Problem getting an LDAPContext after authenticating via Kerberos

Question

Hi,
I am trying to create a Java program that can query an Active Directory server using the currenlty logged in Windows user's credentials to authenticate via LDAP.
I am getting the following error in my output when trying to create the LdapContext object.
GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos Ticket)
The full output is as follows
Debug is  true storeKey false useTicketCache true useKeyTab false doNotPrompt false ticketCache is null isInitiator true KeyTab is null refreshKrb5Config is false principal is null tryFirstPass is false useFirstPass is false storePass is false clearPass is false
Acquire TGT from Cache
KinitOptions cache name is C:\Documents and Settings\Administrator.THALES-3D8PWWDM\krb5cc_AdministratorAcquire default native Credentials
Obtained TGT from LSA: Credentials:
[email protected]
server=krbtgt/[email protected]
authTime=20090618162927Z
startTime=20090618162927Z
endTime=20090619022927Z
renewTill=20090625162927Z
flags: FORWARDABLE;RENEWABLE;INITIAL;PRE-AUTHENT
EType (int): 23
Principal is [email protected]
Commit Succeeded
Subject:
     Principal: [email protected]
     Private Credential: Ticket (hex) =
0000: 61 82 03 BC 30 82 03 B8   A0 03 02 01 05 A1 0A 1B  a...0...........
<REMOVED>4   8A 8C BE 6B FD 65 5D 2F  .R..t#@d...k.e]/
Client Principal = [email protected]
Server Principal = krbtgt/[email protected]
Session Key = EncryptionKey: keyType=23 keyBytes (hex dump)=
0000: C0 62 F6 3F 5C 29 F4 7B   C1 FC AB A0 77 D1 E7 E0  .b.?\)......w...
Forwardable Ticket true
Forwarded Ticket false
Proxiable Ticket false
Proxy Ticket false
Postdated Ticket false
Renewable Ticket true
Initial Ticket true
Auth Time = Thu Jun 18 17:29:27 BST 2009
Start Time = Thu Jun 18 17:29:27 BST 2009
End Time = Fri Jun 19 03:29:27 BST 2009
Renew Till = Thu Jun 25 17:29:27 BST 2009
Client Addresses  Null
Found ticket for [email protected] to go to krbtgt/[email protected] expiring on Fri Jun 19 03:29:27 BST 2009
KinitOptions cache name is C:\Documents and Settings\Administrator.THALES-3D8PWWDM\krb5cc_AdministratorAcquire default native Credentials
Obtained TGT from LSA: Credentials:
[email protected]
server=krbtgt/[email protected]
authTime=20090618162927Z
startTime=20090618162927Z
endTime=20090619022927Z
renewTill=20090625162927Z
flags: FORWARDABLE;RENEWABLE;INITIAL;PRE-AUTHENT
EType (int): 23
Found ticket for [email protected] to go to krbtgt/[email protected] expiring on Fri Jun 19 03:29:27 BST 2009
GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos Ticket)
     at sun.security.jgss.krb5.Krb5InitCredential.getInstance(Unknown Source)
     at sun.security.jgss.krb5.Krb5MechFactory.getCredentialElement(Unknown Source)
     at sun.security.jgss.GSSManagerImpl.getCredentialElement(Unknown Source)
     at sun.security.jgss.GSSCredentialImpl.add(Unknown Source)
     at sun.security.jgss.GSSCredentialImpl.<init>(Unknown Source)
     at sun.security.jgss.GSSCredentialImpl.<init>(Unknown Source)
     at sun.security.jgss.GSSManagerImpl.createCredential(Unknown Source)
     at sun.security.jgss.GSSContextImpl.initSecContext(Unknown Source)
     at sun.security.jgss.GSSContextImpl.initSecContext(Unknown Source)
     at com.sun.security.sasl.gsskerb.GssKrb5Client.evaluateChallenge(Unknown Source)
     at com.sun.jndi.ldap.sasl.LdapSasl.saslBind(Unknown Source)
     at com.sun.jndi.ldap.LdapClient.authenticate(Unknown Source)
     at com.sun.jndi.ldap.LdapCtx.connect(Unknown Source)
     at com.sun.jndi.ldap.LdapCtx.<init>(Unknown Source)
     at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(Unknown Source)
     at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(Unknown Source)
     at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(Unknown Source)
     at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(Unknown Source)
     at javax.naming.spi.NamingManager.getInitialContext(Unknown Source)
     at javax.naming.InitialContext.getDefaultInitCtx(Unknown Source)
     at javax.naming.InitialContext.init(Unknown Source)
     at javax.naming.InitialContext.<init>(Unknown Source)
     at javax.naming.directory.InitialDirContext.<init>(Unknown Source)
     at com.thalesgroup.planit.ldap.LDAPAction.performLDAPOperation(Main.java:87)
     at com.thalesgroup.planit.ldap.LDAPAction.run(Main.java:66)
     at java.security.AccessController.doPrivileged(Native Method)
     at javax.security.auth.Subject.doAs(Unknown Source)
     at com.thalesgroup.planit.ldap.Main.main(Main.java:46)
javax.naming.AuthenticationException: GSSAPI [Root exception is javax.security.sasl.SaslException: GSS initiate I am running this using the following VM arguments
-Djavax.security.auth.useSubjectCredsOnly=false -Dsun.security.krb5.debug=true
Finally my jaas config file is as follows
fsta {
     com.sun.security.auth.module.Krb5LoginModule required
debug=true client=false useTicketCache=true;
com.sun.security.jgss.initiate {
com.sun.security.auth.module.Krb5LoginModule required useTicketCache=true;
};I am running this locally on the AD server (running Windows Server 2003).
Does anybody know how I can get rid of the exception and create an authenticated LdapContext?
Any suggestions would be greatly appreciated.
Thanks
Graeme

