Keytab runtime reload

Question

I have written a test server which acts as a Kerberos service that uses GSSAPI to authenticate users connect to the service. Here is my gss.conf:
com.sun.security.jgss.accept {
com.sun.security.auth.module.Krb5LoginModule
required
isInitiator=false
storeKey=true
keyTab="/home/danny/temp/GSSKerberosServer/kserver.keytab"
doNotPrompt=true
useKeyTab=true
principal="kserver/danny.com"
debug=true;
Everything works fine. But then I tried making the server runtimer reload the keytab by manually (physically) overwritten the keytab file but noticed that the new file doesn't get read (it still reads the old one) when a new GSSCredential is created. Does anyone know how to do runtime reload of the keytab? Here is the code of my test server:
package GSSKerberosServer;
import java.io.DataInputStream;
import java.io.DataOutputStream;
import java.io.IOException;
import java.net.ServerSocket;
import java.net.Socket;
import org.ietf.jgss.GSSContext;
import org.ietf.jgss.GSSCredential;
import org.ietf.jgss.GSSException;
import org.ietf.jgss.GSSManager;
import org.ietf.jgss.GSSName;
import org.ietf.jgss.Oid;
public class GSSKerberosServer {
* @param args
public static void main(String[] args) throws IOException, GSSException,
InterruptedException{
// Obtain the command-line arguments and parse the port number
if (args.length != 2) {
System.err.println("Usage: java <options> Login SampleServer <localPort> <SPN_name>");
System.exit(-1);
int localPort = Integer.parseInt(args[0]);
String spnName = args[1];
ServerSocket ss = new ServerSocket(localPort);
GSSManager manager = GSSManager.getInstance();
Oid krb5Oid = new Oid("1.2.840.113554.1.2.2");
GSSName spnGSSName = manager.createName("kserver/danny.com", null);
System.out.println("b4 createCredential1");
GSSCredential gssCred = manager.createCredential(spnGSSName,
GSSCredential.INDEFINITE_LIFETIME, krb5Oid,
GSSCredential.ACCEPT_ONLY);
System.out.println("after createCredential1");
System.out.println("Press a key to load credential again!!");
System.in.read();
GSSCredential gssCred2 = manager.createCredential(spnGSSName,
GSSCredential.INDEFINITE_LIFETIME, krb5Oid,
GSSCredential.ACCEPT_ONLY);
System.out.println("Done reloading");
int num = 0;
while (true) {
num++;
System.out.println("Waiting for incoming connection...");
Socket socket = ss.accept();
DataInputStream inStream =
new DataInputStream(socket.getInputStream());
DataOutputStream outStream =
new DataOutputStream(socket.getOutputStream());
System.out.println("Got connection from client "
+ socket.getInetAddress());
* Create a GSSContext to receive the incoming request
* from the client. Use null for the server credentials
* passed in. This tells the underlying mechanism
* to use whatever credentials it has available that
* can be used to accept this connection.
System.out.println("b4 createContext");
GSSContext context = null;
if (num % 2 == 0) {
context = manager.createContext(gssCred);
else {
context = manager.createContext(gssCred2);
// GSSContext context = manager.createContext(gssCred2);
System.out.println("after createContext");
// GSSContext context = manager.createContext((GSSCredential) null);
// Do the context eastablishment loop
byte[] token = null;
while (!context.isEstablished()) {
token = new byte[inStream.readInt()];
System.out.println("Will read input token of size "
+ token.length
+ " for processing by acceptSecContext");
inStream.readFully(token);
token = context.acceptSecContext(token, 0, token.length);
// Send a token to the peer if one was generated by
// acceptSecContext
if (token != null) {
System.out.println("Will send token of size "
+ token.length
+ " from acceptSecContext.");
outStream.writeInt(token.length);
outStream.write(token);
outStream.flush();
System.out.print("Context Established! ");
System.out.println("Client is " + context.getSrcName());
System.out.println("Server is " + context.getTargName());
* If mutual authentication did not take place, then
* only the client was authenticated to the
* server. Otherwise, both client and server were
* authenticated to each other.
if (context.getMutualAuthState())
System.out.println("Mutual authentication took place!");
token = new byte[inStream.readInt()];
inStream.readFully(token);
String readString = new String (token, "US-ASCII");
System.out.println("1 read =" + readString);
String reply = "Server got =" + readString;
byte[] replyByte = reply.getBytes("US-ASCII");
outStream.writeInt(replyByte.length);
outStream.write(replyByte);
outStream.flush();
System.out.println("Closing connection with client "
+ socket.getInetAddress());
context.dispose();
socket.close();
}

Answer 1

This question has been answered on another forum. The solution is to set refreshKrb5Config=true.