JiscMail Logo
Email discussion lists for the UK Education and Research communities

Help for MOONSHOT-COMMUNITY Archives


MOONSHOT-COMMUNITY Archives

MOONSHOT-COMMUNITY Archives


MOONSHOT-COMMUNITY@JISCMAIL.AC.UK


View:

Message:

[

First

|

Previous

|

Next

|

Last

]

By Topic:

[

First

|

Previous

|

Next

|

Last

]

By Author:

[

First

|

Previous

|

Next

|

Last

]

Font:

Proportional Font

LISTSERV Archives

LISTSERV Archives

MOONSHOT-COMMUNITY Home

MOONSHOT-COMMUNITY Home

MOONSHOT-COMMUNITY  June 2018

MOONSHOT-COMMUNITY June 2018

Options

Subscribe or Unsubscribe

Subscribe or Unsubscribe

Log In

Log In

Get Password

Get Password

Subject:

Re: A token had an invalid Message Integrity Check (MIC)

From:

Alejandro Perez-Mendez <[log in to unmask]>

Reply-To:

Alejandro Perez-Mendez <[log in to unmask]>

Date:

Thu, 21 Jun 2018 16:29:54 +0200

Content-Type:

text/plain

Parts/Attachments:

Parts/Attachments

text/plain (504 lines)

Dear Björn,

can you tell us the version number of moonshot-gss-eap package you've 
installed? And also the version of the moonshot-ui. That would help us 
debugging your problem.

