Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Windows support of native GSS-API in Java 6

From http://java.sun.com/developer/technicalArticles/J2SE/security/#3:

Note: These two system properties are ignored when applications run on operating systems that do not yet support this feature, for example, MS Windows.

That document is from 2006, so things could have changed but I've not found a definitive answer.

I would like to know if the latest release of Sun Java 6 for Windows support native GSS today (to get the TGT without tinkering with the registry).

like image 414
Thorbjørn Ravn Andersen Avatar asked Aug 12 '10 11:08

Thorbjørn Ravn Andersen


People also ask

Why Java GSS API is not secure?

That's because the Java bindings for GSS API are defined in an IETF specification. The specification itself is independent of the security mechanism. One of the popular security mechanism for Java GSS is Kerberos v5. 3.1. Java GSS API Let's try to understand some of the core APIs that builds Java GSS:

How does GSS work with Kerberos?

Now, a GSS mechanism like Kerberos is typically expected to fetch credentials from an existing Subject. The class Subject here is a JAAS abstraction representing an entity like a person or a service. This is usually populated during a JAAS-based authentication.

What is the difference between gsscontext and gsscredential?

GSSContext encapsulates the GSS API security context and provides services available under the context GSSCredential encapsulates the GSS API credentials for an entity that is necessary to establish the security context


2 Answers

Nope

From http://hg.openjdk.java.net/jdk6/jdk6-gate/jdk/file/78235ae077a1/src/share/classes/sun/security/jgss/GSSManagerImpl.java (47):

   47     static {
   48         USE_NATIVE =
   49             AccessController.doPrivileged(new PrivilegedAction<Boolean>() {
   50                     public Boolean run() {
   51                             String osname = System.getProperty("os.name");
   52                             if (osname.startsWith("SunOS") ||
   53                                 osname.startsWith("Linux")) {
   54                                 return new Boolean(System.getProperty
   55                                     (USE_NATIVE_PROP));
   56                             }
   57                             return Boolean.FALSE;
   58                     }
   59             });
   60 
like image 67
Max Caceres Avatar answered Oct 06 '22 12:10

Max Caceres


Finally, native support for the Windows SSPI (the Windows somewhat equivalent of the GSS-API) is in JDK 11 onwards:

https://stackoverflow.com/a/69871106/1504556

Recap:

  • You must be using at least JDK 11.0.10.
  • You must set -Dsun.security.jgss.native=true
  • The new feature isn't yet reflected in the Accessing Native GSS-API page so you'll have to rely on the bug tracker tickets (see above link) and/or release notes in order to understand the new feature.
like image 30
peterh Avatar answered Oct 06 '22 10:10

peterh