Hi out there,

just want to inform that I had an issue up to now where Kerberos/SPNEGO SSO with our Microsoft AD was not working anymore after installing WebSphere 9.0.5 FP14 (on top of FP13) and Java version = 1.8.0_351, Java Runtime Version = 8.0.7.20    (from Java version = 1.8.0_341, Java Runtime Version = 8.0.7.15).

Case @ IBM is opened. (5003p00002lPn0oAAC)

It seems that the java policy files have changed (at least the change/creation date has changed).

After rolling back JAVA (not WebSphere FP14) Kerberos is now working again.

The error was (in trace): 
[05.12.22 07:36:20:839 MEZ] 000001bc SystemErr R javax.security.auth.login.FailedLoginException: Schlüssel kann nicht aus Chiffrierschlüssel HTTP/fqdnofserver.host.com@HOST.COM abgerufen werden

[05.12.22 07:36:20:870 MEZ] 000001bc ServerCredent E com.ibm.ws.security.spnego.ServerCredentialsFactory initializeServer CWSPN0015E: Unable to create a GSSCredential for: HTTP/fqdnofserver.host.com@HOST.COM
[05.12.22 07:36:20:870 MEZ] 000001bc ServerCredent < com.ibm.ws.security.spnego.ServerCredentialsFactory initializeServer RETURN
[05.12.22 07:36:20:870 MEZ] 000001bc ServerCredent E com.ibm.ws.security.spnego.ServerCredentialsFactory initializeServerCreds CWSPN0017E: Unable to create GSSCredentials for any of the hosts specified in the configuration properties.


​
So please take care before installing up to date Java Runtime for WebSphere 9.0.5

------------------------------
Klaus Schmidinger
IT Guy
Julius Blum GmbH
------------------------------

#AssetandFacilitiesManagement
#Maximo

answer from IBM Support (thanks for great support!)
RC4-HMAC has been disabled in that new JDK (because it's vulnerable since many years..) so in the keytab you just have RC4 keys, you could be experiencing the problem.

When creating our Keytab Files from ActiveDirectory, the ktpass command used the RC4-HMAC algorithmus. We've similiar issues in other applications where with the current java release, Kerberos is getting into trouble 'cause of old algorithmus which should be replaced.


to verify your keytab: 
java com.ibm.security.krb5.internal.tools.Klist -e -k keytabfile

Example.
E:\IBM\WebSphere\AppServer\java\jre\bin>java com.ibm.security.krb5.internal.tools.Klist -e -k E:\IBM\krb\mykeytab.keytab



in my case the result is
[1] Principal: HTTP/hostname.subdomain.domain@ABC.NET
KVNO: 1
Verschlüsselungstyp (skey, tkt): RC4 with HMAC, {1}

------------------------------
Klaus Schmidinger
Teamlead IT4IT
Julius Blum GmbH
------------------------------