Kerberos authentication using Java | Faculty of Engineering | Imperial College London Skip to main content Skip to search Skip to section menu Skip to sidebar menu View accessibility support page Imperial College London Imperial College London Imperial Alert Coronavirus (COVID-19) updates: Safety information for academic year 2021-22 Latest information for current students, staff, offer holders and applicants Main Navigation Study Close Study overview Undergraduate Top Links Courses for 2022 How to apply Fees and funding Accommodation Open days, events and visits Undergraduate prospectus Postgraduate Top Links Courses for 2022-23 Doctoral courses How to apply Fees and funding Accommodation Events and visits Study guide Faculties and departments Education centres and schools Continuing Professional Development Executive Education Living in LondonLondon’s fusion of culture, charm and career opportunities is hard to beat International studentsStudents come from over 140 different countries to study at Imperial Campus lifeExperience what it's like to be a member of the College community Research & Innovation Close Research and Innovation Partner with us At a glance Clinical Trials Business support and partnerships Consultancy Executive education A-Z services for partners Research support At a glance Resources for staff Research Office Faculty research services teams Research integrity Clinical Trials Global Imperial College Strategy 2015-2020 Faculties and departments A-Z research groups and centres Funding opportunities REF 2021 Imperial’s impactRead case studies about how Imperial research has made a difference Research newsKeep up to date with Imperial’s cutting edge discoveries EnterpriseLearn how we support entrepreneurship and help find research-driven solutions to industry challenges Be Inspired Close Be Inspired Take part Top links Schools Outreach What's on at Imperial Festival Imperial Lates Alumni events Volunteering and outreach Engage online Top links Imperial news Podcasts Imperial Magazine Imperial Stories Social media directory Staff and student volunteering Imperial magazine Societal engagement Imperial College Podcastpresented by Gareth Mitchell and the Communications & Public Affairs pod squad Imperial TodaySubscribe to our daily newsletter and receive the best stories from Imperial direct to your inbox Student blogsFind out about life on campus from our team of student bloggers About Close About The College Overview Strategy 2020-2025 Academic Strategy League tables Facts and figures College governance Sustainability Our people At a glance President Provost Alumni stories Award winners Recognising our people Equality, diversity and inclusion A - Z of Faculties and Departments Faculty of Engineering Faculty of Medicine Faculty of Natural Sciences Imperial College Business School Global ImperialWe are the UK's most international university Our campusesExplore our London locations White City CampusImperial’s research and innovation district News What's on News Give A-Z Close Faculties and departments Multidisciplinary networks, centres and institutes Research groups People finder Administration and support services Information for Close Prospective students Current students Alumni Staff Jobs at Imperial Partners and business Media Donors Parents Conference organisers Search Imperial Search Department of Computing Section Navigation Close Department of Computing Overview About Getting here Our values Our facilities Useful contacts Equality and Diversity Equality, Diversity and Culture Committee Women in Computing Athena SWAN Resources Vacancies News and events Health and safety Qualified first aiders Training requirements Theft Students Welcome Information Awards and honours People Academic staff Welcome to new academics Teaching fellows Research staff Administrative staff CSG Recent changes New users Students Lab regulations Staff and PhDs Services Guides Remote Access Facilities Loans Lab Workstations Theatres Help desk Policies Activities CSG Systems Activities Information Systems Activities Honorary staff Emeritus staff DeepMind scholarships Alumnus Research Artificial Intelligence Data Science Programming Languages Security Software Engineering Systems Theory and Algorithms Analysis and Verification Visual Computing Research groups listed alphabetically Prospective students Welcome Undergraduate courses BEng/MEng Computing BEng/MEng Joint Mathematics and Computer Science Postgraduate courses MSc Computing MSc Computing Science regulations MSc Advanced Computing MSc Advanced Computing regulations MSc in Artificial Intelligence MSc Artificial Intelligence regulations MSc Specialist Degrees MSc in Computing (Artificial Intelligence and Machine Learning) MSc in Computing (Management and Finance) MSc in Computing (Security and Reliability) MSc in Computing (Software Engineering) MSc in Computing (Visual Computing and Robotics) MSc in Computing (Specialisms) regulations Integrated MRes/PhD Degrees MRes Artificial Intelligence and Machine Learning PhD FAQs Scholarships HiPEDS Centre for Doctoral Training PhD success stories PhD application guidelines AI4Health Centre for Doctoral Training Open days and taster courses COVID-19 Updates Scholarships and Bursaries Current students Undergraduate Computing: degree and course information Undergraduate degrees UG handbook Undergraduate JMC: degree and course information JMC undergraduate degrees UG handbook Postgraduate degrees and course information PG handbook PhD information PhD diary Facewall PhD 1st Year - Cohort 2020 / 2021 Undergraduate student welfare Exams & Mitigating Circumstances DoC student hub Scholarships and Bursaries Industry Recruit our Students Industrial placements Corporate Partnership Programme Industrial Advisory Board Membership Terms of reference Applications of Computing in Industry Prizes and sponsorship Consultancy Collaborations Outreach and Engagement Girls in Computing DoC Explains Ethics in Computing Coding for Children Bring your child to work day Outreach news and events Public Lecture Series Computing in Schools STEM Club Training Beyond the Classroom This is Engineering CSG Recent changes New users Students Lab regulations Staff and PhDs Services Guides Remote Access Facilities Loans Lab Workstations Theatres Help desk Policies Activities CSG Systems Activities Information Systems Activities Staff intranet Health and safety Qualified first aiders Training requirements Theft Students Welcome Information Home Faculty of Engineering Departments, institutes and centres Department of Computing CSG Guides Java Kerberos authentication using Java Kerberos authentication using Java Please note: these instructions were given to us by a past student. We don't necessarily understand them, let alone guarantee that they're up to date and accurate:-) There are a number of steps which must be taken in order to enable a Java class for Kerberos authentication. The first is to let Java know we're using Kerberos for authentication. This is done in the file ~/.java.login.config, although you could use a different file if you have sufficient privileges to edit ${java.home}/jre/lib/security/java.security. The file should look like this: EntryName {
