title: spnego authentication stops working when CAS deployed
body: <p>I have a working tomcat instance where the tomcat-manager applet authenticates with SPNEGO.
  When I deploy CAS - configured to use SPNEGO - , the following happens:</p>
  
  <ul>
  <li>right after the deployment, both the manager applet and CAS works as expected</li>
  <li>after tomcat restart, none of them works, both of them throws exceptions (see below)</li>
  <li>if I undeploy CAS, the manager applet still does not work until tomcat restart</li>
  </ul>
  
  <p>I have assumed that that applications should not modify the behaviour of other applications, and hence using CAS for authentication is voluntary. If this was true, then this behaviour would be an error. If not, then I would assume that CAS should <strong>replace</strong> the authentication of the application, in which case it would still be an error.
  However I also assume that I miss some important information about how CAS/tomcat should work.
  In short: is it an error to be reported, and/or should I learn more about how CAS/tomcat should work (and where?)</p>
  
  <p>Exception when trying to login to the manager applet:</p>
  
  <pre><code>Apr 30 08:57:03 127.0.0.1/127.0.0.1 1 2013-04-30T06:57:03.222Z tomcat http-bio-8080-exec-1 21438   192.168.1.10 - - [30/Apr/2013:06:57:03 +0000] "GET /manager/ HTTP/1.1" 302 -
  Apr 30 08:57:03 127.0.0.1/127.0.0.1 1 2013-04-30T06:57:03.301Z tomcat http-bio-8080-exec-2 21438   192.168.1.10 - - [30/Apr/2013:06:57:03 +0000] "GET /manager/html?org.apache.catalina.filters.CSRF_NONCE=146B55AA6642928501CA00F62409FCE8 HTTP/1.1" 401 2486
  Apr 30 08:57:03 127.0.0.1/127.0.0.1 1 2013-04-30T06:57:03.348Z tomcat http-bio-8080-exec-3 21438   192.168.1.10 - - [30/Apr/2013:06:57:03 +0000] "GET /manager/html?org.apache.catalina.filters.CSRF_NONCE=146B55AA6642928501CA00F62409FCE8 HTTP/1.1" 500 1000
  Apr 30 08:57:04 s_catalina@tomcat Apr 30, 2013 6:57:03 AM org.apache.catalina.authenticator.SpnegoAuthenticator authenticate
  Apr 30 08:57:04 s_catalina@tomcat SEVERE: Unable to login as the service principal
  Apr 30 08:57:04 s_catalina@tomcat javax.security.auth.login.LoginException: No LoginModules configured for com.sun.security.jgss.krb5.accept
  Apr 30 08:57:04 s_catalina@tomcat   at javax.security.auth.login.LoginContext.init(LoginContext.java:273)
  Apr 30 08:57:04 s_catalina@tomcat   at javax.security.auth.login.LoginContext.&lt;init&gt;(LoginContext.java:349)
  Apr 30 08:57:04 s_catalina@tomcat   at org.apache.catalina.authenticator.SpnegoAuthenticator.authenticate(SpnegoAuthenticator.java:195)
  Apr 30 08:57:04 s_catalina@tomcat   at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:544)
  Apr 30 08:57:04 s_catalina@tomcat   at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:168)
  Apr 30 08:57:04 s_catalina@tomcat   at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:98)
  Apr 30 08:57:04 s_catalina@tomcat   at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:927)
  Apr 30 08:57:04 s_catalina@tomcat   at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
  Apr 30 08:57:04 s_catalina@tomcat   at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:407)
  Apr 30 08:57:04 s_catalina@tomcat   at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:987)
  Apr 30 08:57:04 s_catalina@tomcat   at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:579)
  Apr 30 08:57:04 s_catalina@tomcat   at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:309)
  Apr 30 08:57:04 s_catalina@tomcat   at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
  Apr 30 08:57:04 s_catalina@tomcat   at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
  Apr 30 08:57:04 s_catalina@tomcat   at java.lang.Thread.run(Thread.java:722)
  </code></pre>
  
