Is There an Authentication Token Stored in Active Directory? Single-Sign On and WAFFLE/KERBEROS

Question

I am tasked with creating SSO (single-sign on) for my company's application. I am straight out of college so am still fresh to the majority of the things at play here. I have done tons of research, I don't fully understand all of it but am doing my best. So the scenario I am in, I have a Windows Java Application(Swing) (NOT A WEB BASED APP), and a LINUX based server. Both have access to the same Active Directory(AD). I need to authenticate who the client is saying they are. I have attempted to use both Kerberos and WAFFLE to no avail. Kerberos has zero useful code examples or information online to even begin to try and use that form of authentication. WAFFLE I have set up but can't use because it requires a Windows server where mine is LINUX. What I am now trying to do is find out if there is some token that is stored in the AD that the server can authenticate against.

What I want to do is send the currently logged in Windows user along with a token to the server and the server to do a look up in the active directory to see if the username and token match. If they do then you are good to log in. Is this possible and does such a thing exist in the AD? Does a Kerberos token get stored in the AD? If so am I able to access such a token to send to the server to authenticate with? Does an SSPI token get stored there because that is what this WAFFLE code I have working seems to be using but I haven't been able to find how to query such a token in AD.

In the following code WAFFLE does some authentication using SSPI. I don't fully understand how it works but I wanted to see if I could send the token it is using here to the LINUX server to look up in the AD to check if it is valid but it doesn't seem to be something stored in the AD.

Any help is greatly appreciated.

private void negotiate() {
        IWindowsSecurityContext clientContext = WindowsSecurityContextImpl.getCurrent( "NTLM", "localhost" );
        String securityPackage = "Kerberos";
        int count = 0;

        // initialize a security context on the client
        clientContext = WindowsSecurityContextImpl.getCurrent( securityPackage, clientContext.getPrincipalName() );
        // create an auth provider and a security context for the client 
        // on the server
        WindowsAuthProviderImpl provider = new WindowsAuthProviderImpl();

        // now you would send the byte[] token to the server and the server will 
        // response with another byte[] token, which the client needs to answer again
        IWindowsSecurityContext serverContext = null;

        // Step 1: accept the token on the server and build a security context 
        // representing the client on the server
        byte[] tokenForTheServerOnTheClient = clientContext.getToken();
        serverContext = provider.acceptSecurityToken("server-connection", tokenForTheServerOnTheClient, securityPackage);

        do {    
            count++;
            // Step 2: If you have already build an initial security context for the client
            // on the server, send a token back to the client, which the client needs to 
            // accept and send back to the server again (a handshake)
            if (serverContext != null) {
                byte[] tokenForTheClientOnTheServer = serverContext.getToken();
                SecBufferDesc continueToken = new SecBufferDesc(Sspi.SECBUFFER_TOKEN, tokenForTheClientOnTheServer);
                clientContext.initialize(clientContext.getHandle(), continueToken, clientContext.getPrincipalName());
                System.out.println(tokenForTheClientOnTheServer);
            }  

            tokenForTheServerOnTheClient = clientContext.getToken();
            serverContext = provider.acceptSecurityToken("server-connection", tokenForTheServerOnTheClient, securityPackage);

        } while (clientContext.isContinue() && count < 5);

        if(count >= 5) {
            System.out.println("Unable to authenticate the user.");
        }else {
            // at the end of this handshake, we know on the server side who the
            // client is, only by exchanging byte[] arrays
            System.out.println(serverContext.getIdentity().getFqn());
        }

    }