Encryption type RC4 with HMAC is not supported/enabled

How to fix Encryption type RC4 with HMAC is not supported/enabled?

Answer:

The following error is noticed in the jespa.log file:

jespa.security.SecurityProviderException: Token Type:WRAPPED_LEGACY_KRB Failure unspecified at GSS-API level (Mechanism level: Encryption type RC4 with HMAC is not supported/enabled)

This error indicates that the end user and EasySSO attempted to authenticate using RC4 encryption, based on the settings of your domain, but that the underlying JVM does not support this weaker encryption type.

This can sometimes start occurring after an upgrade to the underlying Confluence or Jira instance since they bundle newer versions of Java as part of their default installation.

To fix this issue, you need to ensure that the computer account responsible for Kerberos authentication is configured to use a stronger encryption type.

To update this configuration, you can set the msDS-SupportedEncryptionTypes attribute on the computer account to 24 (0x18). This can be updated either using a Group Policy Object, or manually:

  1. Open Active Directory Users and Computers
  2. select View/Advanced Features
  3. Locate the computer record in Computers
  4. Double-click for Properties, Attributes Editor tab
  5. Find msDS-SupportedEncryptionTypes and change accordingly.

(see: https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/decrypting-the-selection-of-supported-kerberos-encryption-types/ba-p/1628797)



EasySSO Documentation