If someone could help, that will be greatly appreciated. I am a newbie to Kerberos not sure if this is an obvious question, please excuse me for my newness.
I am in Kerberos configured Windows machine. Two users user1 and user2 have permission to it.
Below is my Java code :
System.setProperty("java.security.krb5.conf", "<JRE Path>\\lib\\security\\<kerb.conf file>");
System.setProperty("java.security.auth.login.config", "jaas.conf");
/*
* Content of jaas.conf:
* JAAS {
* com.sun.security.auth.module.Krb5LoginModule required
* useTicketCache=true debug=true;
* };
*/
// kinit of user1
// Content of kinituser1.bat: "<JRE Path>\bin\kinit.exe" -A -k -t "/user1.keytab" "<user1 principal>"
String[] cmdScript1 = new String[]{"kinituser1.bat"};
Process procScript1 = Runtime.getRuntime().exec(cmdScript1);
LoginContext context1 = AccessController.doPrivileged(
new PrivilegedExceptionAction<LoginContext>() {
public LoginContext run() throws LoginException {
return new LoginContext("JAAS");
}
});
context1.login();
Subject subject1 = context1.getSubject();
System.out.println("Connected as:" + subject1); // This returns the expected user1 user ticket.
context1.logout();
// kinit of user2
// Content of kinituser1.bat: "<JRE Path>\bin\kinit.exe" -A -k -t "/user2.keytab" "<user2 principal>"
String[] cmdScript2 = new String[]{"kinituser2.bat"};
Process procScript2 = Runtime.getRuntime().exec(cmdScript2);
LoginContext context2 = AccessController.doPrivileged(
new PrivilegedExceptionAction<LoginContext>() {
public LoginContext run() throws LoginException {
return new LoginContext("JAAS");
}
});
context2.login();
Subject subject2 = context2.getSubject();
System.out.println("Connected as:" + subject2); // Here we are seeing the issue: This is still returning user1 ticket subject, I was expecting user2 here.
context2.logout();
On Running above application, inspite of cache getting refreshed with user2 after executing kinituser2.bat, I am getting user1 ticket cache in the context2 subject. And if I swap user1 and user2, user2 ticket details is returned for both the cases. This is giving an impression that irrespective of ticket cache getting updated with other user tickets, initial user ticket is returned always for later LoginContext's.
Did anyone face like above? Can someone tell me if I am missing or doing anything wrong?
