title: How to fix 'Unable to login as the service principal' exception caused due to 'Unable to obtain password from user' for Tomcat Windows Authentication?
body: <p>I am trying to implement windows authentication for Tomcat8.0 webapps using its inbuilt support. And I'm getting the following exception in the <strong>TOMCAT_HOME\logs\tomcat8-stderr.2017-03-17.log</strong> file :-</p>
  
  <pre><code>17-Mar-2017 10:59:39.367 FINE [http-nio-8080-exec-6] org.apache.catalina.authenticator.AuthenticatorBase.invoke Security checking request GET /testad/
  17-Mar-2017 10:59:39.367 FINE [http-nio-8080-exec-6] org.apache.catalina.realm.RealmBase.findSecurityConstraints   Checking constraint 'SecurityConstraint[Common Area]' against GET /index.jsp --&gt; true
  17-Mar-2017 10:59:39.367 FINE [http-nio-8080-exec-6] org.apache.catalina.realm.RealmBase.findSecurityConstraints   Checking constraint 'SecurityConstraint[Common Area]' against GET /index.jsp --&gt; true
  17-Mar-2017 10:59:39.367 FINE [http-nio-8080-exec-6] org.apache.catalina.authenticator.AuthenticatorBase.invoke  Calling hasUserDataPermission()
  17-Mar-2017 10:59:39.367 FINE [http-nio-8080-exec-6] org.apache.catalina.realm.RealmBase.hasUserDataPermission   User data constraint has no restrictions
  17-Mar-2017 10:59:39.367 FINE [http-nio-8080-exec-6] org.apache.catalina.authenticator.AuthenticatorBase.invoke  Calling authenticate()
  17-Mar-2017 10:59:39.383 SEVERE [http-nio-8080-exec-6] org.apache.catalina.authenticator.SpnegoAuthenticator.doAuthenticate Unable to login as the service principal
   javax.security.auth.login.LoginException: Unable to obtain password from user
  
      at com.sun.security.auth.module.Krb5LoginModule.promptForPass(Unknown Source)
      at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Unknown Source)
      at com.sun.security.auth.module.Krb5LoginModule.login(Unknown Source)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
      at java.lang.reflect.Method.invoke(Unknown Source)
      at javax.security.auth.login.LoginContext.invoke(Unknown Source)
      at javax.security.auth.login.LoginContext.access$000(Unknown Source)
      at javax.security.auth.login.LoginContext$4.run(Unknown Source)
      at javax.security.auth.login.LoginContext$4.run(Unknown Source)
      at java.security.AccessController.doPrivileged(Native Method)
      at javax.security.auth.login.LoginContext.invokePriv(Unknown Source)
      at javax.security.auth.login.LoginContext.login(Unknown Source)
      at org.apache.catalina.authenticator.SpnegoAuthenticator.doAuthenticate(SpnegoAuthenticator.java:197)
      at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:556)
      at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140)
      at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79)
      at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87)
      at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:349)
      at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:783)
      at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
      at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:798)
      at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1434)
      at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
      at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
      at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
      at java.lang.Thread.run(Unknown Source)
  
  17-Mar-2017 10:59:39.383 FINE [http-nio-8080-exec-6] org.apache.catalina.authenticator.AuthenticatorBase.invoke  Failed authenticate() test
  </code></pre>
  
  <p>Following are my environment details:-</p>
  
  <ol>
  <li>Windows Server 2012 (FQDN: <strong>dev.devdevelopment.com</strong>) for AD</li>
  <li>Windows 7 machine (FQDN: <strong>windows7devpc.devdevelopment.com</strong>) for Apache Tomcat 8.5.11 with Java 1.8.0_31(64 Bit)</li>
  <li>Windows XP machine as client (Firefox browser)</li>
  <li>AD Domain Name : devdevelopment.com</li>
  </ol>
  
  <p>I have a domain user <strong>devtomcat</strong> to which the following SPNs are mapped:-</p>
  
  <p><a href="https://i.stack.imgur.com/0qVXf.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/0qVXf.png" alt="enter image description here"></a></p>
  
