Java-written embedded Kerberos server for testing

Question

is anyone aware of any embeddable Kerberos servers (KDC / KAdmin), which are written in Java and may run just within the JVM process (something like Hadoop minicluster or embedded LDAP servers)?

My goal it to let people run integ tests requiring Kerberos authentication without having to install local kerberos server/configure remote server and connection to it.

score 6 · Accepted Answer · edited Oct 20 '16 at 09:46

6

You can give Apache Directory Server (http://directory.apache.org/) a try. It supports LDAP and Kerberos. See this example:

http://svn.apache.org/repos/asf/directory/apacheds/trunk/kerberos-test/src/test/java/org/apache/directory/server/kerberos/kdc/SaslGssapiBindITest.java

edited Oct 20 '16 at 09:46

Mathias Conradt

28,420
21
138
192

answered Jan 19 '13 at 04:53

kayyagari

1,882
13
10

@Michael-O this test demonstrates the functioning of the KDC which is embeddable and implemented in pure java. – kayyagari Jan 21 '13 at 04:17
Yep, thanks - just got time to get back to this task, looks like it's a way to go. I will be trying that and report here if it works as expected or not and it it's causing any unexpected pain. Thanks both of you! – Zorkus Jan 24 '13 at 19:47
Is this example current and still a recommended approach? – Oct 08 '16 at 07:28

Michael-O · Answer 2 · 2013-01-19T21:08:29.513

0

I was/am looking for such a thing too but this is simply not really possible because you will need a fully functional DNS server for this. A fully decoupled system is necessary. You can achieve this via the virtualization-maven-plugin and a group of virtual machines in VirtualBox with an internal network.

LDAP servers won't help you at all because they do absolutely nothing with GSS-API and Kerberos. SASL does everything by delegating auth to the next available KDC.

You need KDC and DNS server. You may try Samba 4 on one machine, setup a second one which joins the domain. Install Hadoop on it, add a third one (client), join and run tests from there.

It seems like you can have Apache DS mimic a KDC: http://directory.apache.org/apacheds/configuration/ads-2.0-configuration.html

edited Jan 19 '13 at 21:08

answered Jan 18 '13 at 22:04

Michael-O

18,123
6
55
121

I don't think I need DNS, I can provide IPs and use them, but I do need KDC implemented as java app and running within the test process..did't find one yet. – Zorkus Jan 19 '13 at 05:23
No, this won't work. Kerberos requires DNS does *not* work without it unless probably you put all hosts into your `/etc/hots`. – Michael-O Jan 19 '13 at 09:29
Which is fine, i can put all needed hosts in there, or make it always use localhost for all communications. – Zorkus Jan 19 '13 at 13:31
Thanks, will try to do that and report how it goes for me – Zorkus Jan 24 '13 at 21:12

javanx · Answer 3 · 2016-11-22T17:19:05.043

I have a written an Embedded LDAP for similar purpose and also to you can use it for testing with Kerberos, spcially useful for cases like testing Hadoop Kerberos testing.

https://github.com/krishdey/EmbeddedLdapKDC

You may also look at the class for writing embedded JUnit testing https://github.com/krishdey/EmbeddedLdapKDC/blob/master/EmbeddedLdapKDC/src/test/java/com/krish/ead/server/KerberosLdapIntegrationTest.java

Might be useful for you.