| Re: [ptp-user] "Auth fail" when attempting to open connections |
Well, I managed to make some headway. After several hours on google, I
discovered that apparently there is some "known issue" with JSch since
some versions of Java 1.7 that causes it to ask for Kerberos credentials
(gssapi-with-mic authentication) interactively. However, unless the
correct flags are passed to Java, this interactive prompt is suppressed,
leading to silent failures.
Based on threads I found here:
http://sourceforge.net/p/jsch/mailman/message/27043149/
http://sourceforge.net/p/jsch/mailman/message/32021161/
I discovered that I needed to add some lines to my eclipse.ini:
-Djava.security.auth.login.config=/path/to/login.conf
-Djavax.security.auth.useSubjectCredsOnly=false
-Djava.security.krb5.conf=/etc/krb5.conf
Where the file /path/to/login.conf contains:
com.sun.security.jgss.initiate {
com.sun.security.auth.module.Krb5LoginModule required
debug="true"
useTicketCache="true"
ticketCache="/tmp/krb5cc_1000"
principal="<principal>@<realm>"
;
};
(Obviously substituting my principal and realm in for <principal> and
<realm>. Also, /tmp/krb5cc_1000 is the default Kerberos ticket cache
location on my system. I found full documentation on what can go in
this file at
http://docs.oracle.com/javase/1.5.0/docs/guide/security/jaas/spec/com/sun/security/auth/module/Krb5LoginModule.html.)
Once I did this, then I found that if I started Eclipse via a terminal,
I got a prompt for my Kerberos password in the terminal where Eclipse
was started. If I enter this, then the connection succeeded every time.
In principle, the configuration above ought to be able to pull a valid
Kerberos ticket out of my ticket cache, but it doesn't seem to be able
to do that. If it did, I wouldn't have to enter the password into the
terminal, which would be a significant improvement (then I could start
Eclipse via a launcher in my desktop environment). But at least this
makes everything usable again.
-Jeremy
On 12/10/2015 03:50 PM, Jeremy Wolcott wrote:
> ... or, for that matter, some way of using my system ssh client instead
> of JSch in Eclipse Mars, since my system ssh has always worked without
> any problems...
>
> On 12/10/2015 03:44 PM, Jeremy Wolcott wrote:
>> Follow-up:
>>
>> Does anybody have advice on how to get JSch to give me more verbose
>> output (equivalent to 'ssh -vv') so that I can try to figure out what's
>> wrong? That would be fantastic.
>>
>> Thanks!
>>
>> -Jeremy
>>
>> On 12/04/2015 04:18 PM, Jeremy Wolcott wrote:
>>> Hi Greg,
>>>
>>> I included a sample from the .log file in my first message. Is there
>>> anything in particular you're hoping to see that isn't there?
>>>
>>> Thanks!
>>>
>>> -Jeremy
>>>
>>> On 12/04/2015 01:04 PM, Greg Watson wrote:
>>>> Are there any messages in the .log file?
>>>>
>>>>> On Dec 4, 2015, at 12:32 PM, Alameda, Jay <alameda@xxxxxxxxxxxx>
>>>>> wrote:
>>>>>
>>>>> Jeremy, John,
>>>>>
>>>>> I ran into a slightly similar issue earlier this year, and this
>>>>> thread helped - http://www.eclipse.org/forums/index.php/t/175157/ -
>>>>> it may be worth checking into --
>>>>>
>>>>> Jay
>>>>> -----Original Message-----
>>>>> From: ptp-user-bounces@xxxxxxxxxxx
>>>>> [mailto:ptp-user-bounces@xxxxxxxxxxx] On Behalf Of Jeremy Wolcott
>>>>> Sent: Friday, December 04, 2015 11:25 AM
>>>>> To: ptp-user@xxxxxxxxxxx
>>>>> Subject: Re: [ptp-user] "Auth fail" when attempting to open
>>>>> connections
>>>>>
>>>>> Hi John,
>>>>>
>>>>> Thanks for your suggestions. Unfortunately I've already tried both
>>>>> already and forgot to mention them: ssh using the Linux ssh client
>>>>> works fine, and I've tried recreating connections within Eclipse a
>>>>> handful of times to no avail.