  <p>I have another domain user <strong>devuser</strong> that is a member of a group named <strong>tc-webapp-users</strong> which is inturn within an OU named <strong>tomcat-ou</strong>. This user is used to access the webapp from the windows xp machine.</p>
  
  <p><a href="https://i.stack.imgur.com/xsIJi.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/xsIJi.png" alt="enter image description here"></a></p>
  
  <p>Following is my tomcat's <strong>server.xml</strong></p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  
  &lt;Server port="8005" shutdown="SHUTDOWN"&gt;
    &lt;Listener className="org.apache.catalina.startup.VersionLoggerListener" /&gt;
    &lt;Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" /&gt;
    &lt;Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" /&gt;
    &lt;Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" /&gt;
    &lt;Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" /&gt;
  
    &lt;GlobalNamingResources/&gt;
  
    &lt;Service name="Catalina"&gt;
      &lt;Connector port="8080" maxSavePostSize="2097152" URIEncoding="UTF-8" maxHttpHeaderSize="65536"/&gt;
      &lt;Connector port="8009" protocol="AJP/1.3" redirectPort="8443" /&gt;
      &lt;Engine name="Catalina" defaultHost="localhost"&gt;
          &lt;Host name="localhost" appBase="webapps" unpackWARs="true" autoDeploy="true"&gt;
              &lt;Context docBase="testad" path="/testad"&gt;
                  &lt;Realm className="org.apache.catalina.realm.JNDIRealm"
                          connectionURL="ldap://dev.devdevelopment.com:389"
                          userSubtree="true"
                          userBase="CN=Users,DC=devdevelopment,DC=com"
                          userSearch="(sAMAccountName={0})"
                          userRoleName="memberOf"
                          roleBase="CN=tc-webapp-users,OU=tomcat-ou,DC=devdevelopment,DC=com"
                          roleName="cn"
                          roleSearch="(member={0})"
                          roleSubtree="true"
                          roleNested="true"/&gt;
                  &lt;Valve className="org.apache.catalina.authenticator.SpnegoAuthenticator" storeDelegatedCredential="true"/&gt;
              &lt;/Context&gt;
          &lt;/Host&gt;
      &lt;/Engine&gt;
    &lt;/Service&gt;
  &lt;/Server&gt;
  </code></pre>
  
  <p>Following is the webapp's <strong>web.xml</strong></p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app version="2.5" 
      xmlns="http://java.sun.com/xml/ns/javaee" 
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
      xsi:schemaLocation="http://java.sun.com/xml/ns/javaee 
      http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"&gt;
  
      &lt;welcome-file-list&gt;
          &lt;welcome-file&gt;index.jsp&lt;/welcome-file&gt;
      &lt;/welcome-file-list&gt;
  
      &lt;session-config&gt;
          &lt;session-timeout&gt;
              30
          &lt;/session-timeout&gt;
      &lt;/session-config&gt;
  
      &lt;security-constraint&gt;
          &lt;web-resource-collection&gt;
              &lt;web-resource-name&gt;Common Area&lt;/web-resource-name&gt;
              &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
              &lt;http-method&gt;GET&lt;/http-method&gt;
              &lt;http-method&gt;POST&lt;/http-method&gt;
              &lt;http-method&gt;PUT&lt;/http-method&gt;
              &lt;http-method&gt;HEAD&lt;/http-method&gt;
              &lt;http-method&gt;TRACE&lt;/http-method&gt;
              &lt;http-method&gt;DELETE&lt;/http-method&gt;
              &lt;http-method&gt;OPTIONS&lt;/http-method&gt;
          &lt;/web-resource-collection&gt;
          &lt;auth-constraint&gt;
              &lt;role-name&gt;tc-webapp-users&lt;/role-name&gt;
          &lt;/auth-constraint&gt;
          &lt;user-data-constraint&gt;
              &lt;transport-guarantee&gt;NONE&lt;/transport-guarantee&gt;
          &lt;/user-data-constraint&gt;
      &lt;/security-constraint&gt;
  
      &lt;login-config&gt;
          &lt;auth-method&gt;SPNEGO&lt;/auth-method&gt;
      &lt;/login-config&gt;
  
