0

Below is my scenario:

Client is connecting to intermediate service and intermediate service is connecting to the target service. I want to use the client credentials from the intermediate service to connect to the target service.

I used the below code in the intermediate service to acquire the credentials of the client.

GSSCredential clientCredential =((ExtendedGSSCredential)intermediateServiceCreds).impersonate(clientGSSName);

Establishing the context is failing with

NOT_ALLOWED_TO_DELEGATE

Do I need to set any flags while creating the principle of the client, intermediate service and target service? I don't want to make code changes in the client to set the credential delegation to true.

n4m31ess_c0d3r
  • 3,028
  • 5
  • 26
  • 35
Vamsi Krishna Brahmadevara
  • 1
  • 2

1 Answers1

1

Looks like your intermediate service principal is missing "ok_to_auth_as_delegate" attribute. https://web.mit.edu/kerberos/krb5-devel/doc/admin/admin_commands/kadmin_local.html#add-principal

viktor
  • 11
  • 1