Regards,
Alejandro
El 21/06/18 a las 16:00, Abt Björn Erik (PSI) escribió:
> Dear Stefan,
>
> no Problem at all. I use the "Red Hat Enterprise Linux Server release 7.4 (Maipo)" OS.
>
> And I get exactly the same message with gss-client and gss-server...
>
> On the client I issue: gss-client -mech {1.3.6.1.5.5.15.1.1.18} moonshot01.psi.ch [log in to unmask] foo
>
> Sending init_sec_context token (size=45)...continue needed...
> Sending init_sec_context token (size=43)...continue needed...
> Sending init_sec_context token (size=320)...continue needed...
> Sending init_sec_context token (size=29)...continue needed...
> Sending init_sec_context token (size=29)...continue needed...
> Sending init_sec_context token (size=156)...continue needed...
> Sending init_sec_context token (size=94)...continue needed...
> Sending init_sec_context token (size=126)...continue needed...
> Sending init_sec_context token (size=29)...continue needed...
> Sending init_sec_context token (size=47)...continue needed...
> GSS-API error initializing context: Unspecified GSS failure.  Minor code may provide more information
> GSS-API error initializing context: Error token is malformed or corrupt
>
>
> And on the server I issue: gss-server -verbose [log in to unmask]
>
> starting...
> Received token (size=45):
> 60 2b 06 09 2b 06 01 05 05 0f 01 01 12 06 01 00
> 00 00 02 00 00 00 16 68 6f 73 74 2f 6d 6f 6f 6e
> 73 68 6f 74 30 31 2e 70 73 69 2e 63 68
> Sending accept_sec_context token (size=58):
> 60 38 06 09 2b 06 01 05 05 0f 01 01 12 06 02 00
> 00 00 03 00 00 00 16 68 6f 73 74 2f 6d 6f 6f 6e
> 73 68 6f 74 30 31 2e 70 73 69 2e 63 68 80 00 00
> 05 00 00 00 05 01 00 00 05 01
> continue needed...
> Received token (size=43):
> 60 29 06 09 2b 06 01 05 05 0f 01 01 12 06 01 80
> 00 00 04 00 00 00 14 02 00 00 14 01 40 55 4d 42
> 52 45 4c 4c 41 49 44 2e 4f 52 47
> Sending accept_sec_context token (size=29):
> 60 1b 06 09 2b 06 01 05 05 0f 01 01 12 06 02 80
> 00 00 05 00 00 00 06 01 01 00 06 15 20
> continue needed...
> Received token (size=320):
> 60 82 01 3c 06 09 2b 06 01 05 05 0f 01 01 12 06
> 01 80 00 00 04 00 00 01 27 02 01 01 27 15 00 16
> 03 01 01 1c 01 00 01 18 03 03 d0 62 93 06 d8 df
> bf b1 23 df 34 41 6d 6f 71 e8 87 81 ae e2 bc 30
> 4d 21 9d 72 51 17 31 65 bd 3a 00 00 ac c0 30 c0
> 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00
> 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00
> 36 00 88 00 87 00 86 00 85 c0 32 c0 2e c0 2a c0
> 26 c0 0f c0 05 00 9d 00 3d 00 35 00 84 c0 2f c0
> 2b c0 27 c0 23 c0 13 c0 09 00 a4 00 a2 00 a0 00
> 9e 00 67 00 40 00 3f 00 3e 00 33 00 32 00 31 00
> 30 00 9a 00 99 00 98 00 97 00 45 00 44 00 43 00
> 42 c0 31 c0 2d c0 29 c0 25 c0 0e c0 04 00 9c 00
> 3c 00 2f 00 96 00 41 c0 12 c0 08 00 16 00 13 00
> 10 00 0d c0 0d c0 03 00 0a 00 07 c0 11 c0 07 c0
> 0c c0 02 00 05 00 04 00 ff 01 00 00 43 00 0b 00
> 04 03 00 01 02 00 0a 00 0a 00 08 00 17 00 19 00
> 18 00 16 00 23 00 00 00 0d 00 20 00 1e 06 01 06
> 02 06 03 05 01 05 02 05 03 04 01 04 02 04 03 03
> 01 03 02 03 03 02 01 02 02 02 03 00 0f 00 01 01
>
> Sending accept_sec_context token (size=1029):
> 60 82 04 01 06 09 2b 06 01 05 05 0f 01 01 12 06
> 02 80 00 00 05 00 00 03 ec 01 02 03 ec 15 c0 00
> 00 0a d7 16 03 03 00 5e 02 00 00 5a 03 03 a1 f7
> 1d af ad c7 5f dc 40 f4 e4 92 6f c8 a5 a3 ad 79
> b4 49 ca 60 55 3a 40 26 66 82 a7 e0 d8 d3 20 f4
> cf ca ab f4 91 1b dd 52 a0 01 07 7e 9f 2e 5b fd
> 24 5c 82 8c 73 e5 b9 4c ea 69 05 00 1e 11 51 c0
> 30 00 00 12 ff 01 00 01 00 00 0b 00 04 03 00 01
> 02 00 0f 00 01 01 16 03 03 09 14 0b 00 09 10 00
> 09 0d 00 03 f8 30 82 03 f4 30 82 02 dc a0 03 02
> 01 02 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01
> 01 0b 05 00 30 81 a1 31 0b 30 09 06 03 55 04 06
> 13 02 43 48 31 14 30 12 06 03 55 04 08 0c 0b 53
> 77 69 74 7a 65 72 6c 61 6e 64 31 15 30 13 06 03
> 55 04 07 0c 0c 56 69 6c 6c 69 67 65 6e 20 50 53
