Kerberos TGT From Memory

Here is my debug

Debug is true storeKey false useTicketCache true useKeyTab false doNotPrompt true ticketCache is isInitiator true KeyTab is null refreshKrb5Config is false principal is <principal> tryFirstPass is false useFirstPass is false storePass is false clearPass is false

Acquire TGT from Cache

Principal is <principal>

null credentials from Ticket Cache

[Krb5LoginModule] authentication failed

Unable to obtain password from user

Authentication failed:

Unable to obtain password from user

jjhusa01a at 2007-7-11 16:09:48 >

Sorry to bump this. But between looking for information and feeling I may have not accurately described my problem, I decided to post again. Hopefully giving a clearer picture of what I am looking at.

First, let me try to explain what I am working with.

OS: RedHat Enterprise & CentOS

Location of TGT: PIPE:#### stored in memory

Java Version: Java(TM) SE Runtime Environment (build 1.6.0_01-b06)

At log on, the PIPE is created in memory and given a four digit number. This is where the credential cache is stored. From what I understand, this most likely considered an "unnamed" pipe. Therefore, only the parent/children processes can access this. I believe this is where my problem is coming from. I need a separate Java application to access this and authenticate to use other Java applications.

I have used the examples Seema has posted. I can get it to work with only a file Ccache. I generally set the file to /tmp/krb5cc_uid. I have been able to test and authenticate this way. Again, once I move it to the PIPE, I cannot read the Ccache.

Moving this to a file is out of the question. For security reason, most likely reason I am having my problems, it must stay in this form.

Message was edited by:

jjhusa01

Message was edited by:

jjhusa01

jjhusa01a at 2007-7-11 16:09:48 >

Seema,

You'll have to excuse me. My Linux/Unix programming is limited to classroom experience in which we never covered anything like this.

What information are you looking for about the ticket cache?

From what I know, its a credential cache stored in a pipe in memory.

At login a PIPE is initialized. Kinit, which is the child of kshell creates the pipe. The name of this pipe is stored in the KRB5CCNAME variable. When it was a file cache, it was "FILE:/tmp/krb5cc_uid". Now it is set to "PIPE:XXXX" where XXXX is an integer. Just for an example, we'll use 1234. In the Linux environment, KRB5CCNAME=PIPE:1234.

The PIPE will store the exact information as the krb5cc_uid file would.

I think the problem stems from the java applications are not children of the shell that created the pipe.

I can run kshell to create a new shell and kinit under that. That will setup another pipe to store my ticket.

Message was edited by:

jjhusa01

jjhusa01a at 2007-7-11 16:09:48 >