SpNego：检测到有缺陷的令牌
我有一个连接到 WCF 服务的 java 客户端。该服务配置为作为单独的域用户在主机上运行（即不是作为本地服务或网络服务）。该服务在其 WSDL 中发布 userPrincipalName。
在 SpNego 令牌交换期间，我在客户端中遇到以下异常
Defective token detected (Mechanism level: AP_REP token id does not match!)
This is the call stack:
at sun.security.jgss.spnego.SpNegoContext.initSecContext(SpNegoContext.java:450)
at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:230)
at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:162)
如果我将 WCF 服务配置为在本地系统帐户下运行，则 SpNego 令牌交换可以正常工作。 我是否需要修改不在本地系统帐户下运行的服务的代码？
Update-1
通过让 C# 客户端连接 WCF 服务进行一些调试后，我发现 C# 客户端正在使用名为 MS-SPNG。 Java 6 支持这个吗？当我检查令牌时，我收到有关不受支持的机制 1.2.840.113554.1.2.2.3 的错误。
I have a java client connecting to a WCF service. This service is configured to run on the host as a separate domain user (i.e. not as Local Service or Network Service). The Service publishes a userPrincipalName in its WSDL.
During the SpNego token exchange I get the following exception in the client
Defective token detected (Mechanism level: AP_REP token id does not match!)
This is the call stack:
at sun.security.jgss.spnego.SpNegoContext.initSecContext(SpNegoContext.java:450)
at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:230)
at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:162)
If I configure the WCF service to run under Local System account the SpNego token exchange works.
Do I need to modify the code for services not running under Local system account?
Update-1
After some debugging by getting a C# client to connect with the WCF service, I found that the C# client is using a modified version of SpNego protocol called MS-SPNG. Does Java 6 support this? When I inspect the token I get an error about unsupported mechanism 1.2.840.113554.1.2.2.3.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
这些链接解释了发生的情况。 MS 有 SpNego 协议的扩展，当我们作为用户（即不是本地服务等）运行 WCF 服务时，该扩展就会启动。
这是新协议的 MS 规范和 这里是解释解决方法的 openjdk 文档。
These links explains whats happening. MS has a extension for SpNego protocol, which kicks in when we run a WCF service as a user (i.e. not as Local Service etc).
This is the MS specification for the new protocol, and here is the openjdk doc that xplains the workarounds.