0

Here is a simple class supposed to do JAAS+JGSS authentication. It fails at the step "createCredential" : GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt) Has anyone a clue about the cause of this ? Thanks in advance. P

package tsn.jaas;

import java.security.AccessControlContext;

public class Test {
    private static Logger logger = Logger.getLogger(JaasClient.class.getName());

    
    public static void main(String[] args) throws LoginException, GSSException {
        logger.info("Client starting - configuration: " + System.getProperty("java.security.auth.login.config"));
        
        // JAAS Login
        LoginContext lc = new LoginContext("JaasClient", new TextCallbackHandler()); 
        lc.login();
        logger.info("Logged in");
        
        // Extract principal name
        final Set<Principal> principalSet = lc.getSubject().getPrincipals(); // extract principal
        final Principal principal = principalSet.iterator().next();
        logger.info("Principal: " + principal.getName());
        
        // Get GSS Name
        GSSManager manager = GSSManager.getInstance();
        GSSName gssName = manager.createName(principal.getName(),GSSName.NT_USER_NAME);
        
        // Get credential
        AccessControlContext acc = (AccessControlContext) Subject.doAsPrivileged(lc.getSubject(), new PrivilegedAction<Object>() {
              public Object run() {
                logger.info("DoAsPrivileged");
                try {
                    GSSCredential clientCreds = manager.createCredential(gssName, GSSCredential.DEFAULT_LIFETIME, new Oid("1.2.840.113554.1.2.2"), GSSCredential.INITIATE_ONLY);
                } catch (GSSException e) {
                    e.printStackTrace();
                }
                logger.info("DoAsPrivileged ended");
                return null;
              }
            }, null);
    } // main
} // class
  • What is in the `principalSet` and does it match your ActiveDirectory? I'm guessing no. You only try with the first `Principal` currently. I'm not certain any of the `Principal`(s) are correct though. What is the relationship between the `LoginContext` and the Kerberos realm? – Elliott Frisch Jun 11 '23 at 13:28
  • The principal retrieved from my MIT KDC is logged and is correct. The code only deals with one principal to simplify, but the result has been checked and is OK. – Pascal Jakobi Jun 11 '23 at 13:32

0 Answers0