Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

The token supplied to the function is invalid #107

Closed
hazendaz opened this issue Jul 9, 2014 · 12 comments
Closed

The token supplied to the function is invalid #107

hazendaz opened this issue Jul 9, 2014 · 12 comments
Labels

Comments

@hazendaz
Copy link
Member

hazendaz commented Jul 9, 2014

There appears to be a bug introduced in last week or so to the project affecting waffle-test and tomcat modules unit tests where 'the token supplied to the function is invalid'. This is a marker so that we don't release until this has been resolved. Sufficient logging exists around this to log the condition. More research is required to resolve this.

@hazendaz hazendaz added the bug label Jul 9, 2014
@hazendaz
Copy link
Member Author

hazendaz commented Jul 9, 2014

Affected test cases...

waffle-tests
testAcceptSecurityToken
testAcceptAndImpersonateSecurityToken

waffle-tomcat5/6/7/8
testPOSTEmpty

All 6 of these are using "Negotiate" for security package. If I switch these all to "NTLM", everything works. Please advice if this is something that should be changed or if this potentially indicates some other issue.

Quick test of project jar files in tomcat worked without incident so I'm thinking test case issue only. But unclear as to what this started occurring when it didn't seem to before. Possibly machine related.

@dblock
Copy link
Collaborator

dblock commented Jul 9, 2014

Make a PR where these tests aren't ignored anymore. I'll take a look.

@dblock
Copy link
Collaborator

dblock commented Jul 17, 2014

I am not seeing failures in these tests locally (Windows 7 VM). However it is likely a real problem. Is your machine joined to a domain? What name(s) are being passed into things like InitializeSecurityContext? Maybe there's an SPN problem?

@hazendaz
Copy link
Member Author

Although all builds work even for me, I have the unit tests ignoring this error essentially. The stack trace is sent out to the log. This doesn't seem to have any impact to running the project components.

com.sun.jna.platform.win32.Win32Exception: The token supplied to the function is invalid
at waffle.windows.auth.impl.WindowsAuthProviderImpl.acceptSecurityToken(WindowsAuthProviderImpl.java:134)
at waffle.apache.NegotiateAuthenticator.authenticate(NegotiateAuthenticator.java:96)
at waffle.apache.NegotiateAuthenticatorTests.testPOSTEmpty(NegotiateAuthenticatorTests.java:186)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:606)
at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:47)
at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:44)
at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
at org.junit.internal.runners.statements.RunBefores.evaluate(RunBefores.java:26)
at org.junit.internal.runners.statements.RunAfters.evaluate(RunAfters.java:27)
at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:271)
at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:70)
at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:50)
at org.junit.runners.ParentRunner$3.run(ParentRunner.java:238)
at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:63)
at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:236)
at org.junit.runners.ParentRunner.access$000(ParentRunner.java:53)
at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:229)
at org.junit.runners.ParentRunner.run(ParentRunner.java:309)
at org.apache.maven.surefire.junit4.JUnit4Provider.execute(JUnit4Provider.java:264)
at org.apache.maven.surefire.junit4.JUnit4Provider.executeTestSet(JUnit4Provider.java:153)
at org.apache.maven.surefire.junit4.JUnit4Provider.invoke(JUnit4Provider.java:124)
at org.apache.maven.surefire.booter.ForkedBooter.invokeProviderInSameClassLoader(ForkedBooter.java:200)
at org.apache.maven.surefire.booter.ForkedBooter.runSuitesInProcess(ForkedBooter.java:153)
at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:103)

@hazendaz
Copy link
Member Author

hazendaz commented Oct 5, 2014

Tried full build out on another machine. This issue is not present there so likely a machine specific issue. Since I've already coded around the problem by accepting this condition, closing out this issue as it does not hinder any build from working now.

@hazendaz hazendaz closed this as completed Oct 5, 2014
hazendaz referenced this issue in hazendaz/waffle Mar 31, 2015
A fix to capture tomcat 6, 7, and 8 negotiate authenticator
Win32Exception which started occurring around June 2015 per issue #107.
Around that time Exception was switched out for IOException which
allowed Win32Exception to occur.  Now catch that and perform same
actions as IOException.  Left original unit tests capturing fall through
and added new check as this shows Negotiate, NTLM where the comma was
normally expected to be a space.  This does fix the condition but I'm
not 100% certain this is correct from unit test side.
hazendaz referenced this issue in hazendaz/waffle Mar 31, 2015
A fix to capture tomcat 6, 7, and 8 negotiate authenticator
Win32Exception which started occurring around June 2015 per issue #107.
Around that time Exception was switched out for IOException which
allowed Win32Exception to occur.  Now catch that and perform same
actions as IOException.  Left original unit tests capturing fall through
and added new check as this shows Negotiate, NTLM where the comma was
normally expected to be a space.  This does fix the condition but I'm
not 100% certain this is correct from unit test side.
@ASunc
Copy link
Collaborator

ASunc commented May 11, 2015

I just bumped into this. The original issue seems to occur when client is on different domain than the web server is. When client is on same domain as server, everything works ok.

