Stopping the service principle from requesting a TGT

Question

Is there a way to stop the service end of the JGSS negotiation from requesting a TGT for its service principle ?
</P>
In a Kerberos GSSAPI negotiation the accepting service only needs access to a keytable containing the exported service key to successfully authentication and identify the client principal. The service does not need any network access to the KDC.
</P>
The JGSS implementation during the acceptSecContext requests a TGT for the service principal, even though it makes no use of it and discards it. The service therefore requires network access to the KDC and incurs the overhead of a KDC access for each authentication.
</P>
This can simply be demonstrated using the sample code at:
</P>
http://java.sun.com/javase/6/docs/technotes/guides/security/jgss/tutorials/BasicClientServer.html
</P>
If the com.sun.security.jgss.accept entry is bcsLogin.conf is modified to:
</P>
com.sun.security.jgss.accept {
com.sun.security.auth.module.Krb5LoginModule required storeKey=true doNotPrompt=true useKeyTab=true keyTab="service.keytab" principal="service";
</P>
I would not expect the service to request a TGT, but it does, as the KDC log shows:
</P>
Jun 27 16:06:35 kdc krb5kdc[1865](info): AS_REQ (3 etypes {16 3 1}) 192.168.111.1: ISSUE: authtime 1151420795, etypes {rep=16 tkt=16 ses=16}, service@REALM for krbtgt/REALM@REALM
Jun 27 16:06:35 kdc krb5kdc[1865](info): AS_REQ (3 etypes {16 3 1}) 192.168.111.1: ISSUE: authtime 1151420795, etypes {rep=16 tkt=16 ses=16}, service@REALM for krbtgt/REALM@REALM
</P>
Any ideas ?
</P>
Thank
</P>
Phil

Answer 1

Hi Seema,
Thanks for the reply. I assume you're talking about the isInitiator flag ?
I'm using Java version 1.6.0-beta2 and still getting the same results. The config file is now:
com.sun.security.jgss.initiate {
  com.sun.security.auth.module.Krb5LoginModule required
useTicketCache=true ticketCache=ticket.cache debug=true;
com.sun.security.jgss.accept {
  com.sun.security.auth.module.Krb5LoginModule required isInitiator=false
storeKey=true doNotPrompt=true useKeyTab=true
keyTab="service.keytab" principal="service" debug=true;
};The output from the SampleServer is:
[root@kdc gssapi.new]# ./server
Waiting for incoming connection...
Got connection from client /127.0.0.1
Will read input token of size 445 for processing by acceptSecContext
Debug is  true storeKey true useTicketCache false useKeyTab true
doNotPrompt true ticketCache is null KeyTab is service.keytab
refreshKrb5Config is false principal is service tryFirstPass is false
useFirstPass is false storePass is false clearPass is false
principal's key obtained from the keytab principal is service@REALM
Acquire TGT using AS Exchange
EncryptionKey: keyType=3 keyBytes (hex dump)=0000: 57 08 1A 80 75 D0 7C 31
...As you can see the server is still acquiring a TGT. Also the isInitiator flag is not showing up in the debug options.
Is this functionality in version 1.6.0-beta2 ?
Thanks again
Phil