Kerberos Code 41: Someone’s Tweaking the Stream!

If your Java services started throwing KRB_AP_ERR_MODIFIED errors after a JDK update, the culprit is likely the referral-following behavior added in JDK 1.8.0u242. Two small configuration changes on each affected node will restore normal Kerberos authentication against Active Directory.

JDK 1.8.0u242 and later added additional Kerberos features to align with other platforms that support Kerberos. The Java team implemented referral following in accordance with RFC 6806, but this change conflicts with the way Active Directory handles those requests. During name canonicalization, the returned name on the ticket can be altered, resulting in a KRB_AP_ERR_MODIFIED failure.

See the related bug report: JDK-8230496.

Fix: Disable Kerberos Referrals

To resolve the referral issue, take the following action on all impacted nodes as appropriate for your environment:

1. Edit the java.security file located in the active JDK on the cluster.
2. Add or alter the sun.security.krb5.disableReferrals parameter to ensure it is set to true:

sun.security.krb5.disableReferrals=true

Understanding Name Canonicalization

Principal name changes are allowed in AS-REQ responses only if:

1. The canonicalize option was set in the AS-REQ request.
2. PA-REQ-ENC-PA-REP pre-authentication data was sent in the AS-REQ response (meaning the server supports the RFC 6068 FAST scheme).
3. The authenticated checksum is correct.

Principal name changes are allowed in TGS-REQ responses only if:

1. The canonicalize option was set in the TGS-REQ request.
2. The sname has a referral value of the form krbtgt/TO-REALM.COM@FROM-REALM.COM.

Principal name changes are not allowed in other cases, and a KRB_AP_ERR_MODIFIED exception is thrown.

Fix: Renew Lifetime Mismatch

In addition to the referral issue, the Java team also changed how renewals are handled in earlier JDK releases. If the renew_lifetime parameter is present in the krb5.conf file on the host and the values do not appropriately align with what the KDC offers, the request will fail and produce a similar error.

To resolve this, simply comment out the renew_lifetime parameter in krb5.conf:

# renew_lifetime = 7d

• Security
• Technology

• Kerberos
• Active-Directory
• Troubleshooting