charset=\"UTF-8\"", "Negotiate", "Bearer realm=\"security\""]
}
},
"status": 401
}and this is my elasticsearch log entry when attempt at auth happens:
[2018-08-30T10:32:33,663][INFO ][o.e.x.s.a.AuthenticationService] [SERVER_NAME-client] Authentication of [<Kerberos Token>] was terminated by realm [realm0] - failed to authenticate user, gss context negotiation failureI have created the keytab file using the same ID we use for active_directory auth with elasticsearch that works just fine still.
and I am using aes256-sha1 as encryption for the addentry in ktutil.
Password has been now quadruple checked by multiple members of my team...