Kerberos Service tickets & Service server

Question

Hi,
I've implemented a simple hello_world.java application (on Windows) that gets authentified by the KerberosLoginModule by the Kerberos Keytab (not the TGT!).
- That Keytab was built on a Microsoft Server 2003 using "ktpass".
- The name of the application "hello_world" was added in Active directory using setspn.exe (necessary if I want to use Kerberos Service Tickets) for an user account.
At the moment every account can launch the application.
But how can I:
1- Make that application require and use the service ticket to allow just 1 user to launch the application?
2- Prevent/Deny all the others.
and also:
3- From the user account, establish the communication with the KDC (TGS) to acquire Service Tickets?
---> I want that application to require the Kerberos Service Ticket from the user AND decrypt it by using the keytab (to finally allow access to the user).
Any suggestions for a newbie like me are all welcome..
Thanks !

Answer 1

what do you mean "launch the application"? If it's a class or a jar readable by all, then everyone can launch it. if your "launch" means it can authenticate itself and goes on, maybe you can simply make the keytab file readable by a single user.
Anyway this looks a little strange. Normally JGSS programs have a client and a server, the client need to authenticate itself to the server, and request the server to do something. If you have only one program, user may alter the configuration (say, appointing another KDC), trick the program to believe it passes the authentication stage, and goes on.