Answer 1

My java source is as follows (its a modified example I found online)
import java.util.Hashtable;
import javax.naming.Context;
import javax.naming.NamingEnumeration;
import javax.naming.NamingException;
import javax.naming.directory.Attributes;
import javax.naming.directory.DirContext;
import javax.naming.directory.InitialDirContext;
import javax.naming.directory.SearchControls;
import javax.naming.directory.SearchResult;
import javax.security.auth.Subject;
import javax.security.auth.login.LoginContext;
import javax.security.auth.login.LoginException;
import com.sun.security.auth.callback.TextCallbackHandler;
public class Main {
    public static void main(String[] args) {
    java.util.Properties p = new java.util.Properties(System.getProperties());
    p.setProperty("java.security.krb5.realm", "fsta.com");
    p.setProperty("java.security.krb5.kdc", "192.168.1.10");
    p.setProperty("java.security.auth.login.config", "C:\\jaas.conf");
    System.setProperties(p);
    // 1. Log in (to Kerberos)
    LoginContext lc = null;
    try {
            lc = new LoginContext("fsta", new TextCallbackHandler());
    // Attempt authentication
    lc.login();
    } catch (LoginException le) {
    System.err.println("Authentication attempt failed" + le);
    System.exit(-1);
    Subject subject = lc.getSubject();
    System.out.println(subject.toString());
    // 2. Perform JNDI work as logged in subject
    Subject.doAs(subject, new LDAPAction(args));
    // 3. Perform LDAP Action
    * The application must supply a PrivilegedAction that is to be run
    * inside a Subject.doAs() or Subject.doAsPrivileged().
    class LDAPAction implements java.security.PrivilegedAction {
    private String[] args;
    private static String[] sAttrIDs;
    private static String sUserAccount = new String("Administrator");
    public LDAPAction(String[] origArgs) {
    this.args = origArgs.clone();
    public Object run() {
    performLDAPOperation(args);
    return null;
    private static void performLDAPOperation(String[] args) {
    // Set up environment for creating initial context
    Hashtable env = new Hashtable(11);
    env.put(Context.INITIAL_CONTEXT_FACTORY,
    "com.sun.jndi.ldap.LdapCtxFactory");
    // Must use fully qualified hostname
    env.put(Context.PROVIDER_URL, "ldap://192.168.1.10:389");
    // Request the use of the "GSSAPI" SASL mechanism
    // Authenticate by using already established Kerberos credentials
    env.put(Context.SECURITY_AUTHENTICATION, "GSSAPI");
//    env.put("javax.security.sasl.server.authentication", "true");
    try {
    /* Create initial context */
    DirContext ctx = new InitialDirContext(env);
    /* Get the attributes requested */
    //Create the search controls        
    SearchControls searchCtls = new SearchControls();
    //Specify the attributes to return
    String returnedAtts[]={"sn","givenName","mail"};
    searchCtls.setReturningAttributes(returnedAtts);
    //Specify the search scope
    searchCtls.setSearchScope(SearchControls.SUBTREE_SCOPE);
    //specify the LDAP search filter
    String searchFilter = "(&(objectClass=user)(mail=*))";
    //Specify the Base for the search
    String searchBase = "DC=fsta,DC=com";
    //initialize counter to total the results
    int totalResults = 0;
    // Search for objects using the filter
    NamingEnumeration answer = ctx.search(searchBase, searchFilter, searchCtls);
    //Loop through the search results
    while (answer.hasMoreElements()) {
            SearchResult sr = (SearchResult)answer.next();
        totalResults++;
        System.out.println(">>>" + sr.getName());
        // Print out some of the attributes, catch the exception if the attributes have no values
        Attributes attrs = sr.getAttributes();
        if (attrs != null) {
            try {
            System.out.println("   surname: " + attrs.get("sn").get());
            System.out.println("   firstname: " + attrs.get("givenName").get());
            System.out.println("   mail: " + attrs.get("mail").get());
            catch (NullPointerException e)    {
            System.err.println("Error listing attributes: " + e);
    System.out.println("RABOTIII");
        System.out.println("Total results: " + totalResults);
    ctx.close();
    } catch (NamingException e) {
    e.printStackTrace();
}Edited by: GraemeK on Jun 18, 2009 11:56 AM