com.sun.security.auth.module.Krb5LoginModule required;
}; Where EntryName is a name we will reference later from the Java code. The file can of course contain multiple entries like the one shown. There are some options you can use to modify the behaviour of the module. Probably the most important is useTicketCache. When set to true, it causes the module to look in the ticket cache for a valid ticket first before prompting for a username and password. If it finds a ticket it can use, it'll just use that. The default is false, which means always prompt for the username and password. There are detailed explanations of all the possible options at the Krb5 Login Module Javadoc, but if you just need useTicketCache, simply change the configuration line to: com.sun.security.auth.module.Krb5LoginModule required useTicketCache=true; Once the security config file is set up, the next thing is to write the Java code itself. You will need the follow import directives to use Kerberos: import javax.security.auth.*;
import javax.security.auth.login.*;
import javax.security.auth.callback.*;
import javax.security.auth.kerberos.*; The next thing you need is an instance of class Subject to authenticate. Usually this will be enough: Subject mysubject = new Subject(); However, if you are using the ticket cache and the above code, Kerberos will simply authenticate the user with a ticket from the cache and get a new ticket based on that, without prompting for a username or password. Depending on what you're trying to do, this could be good or bad. The next thing is to create a LoginContext instance, which is a way of communicating with the authentication module. LoginContext lc;
try {
lc = new LoginContext("EntryName", mysubject, new MyCallbackHandler());
} catch (LoginException e) {
// If an exception is caused here, it's likely the ~/.java.login.config file is wrong
} Where MyCallbackHandler is the class you want the authentication module to ask for the username and password. Even if you want to use the ticket cache, you still need to supply this in case the cache is empty. The suggested code is as follows: class MyCallbackHandler implements CallbackHandler {
String user = 'xxxx';
String password = 'yyyyy'; // much better to read these from a secure file..
public void handle(Callback[] callbacks)
throws IOException, UnsupportedCallbackException {
for (int i = 0; i < callbacks.length; i++) {
if (callbacks[i] instanceof NameCallback) {
NameCallback nc = (NameCallback)callbacks[i];
nc.setName(username);
} else if (callbacks[i] instanceof PasswordCallback) {
PasswordCallback pc = (PasswordCallback)callbacks[i];
char passwordchars[] = password.toCharArray();
pc.setPassword( passwordchars );
for (int i = 0; i < password.length(); i++) passwordchars[i] = '*';
} else throw new UnsupportedCallbackException
(callbacks[i], "Unrecognised callback");
}
}
} username and password are String instance variables containing the username and password to authenticate with. You might want to write a MyCallbackHandler( the_username, the_password ) constructor that stores them in the instance variables, and read the password from somewhere else securely. Going back to the main code, the final step is to call the login() method of the LoginContext class (called lc in my code). try {
lc.login();
} catch (LoginException e) {
// Bad username/password
} If no exception is thrown, the user is now authenticated and the mysubject object you supplied earlier now holds a valid Kerberos ticket, which you can access if necessary with mysubject.getPrivateCredentials(). Note that, for added security, we've added a simple for loop to overwrite the password array, so that it doesn't stay intact in memory for all to see via process introspection techniques. CSG Recent changes New users Students Lab regulations Staff and PhDs Services Guides Remote Access Facilities Loans Lab Workstations Theatres Help desk Policies Activities CSG Systems Activities Information Systems Activities Print Email Contact & Links Section Information Faculty of Engineering Department of Computing Imperial College London South Kensington Campus London SW7 2AZMap Get in touch Useful contacts UG admissions enquiries MSc admissions enquiries PhD admissions enquiries Quick links Job opportunities Recruit our students Outreach Computing Support Group (CSG) FollowTwitterLinked in Useful Links Information for Prospective students Alumni Jobs Partners and business Media Donors Parents Conference organisers Top links Visit Imperial Imperial and the EU Outlook 365 web access Contact the ICT Service Desk Library Blackboard Move Imperial Term dates Students Imperial students Imperial College Union Student Hub Careers Service Imperial Mobile Graduation Staff Staff main page ICIS HR Procedures Salaries Pension schemes Research support Information for new staff Imperial partners Imperial College Healthcare NHS Trust Imperial College Academic Health Science Centre Imperial College Health Partners Imperial Consultants A-Z Faculties, departments and institutes Research groups Administration and support services People finder College Information Imperial College London Address South Kensington Campus London SW7 2AZ, UK tel: +44 (0)20 7589 5111 Campuses & maps Follow Imperial Facebook Twitter You Tube Linked in Instagram Weibo Site Information Sitemap Accessibility Modern slavery statement Privacy notice Use of cookies Report incorrect content © 2022 Imperial College London Log in
