JNDI,AD,Kerberos Authentication, Windows

Question

Hi all,
OS:
Server: LDAP Server AD running on win2k server with KDC on the same machine
Client: Sun's JNDI application on WinXP
Senario:
I managed to make the well-known tutorial example (list 1) work well on both jdk1.4.2_05 and jdk1.5.1_02. The main steps can be summarized as
step 1: Kerberose authtication with lc.login() based on JAAS
step 2: Assume the identity of the authenticated subject
step 3: Run JNDI client application under this identity with Subject.doAS()
Problem:
It's very hard to force users to run their JNDI applications UNDER step 1 & 2. As you know, step 3 is run by a spawn child's thread and for this reason it's very hard to convince users including myself of doing SSO in this way. There should be a better way. Actually, KDC's realm is built in such a way that all applications and computers under the same realm should be SSO Kerberose aware -- that is -- once the intial authentication is done, the identity assuming should be valid for the entire login session (usually 8~10 hours).
Solution:
Step 0: Create client's user account 'testuser' on AD
Step 1: Initially login using command kinit()
C\: kinit test
Password for testuser@REALM:mypassword
New ticket is stored in cache file C:\Documents and Settings\abc\kerb5cc_abc
Step 2: Run JNDI client application (list 2)
Error:
GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos Ticket)
     at sun.security.jgss.krb5.Krb5InitCredential.getInstance(Krb5InitCredential.java:133)
     at sun.security.jgss.krb5.Krb5MechFactory.getCredentialElement(Krb5MechFactory.java:72)
     at sun.security.jgss.GSSManagerImpl.getCredentialElement(GSSManagerImpl.java:149)
     at sun.security.jgss.GSSCredentialImpl.add(GSSCredentialImpl.java:389)
     at sun.security.jgss.GSSCredentialImpl.<init>(GSSCredentialImpl.java:60)
     at sun.security.jgss.GSSCredentialImpl.<init>(GSSCredentialImpl.java:37)
     at sun.security.jgss.GSSManagerImpl.createCredential(GSSManagerImpl.java:96)
     at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:178)
     at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:158)
     at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:155)
     at com.sun.jndi.ldap.sasl.LdapSasl.saslBind(LdapSasl.java:105)
     at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:214)
     at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2637)
     at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:283)
     at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:175)
     at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:193)
     at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:136)
     at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:66)
     at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:667)
     at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:247)
     at javax.naming.InitialContext.init(InitialContext.java:223)
     at javax.naming.InitialContext.<init>(InitialContext.java:197)
     at javax.naming.directory.InitialDirContext.<init>(InitialDirContext.java:82)
     at JndiClientAction.main(JndiClientAction.java:61)
javax.naming.AuthenticationException: GSSAPI [Root exception is javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided]]
     at com.sun.jndi.ldap.sasl.LdapSasl.saslBind(LdapSasl.java:150)
     at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:214)
     at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2637)
     at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:283)
     at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:175)
     at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:193)
     at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:136)
     at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:66)
     at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:667)
     at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:247)
     at javax.naming.InitialContext.init(InitialContext.java:223)
     at javax.naming.InitialContext.<init>(InitialContext.java:197)
     at javax.naming.directory.InitialDirContext.<init>(InitialDirContext.java:82)
     at JndiClientAction.main(JndiClientAction.java:61)
Caused by: javax.security.sasl.SaslException: GSS initiate failed [Caused by GSSException: No valid credentials provided]
     at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:174)
     at com.sun.jndi.ldap.sasl.LdapSasl.saslBind(LdapSasl.java:105)
     ... 13 more
Caused by: GSSException: No valid credentials provided
     at sun.security.jgss.GSSCredentialImpl.<init>(GSSCredentialImpl.java:69)
     at sun.security.jgss.GSSCredentialImpl.<init>(GSSCredentialImpl.java:37)
     at sun.security.jgss.GSSManagerImpl.createCredential(GSSManagerImpl.java:96)
     at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:178)
     at sun.security.jgss.GSSContextImpl.initSecContext(GSSContextImpl.java:158)
     at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(GssKrb5Client.java:155)
