I am trying to run JGSS' initSecContext... and fail (on Fedora 35).
I ran first kinit succesfully :
[pascal@zbook appClientModule]$ klist
Ticket cache: KCM:1000
Default principal: client@TEST.COM
Valid starting Expires Service principal
10/15/2022 12:56:10 10/16/2022 12:56:10 krbtgt/TEST.COM@TEST.COM
renew until 10/15/2022 12:56:10
Then, I ran a test program that essentially authenticates against JAAS, creates a context + credential in GSS and tries to establish a context :
public static void main(String[] args) throws IOException {
System.setProperty("java.security.krb5.conf", "/etc/krb5.conf");
System.setProperty("java.security.krb5.realm","TEST.COM");
System.setProperty("java.security.krb5.kdc","zbook.home");
System.setProperty("java.security.auth.login","/etc/security/login.conf");
System.setProperty("java.security.auth.login.config", "/etc/kafka/jaas.conf");
getArgs(args);
// JAAS Authn
LoginContext lc = null;
try { lc = new LoginContext("JaasClient", new TextCallbackHandler()); }
catch (LoginException le) { error("Cannot create login context: ", le,ERR_JAAS_CTXT); }
catch (SecurityException se) { error("Cannot create login context (security): ", se,ERR_JAAS_CTXT); }
try { lc.login(); } catch (LoginException le) { error("JAAS Authentication failed: ", le, ERR_LOGIN); }
System.out.println("User authenticated (JAAS) - " + lc.getSubject());
// Connect to server.
Socket socket = new Socket(server,port);
DataInputStream inStream = new DataInputStream(socket.getInputStream());
DataOutputStream outStream = new DataOutputStream(socket.getOutputStream());
System.out.println("Connected to server "+ socket.getInetAddress() + ":" + port);
// Create a GSSContext for mutual authentication with the server.
String ops = "";
GSSContext context = null;
try {
Oid krb5Oid = new Oid("1.2.840.113554.1.2.2");
ops="new OID";
GSSManager manager = GSSManager.getInstance();
ops="createName";
GSSName serverName = manager.createName(principal, null);
ops="createContext";
context = manager.createContext(serverName,krb5Oid,null,GSSContext.DEFAULT_LIFETIME);
context.requestMutualAuth(true); // Mutual authentication
context.requestConf(true); // Will use confidentiality later
context.requestInteg(true); // Will use integrity later
} catch (GSSException e) { error(String.format("GSS internal error (%s):",ops),e,ERR_GSS); }
System.out.println("Context created");
// Context establishment loop
byte[] token = new byte[0];
while (!context.isEstablished()) {
try {
token = context.initSecContext(token, 0, token.length);
System.out.println("Token generated");
} catch (GSSException e) { error(String.format("GSS internal error (%s):","initSecContext"),e,ERR_GSS); }
The output of that code is :
[pascal@zbook appClientModule]$ java tsn.jaas.gssClient
Debug is true storeKey false useTicketCache true useKeyTab true doNotPrompt false ticketCache is null isInitiator false KeyTab is null refreshKrb5Config is false principal is client tryFirstPass is false useFirstPass is false storePass is false clearPass is false
Acquire TGT from Cache
Principal is client@TEST.COM
null credentials from Ticket Cache
principal is client@TEST.COM
Will use keytab
Commit Succeeded
User authenticated (JAAS) - Subject:
Principal: client@TEST.COM
Connected to server localhost/127.0.0.1:2000
Context created
GSS internal error (initSecContext): :No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)
Do someone more knowledgeable than me see a bug in that code ? More generally, I wonder if the changes ine kerberos cache (keyring) have note broken the API .... Any input more than welcome.
