title: Java Authentication against Active Directory, authentication mismatch?
body: <p>So I have some code which I'm testing to make sure it works nicely for authentication. It works fine against straight kerberos, so I figured there should only be some minor hiccups with AD. Unfortunately, I cannot get around a KrbException: KDC has no support for encryption type (14).</p>
  
  <p>I know the error is an encryption type mismatch. But I can kinit just fine, it's only in the code that I hit an issue. I'm not setting anything, so I think it should be inheriting the same defaults as kinit, but that obviously isn't the case.</p>
  
  <p>The code-</p>
  
  <pre><code>System.setProperty("sun.security.krb5.debug", "true");
  System.setProperty("java.security.krb5.realm", "TEST.SQRRL.COM");
  System.setProperty("java.security.krb5.kdc", "172.16.101.128");
  System.setProperty("java.security.auth.login.config", "./conf/jaas.conf");
  System.setProperty("javax.security.auth.useSubjectCredsOnly", "true");
  
  // "Client" references the JAAS configuration in the jaas.conf file.
  LoginContext loginCtx = null;
  loginCtx = new LoginContext("Server", new LoginCallbackHandler("test".toCharArray()));
  loginCtx.login();
  subject = loginCtx.getSubject();
  </code></pre>
  
  <p>and the jaas.conf</p>
  
  <pre><code>Server {
  com.sun.security.auth.module.Krb5LoginModule required
  useKeyTab=false
  storeKey=true
  useTicketCache=true
  principal="accumulo@test.SQRRL.COM";
  };
  </code></pre>
  
  <p>And, the stack trace-</p>
  
  <pre><code>&gt;&gt;&gt;KRBError:
       sTime is Tue Nov 27 18:16:36 EST 2012 1354058196000
       suSec is 257213
       error code is 14
       error Message is KDC has no support for encryption type
       realm is test.SQRRL.COM
       sname is krbtgt/test.SQRRL.COM
       msgType is 30
  javax.security.auth.login.LoginException: KDC has no support for encryption type (14)
      at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:696)
      at com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:542)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
      at java.lang.reflect.Method.invoke(Method.java:597)
      at javax.security.auth.login.LoginContext.invoke(LoginContext.java:769)
      at javax.security.auth.login.LoginContext.access$000(LoginContext.java:186)
      at javax.security.auth.login.LoginContext$4.run(LoginContext.java:683)
      at java.security.AccessController.doPrivileged(Native Method)
      at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)
      at javax.security.auth.login.LoginContext.login(LoginContext.java:579)
      at authenticators.KerberosAuthenticator.&lt;init&gt;(KerberosAuthenticator.java:37)
      at main.ServerImpl.&lt;init&gt;(ServerImpl.java:91)
      at main.PlugServer.run(PlugServer.java:22)
      at main.PlugServer.main(PlugServer.java:42)
  Caused by: KrbException: KDC has no support for encryption type (14)
      at sun.security.krb5.KrbAsRep.&lt;init&gt;(KrbAsRep.java:66)
      at sun.security.krb5.KrbAsReq.getReply(KrbAsReq.java:446)
      at sun.security.krb5.Credentials.sendASRequest(Credentials.java:401)
      at sun.security.krb5.Credentials.acquireTGT(Credentials.java:373)
      at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:662)
      ... 15 more
  Caused by: KrbException: Identifier doesn't match expected value (906)
      at sun.security.krb5.internal.KDCRep.init(KDCRep.java:133)
      at sun.security.krb5.internal.ASRep.init(ASRep.java:58)
      at sun.security.krb5.internal.ASRep.&lt;init&gt;(ASRep.java:53)
      at sun.security.krb5.KrbAsRep.&lt;init&gt;(KrbAsRep.java:50)
      ... 19 more
  Exception in thread "main" java.lang.RuntimeException: javax.security.auth.login.LoginException: KDC has no support for encryption type (14)
      at main.PlugServer.run(PlugServer.java:36)
      at main.PlugServer.main(PlugServer.java:42)
  Caused by: javax.security.auth.login.LoginException: KDC has no support for encryption type (14)
      at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:696)
      at com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:542)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
      at java.lang.reflect.Method.invoke(Method.java:597)
      at javax.security.auth.login.LoginContext.invoke(LoginContext.java:769)
      at javax.security.auth.login.LoginContext.access$000(LoginContext.java:186)
      at javax.security.auth.login.LoginContext$4.run(LoginContext.java:683)
      at java.security.AccessController.doPrivileged(Native Method)
      at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)
      at javax.security.auth.login.LoginContext.login(LoginContext.java:579)
      at authenticators.KerberosAuthenticator.&lt;init&gt;(KerberosAuthenticator.java:37)
      at main.ServerImpl.&lt;init&gt;(ServerImpl.java:91)
      at main.PlugServer.run(PlugServer.java:22)
      ... 1 more
  Caused by: KrbException: KDC has no support for encryption type (14)
      at sun.security.krb5.KrbAsRep.&lt;init&gt;(KrbAsRep.java:66)
      at sun.security.krb5.KrbAsReq.getReply(KrbAsReq.java:446)
      at sun.security.krb5.Credentials.sendASRequest(Credentials.java:401)
      at sun.security.krb5.Credentials.acquireTGT(Credentials.java:373)
      at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:662)
      ... 15 more
  Caused by: KrbException: Identifier doesn't match expected value (906)
      at sun.security.krb5.internal.KDCRep.init(KDCRep.java:133)
      at sun.security.krb5.internal.ASRep.init(ASRep.java:58)
      at sun.security.krb5.internal.ASRep.&lt;init&gt;(ASRep.java:53)
      at sun.security.krb5.KrbAsRep.&lt;init&gt;(KrbAsRep.java:50)
      ... 19 more
  </code></pre>