How to integrate windows authentication (SSO) in my custom web server Java based?

Question

I have a custom web server application Java based and I need to support Single-Sign-On. I made a research on the issue and found out that I can use JAAS to implement SSO. I already configured my http server to accept the Authentication handshake process, so I have the logged-in user Authentication encoded in my java application and I am passing it my JAAS authentication function.
Now, I need to authenticate the user with my domain controller. So, I'm using jaas.conf file to define the LoginModule:

SSOAUTH {
  com.sun.security.auth.module.Krb5LoginModule required  
  useKeyTab=false
  storeKey=true
  useTicketCache=false
  debug=true;
};

As you can see I would like to use the Kerberos protocol.
The first question is: Do I need to make some installation/configuration for my domain controller to support this protocol?

This is my java code in my web server application that will handle the whole authentication process using JAAS:

public class LDAPClient
{
   private static final String LOGIN_MODULE_NAME = "SSOAUTH";


/**
 * Constructor
 * @param domain
 * @param ldapServer
 * @param jaasConfigPath
 */
public LDAPClient(String domain, String ldapServer, String jaasConfigPath)
{
    System.setProperty("sun.security.krb5.debug", "true");
    System.setProperty("java.security.krb5.realm", domain);
    System.setProperty("java.security.krb5.kdc", ldapServer); // LDAP active directory server name
    System.setProperty("javax.security.auth.useSubjectCredsOnly", "true");
    System.setProperty("java.security.auth.login.config", jaasConfigPath); // path to the jaas.conf file.
}


/**
 * Authenticates the given kerberos token and returns the client principal.
 *
 * @param argKerberosTokenAsBase64 The kerberos content token.
 * @return
 * @throws Exception
 */
public String authenticate(String argKerberosTokenAsBase64) throws Exception
{
    BASE64Decoder decoder = new BASE64Decoder();
    byte[] kerberosToken = decoder.decodeBuffer(argKerberosTokenAsBase64.substring("Negotiate ".length()));
    String clientName;

    try
    {
        // Login to the KDC and obtain subject for the service principal
        Subject subject = createServiceSubject(argKerberosTokenAsBase64);
        if (subject != null)
        {
            clientName = acceptSecurityContext(subject, kerberosToken).toUpperCase();
            System.out.println("Security context successfully initialized!");
        }
        else
        {
            throw new Exception("Unable to obtain kerberos service context");
        }
    }
    catch (Throwable throwable)
    {
        System.out.println("Token: " + argKerberosTokenAsBase64);
        throwable.printStackTrace();
        throw new Exception(throwable);
    }

    return clientName;
}

/**
 * Creates service subject based on the service principal and service
 * password.
 *
 * @param password
 * @return
 * @throws LoginException
 */
private static Subject createServiceSubject(String password)
        throws LoginException
{
    // "Client" references the JAAS configuration in the jaas.conf file.
    LoginContext loginCtx = new LoginContext(LOGIN_MODULE_NAME, new LoginCallbackHandler(password));
    loginCtx.login();
    return loginCtx.getSubject();
}

/**
 * Completes the security context initialisation and returns the client
 * name.
 * @param argSubject
 * @param serviceTicket
 * @return
 * @throws GSSException
 */
private static String acceptSecurityContext(Subject argSubject, final byte[] serviceTicket) throws GSSException
{
    // Accept the context and return the client principal name.
    return (String) Subject.doAs(argSubject, new PrivilegedAction()
    {
        public Object run()
        {
            try
            {
                // Identify the server that communications are being made
                // to.
                GSSManager manager = GSSManager.getInstance();
                GSSContext context = manager.createContext((GSSCredential) null);
                context.acceptSecContext(serviceTicket, 0, serviceTicket.length);
                return context.getSrcName().toString();
            }
            catch (GSSException exp)
            {
                throw new RuntimeException(exp);
            }
        }
    });
}

}

I am having the following LoginException: javax.security.auth.login.LoginException: Pre-authentication information was invalid (24)

I am passing the kerberos authentication token to the LoginContext, see the call to createServiceSubject(), in order to get the Subject, is it correct or I missing something here?

And this is parts from the System.out debug error:

>>>KRBError:
 sTime is Wed Feb 12 14:29:17 IST 2014 1392208157000
 suSec is 301542
 error code is 25
 error Message is Additional pre-authentication required
 realm is DOMAIN.LOCAL
 sname is krbtgt/DOMAIN.LOCAL
 eData provided.
 msgType is 30
>>>Pre-Authentication Data:
 PA-DATA type = 19
 PA-ETYPE-INFO2 etype = 23
 PA-ETYPE-INFO2 salt = null
 salt for 3 is DOMAIN.LOCALskadar
>>>Pre-Authentication Data:
 PA-DATA type = 2
 PA-ENC-TIMESTAMP
>>>Pre-Authentication Data:
 PA-DATA type = 16
>>>Pre-Authentication Data:
 PA-DATA type = 15
AcquireTGT: PREAUTH FAILED/REQUIRED, re-send AS-REQ
Updated salt from pre-auth = DOMAIN.LOCALskadar
>>>KrbAsReq salt is DOMAIN.LOCALskadar
Pre-Authenticaton: find key for etype = 3
AS-REQ: Add PA_ENC_TIMESTAMP now
>>> EType: sun.security.krb5.internal.crypto.DesCbcMd5EType

Answer 1

Use SPNEGO/Kerberos Authenticator and Active Directory Realm for Apache Tomcat 6 if you are on Tomcat.