Bug in JAAS Kerberos module on Windows XP?

Question

We have a large application with its own user management. A recent addition to this application is a single sign-on using the Microsoft Active Directory.
Specifically we use the Sun provided Kerberos login provider for JAAS to retrieve the currently logged in user. This works perfectly on Windows 2000 Professional.
On Windows XP however, the login provider does not return the currently logged in user. What am I missing?
JAAS configuration file:
PbsJaas {
com.sun.security.auth.module.Krb5LoginModule required debug=true useTicketCache=true dontPrompt=true;
Test program:
package test;
import java.io.*;
import javax.security.auth.login.*;
import javax.security.auth.*;
import java.util.*;
import java.security.*;
* Testing Single Sign On with Microsoft Active Directory
public class SsoTest {
private static String getAuthenticatedUser() {
String ssoUser = null;
try {
File confFile = new File( "C:/test", "pbsjaas.conf" );
System.setProperty("java.security.auth.login.config",confFile.getAbsolutePath());
System.setProperty("java.security.krb5.realm", "MY.DOMAIN");
System.setProperty("java.security.krb5.kdc", "DOMAINSERVER");
LoginContext lc = new LoginContext( "PbsJaas" );
lc.login();
Subject s = lc.getSubject();
for (Iterator iter = s.getPrincipals().iterator(); iter.hasNext(); ) {
Principal p = (Principal) iter.next();
ssoUser = p.getName();
break;
catch (Exception ex) {
System.out.println("exception during sso authentication - assuming not authenticated");
ex.printStackTrace(System.out);
ssoUser = null;
return ssoUser;
public static void main(String[] args) {
try {
String ssoUser = getAuthenticatedUser();
System.out.println("user?: "+ssoUser);
catch (Exception ex) {
ex.printStackTrace();
System.exit(0);
The output on Windows XP is:
Debug is true storeKey false useTicketCache true useKeyTab false doNotPrompt false ticketCache is null KeyTab is null refreshKrb5Config is false principal is null tryFirstPass is false useFirstPass is false storePass is false clearPass is false
Principal is null
null credentials from Ticket Cache
          [Krb5LoginModule] authentication failed
No CallbackHandler available to garner authentication information from the user
exception during sso authentication - assuming not authenticated
javax.security.auth.login.LoginException: No CallbackHandler available to garner authentication information from the user
     at com.sun.security.auth.module.Krb5LoginModule.promptForName(Krb5LoginModule.java:626)
     at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:544)
     at com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:475)
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
     at java.lang.reflect.Method.invoke(Method.java:324)
     at javax.security.auth.login.LoginContext.invoke(LoginContext.java:675)
     at javax.security.auth.login.LoginContext.access$000(LoginContext.java:129)
     at javax.security.auth.login.LoginContext$4.run(LoginContext.java:610)
     at java.security.AccessController.doPrivileged(Native Method)
     at javax.security.auth.login.LoginContext.invokeModule(LoginContext.java:607)
     at javax.security.auth.login.LoginContext.login(LoginContext.java:534)
     at pbs.test.SsoTest.getAuthenticatedUser(SsoTest.java:23)
     at pbs.test.SsoTest.main(SsoTest.java:50)
user?: null
Again, on Windows 2000 Professional everything works fine, and I get the currently logged in user.
We are running Windows 2000 Server.
Any help would be greatly appreciated.
David Sykes

Answer 1

Firstly there appears to be a bug in the Kerberos libraries where it does not look at the local cache on XP. Try with -Dos.name="Windows 2000". This should trick the java libraries into thinking it's on W2K and look at the LSA cache. There appears to be other issues here but still trying to investigate further.
Secondly you haven't specified a CallBackHandler yet you have DoNotPrompt =false. Thus Kerberos will try to ask for the username and password (since it doesn't talk to LSA) yes none is defined in your call to LoginContext.