Manually refreshing TGT leads to "Message stream modified" error

Question

We wish to use Kerberos to implement application authentication without needing username/password. We have code which gets the TGT and can get other tickets from that, and those tickets can successfully be used with LDAP to make queries. However, the TGT will expire after 10 hours, unless (for example) the lockscreen is used to supply a username/password, at which point the TGT is renewed.
We understand that it should be possible to renew the TGT from the application, so that long-running processes do not require another login. The ticket's metadata says it is renewable, and we have set options to say we want to do this. We get hold of the ticket and do refresh(), and this attempts to renew the Credentials. However, the attempt fails with the following exception:
javax.security.auth.RefreshFailedException: Failed to renew Kerberos Ticket for client [email protected] and server krbtgt/[email protected] - Message stream modified (41)
Having traced the executing code down through the debugger, it goes down through KerberosTicket.refresh(), Credentials.renew(), is constructing a new EncryptedData and does Cipher.getInstance() with transformation "DES/CBC/NoPadding". This gets down to a Provider, which raises the exception.
We have checked that we only have one matched pair for serviceprincipalname.
So the questions are: (a) should it be possible to refresh the TGT in this way, or is it simply impossible to refresh it without a username and password?; (b) if it should be possible, what is the likely cause of the exception?
A debug trace of an attempt looks like:
H:\support\users\paulw\Workspace\kerberos\bin>java -Dsun.security.krb5.debug=true -Djava.security.krb5.realm=NMS.DEV.PS.GE.COM -Djava.security.krb5.kd
c=UKCBGDC01DFPS -Djava.security.auth.login.config=jaas.conf JaasAcn
KinitOptions cache name is C:\Documents and Settings\paulw\krb5cc_paulwAcquire default native Credentials
Obtained TGT from LSA: Credentials:
[email protected]
server=krbtgt/[email protected]
authTime=20090127152629Z
startTime=20090127152629Z
endTime=20090128012629Z
renewTill=20090203152629Z
flags: FORWARDABLE;RENEWABLE;INITIAL;PRE-AUTHENT
EType (int): 23
Authentication succeeded!
[email protected]
Start time = Tue Jan 27 15:26:29 GMT 2009, Expires = Wed Jan 28 01:26:29 GMT 2009, isCurrent = true, isInitial=true, [email protected].
GE.COM, ServerPrincipal=krbtgt/[email protected]
Using builtin default etypes for default_tgs_enctypes
default etypes for default_tgs_enctypes: 3 1 23 16 17.
CksumType: sun.security.krb5.internal.crypto.RsaMd5CksumType
EType: sun.security.krb5.internal.crypto.ArcFourHmacEType
KrbKdcReq send: kdc=UKCBGDC01DFPS UDP:88, timeout=30000, number of retries =3, #bytes=1799
KDCCommunication: kdc=UKCBGDC01DFPS UDP:88, timeout=30000,Attempt =1, #bytes=1799
KrbKdcReq send: #bytes read=106
KrbKdcReq send: #bytes read=106
KDCRep: init() encoding tag is 126 req type is 13
KRBError:sTime is Tue Jan 27 16:00:42 GMT 2009 1233072042000
suSec is 717480
error code is 52
error Message is Response too big for UDP, retry with TCP
realm is NMS.DEV.PS.GE.COM
sname is krbtgt/NMS.DEV.PS.GE.COM
msgType is 30
KrbKdcReq send: kdc=UKCBGDC01DFPS TCP:88, timeout=30000, number of retries =3, #bytes=1799
DEBUG: TCPClient reading 1783 bytes
KrbKdcReq send: #bytes read=1783
KrbKdcReq send: #bytes read=1783
EType: sun.security.krb5.internal.crypto.ArcFourHmacETypeerr: javax.security.auth.RefreshFailedException: Failed to renew Kerberos Ticket for client [email protected] and server krbtgt/[email protected] - Message stream modified (41)
The problem is reproducible with a simple java client and has been reproduced on two machines within the corporate network using different kdc's. It is also reproducible on a customers site where the ticket expiry is 1 hour.
thanks
paul

Answer 1

If it helps.. the client code and config file.
If someone has a working system and could confirm whether the general principle here is correct, that would be much appreciated.
thanks
paul
java -Dsun.security.krb5.debug=true -Djava.security.krb5.realm=<realm-name> -Djava.security.krb5.kdc=<kdc-name> -Djava.security.auth.login.config=jaas.conf JaasAcn
* @(#)JaasAcn.java
* Copyright 2001-2002 Sun Microsystems, Inc. All Rights Reserved.
* Redistribution and use in source and binary forms, with or
...snip
* intended for use in the design, construction, operation or
* maintenance of any nuclear facility.
import java.util.*;
import javax.security.auth.kerberos.*;
import javax.security.auth.*;
import javax.security.auth.login.*;
import com.sun.security.auth.callback.TextCallbackHandler;
import java.security.*;
import javax.security.auth.Subject;
* This JaasAcn application attempts to authenticate a user
* and reports whether or not the authentication was successful.
public class JaasAcn {
     public static void main(String[] args) {
          // Obtain a LoginContext, needed for authentication. Tell it
          // to use the LoginModule implementation specified by the
          // entry named "JaasSample" in the JAAS login configuration
          // file and to also use the specified CallbackHandler.
          LoginContext lc = null;
          try {
               lc = new LoginContext("JaasSample", new TextCallbackHandler());
          } catch (LoginException le) {
               System.err.println("Cannot create LoginContext. "
                         + le.getMessage());
               System.exit(-1);
          } catch (SecurityException se) {
               System.err.println("Cannot create LoginContext. "
                         + se.getMessage());
               System.exit(-1);
          System.out.println("Time is now " +new Date());
          try {
               // attempt authentication
               lc.login();
          } catch (LoginException le) {
               System.err.println("Authentication failed:");
               System.err.println("  " + le.getMessage());
               System.exit(-1);
          System.out.println("Authentication succeeded!");
          Subject mSubject = lc.getSubject();
          Iterator li = mSubject.getPrincipals().iterator();
          // Should only have one Principal
          if ( li.hasNext() ) {
               Principal lPrincipal = (Principal) li.next();
               System.out.println(lPrincipal.toString());
          li = mSubject.getPrivateCredentials().iterator();
          if ( li.hasNext() ) {
               Object lObject = (Object) li.next();
               if ( lObject instanceof KerberosTicket ) {
                    KerberosTicket lKerberosTicket = (KerberosTicket) lObject;
                    System.out.println(
                              "Start time=" + lKerberosTicket.getStartTime() +
                              ", Expires=" + lKerberosTicket.getEndTime() +
                              ", RenewUntil=" + lKerberosTicket.getRenewTill() +
                              ", isCurrent=" + lKerberosTicket.isCurrent() +
                              ", isRenewable=" + lKerberosTicket.isRenewable() +
                              ", isInitial=" + lKerberosTicket.isInitial() +
                              ", ClientPrincipal=" + lKerberosTicket.getClient().toString() +
                              ", ServerPrincipal=" + lKerberosTicket.getServer().toString());            
                    try {
                         lKerberosTicket.refresh();
                    catch ( RefreshFailedException e )
                         System.err.println("err: " + e);
/** Login Configuration for the JaasAcn and
** JaasAzn Applications
   [email protected]
   doNotPrompt=true
   useKeyTab=true
JaasSample {
   com.sun.security.auth.module.Krb5LoginModule required
   useTicketCache=true
   renewTGT=true
   debug=true;
};