[jcifs] Error message connecting to DC under load

[Ingo Rockel]

Thanx for the help :o)

Yes, the application is running in a cluster with two nodes. The used 
container is Oracle Application Server 10g.

They are currently using jcifs 1.0.1 and will update to 1.1.8 when the 
new version of our application is deployed.

Do I get this right, jcifs auth might fail in a clustered environment? 
Or do I have to mask the ip, so the auth request to the DC are always 
coming from the same IP?

Regards,

	Ingo

Michael B Allen schrieb:
> Ingo Rockel said:
> 
>>Hi all,
>>
>>one of our customer reports problems with jcifs connecting to its DC.
>>Sometimes a user can't login while later he is able to do so. The
>>following error is logged, if the login attempt fails:
>>
>><NETBIOSUSERNAME>: 0xC0000072: jcifs.smb.SmbAuthException: Logon
>>failure: account currently disabled.
>>jcifs.smb.SmbAuthException: Logon failure: account currently disabled.
>>         at jcifs.smb.SmbTransport.send(SmbTransport.java:659)
>>         at jcifs.smb.SmbSession.sessionSetup(SmbSession.java:189)
>>         at jcifs.smb.SmbSession.send(SmbSession.java:148)
>>         at jcifs.smb.SmbTree.treeConnect(SmbTree.java:134)
>>         at jcifs.smb.SmbSession.sessionSetup(SmbSession.java:183)
>>         at jcifs.smb.SmbSession.send(SmbSession.java:148)
>>         at jcifs.smb.SmbTree.treeConnect(SmbTree.java:134)
>>         at jcifs.smb.SmbSession.logon(SmbSession.java:85)
>>         at jcifs.smb.SmbSession.logon(SmbSession.java:80)
>>
>>where I replaced the user name with <NETBIOSUSERNAME>. I was unable to
>>isolate the problem on a test system, so can't set jcifs into debug at
>>the moment, as the problems only occurs in the production environment.
>>
>>How  does jcifs reinitialize its list of available DC or just keep it up
>>to date? They have a quite big forrest and about three DCs in every
>>domain.
>>
>>Any suggestions, ideas, possible misconfigurations?
> 
> 
> Actually I think this might have to do with trying to serialize
> credentials. Are you using a cluster? What container are you using? What
> version of jcifs are you using?
> 
> The "account disabled" error is occuring because jCIFS is trying to use
> the default "GUEST" account but I'm not certain about what actually
> triggers that. One possibility suggested by another using I think is that
> if the NtlmPasswordAuthentication object stored in the HTTP session is
> serialized and then reconstituted in a different VM (e.g. in a cluster
> environment) the credentials will no longer be valid and the jCIFS client
> fails over to GUEST.
> 
> Mike
> 


-- 
PIRONET NDH AG
Ingo Rockel - Produktentwicklung
Maarweg 149-161, 50825 Koeln
Tel.: +49 (0)221-770-1788 / Fax: +49 (0)221-770-1005
mailto:irockel at pironet-ndh.com - http://www.pironet-ndh.com