  <p>same with CAS:</p>
  
  <pre><code>Apr 30 08:59:58 127.0.0.1/127.0.0.1 1 2013-04-30T06:59:58.104Z tomcat http-bio-8080-exec-4 21438   192.168.1.10 - - [30/Apr/2013:06:59:58 +0000] "GET /cas/ HTTP/1.1" 302 -
  Apr 30 08:59:58 127.0.0.1/127.0.0.1 1 2013-04-30T06:59:58.937Z tomcat http-bio-8080-exec-5 21438   192.168.1.10 - - [30/Apr/2013:06:59:58 +0000] "GET /cas/login HTTP/1.1" 401 954
  Apr 30 08:59:59 s_catalina@tomcat 2013-04-30 06:59:58,761 INFO [org.jasig.cas.web.flow.InitialFlowSetupAction] - &lt;Setting path for cookies to: /cas/&gt;
  Apr 30 08:59:59 s_catalina@tomcat jcifs.spnego.AuthenticationException: Error performing Kerberos authentication: java.lang.reflect.InvocationTargetException
  Apr 30 08:59:59 s_catalina@tomcat   at jcifs.spnego.Authentication.processKerberos(Authentication.java:447)
  Apr 30 08:59:59 s_catalina@tomcat   at jcifs.spnego.Authentication.processSpnego(Authentication.java:346)
  Apr 30 08:59:59 s_catalina@tomcat   at jcifs.spnego.Authentication.process(Authentication.java:235)
  Apr 30 08:59:59 s_catalina@tomcat   at org.jasig.cas.support.spnego.authentication.handler.support.JCIFSSpnegoAuthenticationHandler.doAuthentication(JCIFSSpnegoAuthenticationHandler.java:70)
  Apr 30 08:59:59 s_catalina@tomcat   at org.jasig.cas.authentication.handler.support.AbstractPreAndPostProcessingAuthenticationHandler.authenticate_aroundBody2(AbstractPreAndPostProcessingAuthenticationHandler.java:85)
  Apr 30 08:59:59 s_catalina@tomcat   at org.jasig.cas.authentication.handler.support.AbstractPreAndPostProcessingAuthenticationHandler.authenticate_aroundBody3$advice(AbstractPreAndPostProcessingAuthenticationHandler.java:57)
  Apr 30 08:59:59 s_catalina@tomcat   at org.jasig.cas.authentication.handler.support.AbstractPreAndPostProcessingAuthenticationHandler.authenticate(AbstractPreAndPostProcessingAuthenticationHandler.java:1)
  Apr 30 08:59:59 s_catalina@tomcat   at org.jasig.cas.authentication.AuthenticationManagerImpl.authenticateAndObtainPrincipal(AuthenticationManagerImpl.java:93)
  Apr 30 08:59:59 s_catalina@tomcat   at org.jasig.cas.authentication.AbstractAuthenticationManager.authenticate_aroundBody0(AbstractAuthenticationManager.java:57)
  Apr 30 08:59:59 s_catalina@tomcat   at org.jasig.cas.authentication.AbstractAuthenticationManager.authenticate_aroundBody1$advice(AbstractAuthenticationManager.java:57)
  Apr 30 08:59:59 s_catalina@tomcat   at org.jasig.cas.authentication.AbstractAuthenticationManager.authenticate(AbstractAuthenticationManager.java:1)
  Apr 30 08:59:59 s_catalina@tomcat   at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  
  [... 149 more]
  
