Using javax.security.auth.LoginContext to generate a renewable ticket

Question

Hi,
I tired to use javax.security.auth.LoginContext (with kerberos) to generate a forwardable and renewable ticket. With this ticket I authenticate the user at an other server.
My problem is, that the code generates a forwardable ticket, but not a renewable one. If I use the kinit (console tool) I am able to generate a renewable one.
Here is the JAVA-code:
System.setProperty("sun.security.krb5.debug","true");
System.setProperty("java.security.krb5.conf", "krb5.conf");     
System.setProperty("java.security.auth.login.config", "login.conf");
lc = new LoginContext("SampleCXF",new LoginGuiCallbackHandler());
try {
     lc.login();
}catch(Exception e) {
     e.printStackTrace();
     System.exit(1);
     Subject subject = lc.getSubject();
     KerberosTicket kt = (KerberosTicket) subject.getPrivateCredentials().iterator().next();
     System.out.println(kt);
     Subject.doAsPrivileged(subject, new PrivilegedAction<byte[]>() {
          @Override
          public byte[] run() {
               try {
                    JaxWsProxyFactoryBean factory = new JaxWsProxyFactoryBean();
                    factory.setServiceClass(TestService.class);
                    factory.setAddress("https://server.at/TestProjektServer/services/TestService");
                    TestService client = (TestService) factory.create();
                    String message = client.service1("param service 1");
                    //String message = client.service1("param service 1");
               }catch(Exception e) {
                    e.printStackTrace();
               return null;
     }, null);
the login.conf contains:
SampleCXF {
com.sun.security.auth.module.Krb5LoginModule required useTicketCache=true debug=true renewTGT=true doNotPront=true;
the krb5.conf contains:
[libdefaults]
default_realm = TESTREALM
     kinit = {
     forwardable = true
     proxiable = true
     renew_lifetime = 5d 0h 0m 0s
[realms]
TESTREALM = {
kdc = aba.hostingcenter.uclv.net
admin_server = aba.hostingcenter.uclv.net
[domain_realm]
*.test.net = TESTREALM
.test.net = TESTREALM
[logging]
     default = FILE:/var/log/kdc.log
     kdc = FILE:/var/log/kdc.log
[appdefaults]
     pam = {
          renewable = true
     forwardable = true
     renew_lifetime = 5d 0h 0m 0s
If I use my client principal and password a ticket will be generated. This ticket is not renewable!!
If I use the ticket cache (kinit -r, and kinit -R), a renewable ticket was loaded. On the server side the forwarded ticket is not renewable. It seams that the client generates a new ticket with the forwarded flag, but the renewable flag is not set.
does anyone have an idea?
Thanks a lot
Ludi
Edited by: user6714014 on Dec 13, 2011 7:34 AM

Answer 1

nobody knows?