Easy test case is to create a local username to workstation and try to access web server in domain.

And although the this fix takes the stackdump away, it is not possible to login. I think that this worked OK in waffle 1.6.

@dblock
Copy link
Collaborator

dblock commented May 11, 2015

If the client is in a different domain and the domains don't have trust it can't work, because the server doesn't know anything about this user. I don't see how it worked in Waffle 1.6.

@ASunc
Copy link
Collaborator

ASunc commented May 12, 2015

What happens is that IE asks for username/password and if you enter
values which are valid for server domain, it works. Pretty much similar as if you connect to network disk without domain trust.

But to summarize:
1.6.something, dated at 30.1.2014 seems to work (this is at production server now).
1.7.3: results in stackdump mentioned in this issue
1.7.4-snapshot: seems to ask username/password again and again.

But the last test was done using Win 10 preview desktop, I'll have to try with W7 or 8. I'll report back when I know more.

@ASunc
Copy link
Collaborator

ASunc commented May 12, 2015

Tested again with 1.7.4-SNAPSHOT (compiled today). Server is Win2012 on domain "A". Client is Windows 8 on domain "B". No trust relationship. When browsing to server with IE, it asks for username & password. After typing correct ones, login succeeds and web application works ok.

So I can confirm that this fix seems correct (against my initial thoughts - sorry for that).

@hazendaz
Copy link
Member Author

Sounds like it's time for 1.7.4. I wasn't to happy with unit tests but sounds like fix is good. I'll be doing that off the 1.7.x branch so a little work involved to get it ready. I'll try to get this out later this week.

--- Original Message ---

From: "Ari Suutari" notifications@github.com
Sent: May 12, 2015 6:36 AM
To: "dblock/waffle" waffle@noreply.github.com
Cc: "Jeremy Landis" jeremylandis@hotmail.com
Subject: Re: [waffle] The token supplied to the function is invalid (#107)

Tested again with 1.7.4-SNAPSHOT (compiled today). Server is Win2012 on domain "A". Client is Windows 8 on domain "B". No trust relationship. When browsing to server with IE, it asks for username & password. After typing correct ones, login succeeds and web application works ok.

So I can confirm that this fix seems correct (against my initial thoughts - sorry for that).


Reply to this email directly or view it on GitHub:
#107 (comment)

@dblock
Copy link
Collaborator

dblock commented May 12, 2015

👍

hazendaz referenced this issue in hazendaz/waffle May 13, 2015
A fix to capture tomcat 6, 7, and 8 negotiate authenticator
Win32Exception which started occurring around June 2015 per issue #107.
Around that time Exception was switched out for IOException which
allowed Win32Exception to occur.  Now catch that and perform same
actions as IOException.  Left original unit tests capturing fall through
and added new check as this shows Negotiate, NTLM where the comma was
normally expected to be a space.  This does fix the condition but I'm
not 100% certain this is correct from unit test side.
hazendaz referenced this issue in hazendaz/waffle May 13, 2015
A fix to capture tomcat 6, 7, and 8 negotiate authenticator
Win32Exception which started occurring around June 2015 per issue #107.
Around that time Exception was switched out for IOException which
allowed Win32Exception to occur.  Now catch that and perform same
actions as IOException.  Left original unit tests capturing fall through
and added new check as this shows Negotiate, NTLM where the comma was
normally expected to be a space.  This does fix the condition but I'm
not 100% certain this is correct from unit test side.
hazendaz referenced this issue in hazendaz/waffle May 13, 2015
A fix to capture tomcat 6, 7, and 8 negotiate authenticator
Win32Exception which started occurring around June 2015 per issue #107.
Around that time Exception was switched out for IOException which
allowed Win32Exception to occur.  Now catch that and perform same
actions as IOException.  Left original unit tests capturing fall through
and added new check as this shows Negotiate, NTLM where the comma was
normally expected to be a space.  This does fix the condition but I'm
not 100% certain this is correct from unit test side.
@hazendaz
Copy link
Member Author

Ran out of time tonight but essentially I've got the 1.7.x branch ready for a push. Please ignore the 1.7.4 branch I created. It's just a copy of the master currently and I will remove it later. I need to review everything on the 1.7.x branch before I go ahead and push that and notify the group. I should be able to get this up tomorrow and have it available by Thursday in central.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

3 participants