>>>>>
>>>>> This failure occurs for every connection that needs to use the
>>>>> gssapi-with-mic authentication method. I'm able to successfully
>>>>> create & use Eclipse connections with (for instance) public key-based
>>>>> authentication, however.
>>>>>
>>>>> -Jeremy
>>>>>
>>>>> On 12/04/2015 12:00 PM, John Eblen wrote:
>>>>>> Hi
>>>>>>
>>>>>> I can only offer some general advice. Check that you can still
>>>>>> connect
>>>>>> to the remote outside of Eclipse to rule out an authentic
>>>>>> authentication problem. If that works, try creating a new connection
>>>>>> inside Eclipse.
>>>>>>
>>>>>> Does this same failure happen for other connections or just a single
>>>>>> one?
>>>>>>
>>>>>>
>>>>>> Good luck
>>>>>> John
>>>>>>
>>>>>> On Thu, Dec 3, 2015 at 3:19 PM, Jeremy Wolcott
>>>>>> <jeremy.wolcott@xxxxxxxxx <mailto:jeremy.wolcott@xxxxxxxxx>> wrote:
>>>>>>
>>>>>> Hello,
>>>>>>
>>>>>> I've been enjoying the "synchronized project" functionality in
>>>>>> PTP
>>>>>> as it is the only way I can productively use Eclipse to work on
>>>>>> code
>>>>>> bases that need to be compiled and run on centrally-hosted
>>>>>> servers.
>>>>>> I've been using it successfully for the last month or two.
>>>>>>
>>>>>> However, in the last few days, I've all of a sudden started
>>>>>> getting
>>>>>> "Auth fail" errors when I attempt to synchronize and/or open
>>>>>> connections that previously worked without incident. (The full
>>>>>> error text from <workspace>/.metadata/.log is pasted below this
>>>>>> message.) This happens basically every time and (unfortunately)
>>>>>> renders Eclipse useless to me again.
>>>>>>
>>>>>> This is coincident with -- and maybe caused by -- a recent
>>>>>> update to
>>>>>> Java that was pushed to me by my OS a few days ago: from OpenJDK
>>>>>> 7u85 to 7u91.
>>>>>>
>>>>>> Unfortunately "Auth fail" is so vague as to be of no help to
>>>>>> me at
>>>>>> all in trying to diagnose what's actually wrong. Some details:
>>>>>>
>>>>>> * OS: Ubuntu 14.04
>>>>>> * Java: (as noted above) OpenJDK 7, though I also tried Oracle
>>>>>> Java 1.7.0_80 with the same results
>>>>>> * Connection: via SSH using Kerberos (gssapi-with-mic)
>>>>>> authentication
>>>>>>
>>>>>> Can anyone offer advice as to how I can try to track down what
>>>>>> the
>>>>>> underlying problem is?
>>>>>>
>>>>>> Thanks!
>>>>>>
>>>>>> -Jeremy
>>>>>>
>>>>>> ========= excerpt from <workspace>/.metadata/.log below
>>>>>> ===========
>>>>>>
>>>>>> !ENTRY org.eclipse.ptp.rdt.sync.ui 4 4 2015-12-03 15:01:18.842
>>>>>> !MESSAGE Error
>>>>>> !STACK 1
>>>>>> org.eclipse.ptp.rdt.sync.core.exceptions.RemoteSyncException:
>>>>>>
>>>>>> org.eclipse.ptp.rdt.sync.core.exceptions.RemoteExecutionException: or
>>>>>> g.eclipse.remote.core.exception.RemoteConnectionException: Auth
>>>>>> fail
>>>>>> at
>>>>>>
>>>>>> org.eclipse.ptp.internal.rdt.sync.git.core.GitRepo.getRemoteGitVersion(GitRepo.java:454)
>>>>>>
>>>>>>
>>>>>>
>>>>>> at
>>>>>>
>>>>>> org.eclipse.ptp.internal.rdt.sync.git.core.GitRepo.<init>(GitRepo.java:81)
