GSSException: Defective token detected Error when accessing OAM WNA resources from outside the company network domain, OAM- WNA Fallback fails (Doc ID 1630453.1)

Last updated on SEPTEMBER 25, 2023

Applies to:

Goal

Customer has users that are not logged in to their AD domain, or not logged into the network company domain directly.
This can happens for instance for users accessing their company network outside the offices, as per use of VPN.

But still, users would need to login via WNA fallback authentication and access to the OAM WNA protected resources.

However, it would appear that some users running with the Windows 8 or Windows 7 clients machines, might fail to access WNA resources due to an unrecognized token being sent to OAM.

The issue appears to be that something different from a Kerberos or NTLM token is being sent by the Microsoft IE browser client machine.

OAM only accepts Kerberos or NTLM tokens for now.

It can be seen that the browser was sending the following token when outside of the company network domain.
And it keeps sending this similar like "Authorization: Negotiate" string over and over.

Authorization: Negotiate
YIGeBgYrBgEFBQKggZMwgZCgGjAYBgorBgEEAYI3AgIeBgorBgEEAYI3AgIKonIEcE5FR09FWFRTAA
AAAAAAAABgAAAAcAAAAByYkcFlDJDJ1CLBKiPp1EHAWr1ZstiFepuJLBr7EduFitBaRa45+4nQ/AGW
5Jf/GwAAAAAAAAAAYAAAAAEAAAAAAAAAAAAAAEVyfDIyRYtIv9kqa6BepAo=

This is not a standard NTLM value, as normally when we review the headers we would expect to see either:

 Authorization: Negotiate TlRMTVNTUAABAAA.... (NTLM)
 Authorization: Negotiate YIIGeAYGK...(Kerberos)


So, even if the following KM doc 1499433.1 is applied in the env to do NTLM fallback...

--> How To Configure OAM 11g WNA For NTLM Fallback (Doc ID 1499433.1)

..., then this will still not work for OAM WAN Fallback, since the token received by OAM Server is NOT an NTLM token like, but appears to be more related to a NEGOEXTS token, which the Windows 7 clients sometimes send.

So, the token was not sent correctly by the browser to OAM server.
This seems to correspond to the errors in the oam server diagnostics log that says:

[2013-11-19T21:22:21.383+03:00] [oam_server1] [ERROR] [] [oracle.oam.engine.authn] [tid: [ACTIVE].ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: <anonymous>] [ecid: 079e47740cb39a0b:-18fbc741:14223a9f093:-8000-0000000000006886,0] [APP: oam_server#11.1.2.0.0] Defective token detected (Mechanism level: GSSHeader did not find the right tag)[[
GSSException: Defective token detected (Mechanism level: GSSHeader did not find the right tag)
at sun.security.jgss.GSSHeader.<init>(GSSHeader.java:80)
at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:287)
at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:267)
at sun.security.jgss.spnego.SpNegoContext.GSS_acceptSecContext(SpNegoContext.java:858)
...
..........

Solution

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.