> 49 31 13 30 11 06 03 55 04 0a 0c 0a 75 6d 62 72
> 65 6c 6c 61 49 44 31 25 30 23 06 09 2a 86 48 86
> f7 0d 01 09 01 16 16 63 6f 6e 74 61 63 74 40 75
> 6d 62 72 65 6c 6c 61 69 64 2e 6f 72 67 31 29 30
> 27 06 03 55 04 03 0c 20 75 6d 62 72 65 6c 6c 61
> 49 44 20 43 65 72 74 69 66 69 63 61 74 65 20 41
> 75 74 68 6f 72 69 74 79 30 1e 17 0d 31 36 31 31
> 31 38 30 39 32 31 32 38 5a 17 0d 31 38 31 31 31
> 38 30 39 32 31 32 38 5a 30 81 87 31 0b 30 09 06
> 03 55 04 06 13 02 43 48 31 14 30 12 06 03 55 04
> 08 0c 0b 53 77 69 74 7a 65 72 6c 61 6e 64 31 13
> 30 11 06 03 55 04 0a 0c 0a 75 6d 62 72 65 6c 6c
> 61 49 44 31 26 30 24 06 03 55 04 03 0c 1d 75 6d
> 62 72 65 6c 6c 61 49 44 20 53 65 72 76 65 72 20
> 43 65 72 74 69 66 69 63 61 74 65 31 25 30 23 06
> 09 2a 86 48 86 f7 0d 01 09 01 16 16 63 6f 6e 74
> 61 63 74 40 75 6d 62 72 65 6c 6c 61 69 64 2e 6f
> 72 67 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d
> 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82
> 01 01 00 d4 40 ec ea dd 74 ac 29 6f 75 a1 77 30
> 30 4c b3 9f 08 9e 3a 89 eb b0 4e 8e 1d 1d e3 d7
> 6e 66 74 75 56 07 16 a2 5a a1 25 d0 17 23 72 13
> 13 a6 da cf 36 27 04 e7 ef 3c 13 e1 80 0c 3d 88
> ae 09 48 be 7f 19 46 25 f3 39 f3 83 51 72 5e 32
> 77 03 c1 ce 0b fb 99 43 08 0e 00 f0 e0 b0 5c 4e
> 29 35 47 be ee f3 cc 23 cc 06 f7 8b ca fd cf 1f
> e5 d4 97 75 b5 4e 26 ae c2 2d 2e 14 86 4d d5 b9
> 9c 88 18 e7 d7 45 67 e0 95 16 cb ff db 6c ef 26
> ae 6f a8 a8 d0 0a 2f 20 51 67 e5 b5 66 b3 6a 01
> c5 b8 d6 3a 0a 8a bb dc 80 4f c5 4b fc e3 79 c9
> 0d f4 0d 24 0d 8a 24 74 99 5c 44 92 7e 5a 6f b7
> 3d 61 3f 45 71 d2 8c de 45 04 57 61 44 b7 a6 ea
> fe 2c 25 f1 be bc b4 a1 c7 63 c6 3f 67 a5 8d 0b
> 0d 33 8f 8a f1 98 d6 c6 48 06 67 df 13 0d f8 9f
> 5f c7 e1 3e 8f f4 2d 53 75 60 04 59 10 50 e4 c5
> 60 21 91 02 03 01 00 01 a3 4f 30 4d 30 13 06 03
> 55 1d 25 04 0c 30 0a 06 08 2b 06 01 05 05 07 03
> 01 30 36 06 03 55 1d 1f 04 2f 30 2d 30 2b a0 29
> a0 27 86 25 68 74 74 70 3a 2f 2f 77 77 77 2e 65
> 78 61 6d 70 6c 65 2e 63 6f 6d 2f 65 78 61 6d 70
> 6c 65 5f 63 61 2e 63 72 6c 30 0d 06 09 2a 86 48
> 86 f7 0d 01 01 0b 05 00 03 82 01 01 00 2d 50 76
> 8a 6c b6 65 bd f6 e7 32 dd c2 ab b9 c7 31 25 7b
> 48 73 b8 c4 99 c7 46 7e 29 55 1c c0 88 d7 3a 8f
> 54 67 1e c5 b4 b7 a9 78 cb 5b ac 5b 1d e9 de f6
> cf 85 92 0c dc 73 f2 65 97 1d 26 81 5f ea a3 93
> 21 c4 fe 01 de 9b 8a b4 43 f5 49 b8 6e ae ef a8
> ec 84 05 32 bf d8 ab 27 5d 4b f5 65 0d bb ee 92
> 5e e5 2c 00 cc dc 8f 7b ad f5 21 99 08 a4 5a e4
> 1d 0d b2 99 39
> continue needed...
> Received token (size=29):
> 60 1b 06 09 2b 06 01 05 05 0f 01 01 12 06 01 80
> 00 00 04 00 00 00 06 02 02 00 06 15 00
> Sending accept_sec_context token (size=1029):
> 60 82 04 01 06 09 2b 06 01 05 05 0f 01 01 12 06
> 02 80 00 00 05 00 00 03 ec 01 03 03 ec 15 c0 00
> 00 0a d7 a4 ae 0a ce 41 91 c8 4f ff 18 36 f1 26
> 17 ad 3e 8e 56 b2 4f d7 72 50 c5 a7 fb 01 e8 38
> df 25 22 fe 18 e3 3d 40 55 bd 6e 09 a8 2e 38 0a
> 74 e7 9f a2 4e f3 fb c2 7c 21 de 7d 7b 59 1e 6e
> da 3d 04 3b 43 bc 35 40 df d9 b0 a4 4e 75 a3 ab
> b7 d4 ab e0 c9 c1 1a 85 b7 6c 20 43 72 ba 22 61
> 88 4c 80 e0 f4 4d 18 9b 99 f8 53 1f 39 fe db fd
> 8a a3 64 0c 14 36 75 94 bf 5e 83 84 30 e0 59 8e
> 86 fb 58 8b d7 20 fe 16 4b 81 e7 00 05 0f 30 82
> 05 0b 30 82 03 f3 a0 03 02 01 02 02 09 00 d3 c4
> 34 67 60 92 00 65 30 0d 06 09 2a 86 48 86 f7 0d
> 01 01 0b 05 00 30 81 a1 31 0b 30 09 06 03 55 04
> 06 13 02 43 48 31 14 30 12 06 03 55 04 08 0c 0b
> 53 77 69 74 7a 65 72 6c 61 6e 64 31 15 30 13 06
> 03 55 04 07 0c 0c 56 69 6c 6c 69 67 65 6e 20 50
> 53 49 31 13 30 11 06 03 55 04 0a 0c 0a 75 6d 62
> 72 65 6c 6c 61 49 44 31 25 30 23 06 09 2a 86 48
> 86 f7 0d 01 09 01 16 16 63 6f 6e 74 61 63 74 40
> 75 6d 62 72 65 6c 6c 61 69 64 2e 6f 72 67 31 29
> 30 27 06 03 55 04 03 0c 20 75 6d 62 72 65 6c 6c
> 61 49 44 20 43 65 72 74 69 66 69 63 61 74 65 20
