How to use Krb5LoginModule and give it a user/pass in unix

Question

I need to login using kerberos on a unix machine to call a URL using a windows network. I can use the useTicketCache=true in windows and everything works fine. How do I do this from a unix box and just pass in the user/pass to my java program instead of using the ticket cache?

Answer 1

This is not the way you should go. The human itself should obtain the TGT on Windows logon. You access the TGT then ot obtain a service ticket from KDC. If your unix setup does not use winbind to perform auth, so you don't have access to a prepopulated credential cache, you have three options:

1. Use winbind to manage your unix users in AD
2. Perform a unix kinit
3. Pass a Username and/or PasswordCallback to new LoginContext.

I would favor 1 or 2.

Option two would work like this from Java:

Runtime.exec("kinit " + upn);
// Obtain the input stream of the forked process
is.write(password);
// Check exit code

Now you have a native valid TGT in your credential cache. Java can pick this up now and request further service tickets.