docs(sso-spnego): correct the Kerberos settings for current AD and JDK 21

[marevol]

Summary

The SPNEGO page told operators to build a krb5.conf that breaks against a current Active Directory, and its settings table described defaults that no longer match the implementation. Both 15.7 (current release) and 15.8 are updated; the parts that depend on 15.8-only code changes are applied to 15.8 only.

The krb5.conf sample could not authenticate against a current AD

The sample listed:

permitted_enctypes = aes128-cts rc4-hmac des3-cbc-sha1 des-cbc-md5 des-cbc-crc

Two problems compound:

1. RC4, 3DES and DES are disabled by default in Java 17+, so everything after aes128-cts is inert. On JDK 21 the built-in default encryption types are exactly 18, 17, 20, 19 — AES only.
2. AES256 was never in the list. The Kerberos acceptor validates the incoming service ticket against permitted_enctypes (sun.security.krb5.KrbApReq → "encryption type not in permitted_enctypes list"), so the moment the KDC issues an AES256 service ticket — the normal case for any service account whose password was set on a modern DC — authentication fails.

The sample now lists AES-SHA1 256/128 followed by the AES-SHA2 (RFC 8009) types aes256-cts-hmac-sha384-192 / aes128-cts-hmac-sha256-128 that Windows Server 2025 supports, with:

• a warning naming the exact failure (encryption type not in permitted_enctypes list) and stating that AES256 must be listed;
• a note explaining that RC4/3DES/DES are inert on Java 17+, and that a service account holding only an RC4 key must have its password reset so AES keys are generated — relevant given Microsoft's RC4 phase-out.

Corrections applied to both 15.7 and 15.8

Was	Now
"If these files do not exist on the classpath, SPNEGO initialization will fail and Fess will not start."	SPNEGO initializes on the first login, so Fess starts normally; only SSO login fails.
spnego.exclude.dirs documented as "directories to exclude from authentication"	Row removed. Only SpnegoHttpFilter consumes it, and Fess calls SpnegoAuthenticator#authenticate directly instead of installing that filter, so it never excluded anything.

Two new troubleshooting entries, both for failures that leave nothing in the Fess log:

• Login returns HTTP 400 — a user in many groups produces a large PAC, the Authorization header exceeds Tomcat's default 8KB limit, and the request is rejected before it reaches Fess. Documents tomcat.maxHttpHeaderSize in tomcat_config.properties.
• Authentication fails after the service account password is changed — the server credential is obtained once on the first login and cached for the lifetime of the process, so a password rotation or keytab swap needs a restart. Same for any spnego.* change, since SpnegoFilterConfig is a JVM-wide singleton.

15.8 only

These follow code that is on master but not in 15.7:

• spnego.allow.unsecure.basic and spnego.allow.localhost now document false. The table said true for both — telling operators the localhost bypass (which authenticates same-host requests as the server OS user with no Kerberos verification) is on when it is off.
• spnego.allowed.realms is documented — the allowlist for intentional cross-realm trust. It appeared nowhere before.
• A note showing the keytab form of the spnego-server login module, which became reachable once spnego.preauth.username / .password started defaulting to empty.

Verification

All 14 pages parse with zero docutils messages. This also fixes a pre-existing German title overline (45 characters under a 60-character title), which was the only warning before.

Related: codelibs/fess#3216 (authenticator fixes, including removing the spnego.exclude.dirs mapping) and codelibs/fess#3220 (admin screen field for spnego.allowed.realms).