Mailing-List: contact users-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@directory.apache.org
Received-SPF: pass (nike.apache.org: local policy)
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----_=_NextPart_001_01C9D3CA.4C2810F3"
Subject: Exporting kerberos keys from service principal
Date: Wed, 13 May 2009 14:56:55 +0200
Message-ID: <96B58CE679D9514B87F3149C1036B1B3248C02@INFRA-BLN-EX.psi.de>
Thread-Topic: Exporting kerberos keys from service principal
Thread-Index: AcnTykriND7qMBXfTqOkwPY3V9+gSw==
From: "Rippich, Andrej" <A.Rippich@psi-bt.de>
To: <users@directory.apache.org>

------_=_NextPart_001_01C9D3CA.4C2810F3
Content-Type: text/plain;
	charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable

Hi all,

I'm trying to set up a simple (and sample) web application which uses
Kerberos as authentication protocol.

I'm using Apache DS 1.5.1 as KDC.

I've created two service principals (krbtgt and a principal which
belongs to my target service) and a user principal.

I'm using JGSS with Sun's Krb5LoginModule with Java 6.

=20

Because I don't now how to export the generated keys for the service
principal I've set a plain text password for my service principal. I've
further created a Keytab using the Java Tool ktab (ktab -a
server/hostname@EXAMPLE.COM plaintext password) using the same password
as I used when creating the service principal.

When I'm trying to run my application the client is able to get the TGT
and TGS ticket but on the server side the JGSS context acceptSecContext
call fails.

The JGSS debug output is:  (Mechanism level: Integrity check on
decrypted field failed (31)).

It seems to me there is something wrong with the keys of the service
principal but as I'm starting with Kerberos I'm not sure what exactly
causes the problem.

=20

My question, is there a way (without writing my own Tool using
Ldap/JNDI) to export generated keys of a service principal from Apache
DS to a keytab?=20

Or is there another solution and my approach is wrong?

Thanks in advance

Andrej


------_=_NextPart_001_01C9D3CA.4C2810F3--