  Apr 30 08:59:59 s_catalina@tomcat Caused by: java.lang.reflect.InvocationTargetException
  Apr 30 08:59:59 s_catalina@tomcat   at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  Apr 30 08:59:59 s_catalina@tomcat   at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
  Apr 30 08:59:59 s_catalina@tomcat   at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  Apr 30 08:59:59 s_catalina@tomcat   at java.lang.reflect.Method.invoke(Method.java:601)
  Apr 30 08:59:59 s_catalina@tomcat   at jcifs.spnego.Authentication$ServerAction.run(Authentication.java:511)
  Apr 30 08:59:59 s_catalina@tomcat   at jcifs.spnego.Authentication.processKerberos(Authentication.java:430)
  Apr 30 08:59:59 s_catalina@tomcat   ... 160 more
  Apr 30 08:59:59 s_catalina@tomcat Caused by: GSSException: No valid credentials provided (Mechanism level: Attempt to obtain new ACCEPT credentials failed!)
  Apr 30 08:59:59 s_catalina@tomcat   at sun.security.jgss.krb5.Krb5AcceptCredential.getInstance(Krb5AcceptCredential.java:81)
  Apr 30 08:59:59 s_catalina@tomcat   at sun.security.jgss.krb5.Krb5MechFactory.getCredentialElement(Krb5MechFactory.java:126)
  Apr 30 08:59:59 s_catalina@tomcat   at sun.security.jgss.GSSManagerImpl.getCredentialElement(GSSManagerImpl.java:192)
  Apr 30 08:59:59 s_catalina@tomcat   at sun.security.jgss.GSSCredentialImpl.add(GSSCredentialImpl.java:406)
  Apr 30 08:59:59 s_catalina@tomcat   at sun.security.jgss.GSSCredentialImpl.&lt;init&gt;(GSSCredentialImpl.java:60)
  Apr 30 08:59:59 s_catalina@tomcat   at sun.security.jgss.GSSManagerImpl.createCredential(GSSManagerImpl.java:153)
  Apr 30 08:59:59 s_catalina@tomcat   ... 166 more
  Apr 30 08:59:59 s_catalina@tomcat Caused by: javax.security.auth.login.LoginException: Unable to obtain Princpal Name for authentication 
  Apr 30 08:59:59 s_catalina@tomcat   at com.sun.security.auth.module.Krb5LoginModule.promptForName(Krb5LoginModule.java:796)
  Apr 30 08:59:59 s_catalina@tomcat   at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:667)
  Apr 30 08:59:59 s_catalina@tomcat   at com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:580)
  Apr 30 08:59:59 s_catalina@tomcat   at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  Apr 30 08:59:59 s_catalina@tomcat   at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
  Apr 30 08:59:59 s_catalina@tomcat   at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  Apr 30 08:59:59 s_catalina@tomcat   at java.lang.reflect.Method.invoke(Method.java:601)
  Apr 30 08:59:59 s_catalina@tomcat   at javax.security.auth.login.LoginContext.invoke(LoginContext.java:784)
  Apr 30 08:59:59 s_catalina@tomcat   at javax.security.auth.login.LoginContext.access$000(LoginContext.java:203)
  Apr 30 08:59:59 s_catalina@tomcat   at javax.security.auth.login.LoginContext$5.run(LoginContext.java:721)
  Apr 30 08:59:59 s_catalina@tomcat   at javax.security.auth.login.LoginContext$5.run(LoginContext.java:719)
  Apr 30 08:59:59 s_catalina@tomcat   at java.security.AccessController.doPrivileged(Native Method)
  Apr 30 08:59:59 s_catalina@tomcat   at javax.security.auth.login.LoginContext.invokeCreatorPriv(LoginContext.java:718)
  Apr 30 08:59:59 s_catalina@tomcat   at javax.security.auth.login.LoginContext.login(LoginContext.java:590)
  Apr 30 08:59:59 s_catalina@tomcat   at sun.security.jgss.GSSUtil.login(GSSUtil.java:255)
  Apr 30 08:59:59 s_catalina@tomcat   at sun.security.jgss.krb5.Krb5Util.getServiceCreds(Krb5Util.java:334)
  Apr 30 08:59:59 s_catalina@tomcat   at sun.security.jgss.krb5.Krb5AcceptCredential$1.run(Krb5AcceptCredential.java:76)
  Apr 30 08:59:59 s_catalina@tomcat   at sun.security.jgss.krb5.Krb5AcceptCredential$1.run(Krb5AcceptCredential.java:74)
  Apr 30 08:59:59 s_catalina@tomcat   at java.security.AccessController.doPrivileged(Native Method)
  Apr 30 08:59:59 s_catalina@tomcat   at sun.security.jgss.krb5.Krb5AcceptCredential.getInstance(Krb5AcceptCredential.java:73)
  Apr 30 08:59:59 s_catalina@tomcat   ... 171 more
  Apr 30 08:59:59 s_catalina@tomcat 2013-04-30 06:59:59,163 INFO [org.jasig.cas.authentication.AuthenticationManagerImpl] - &lt;org.jasig.cas.support.spnego.authentication.handler.support.JCIFSSpnegoAuthenticationHandler failed authenticating unknown&gt;
  Apr 30 08:59:59 s_catalina@tomcat 2013-04-30 06:59:59,171 INFO [com.github.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - &lt;Audit trail record BEGIN
  Apr 30 08:59:59 s_catalina@tomcat =============================================================
  Apr 30 08:59:59 s_catalina@tomcat WHO: unknown
  Apr 30 08:59:59 s_catalina@tomcat WHAT: supplied credentials: unknown
  Apr 30 08:59:59 s_catalina@tomcat ACTION: AUTHENTICATION_FAILED
  Apr 30 08:59:59 s_catalina@tomcat APPLICATION: CAS
  Apr 30 08:59:59 s_catalina@tomcat WHEN: Tue Apr 30 06:59:59 GMT 2013
  Apr 30 08:59:59 s_catalina@tomcat CLIENT IP ADDRESS: 192.168.1.10
  Apr 30 08:59:59 s_catalina@tomcat SERVER IP ADDRESS: 192.168.1.29
  Apr 30 08:59:59 s_catalina@tomcat =============================================================
  Apr 30 08:59:59 s_catalina@tomcat &gt;
  Apr 30 08:59:59 s_catalina@tomcat 2013-04-30 06:59:59,174 INFO [com.github.inspektr.audit.support.Slf4jLoggingAuditTrailManager] - &lt;Audit trail record BEGIN
  Apr 30 08:59:59 s_catalina@tomcat =============================================================
  Apr 30 08:59:59 s_catalina@tomcat WHO: unknown
  Apr 30 08:59:59 s_catalina@tomcat WHAT: :jcifs.spnego.AuthenticationException: Error performing Kerberos authentication: java.lang.reflect.InvocationTargetException
  Apr 30 08:59:59 s_catalina@tomcat ACTION: TICKET_GRANTING_TICKET_NOT_CREATED
  Apr 30 08:59:59 s_catalina@tomcat APPLICATION: CAS
  Apr 30 08:59:59 s_catalina@tomcat WHEN: Tue Apr 30 06:59:59 GMT 2013
  Apr 30 08:59:59 s_catalina@tomcat CLIENT IP ADDRESS: 192.168.1.10
  Apr 30 08:59:59 s_catalina@tomcat SERVER IP ADDRESS: 192.168.1.29
  Apr 30 08:59:59 s_catalina@tomcat =============================================================
  Apr 30 08:59:59 s_catalina@tomcat &gt;
  </code></pre>