      &lt;security-role&gt;
          &lt;description&gt;TC-WebApp-Roles&lt;/description&gt;
          &lt;role-name&gt;tc-webapp-users&lt;/role-name&gt;
      &lt;/security-role&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p>Following is the content of <strong>krb5.ini</strong> file which is placed under <strong>C:\Program Files\Apache Software Foundation\Tomcat 8.5\conf</strong> directory :-</p>
  
  <pre><code>[libdefaults]
  default_realm=DEVDEVELOPMENT.COM
  default_keytab_name=“C:/Program Files/Apache Software Foundation/Tomcat 8.5/conf/tomcat.keytab"
  default_tkt_enctypes=rc4-hmac,aes256-cts-hmac-shal-96,aes128-cts-hmac-shal-96
  default_tgs_enctypes=rc4-hmac,aes256-cts-hmac-shal-96,aes128-cts-hmac-shal-96
  permitted_enctypes=rc4-hmac,aes256-cts-hmac-shal-96,aes128-cts-hmac-shal-96
  udp_preference_limit=1
  forwardable=true
  
  [realms]
  DEVDEVELOPMENT.COM={
      kdc=dev.devdevelopment.com
  }
  
  [domain_realm]
  devdevelopment.com=DEVDEVELOPMENT.COM
  .devdevelopment.com=DEVDEVELOPMENT.COM
  </code></pre>
  
  <p>Following is the content of <strong>jaas.conf</strong> file which is placed under <strong>C:\Program Files\Apache Software Foundation\Tomcat 8.5\conf</strong> directory :-</p>
  
  <pre><code>com.sun.security.jgss.krb5.accept {
      com.sun.security.auth.module.Krb5LoginModule required
      doNotPrompt=true
      principal="HTTP/windows7devpc.devdevelopment.com@DEVDEVELOPMENT.COM"
      keyTab="C:\Program Files\Apache Software Foundation\Tomcat 8.5\conf\tomcat.keytab"
      storeKey=true
      useKeyTab=true
      useTicketCache=true
      isInitiator=true
      refreshKrb5Config=true
      moduleBanner=true
      storePass=true;
  };
  
  com.sun.security.jgss.krb5.initiate {
      com.sun.security.auth.module.Krb5LoginModule required
      doNotPrompt=true
      principal="HTTP/windows7devpc.devdevelopment.com@DEVDEVELOPMENT.COM"
      keyTab="C:\Program Files\Apache Software Foundation\Tomcat 8.5\conf\tomcat.keytab"
      storeKey=true
      useKeyTab=true
      useTicketCache=true
      isInitiator=true
      refreshKrb5Config=true
      moduleBanner=true
      storePass=true
      debug=true;
  };
  </code></pre>
  
  <p>Following is the diagnostic output of the JDK's <strong>klist</strong> command (run on the Tomcat machine):-</p>
  
  <pre><code>c:\Program Files\Java\jdk1.8.0_31\bin&gt;klist -e -k -t "C:\Program Files\Apache Software Foundation\Tomcat 8.5\conf\tomcat.keytab"
  
  Key tab: C:\Program Files\Apache Software Foundation\Tomcat 8.5\conf\tomcat.keytab, 1 entry found.
  
  [1] Service principal: HTTP/windows7devpc.devdevelopment.com@DEVDEVELOPMENT.COM
           KVNO: 12
           Key type: 18
           Time stamp: Jan 01, 1970 05:30:00
  </code></pre>
  
  <p>Following is the diagnostic output of the JDK's <strong>kinit</strong> command (run on the Tomcat machine) in debug mode :-</p>
  