> 41 75 74 68 6f 72 69 74 79 30 1e 17 0d 31 36 31
> 31 31 38 30 39 32 31 32 38 5a 17 0d 31 38 31 31
> 31 38 30 39 32 31 32 38 5a 30 81 a1 31 0b 30 09
> 06 03 55 04 06 13 02 43 48 31 14 30 12 06 03 55
> 04 08 0c 0b 53 77 69 74 7a 65 72 6c 61 6e 64 31
> 15 30 13 06 03 55 04 07 0c 0c 56 69 6c 6c 69 67
> 65 6e 20 50 53 49 31 13 30 11 06 03 55 04 0a 0c
> 0a 75 6d 62 72 65 6c 6c 61 49 44 31 25 30 23 06
> 09 2a 86 48 86 f7 0d 01 09 01 16 16 63 6f 6e 74
> 61 63 74 40 75 6d 62 72 65 6c 6c 61 69 64 2e 6f
> 72 67 31 29 30 27 06 03 55 04 03 0c 20 75 6d 62
> 72 65 6c 6c 61 49 44 20 43 65 72 74 69 66 69 63
> 61 74 65 20 41 75 74 68 6f 72 69 74 79 30 82 01
> 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00
> 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 b1 25
> 99 5d a0 b5 6a c4 59 63 ae d2 dd 4c 22 30 de 01
> 87 d9 21 45 80 47 da d0 a1 a4 54 97 e5 59 de 8b
> 7b 1e d4 c6 0f 56 5c 5c 25 de a9 19 c8 96 a0 a1
> 74 21 4b b7 11 00 59 02 d5 bb 13 36 31 ae 80 03
> f7 99 69 00 f3 a4 91 2d 63 6a de 59 a0 fc ad c7
> 0c 7a 95 37 20 ad f8 2d f7 fe 84 af 8c 88 11 46
> 4a 2f 90 e6 72 90 2c b8 58 ca 5b e5 e4 81 7b 91
> 18 49 9d 74 a3 9e 19 42 8b 5f 11 30 e8 de 6c 74
> fa c6 bc 7e c9 67 2f b3 16 47 20 2d 42 e6 ed 30
> b4 a6 54 ce d8 b3 b1 95 02 53 a4 01 eb f7 27 be
> ac fd d8 40 9d 62 75 42 e9 1c 0b 1c 72 76 4a d1
> 24 b7 d5 85 fc ad aa f8 2a dd 15 0c 9f 64 67 c9
> 63 ea 64 cb 8f 08 b5 99 49 ad d7 71 ec af f6 0e
> f9 2d f8 2a 1c a0 b2 e6 c8 30 93 fb ee 9f e1 7b
> fa 71 8a 27 16 13 72 ae a1 4c 8c f1 77 ce 7c 49
> 0d f7 78 5e 65 89 b8 bb 6e 4a 3d 76 a8 ed 02 03
> 01 00 01 a3 82 01 42 30 82 01 3e 30 1d 06 03 55
> 1d 0e 04 16 04 14 11 c9 2b 79 a9 ca 64 25 88 df
> ee e6 9f e1 10 83 0b c5 5f e8 30 81 d6 06 03 55
> 1d 23 04 81 ce 30 81 cb 80 14 11 c9 2b 79 a9 ca
> 64 25 88 df ee e6 9f e1 10 83 0b c5 5f e8 a1 81
> a7 a4 81 a4 30 81 a1 31 0b 30 09 06 03 55 04 06
> 13 02 43 48 31 14 30 12 06 03 55 04 08 0c 0b 53
> 77 69 74 7a 65 72 6c 61 6e 64 31 15 30 13 06 03
> 55 04 07 0c 0c 56 69 6c 6c 69 67 65 6e 20 50 53
> 49 31 13 30 11 06 03 55 04 0a 0c 0a 75 6d 62 72
> 65 6c 6c 61 49
> continue needed...
> Received token (size=29):
> 60 1b 06 09 2b 06 01 05 05 0f 01 01 12 06 01 80
> 00 00 04 00 00 00 06 02 03 00 06 15 00
> Sending accept_sec_context token (size=822):
> 60 82 03 32 06 09 2b 06 01 05 05 0f 01 01 12 06
> 02 80 00 00 05 00 00 03 1d 01 04 03 1d 15 80 00
> 00 0a d7 44 31 25 30 23 06 09 2a 86 48 86 f7 0d
> 01 09 01 16 16 63 6f 6e 74 61 63 74 40 75 6d 62
> 72 65 6c 6c 61 69 64 2e 6f 72 67 31 29 30 27 06
> 03 55 04 03 0c 20 75 6d 62 72 65 6c 6c 61 49 44
> 20 43 65 72 74 69 66 69 63 61 74 65 20 41 75 74
> 68 6f 72 69 74 79 82 09 00 d3 c4 34 67 60 92 00
> 65 30 0c 06 03 55 1d 13 04 05 30 03 01 01 ff 30
> 36 06 03 55 1d 1f 04 2f 30 2d 30 2b a0 29 a0 27
> 86 25 68 74 74 70 3a 2f 2f 77 77 77 2e 65 78 61
> 6d 70 6c 65 2e 63 6f 6d 2f 65 78 61 6d 70 6c 65
> 5f 63 61 2e 63 72 6c 30 0d 06 09 2a 86 48 86 f7
> 0d 01 01 0b 05 00 03 82 01 01 00 31 25 e9 fe f1
> 8c 41 d7 b4 a8 e8 3a 78 27 5f 91 37 66 d3 a1 cb
> 7e d4 03 fc c1 18 dc 64 bf a1 72 ee e1 b2 f5 e4
> 01 f2 ca b1 fc 23 ea 25 b8 96 1f 86 19 77 be 6e
> e7 5f 18 cc f1 68 b2 61 6d fc ea 86 c6 d3 4b b8
> ae 8f f9 ab 71 68 ad 91 6f bc ed c2 85 45 37 bd
> 1b ea 1e f3 1b 2d 00 17 18 f6 e7 25 54 bd 71 50
> 0b 01 00 42 aa 56 00 64 a3 bb 91 96 3d be ff ad
> 81 ef 25 9c ec a7 bc 15 02 f8 38 fa d2 ff e2 29
> 6d f6 fe 81 ca 31 7c 8d 22 a1 93 36 0b fc 6a 4b
> 37 c4 7e f9 73 3d bc 3b a0 85 7d 92 f5 d5 cb 19
> 67 1a 7a a8 6d 82 0d 22 af 0b 8a 66 52 70 d7 01
> 4e 47 26 dc ee 14 36 63 16 86 03 fe ca 63 c7 1d
> 74 14 2e cc bc e1 e0 47 fb 80 bc 2a 26 b4 85 c3
> 3e 7d 01 89 ad bb eb 46 ed f4 cc 5c f8 55 3b a8
> 58 1d 4f 3b 5a 47 b7 cd d6 b4 d2 6b bf a8 48 57
> 8a 85 ac c9 f8 dd ba ef 17 e6 36 16 03 03 01 4d
> 0c 00 01 49 03 00 17 41 04 e6 47 c2 61 c4 0a 0d
> 73 58 45 ee a2 40 cd e5 93 10 41 87 b1 fc d4 0a