>>>>>>
>>>>>>
>>>>>>
>>>>>> at
>>>>>>
>>>>>> org.eclipse.ptp.internal.rdt.sync.git.core.GitSyncService.getGitRepo(GitSyncService.java:279)
>>>>>>
>>>>>>
>>>>>>
>>>>>> at
>>>>>>
>>>>>> org.eclipse.ptp.internal.rdt.sync.git.core.GitSyncService.doSync(GitSyncService.java:610)
>>>>>>
>>>>>>
>>>>>>
>>>>>> at
>>>>>>
>>>>>> org.eclipse.ptp.internal.rdt.sync.git.core.GitSyncService.synchronize(GitSyncService.java:529)
>>>>>>
>>>>>>
>>>>>>
>>>>>> at
>>>>>>
>>>>>> org.eclipse.ptp.rdt.sync.core.SyncManager$SynchronizeJob.run(SyncManager.java:79)
>>>>>>
>>>>>>
>>>>>>
>>>>>> at
>>>>>> org.eclipse.core.internal.jobs.Worker.run(Worker.java:55)
>>>>>> Caused by:
>>>>>>
>>>>>> org.eclipse.ptp.rdt.sync.core.exceptions.RemoteExecutionException:
>>>>>> org.eclipse.remote.core.exception.RemoteConnectionException:
>>>>>> Auth fail
>>>>>> ... 7 more
>>>>>> Caused by:
>>>>>> org.eclipse.remote.core.exception.RemoteConnectionException:
>>>>>> Auth fail
>>>>>> at
>>>>>>
>>>>>> org.eclipse.remote.internal.jsch.core.JSchConnection.newSession(JSchConnection.java:928)
>>>>>>
>>>>>>
>>>>>>
>>>>>> at
>>>>>>
>>>>>> org.eclipse.remote.internal.jsch.core.JSchConnection.open(JSchConnection.java:966)
>>>>>>
>>>>>>
>>>>>>
>>>>>> at
>>>>>>
>>>>>> org.eclipse.remote.internal.jsch.core.JSchConnection.open(JSchConnection.java:939)
>>>>>>
>>>>>>
>>>>>>
>>>>>> at
>>>>>>
>>>>>> org.eclipse.remote.internal.core.RemoteConnection.open(RemoteConnection.java:208)
>>>>>>
>>>>>>
>>>>>>
>>>>>> at
>>>>>>
>>>>>> org.eclipse.ptp.internal.rdt.sync.git.core.CommandRunner.executeRemoteCommand(CommandRunner.java:242)
>>>>>>
>>>>>>
>>>>>>
>>>>>> at
>>>>>>
>>>>>> org.eclipse.ptp.internal.rdt.sync.git.core.CommandRunner.executeRemoteCommand(CommandRunner.java:214)
>>>>>>
>>>>>>
>>>>>>
>>>>>> at
>>>>>>
>>>>>> org.eclipse.ptp.internal.rdt.sync.git.core.GitRepo.getRemoteGitVersion(GitRepo.java:450)
>>>>>>
>>>>>>
>>>>>>
>>>>>> ... 6 more
>>>>>> !SUBENTRY 1 org.eclipse.ptp.rdt.sync.git.core 4 0 2015-12-03
>>>>>> 15:01:18.843
>>>>>> !MESSAGE
>>>>>>
>>>>>> org.eclipse.ptp.rdt.sync.core.exceptions.RemoteExecutionException:
>>>>>> org.eclipse.remote.core.exception.RemoteConnectionExcep
>>>>>> tion: Auth fail
>>>>>> !STACK 0
>>>>>>
>>>>>> org.eclipse.ptp.rdt.sync.core.exceptions.RemoteExecutionException:
>>>>>> org.eclipse.remote.core.exception.RemoteConnectionException:
>>>>>> Auth fail
>>>>>> at
>>>>>>
>>>>>> org.eclipse.ptp.internal.rdt.sync.git.core.GitRepo.getRemoteGitVersion(GitRepo.java:454)
>>>>>>
>>>>>>
>>>>>>
>>>>>> at
>>>>>>
>>>>>> org.eclipse.ptp.internal.rdt.sync.git.core.GitRepo.<init>(GitRepo.java:81)
>>>>>>
>>>>>>
>>>>>>
>>>>>> at
>>>>>>
>>>>>> org.eclipse.ptp.internal.rdt.sync.git.core.GitSyncService.getGitRepo(GitSyncService.java:279)
>>>>>>
>>>>>>
>>>>>>
>>>>>> at
>>>>>>
>>>>>> org.eclipse.ptp.internal.rdt.sync.git.core.GitSyncService.doSync(GitSyncService.java:610)
>>>>>>
>>>>>>
>>>>>>
>>>>>> at
>>>>>>
>>>>>> org.eclipse.ptp.internal.rdt.sync.git.core.GitSyncService.synchronize(GitSyncService.java:529)
