2

I want to implement integration test for my spring security kerberos authentication. There is KerberosRestTemplate (reference) for this purpose. KerberosRestTemplate has got a default constructor with description "Leave keyTabLocation and userPrincipal empty if you want to use cached ticket".

For research i wrote a trivial class: 

   public static void main(String[] args) {
        KerberosRestTemplate krt = new KerberosRestTemplate();
        String result = krt.getForObject("http://testserver.testad.local:8080/", String.class);
        System.out.println(result);
    }

When i run it, exception has thrown:

Exception in thread "main" org.springframework.web.client.RestClientException: Error running rest call; nested exception is java.lang.IllegalArgumentException: Null name not allowed
        at org.springframework.security.kerberos.client.KerberosRestTemplate.doExecute(KerberosRestT
emplate.java:196)
        at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:530)
        at org.springframework.web.client.RestTemplate.getForObject(RestTemplate.java:237)
        at edu.mezlogo.Application.main(Application.java:9)
Caused by: java.lang.IllegalArgumentException: Null name not allowed
        at sun.security.krb5.PrincipalName.<init>(Unknown Source)
        at sun.security.krb5.PrincipalName.<init>(Unknown Source)
        at javax.security.auth.kerberos.KerberosPrincipal.<init>(Unknown Source)
        at javax.security.auth.kerberos.KerberosPrincipal.<init>(Unknown Source)
        at org.springframework.security.kerberos.client.KerberosRestTemplate.doExecute(KerberosRestT
emplate.java:182)
        ... 3 more

My klist contain correct cached ticket, for my service.

#2>     Client: deniz @ TESTAD.LOCAL
        Server: HTTP/testserver.testad.local @ TESTAD.LOCAL
        KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
        Ticket Flags 0x40a10000 -> forwardable renewable pre_authent name_canonicalize
        Start Time: 2/5/2016 6:17:39 (local)
        End Time:   2/5/2016 16:16:32 (local)
        Renew Time: 2/12/2016 6:16:32 (local)
        Session Key Type: RSADSI RC4-HMAC(NT)

And my browser (firefox) has successful authenticated with kerberos sso.

I use Windows server 2012. And Windows 7 as client.

How to use cached ticket? (And does ktpass can generate client keytab?)

P.s. sorry for my English.

Jaz Brok
  • 231
  • 1
  • 4
  • 18

1 Answers1

1

You are checking the Windows credentials cache - while Java is maintaining it's separate. In order to view the Java's credentials cache you should execute the klist command from your JRE/bin folder

bedrin
  • 4,458
  • 32
  • 53