> 48 9d 05 8e 36 00 f0 b1 89 f5 a7 0d dc 5c d0 91
> 50 d3 fe 48 19 38 4b ad d3 27 79 6d d4 3a 0f cf
> 5e 67 2c eb 42 56 31 4b 35 06 01 01 00 56 42 d5
> d9 32 5e 00 b8 f7 dd a1 a5 e3 a5 08 03 84 a4 30
> fc 3b 6a fc 13 32 18 24 d8 34 dc 4a 03 7f 53 73
> 7f 36 7b a8 38 23 f7 95 8e 31 80 31 8b fa 5d d2
> 25 a5 9b 0a d6 a9 e2 98 50 92 e4 12 48 69 1e 64
> 31 d7 de 02 ee 4e db 42 8d 7d 45 2e 16 6c 1d d5
> 07 d5 6f 3a 22 3a 04 2c 74 51 69 4f fc f4 f9 6d
> a2 e7 d2 43 d2 97 f4 d5 f7 e0 59 6b 3d 63 0b 97
> 10 59 1b 91 2a 69 c9 b9 9e ee a2 75 b9 40 71 51
> f8 f3 7a d9 9c d6 b3 13 13 69 12 dc c8 a7 69 50
> 30 01 92 86 c0 f8 52 10 f8 0d 58 41 7b 5e bc 97
> 43 82 9c c4 98 76 54 ea dc e9 5f 30 17 33 53 fb
> 92 df ec 5b 99 5f e3 f4 59 09 84 af 1c e2 93 08
> 1e 9d 12 c7 d4 03 a7 c1 f6 16 77 54 29 1f 64 25
> 8f cf fb fd e2 90 4e 50 82 5f af 75 93 f1 d5 0e
> bd 5a c6 69 fb 23 59 89 84 74 bb 25 b4 33 b1 7f
> d7 a4 77 fe bb 7d 41 ba be ff 19 2d 62 16 03 03
> 00 04 0e 00 00 00
> continue needed...
> Received token (size=156):
> 60 81 99 06 09 2b 06 01 05 05 0f 01 01 12 06 01
> 80 00 00 04 00 00 00 84 02 04 00 84 15 00 16 03
> 03 00 46 10 00 00 42 41 04 bd bc 1a 91 b6 9a d4
> dc 98 3f 65 59 59 d5 78 a9 cb c8 60 36 b4 15 1e
> 3c db 54 b6 43 a1 50 ef 0a 89 ae a3 a1 c3 68 df
> 8c c9 13 90 83 7d fa 94 90 41 97 61 0a 67 c7 19
> ca 11 72 36 34 72 b6 95 a1 14 03 03 00 01 01 16
> 03 03 00 28 e0 7e de ef 92 db ae d0 70 f2 8b ee
> db 87 c5 47 9e d2 af 9d 50 ab cf 4f 5f a5 a6 30
> fc 60 fe 1e b5 cb 0e 8c 4a b1 9c 2a
> Sending accept_sec_context token (size=84):
> 60 52 06 09 2b 06 01 05 05 0f 01 01 12 06 02 80
> 00 00 05 00 00 00 3d 01 05 00 3d 15 80 00 00 00
> 33 14 03 03 00 01 01 16 03 03 00 28 e5 c1 a4 50
> 31 85 cc c1 fc 78 33 4e a4 e4 ec 19 26 cc 78 5b
> 44 f7 8f ab ed 2e f4 fd 77 bf 38 13 62 1a 12 10
> 6e e9 64 fc
> continue needed...
> Received token (size=94):
> 60 5c 06 09 2b 06 01 05 05 0f 01 01 12 06 01 80
> 00 00 04 00 00 00 47 02 05 00 47 15 00 17 03 03
> 00 3c e0 7e de ef 92 db ae d1 f8 b2 47 c3 d9 f4
> ac af b2 43 04 b0 cf 90 32 c2 f5 82 65 c6 f9 64
> 0c f4 9e a7 3a ed d6 37 99 44 fb 6e 01 8d 2a 75
> 23 e9 92 e8 00 f0 4b 6d 38 1f b0 1c 98 5d
> Sending accept_sec_context token (size=86):
> 60 54 06 09 2b 06 01 05 05 0f 01 01 12 06 02 80
> 00 00 05 00 00 00 3f 01 06 00 3f 15 80 00 00 00
> 35 17 03 03 00 30 e5 c1 a4 50 31 85 cc c2 ab f9
> c8 c2 fc f3 71 4c b1 4b 3e 04 ba fb a0 82 e7 dc
> e7 b3 08 3a ab 7e 74 44 d8 4e 8a 7a 06 43 4a 11
> c3 7b 05 b3 be 7f
> continue needed...
> Received token (size=126):
> 60 7c 06 09 2b 06 01 05 05 0f 01 01 12 06 01 80
> 00 00 04 00 00 00 67 02 06 00 67 15 00 17 03 03
> 00 5c e0 7e de ef 92 db ae d2 4f cd de 22 6e e0
> da 51 14 e2 6c 77 28 19 59 dc dd 6b 62 a1 e5 10
> f3 9d f9 e3 09 73 58 ec d9 44 15 35 3c 6d c1 aa
> 46 bf a6 be 04 35 a6 6c 2d 7e b7 78 a2 2c 66 8d
> 51 8d 9c 89 b5 86 8b f2 18 ef 1c 6b f3 bc ba 6f
> ae bc 74 5d c7 af e0 90 90 3f d9 74 fa ea
> Sending accept_sec_context token (size=106):
> 60 68 06 09 2b 06 01 05 05 0f 01 01 12 06 02 80
> 00 00 05 00 00 00 53 01 07 00 53 15 80 00 00 00
> 49 17 03 03 00 44 e5 c1 a4 50 31 85 cc c3 c0 e3
> c5 ca f5 e7 af 76 ee e0 81 c5 c7 51 06 82 6a 58
> a0 c9 e4 42 45 6f ef ad c8 04 83 aa 42 7d a6 a8
> d9 c6 7a 1a 88 2f 86 18 c2 77 a0 d0 5a cb 86 de
> ee aa 06 dd 60 9d 40 01 79 3f
> continue needed...
> Received token (size=29):
> 60 1b 06 09 2b 06 01 05 05 0f 01 01 12 06 01 80
> 00 00 04 00 00 00 06 02 07 00 06 15 00
> 2018-06-21 15:53:50 WARN Shibboleth.Application : insecure cookieProps setting, set to "https" for SSL/TLS-only usage
> 2018-06-21 15:53:50 WARN Shibboleth.Application : handlerSSL should be enabled for SSL/TLS-enabled web sites
> 2018-06-21 15:53:50 WARN Shibboleth.Application : no MetadataProvider available, configure at least one for standard SSO usage
> Sending accept_sec_context token (size=27):
> 60 19 06 09 2b 06 01 05 05 0f 01 01 12 06 02 80
