0

I have a requirement to make multiple independent micro service calls in parallel in Spring Boot (Java) in order to address the performance issue in making sequential calls and these micro services are authenticated using Kerberos.

When I initially tried to make these calls as parallel, I understood that the Kerberos Ticket and the Token will be invalidated when initiating the parallel request as the previous ticket will no longer be valid, but I would like to listen from other experts here if there's any other way that we can achieve this.

Mohamed Yusuff
  • 91
  • 1
  • 4

2 Answers2

1

Maybe you can cache the ticket and the token on Kerberos' server-side.

Hao Deng
  • 11
  • 2
  • Thanks for the suggestion. While I'm checking on the Credential Caching mechanism, please clarify whether this Caching has to be configured at the KDC server or at the Micro-service provider's Server. Please note that these services are deployed in K8s clusters. – Mohamed Yusuff Dec 13 '22 at 03:09
1

When I initially tried to make these calls as parallel, I understood that the Kerberos Ticket and the Token will be invalidated when initiating the parallel request as the previous ticket will no longer be valid, but I would like to listen from other experts here if there's any other way that we can achieve this.

No, the ticket is multiple-use and never invalidated (until it reaches the ~10h expiry) – you can see in klist that the same ticket stays around across multiple runs. Only the token built out of a ticket + verifier is single-use, but the application can freely create as many tokens from a single cached ticket as it wants.

When using e.g. HTTP, normally you (or the HTTP client library) would call the GSSAPI or Kerberos library to start a new "security context" and get a new token immediately before every HTTP request. It's fine to start multiple GSSAPI contexts and get multiple tokens in parallel; the GSSAPI/Kerberos library will take care of acquiring and caching the service ticket.

user1686
  • 13,155
  • 2
  • 35
  • 54