>>>>>>
>>>>>>
>>>>>>
>>>>>> at
>>>>>>
>>>>>> org.eclipse.ptp.rdt.sync.core.SyncManager$SynchronizeJob.run(SyncManager.java:79)
>>>>>>
>>>>>>
>>>>>>
>>>>>> at
>>>>>> org.eclipse.core.internal.jobs.Worker.run(Worker.java:55)
>>>>>> Caused by:
>>>>>> org.eclipse.remote.core.exception.RemoteConnectionException:
>>>>>> Auth fail
>>>>>> at
>>>>>>
>>>>>> org.eclipse.remote.internal.jsch.core.JSchConnection.newSession(JSchConnection.java:928)
>>>>>>
>>>>>>
>>>>>>
>>>>>> at
>>>>>>
>>>>>> org.eclipse.remote.internal.jsch.core.JSchConnection.open(JSchConnection.java:966)
>>>>>>
>>>>>>
>>>>>>
>>>>>> at
>>>>>>
>>>>>> org.eclipse.remote.internal.jsch.core.JSchConnection.open(JSchConnection.java:939)
>>>>>>
>>>>>>
>>>>>>
>>>>>> at
>>>>>>
>>>>>> org.eclipse.remote.internal.core.RemoteConnection.open(RemoteConnection.java:208)
>>>>>>
>>>>>>
>>>>>>
>>>>>> at
>>>>>>
>>>>>> org.eclipse.ptp.internal.rdt.sync.git.core.CommandRunner.executeRemoteCommand(CommandRunner.java:242)
>>>>>>
>>>>>>
>>>>>>
>>>>>> at
>>>>>>
>>>>>> org.eclipse.ptp.internal.rdt.sync.git.core.CommandRunner.executeRemoteCommand(CommandRunner.java:214)
>>>>>>
>>>>>>
>>>>>>
>>>>>> at
>>>>>>
>>>>>> org.eclipse.ptp.internal.rdt.sync.git.core.GitRepo.getRemoteGitVersion(GitRepo.java:450)
>>>>>>
>>>>>>
>>>>>>
>>>>>> ... 6 more
>>>>>> _______________________________________________
>>>>>> ptp-user mailing list
>>>>>> ptp-user@xxxxxxxxxxx <mailto:ptp-user@xxxxxxxxxxx>
>>>>>> To change your delivery options, retrieve your password, or
>>>>>> unsubscribe from this list, visit
>>>>>> https://dev.eclipse.org/mailman/listinfo/ptp-user
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>> _______________________________________________
>>>>>> ptp-user mailing list
>>>>>> ptp-user@xxxxxxxxxxx
>>>>>> To change your delivery options, retrieve your password, or
>>>>>> unsubscribe from this list, visit
>>>>>> https://dev.eclipse.org/mailman/listinfo/ptp-user
>>>>>>
>>>>> _______________________________________________
>>>>> ptp-user mailing list
>>>>> ptp-user@xxxxxxxxxxx
>>>>> To change your delivery options, retrieve your password, or
>>>>> unsubscribe from this list, visit
>>>>> https://dev.eclipse.org/mailman/listinfo/ptp-user
>>>>> _______________________________________________
>>>>> ptp-user mailing list
>>>>> ptp-user@xxxxxxxxxxx
>>>>> To change your delivery options, retrieve your password, or
>>>>> unsubscribe from this list, visit
>>>>> https://dev.eclipse.org/mailman/listinfo/ptp-user
>>>>
>>>> _______________________________________________
>>>> ptp-user mailing list
>>>> ptp-user@xxxxxxxxxxx
>>>> To change your delivery options, retrieve your password, or
>>>> unsubscribe from this list, visit
>>>> https://dev.eclipse.org/mailman/listinfo/ptp-user
>>>>
_______________________________________________
ptp-user mailing list
ptp-user@xxxxxxxxxxx
To change your delivery options, retrieve your password, or unsubscribe from this list, visit
https://dev.eclipse.org/mailman/listinfo/ptp-user