> 00 00 05 00 00 00 04 03 07 00 04
> continue needed...
> Received token (size=47):
> 60 2d 06 09 2b 06 01 05 05 0f 01 01 12 06 01 00
> 00 00 0c 00 00 00 04 00 00 00 02 80 00 00 0d 00
> 00 00 0c bc c7 48 bc 94 0e 78 a5 1c 20 fe 93
> Sending accept_sec_context token (size=31):
> 60 1d 06 09 2b 06 01 05 05 0f 01 01 12 06 02 80
> 00 00 01 00 00 00 08 00 06 00 00 00 00 00 00
> GSS-API error accepting context: A token had an invalid Message Integrity Check (MIC)
> GSS-API error accepting context: Decrypt integrity check failed
>
>
> Cheers Björn
> __________________________________________
> Paul Scherrer Institut
> Björn Erik Abt
> IT Security Officer
> WHGA/U136
> CH-5232 Villigen PSI
>
> Telefon: +41 56 310 40 17
> E-Mail: [log in to unmask]
>
>
> -----Original Message-----
> From: GOV-UK-REQUESTS [mailto:[log in to unmask]] On Behalf Of Stefan Paetow
> Sent: Donnerstag, 21. Juni 2018 15:40
> To: [log in to unmask]
> Subject: FW: A token had an invalid Message Integrity Check (MIC)
>
>      Hi Björn,
>      
>      Apologies for the late reply! That is odd.
>      
>      Do you get a similar message if you use the classic gss-server and gss-client exchange (i.e. using gss-client on the client machine, whilst running gss-server on the server)?
>      
>      Also, which OS is this? CentOS?
>      
>      With Regards
>      
>      Stefan Paetow
>      Consultant, Trust and Identity
>      
>      t: +44 (0)1235 822 125
>      gpg: 0x3FCE5142
>      xmpp: [log in to unmask]
>      skype: stefan.paetow.janet
>      
>      jisc.ac.uk
>      
>      Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.
>      
>      
>      From: GOV-UK-REQUESTS <[log in to unmask]> on behalf of Abt Björn <[log in to unmask]>
>      Reply-To: Abt Björn <[log in to unmask]>
>      Date: Wednesday, 20 June 2018 at 14:40
>      To: <[log in to unmask]>
>      Subject: A token had an invalid Message Integrity Check (MIC)
>      
>      Dear Moonshot-List,
>       
>      I’m trying to setup a moonshot infrastructure and am failing with an openssh login.
>       
>      The setup uses an rp-proxy to connect directly to an idp without a trust router:
>       
>      openssh-client → openssh-server → rp proxy → idp
>       
>      When connecting via ssh the moonshot-ui pops up and allows the selection of an identity to be sent.
>       
>      The radsec communication and the authentication on the idp look fine AFAIK:
>       
>      Access-Accept from idp:
>       
>      (263) Sent Access-Accept Id 98 from 0.0.0.0:2083 to 129.129.230.131:59006 length 1262
>      (263)   MS-MPPE-Recv-Key = 0x1c1acc12b842cc3eb6acb36bfac13eab194ea8278997e73017ea412287445f84
>      (263)   MS-MPPE-Send-Key = 0xee3f19523b5051975cb5b429d71b30e807dd2596b7de789e333b781ef316284b
>      (263)   EAP-Message = 0x03070004
>      (263)   Message-Authenticator = 0x00000000000000000000000000000000
>      (263)   Proxy-State = 0x30
>      (263)   EAP-Channel-Binding-Message += 0x02001901a406686f7374a5136d6f6f6e73686f7430312e7073692e6368
>      (263)   SAML-AAA-Assertion = '<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" IssueInstant="2018-06-20T13:53:39" ID="7824c02a-6d7d-42e4-9d97-db85db5eaa35" Version="2.0">'
>      (263)   SAML-AAA-Assertion += '<saml:Issuer>urn:mace:incommon:umbrellaid.org</saml:Issuer><saml:AttributeStatement>'
>      (263)   SAML-AAA-Assertion += '<saml:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" Name="urn:oid:0.9.2342.19200300.100.1.1" FriendlyName="uid">'
>      (263)   SAML-AAA-Assertion += '<saml:AttributeValue>flowback</saml:AttributeValue>'
>      (263)   SAML-AAA-Assertion += '</saml:Attribute><saml:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" Name="urn:oid:1.3.6.1.4.1.42750.1.1.1" FriendlyName="EAAHash">'
