[jcifs] jcifs.smb.SmbAuthException: Logon failure: account currently disabled.

[Michael B Allen]

On Wed, Oct 8, 2008 at 9:24 AM, Bérengère CLAUDEAU
<berengere.claudeau at ilex.fr> wrote:
> Hi,
>
> I'm trying to protect a web application with the NtlmHttpFilter.
> Sometimes it works perfectly, sometimes the negotiation fail and I don't
> understand what does it wrong...
>
> the web.xml contains :
>  <init-param>
>       <param-name>jcifs.smb.client.domain</param-name>
>       <param-value>ILEX</param-value>
>   </init-param>     <init-param>
>       <param-name>jcifs.netbios.wins</param-name>
>       <param-value>192.168.10.72</param-value>
>   </init-param>
>   <init-param>
>       <param-name>jcifs.smb.client.password</param-name>
>       <param-value>ClearPasswordOfTestAccount</param-value>
>   </init-param>
>   <init-param>
>       <param-name>jcifs.smb.client.username</param-name>
>       <param-value>test</param-value>
>   </init-param>
>  <init-param>
>       <param-name>jcifs.util.loglevel</param-name>
>       <param-value>4</param-value>
>   </init-param>
>  <init-param>
>       <param-name>jcifs.encoding</param-name>
>       <param-value>Cp1252</param-value>
>   </init-param>
>
>
> The error "account currently disabled" occur but my account and the "test"
> account are both enable...

The "account currently disabled" error is misleading. If JCIFS fails
to determine credentials for any reason, it will fall-back to the
account 'GUEST' which is almost always present but disabled.

> Errors are  :
>
> java.net.NoRouteToHostException: No route to host: connect
> [...]

This is very likely the error you should be interested in.

> jcifs.smb.SmbException: Connection timeout
> jcifs.util.transport.TransportException: Connection timeout
>   at jcifs.util.transport.Transport.connect(Transport.java:178)
>   at jcifs.smb.SmbTransport.connect(SmbTransport.java:293)

And this.

It looks like general network failure. This is the sort of thing that
can happen when someone reboots the DC for example. There are some
patches that can improve DC acquisition (e.g. DnsSrv.patch) that you
might look into.

Mike

-- 
Michael B Allen
PHP Active Directory SPNEGO SSO
http://www.ioplex.com/