nchiluku Absent Member.
Absent Member.

Kerberos authentication to a Web service from HPOO

I need to invoke and access a web service from HPOO that allows only kerberos authentication.  I configured the parameters on the HTTP Client Post Raw action to invoke the webservice. 


Here is the sample parameters


url:  http://xxxxxxxx/TestServices/TestService.svc

PostDocument: SOAP Envelope

Username:  XXXX

Password: XXXX

authType: kerberos

kerberosConfFile: C:\Authentication\krb5.conf


After executing the flow in the debug mode on HPOO studio, following error is thrown. "Please provide a valid path for the kerberos configuration file."



{errorMessage=;returnCode=-4;Result=-4;status=;urls=;responseTimeInMs=0;exception=java.lang.Exception: Please provide a valid path for the kerberos configuration file!
at com.hp.oo.content.commons.util.http.OOHttpClientBuilder.addKerberosAuth(
at com.hp.oo.content.commons.util.http.OOHttpClientBuilder.configureAuthentication(
at com.hp.oo.content.commons.util.http.OOHttpClientBuilder.configure(
at com.hp.oo.content.commons.util.http.OOHttpClientRequestExecutor.executeRequest(
at com.iconclude.content.actions.httpclient.HttpClientBase.executeBase(
at com.iconclude.content.actions.httpclient.HttpClientBase.execute(
at com.iconclude.content.actions.httpclient.HttpClientPostRaw.execute(
at com.iconclude.webservices.ras.classLoadedIaction.execute(
at com.iconclude.webservices.ras.JavaExtensionService.executeFromThisDelegator(
at com.iconclude.webservices.ras.ExtensionServiceDelegator.execute(
at com.iconclude.webservices.ras.RCAgentServiceSoapBindingImpl.execute(
at com.iconclude.webservices.ras.RCAgentServiceSoapBindingSkeleton.execute(
at sun.reflect.GeneratedMethodAccessor14.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at org.apache.axis.strategies.InvocationStrategy.visit(
at org.apache.axis.SimpleChain.doVisiting(
at org.apache.axis.SimpleChain.invoke(
at org.apache.axis.handlers.soap.SOAPService.invoke(
at org.apache.axis.server.AxisServer.invoke(
at org.apache.axis.transport.http.AxisServlet.doPost(
at javax.servlet.http.HttpServlet.service(
at org.apache.axis.transport.http.AxisServletBase.service(
at javax.servlet.http.HttpServlet.service(
at org.mortbay.jetty.servlet.ServletHolder.handle(
at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(
at org.acegisecurity.securechannel.ChannelProcessingFilter.doFilter(
at org.acegisecurity.util.FilterToBeanProxy.doFilter(
at com.iconclude.dharma.commons.util.http.DharmaFilterToBeanProxy.doFilter(
at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(
at org.mortbay.jetty.servlet.ServletHandler.handle(
at org.mortbay.jetty.servlet.SessionHandler.handle(
at org.mortbay.jetty.handler.ContextHandler.handle(
at org.mortbay.jetty.webapp.WebAppContext.handle(
at org.mortbay.jetty.handler.ContextHandlerCollection.handle(
at org.mortbay.jetty.handler.HandlerCollection.handle(
at org.mortbay.jetty.handler.HandlerWrapper.handle(
at org.mortbay.jetty.Server.handle(
at org.mortbay.jetty.HttpConnection.handleRequest(
at org.mortbay.jetty.HttpConnection$RequestHandler.content(
at org.mortbay.jetty.HttpParser.parseNext(
at org.mortbay.jetty.HttpParser.parseAvailable(
at org.mortbay.jetty.HttpConnection.handle(
at org.mortbay.thread.QueuedThreadPool$



I also tried one other approach after having the above failure.  


1. Copied the krb5.conf file tothe C:\Program Files\Hewlett-Packard\Operations Orchestration\Studio\conf folder. 


2. Changed the file with the following in the kerberos section.  krb5.conf=%ICONCLUDE_HOME%/conf/krb5.conf


It also returned the same error.



Any ideas on how to configure the kerberos on HTTP Client POST RAW action to invoke a web service that is secured with kerberos.





Labels (1)
1 Reply
Mihai_David Absent Member.
Absent Member.

Re: Kerberos authentication to a Web service from HPOO


The error is most probably because the account running RSJRAS service does not have access to the C:\Authentication folder. (Other reason could be that you mispelled the folder name).


After you get passed this error note that the operation will create a file at "c:\Program Files\Hewlett-Packard\Operations Orchestration\jetty\bin\kerberosLogin.conf"  or use it if it exists. So you can modify this after the first run. (it is needed by the JAAS framework - more info here:


The Http Client operations (from OO9) will ignore your username and password inputs for authType=kerberos.

Debug information abut the kerberos login can be found in "c:\Program Files\Hewlett-Packard\Operations Orchestration\RAS\Java\Default\webapp\logs\wrapper.log" 

You are working on OO9 but note that in OO 10, for the upcoming Base 1.3.0 content pack we have rewriten the kerberos autentication for the "Http Client v2.0" operations. You should also find more documentation there (check folder description).

Mihai David

(OO Content Developer)

The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.