>      (263)   SAML-AAA-Assertion += '<saml:AttributeValue>XXXXXXXX-XXXX-XXXXX-XXXX-XXXXXXXXXXXX</saml:AttributeValue>'
>      (263)   SAML-AAA-Assertion += '</saml:Attribute><saml:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" Name="urn:oid:1.3.6.1.4.1.42750.1.1.3" FriendlyName="EAAKey">'
>      (263)   SAML-AAA-Assertion += '<saml:AttributeValue> XXXXXXXX-XXXX-XXXXX-XXXX-XXXXXXXXXXXX </saml:AttributeValue>'
>      (263)   SAML-AAA-Assertion += '</saml:Attribute></saml:AttributeStatement></saml:Assertion>'
>      (263)   Moonshot-Host-TargetedId = [log in to unmask]
>      (263) Finished request
>       
>      And also the rp proxy returns an Access-Accept after a user mapping via a database:
>       
>      (79) Sent Access-Accept Id 0 from 0.0.0.0:2083 to 129.129.230.132:40376 length 0
>      (79)   MS-MPPE-Recv-Key = 0x1c1acc12b842cc3eb6acb36bfac13eab194ea8278997e73017ea412287445f84
>      (79)   MS-MPPE-Send-Key = 0xee3f19523b5051975cb5b429d71b30e807dd2596b7de789e333b781ef316284b
>      (79)   EAP-Message = 0x03070004
>      (79)   Message-Authenticator = 0x16dc64fef42441fe37d0150c9053bb7f
>      (79)   EAP-Channel-Binding-Message = 0x02001901a406686f7374a5136d6f6f6e73686f7430312e7073692e6368
>      (79)   Moonshot-Host-TargetedId = "[log in to unmask]"
>      (79)   SAML-AAA-Assertion = "<saml:Assertion xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" IssueInstant=\"2018-06-20T13:53:39\" ID=\"76ca4f39-da9c-4b1d-bb2f-553a48537184\" Version=\"2.0\">"
>      (79)   SAML-AAA-Assertion += "<saml:Issuer>urn:mace:incommon:osu.edu</saml:Issuer>"
>      (79)   SAML-AAA-Assertion += "<saml:AttributeStatement>"
>      (79)   SAML-AAA-Assertion += "<saml:Attribute NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:uri\" Name=\"urn:oid:1.3.6.1.4.1.5923.1.1.1.7\">"
>      (79)   SAML-AAA-Assertion += "<saml:AttributeValue>bjoern</saml:AttributeValue>"
>      (79)   SAML-AAA-Assertion += "</saml:Attribute></saml:AttributeStatement>"
>      (79)   SAML-AAA-Assertion += "</saml:Assertion>"
>      (79)   User-Name = "bjoern"
>      (79) Finished request
>       
>      But on the openssh-server I get:
>       
>      debug1: A token had an invalid Message Integrity Check (MIC)
>      Decrypt integrity check failed
>       
>      While on the openssh-client I get:
>       
>      debug1: Received GSSAPI_CONTINUE
>      debug1: Calling gss_init_sec_context
>      debug1: Delegating credentials
>      debug3: send packet: type 31
>      ssh_packet_read: Connection closed
>       
>       
>      Attached you will find the output from an “ltrace -C -l  '*mech_eap*' -f /usr/sbin/sshd -ddd -p 6969” command.
>       
>      Does anyone have a clue what I’m doing wrong?
>       
>      Best regards
>      Björn
>      __________________________________________
>      Paul Scherrer Institut
>      Björn Erik Abt
>      IT Security Officer
>      WHGA/U136
>      CH-5232 Villigen PSI
>      
>      Telefon: +41 56 310 40 17
>      E-Mail: [log in to unmask]
>       
>      
>      
>      To unsubscribe from the MOONSHOT-COMMUNITY list, click the following link:
>      https://www.jiscmail.ac.uk/cgi-bin/webadmin?SUBED1=MOONSHOT-COMMUNITY&A=1
>      
>      
>      ########################################################################
>      
>      To unsubscribe from the MOONSHOT list, click the following link:
>      https://www.jiscmail.ac.uk/cgi-bin/webadmin?SUBED1=MOONSHOT&A=1
>      
>
>
> ########################################################################
>
> To unsubscribe from the MOONSHOT-COMMUNITY list, click the following link:
> https://www.jiscmail.ac.uk/cgi-bin/webadmin?SUBED1=MOONSHOT-COMMUNITY&A=1
>
> ########################################################################
>
> To unsubscribe from the MOONSHOT-COMMUNITY list, click the following link:
> https://www.jiscmail.ac.uk/cgi-bin/webadmin?SUBED1=MOONSHOT-COMMUNITY&A=1