     ... 14 more
SOS:
Can anyone pin point what's going wrong?
Thanks in advance
Spencer
------------------- LIST 1 -------------------
import javax.naming.*;
import javax.naming.directory.*;
import javax.security.auth.login.*;
import javax.security.auth.Subject;
import com.sun.security.auth.callback.TextCallbackHandler;
import java.util.Hashtable;
* Demonstrates how to create an initial context to an LDAP server
* using "GSSAPI" SASL authentication (Kerberos v5).
* Requires J2SE 1.4, or JNDI 1.2 with ldapbp.jar, JAAS, JCE, an RFC 2853
* compliant implementation of J-GSS and a Kerberos v5 implementation.
* Jaas.conf
* racfldap.GssExample {com.sun.security.auth.module.Krb5LoginModule required client=TRUE useTicketCache=true doNotPrompt=true; };
* 'qop' is a comma separated list of tokens, each of which is one of
* auth, auth-int, or auth-conf. If none is supplied, the default is 'auth'.
class KerberosExample {
public static void main(String[] args) {
java.util.Properties p = new java.util.Properties(System.getProperties());
p.setProperty("java.security.krb5.realm", "MYCOMPANY.ORG");
p.setProperty("java.security.krb5.kdc", "mydomaincontroller.mycompany.org");
p.setProperty("java.security.auth.login.config", "C:\\WINNT\\jaas.conf");
System.setProperties(p);
// 1. Log in (to Kerberos)
LoginContext lc = null;
try {
lc = new LoginContext(GssExample.class.getName(),
new TextCallbackHandler());
// Attempt authentication
lc.login();
} catch (LoginException le) {
System.err.println("Authentication attempt failed" + le);
System.exit(-1);
// 2. Perform JNDI work as logged in subject
Subject.doAs(lc.getSubject(), new LDAPAction(args));
// 3. Perform LDAP Action
* The application must supply a PrivilegedAction that is to be run
* inside a Subject.doAs() or Subject.doAsPrivileged().
class LDAPAction implements java.security.PrivilegedAction {
private String[] args;
private static String[] sAttrIDs;
private static String sUserAccount = new String("testuser");
public LDAPAction(String[] origArgs) {
this.args = (String[])origArgs.clone();
public Object run() {
performLDAPOperation(args);
return null;
private static void performLDAPOperation(String[] args) {
// Set up environment for creating initial context
Hashtable env = new Hashtable(11);
env.put(Context.INITIAL_CONTEXT_FACTORY,
"com.sun.jndi.ldap.LdapCtxFactory");
// Must use fully qualified hostname
env.put(Context.PROVIDER_URL, "ldap://mydomaincontroller.mycompany.org:389/DC=mycompany,DC=org");
// Request the use of the "GSSAPI" SASL mechanism
// Authenticate by using already established Kerberos credentials
env.put(Context.SECURITY_AUTHENTICATION, "GSSAPI");
env.put("javax.security.sasl.server.authentication", "true");
try {
/* Create initial context */
DirContext ctx = new InitialDirContext(env);
/* Get the attributes requested */
Attributes aAnswer =ctx.getAttributes( "CN="+ sUserAccount + ",OU=mydivision,OU=Departments");
NamingEnumeration enumUserInfo = aAnswer.getAll();
while(enumUserInfo.hasMoreElements()) {
System.out.println(enumUserInfo.nextElement().toString());
// Close the context when we're done
ctx.close();
} catch (NamingException e) {
e.printStackTrace();
------------------- LIST 2 ------------------------------
import javax.naming.*;
import javax.naming.directory.*;
import java.util.Hashtable;
class JNDIClientAction {
private static String[] sAttrIDs;
private static String sUserAccount = new String("testuser");
public static void main(String[] args) {
// Set up environment for creating initial context
Hashtable env = new Hashtable(11);
env.put(Context.INITIAL_CONTEXT_FACTORY,
"com.sun.jndi.ldap.LdapCtxFactory");
// Must use fully qualified hostname
env.put(Context.PROVIDER_URL, "ldap://mydomaincontroller.mycompany.org:389/DC=mycompany,DC=org");
// Request the use of the "GSSAPI" SASL mechanism
// Authenticate by using already established Kerberos credentials
env.put(Context.SECURITY_AUTHENTICATION, "GSSAPI");
try {
/* Create initial context */
DirContext ctx = new InitialDirContext(env);
/* Get the attributes requested */
Attributes aAnswer =ctx.getAttributes( "CN="+ sUserAccount + ",OU=mydivision,OU=Departments");
NamingEnumeration enumUserInfo = aAnswer.getAll();
while(enumUserInfo.hasMoreElements()) {
System.out.println(enumUserInfo.nextElement().toString());
// Close the context when we're done
ctx.close();
} catch (NamingException e) {
e.printStackTrace();
}

Answer 1

Hi,
these Notes will help you :
Note 352295 - Microsoft Windows Single Sign-On options
Note 595341 - Installation issues with Single Sign-On and SNC
Note 1580808 - SAP Logon 7.20: "SNC logon w/o SSO" for connection entry
http://help.sap.com/saphelp_nwes72/helpdata/en/44/0ea40dc6970d1ce10000000a114a6b/frameset.htm
For Windows SAP Servers pls download the libs of note 352295.
For Linux use the one on OS level  ( /usr/lib64/libgssapi_krb5.so )
For Linux make sure that the krb5 rpm packages are installed
krb5-32bit.......
krb5-...............
krb5-client.......
I hope this helps
greetings
oliver