  <pre><code>c:\Program Files\Java\jdk1.8.0_31\bin&gt;kinit -J-Dsun.security.krb5.debug=true -k -t "C:\Program Files\Apache Software Foundation\Tomcat 8.5\conf\tomcat.keytab" HTTP/windows7devpc.devdevelopment.com@DEVDEVELOPMENT.COM
  &gt;&gt;&gt;KinitOptions cache name is C:\Users\devtomcat\krb5cc_devtomcat
  Principal is HTTP/windows7devpc.devdevelopment.com@DEVDEVELOPMENT.COM
  &gt;&gt;&gt; Kinit using keytab
  &gt;&gt;&gt; Kinit keytab file name: C:\Program Files\Apache Software Foundation\Tomcat 8.5\conf\tomcat.keytab
  Java config name: null
  LSA: Found Ticket
  LSA: Made NewWeakGlobalRef
  LSA: Found PrincipalName
  LSA: Made NewWeakGlobalRef
  LSA: Found DerValue
  LSA: Made NewWeakGlobalRef
  LSA: Found EncryptionKey
  LSA: Made NewWeakGlobalRef
  LSA: Found TicketFlags
  LSA: Made NewWeakGlobalRef
  LSA: Found KerberosTime
  LSA: Made NewWeakGlobalRef
  LSA: Found String
  LSA: Made NewWeakGlobalRef
  LSA: Found DerValue constructor
  LSA: Found Ticket constructor
  LSA: Found PrincipalName constructor
  LSA: Found EncryptionKey constructor
  LSA: Found TicketFlags constructor
  LSA: Found KerberosTime constructor
  LSA: Finished OnLoad processing
  Native config name: C:\Windows\krb5.ini
  &gt;&gt;&gt; Kinit realm name is DEVDEVELOPMENT.COM
  &gt;&gt;&gt; Creating KrbAsReq
  &gt;&gt;&gt; KrbKdcReq local addresses for windows7devpc are:
  
          windows7devpc/192.168.1.229
  IPv4 address
  
          windows7devpc/fe80:0:0:0:80f2:1a68:c0f0:710%11
  IPv6 address
  &gt;&gt;&gt; KdcAccessibility: reset
  &gt;&gt;&gt; KeyTabInputStream, readName(): DEVDEVELOPMENT.COM
  &gt;&gt;&gt; KeyTabInputStream, readName(): HTTP
  &gt;&gt;&gt; KeyTabInputStream, readName(): windows7devpc.devdevelopment.com
  &gt;&gt;&gt; KeyTab: load() entry length: 107; type: 18
  Looking for keys for: HTTP/windows7devpc.devdevelopment.com@DEVDEVELOPMENT.COM
  Added key: 18version: 12
  Using builtin default etypes for default_tkt_enctypes
  default etypes for default_tkt_enctypes: 18 17 16 23.
  &gt;&gt;&gt; KrbAsReq creating message
  getKDCFromDNS using UDP
  &gt;&gt;&gt; KrbKdcReq send: kdc=dev.devdevelopment.com. UDP:88, timeout=30000, number of retries =3, #bytes=227
  &gt;&gt;&gt; KDCCommunication: kdc=dev.devdevelopment.com. UDP:88, timeout=30000,Attempt =1, #bytes=227
  &gt;&gt;&gt; KrbKdcReq send: #bytes read=227
  &gt;&gt;&gt;Pre-Authentication Data:
           PA-DATA type = 19
           PA-ETYPE-INFO2 etype = 18, salt = DEVDEVELOPMENT.COMHTTPwindows7devpc.devdevelopment.com, s2kparams = null
  
  &gt;&gt;&gt;Pre-Authentication Data:
           PA-DATA type = 2
           PA-ENC-TIMESTAMP
  &gt;&gt;&gt;Pre-Authentication Data:
           PA-DATA type = 16
  
  &gt;&gt;&gt;Pre-Authentication Data:
           PA-DATA type = 15
  
  &gt;&gt;&gt; KdcAccessibility: remove dev.devdevelopment.com.:88
  &gt;&gt;&gt; KDCRep: init() encoding tag is 126 req type is 11
  &gt;&gt;&gt;KRBError:
           sTime is Thu Mar 16 22:50:19 IST 2017 1489684819000
           suSec is 759798
           error code is 25
           error Message is Additional pre-authentication required
           sname is krbtgt/DEVDEVELOPMENT.COM@DEVDEVELOPMENT.COM
           eData provided.
           msgType is 30
  &gt;&gt;&gt;Pre-Authentication Data:
           PA-DATA type = 19
           PA-ETYPE-INFO2 etype = 18, salt = DEVDEVELOPMENT.COMHTTPwindows7devpc.devdevelopment.com, s2kparams = null
  