-- 
Alejandro Perez-Mendez
Technical Specialist (AAA), Trust & Identity
M (+34) 619 333 219
Skype alejandro_perez_mendez
jisc.ac.uk

########################################################################

To unsubscribe from the MOONSHOT-COMMUNITY list, click the following link:
https://www.jiscmail.ac.uk/cgi-bin/webadmin?SUBED1=MOONSHOT-COMMUNITY&A=1

Top of Message | Previous Page | Permalink

JiscMail Tools


RSS Feeds and Sharing


Advanced Options


Archives

June 2018
April 2018
November 2017
October 2017
September 2017
August 2017
July 2017
May 2017
April 2017
March 2017
February 2017
November 2016
October 2016
August 2016
July 2016
June 2016
May 2016
March 2016
February 2016
January 2016
November 2015
October 2015
September 2015
August 2015
July 2015
June 2015
May 2015
April 2015
March 2015
February 2015
January 2015
December 2014
November 2014
October 2014
September 2014
August 2014
July 2014
June 2014
May 2014
April 2014
March 2014
February 2014
January 2014
December 2013
November 2013
October 2013
September 2013
August 2013
July 2013
June 2013
May 2013
April 2013
March 2013
February 2013
January 2013
December 2012
November 2012
October 2012
September 2012
August 2012
July 2012
June 2012
May 2012
April 2012
March 2012
February 2012
January 2012
December 2011
November 2011
October 2011
September 2011
August 2011
July 2011
June 2011
May 2011
April 2011
March 2011
February 2011
January 2011
November 2010
October 2010
September 2010
August 2010
July 2010
June 2010
May 2010
April 2010
March 2010
February 2010


JiscMail is a Jisc service.

View our service policies at https://www.jiscmail.ac.uk/policyandsecurity/ and Jisc's privacy policy at https://www.jisc.ac.uk/website/privacy-notice

Secured by F-Secure Anti-Virus CataList Email List Search Powered by the LISTSERV Email List Manager