Single Sign-On with Java Client

Question

I am looking for a Single Sign-On authentication in a Java client.

Since I am logged in to Windows using an AD, the main goal is that I do not have to enter username and password again. I want Java to use the Ticket I recieved at Windows-login. This code is the best I have for the purpose:

LoginContext lc = new LoginContext("com.sun.security.jgss.krb5.initiate", new DialogCallbackHandler());
lc.login();
Subject.doAs(lc.getSubject(), (PrivilegedExceptionAction<Void>) () -> {
            System.out.println("This is privileged");
            return null;
        });

I've set the java.security.krb5.conf and java.security.auth.login.config properties with corresponding conf-files, but still a dialog asking for Username and Password pops up.

I also tried working with GSSName, but GSSManager.createCredential() is also asking for Username and Password (probably using the TextCallbackHandler()).

I tried to get along with Waffle, but did not get it working. Most examples and explanations are Server sided (I only found one example combining server and client side, but I was not able to split it up).

I know, there are Similar questions (e.g. this), but i did not get that working without entering a password.

PS: i know, that DialogCallbackHandler is depricated, I use it for test purposes only.

Answer 1

Ok, after several tries I found a solution. The problem was not in the code, but in the registry. As stated on this page, since Java 7 You can't access the ticket of Windows natively. To change this, You have to set an additional registry key. For this, go into the registry folder

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters

and add the key

Value Name: AllowTgtSessionKey
Value Type: REG_DWORD
Value: 0x01

---

To fully make this work you will need some additional settings:

The jaas configuration file

In the jaas configuration file you have to set up which security modules jaas should use. The part in front of the brackets names your configuration. If you use the GSS libraries you must name it com.sun.security.jgss.krb5.initiate. When you use the LoginContext you just pass the name of the configuration as first parameter. My jaas.conf look as follows:

com.sun.security.jgss.krb5.initiate {
    com.sun.security.auth.module.Krb5LoginModule required
        useTicketCache = true;
 };

The kerberos configuration

You will also need a configuration for the Kerberos module. This mainly contains the realm address, but can hold additional information. A minimal working example:

[realms]
    YOUR.REALM.COM = {
        kdc = your.realm.com:88
        default_domain = REALM.COM
    }

Note, that this is case sensitive!

The System Properties

Finally, you have to set up Java to find this files. You do this either by giving the properties on startup or by calling System.setProperty():

System.setProperty("java.security.krb5.conf", "src/resources/krb5.conf");
System.setProperty("java.security.auth.login.config", "src/resources/jaas.conf");