  &gt;&gt;&gt;Pre-Authentication Data:
           PA-DATA type = 2
           PA-ENC-TIMESTAMP
  &gt;&gt;&gt;Pre-Authentication Data:
           PA-DATA type = 16
  
  &gt;&gt;&gt;Pre-Authentication Data:
           PA-DATA type = 15
  
  KrbAsReqBuilder: PREAUTH FAILED/REQ, re-send AS-REQ
  Using builtin default etypes for default_tkt_enctypes
  default etypes for default_tkt_enctypes: 18 17 16 23.
  Looking for keys for: HTTP/windows7devpc.devdevelopment.com@DEVDEVELOPMENT.COM
  Added key: 18version: 12
  Looking for keys for: HTTP/windows7devpc.devdevelopment.com@DEVDEVELOPMENT.COM
  Added key: 18version: 12
  Using builtin default etypes for default_tkt_enctypes
  default etypes for default_tkt_enctypes: 18 17 16 23.
  &gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType
  &gt;&gt;&gt; KrbAsReq creating message
  getKDCFromDNS using UDP
  &gt;&gt;&gt; KrbKdcReq send: kdc=dev.devdevelopment.com. UDP:88, timeout=30000, number of retries =3, #bytes=316
  &gt;&gt;&gt; KDCCommunication: kdc=dev.devdevelopment.com. UDP:88, timeout=30000,Attempt =1, #bytes=316
  &gt;&gt;&gt; KrbKdcReq send: #bytes read=108
  &gt;&gt;&gt; KrbKdcReq send: kdc=dev.devdevelopment.com. TCP:88, timeout=30000, number of retries =3, #bytes=316
  &gt;&gt;&gt; KDCCommunication: kdc=dev.devdevelopment.com. TCP:88, timeout=30000,Attempt =1, #bytes=316
  &gt;&gt;&gt;DEBUG: TCPClient reading 1766 bytes
  &gt;&gt;&gt; KrbKdcReq send: #bytes read=1766
  &gt;&gt;&gt; KdcAccessibility: remove dev.devdevelopment.com.:88
  Looking for keys for: HTTP/windows7devpc.devdevelopment.com@DEVDEVELOPMENT.COM
  Added key: 18version: 12
  &gt;&gt;&gt; EType: sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType
  &gt;&gt;&gt; KrbAsRep cons in KrbAsReq.getReply HTTP/windows7devpc.devdevelopment.com
  New ticket is stored in cache file C:\Users\devtomcat\krb5cc_devtomcat
  </code></pre>
  
  <p>Following are the Java environment variables that are set in <strong>Java</strong> tab of the <strong>Tomcat8 Properties</strong> window :-</p>
  
  <p><a href="https://i.stack.imgur.com/ZWOzt.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/ZWOzt.png" alt="enter image description here"></a></p>
  
  <p>And finally, following are the settings done in the Firefox browser on the Windows xp machine for the domain user <strong>devuser</strong>:-</p>
  
  <p><a href="https://i.stack.imgur.com/mM9nU.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/mM9nU.png" alt="enter image description here"></a></p>
  
  <p><a href="https://i.stack.imgur.com/7uZAv.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/7uZAv.png" alt="enter image description here"></a></p>
  
  <p>The Wireshark logs in the tomcat machine do not show any entries/activity when the webapp is accessed in windows xp machine. I doubt if the SPNEGO negotiation is being initiated by the tomcat machine.</p>
  
  <p>Should the <strong>krb5.ini</strong> file be placed in <strong>C:\Windows</strong> directory? Also, does the spaces in the keytab file path matter?</p>
  
  <p>I have followed the instructions mentioned <a href="https://dzone.com/articles/do-not-publish-configuring-tomcat-single-sign-on-w" rel="nofollow noreferrer">here</a>. Where &amp; what am I doing wrong / missing something?</p>