"The token supplied to the function is invalid" when validating SPNEGO response token with enctype AES

[FlyingSheepOnSailfish]

We have used Waffle to implement a Java SPENGO SSO Client using SSPI to login to a Java GSSAPI application server running on Windows Server.

Everything works fine if RC4 is used as the encryption type: The server authenticates the client, and the client successfully validates the SPNEGO response token from the server.

However as soon as we enable AES128 / 256 the GSSAPI app server successfully authenticates the client (OK), but the client cannot validate the SPNEGO response token from the server (NOT OK):

2020.05.25 15:04:57.167 ERR <n.a.> SwingWorker-1 [SSPITokenHelper.validateReponseToken] SSPI Exception! Response Token could not be validated. : com.sun.jna.platform.win32.Win32Exception: The token supplied to the function is invalid
at waffle.windows.auth.impl.WindowsSecurityContextImpl.initialize(WindowsSecurityContextImpl.java:134)
at ch.otms.comm.services.SSPITokenHelperFactory$SSPITokenHelper.validateReponseToken(SSPITokenHelperFactory.java:114)

The client code is as follows:

    private IWindowsSecurityContext getClientContext() {			
      return WindowsSecurityContextImpl.getCurrent( "Negotiate", servicePrincipalName.getName());
    }

    public Boolean validateReponseToken(String token) {
      boolean bValidated = false;
      try {
        byte responseData[] = Base64.getDecoder().decode(token);
        // SecBufferDesc continueToken = new SecBufferDesc(Sspi.SECBUFFER_TOKEN, responseData); // Waffle 1.9.1 / jna 4.5.1
        ManagedSecBufferDesc continueToken = new ManagedSecBufferDesc(Sspi.SECBUFFER_TOKEN, responseData); // Waffle 2.2.1 / jna 5.5.0
        clientContext.initialize(clientContext.getHandle(), continueToken, servicePrincipalName.getName());
        bValidated = !clientContext.isContinue();
      } catch (Exception e) {
        Log.log(Log.ERROR, "[SSPITokenHelper.validateReponseToken] SSPI Exception! Response Token could not be validated.", e);
        throw new otms.util.OTMSRuntimeException(" Response Token is not valid: " + e.getMessage());
      } finally {
        clientContext.dispose();
      }
      return bValidated;
    }

We have added debugging code to verify that the token received by the client is identical to that created by the server: nothing is lost or mangled.

We are using Waffle 2.2.1 / jna 5.5.0.

Googling with the error give hits for SqlServer and SSL/TLS, but I do not see how these are directly related to our problem.

Some time ago we opened this StackOverflow question:
https://stackoverflow.com/questions/60422387/the-token-supplied-to-the-function-is-invalid-error-when-validating-spnego-res

[ekkelenkamp]

@FlyingSheepOnSailfish, did you ever get this working? We have a similar use case where we have a Swing fat client that needs to authenticate against a kerberos protected API.