Reputation: 19
I am trying to run JGSS' initSecContext... and fail (on Fedora 35).
I ran first kinit succesfully :
[pascal@zbook appClientModule]$ klist
Ticket cache: KCM:1000
Default principal: [email protected]
Valid starting Expires Service principal
10/15/2022 12:56:10 10/16/2022 12:56:10 krbtgt/[email protected]
renew until 10/15/2022 12:56:10
Then, I ran a test program that essentially authenticates against JAAS, creates a context + credential in GSS and tries to establish a context :
public static void main(String[] args) throws IOException {
System.setProperty("java.security.krb5.conf", "/etc/krb5.conf");
System.setProperty("java.security.krb5.realm","TEST.COM");
System.setProperty("java.security.krb5.kdc","zbook.home");
System.setProperty("java.security.auth.login","/etc/security/login.conf");
System.setProperty("java.security.auth.login.config", "/etc/kafka/jaas.conf");
getArgs(args);
// JAAS Authn
LoginContext lc = null;
try { lc = new LoginContext("JaasClient", new TextCallbackHandler()); }
catch (LoginException le) { error("Cannot create login context: ", le,ERR_JAAS_CTXT); }
catch (SecurityException se) { error("Cannot create login context (security): ", se,ERR_JAAS_CTXT); }
try { lc.login(); } catch (LoginException le) { error("JAAS Authentication failed: ", le, ERR_LOGIN); }
System.out.println("User authenticated (JAAS) - " + lc.getSubject());
// Connect to server.
Socket socket = new Socket(server,port);
DataInputStream inStream = new DataInputStream(socket.getInputStream());
DataOutputStream outStream = new DataOutputStream(socket.getOutputStream());
System.out.println("Connected to server "+ socket.getInetAddress() + ":" + port);
// Create a GSSContext for mutual authentication with the server.
String ops = "";
GSSContext context = null;
try {
Oid krb5Oid = new Oid("1.2.840.113554.1.2.2");
ops="new OID";
GSSManager manager = GSSManager.getInstance();
ops="createName";
GSSName serverName = manager.createName(principal, null);
ops="createContext";
context = manager.createContext(serverName,krb5Oid,null,GSSContext.DEFAULT_LIFETIME);
context.requestMutualAuth(true); // Mutual authentication
context.requestConf(true); // Will use confidentiality later
context.requestInteg(true); // Will use integrity later
} catch (GSSException e) { error(String.format("GSS internal error (%s):",ops),e,ERR_GSS); }
System.out.println("Context created");
// Context establishment loop
byte[] token = new byte[0];
while (!context.isEstablished()) {
try {
token = context.initSecContext(token, 0, token.length);
System.out.println("Token generated");
} catch (GSSException e) { error(String.format("GSS internal error (%s):","initSecContext"),e,ERR_GSS); }
The output of that code is :
[pascal@zbook appClientModule]$ java tsn.jaas.gssClient
Debug is true storeKey false useTicketCache true useKeyTab true doNotPrompt false ticketCache is null isInitiator false KeyTab is null refreshKrb5Config is false principal is client tryFirstPass is false useFirstPass is false storePass is false clearPass is false
Acquire TGT from Cache
Principal is [email protected]
null credentials from Ticket Cache
principal is [email protected]
Will use keytab
Commit Succeeded
User authenticated (JAAS) - Subject:
Principal: [email protected]
Connected to server localhost/127.0.0.1:2000
Context created
GSS internal error (initSecContext): :No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)
Do someone more knowledgeable than me see a bug in that code ? More generally, I wonder if the changes ine kerberos cache (keyring) have note broken the API .... Any input more than welcome.
Upvotes: 1
Views: 1362
Reputation: 2027
I would check:
includedir
directive in krb5.conf
?KCM
credentials cache type?If you export KRB5CCNAME=$(mktemp) && kinit && java ...
then your program should (assuming JGSS obeys the KRB5CCNAME
environment variable) be able to find the TGT in the temporary file created by kinit
. That will rule out anything else.
Upvotes: 0