[27536] in Kerberos
Re: Extract Information from Ticket.
daemon@ATHENA.MIT.EDU (Michael B Allen)
Mon Mar 5 11:34:25 2007
Date: Mon, 5 Mar 2007 11:34:03 -0500
From: Michael B Allen <mba2000@ioplex.com>
To: "Bruce Stewart" <BruceS@nsfas.org.za>
Message-Id: <20070305113403.617a24a1.mba2000@ioplex.com>
In-Reply-To: <A7589312AB39244FA9071CC60A97951EB13C2F@commsbert.nsfas.org.za>
Mime-Version: 1.0
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On Mon, 5 Mar 2007 10:18:15 +0200
"Bruce Stewart" <BruceS@nsfas.org.za> wrote:
> > The
> > stock jcifs distribution only supports NTLM SSO (but that
> > actually works
> > quite well assuming you don't need delegation).
>
> FWIW...the spnego classes accept NTLM aswell as Kerberos tokens - which was a problem for us - we only wanted Kerberos tokens (because we wanted delegation). I created our own bare bones version of the jcifs.spnego.Authentication class - removed the jcifs dependencies (i.e. NTLM code), "client" code and reflection based GSS-API code. Instead of returning a Principal with authentication.getPrincipal(), we return a javax.security.auth.Subject (which contains the KerberosPrincipal and KerberosTicket) with getSubject(). That allows us to use Subject.doAs(subject, ...) etc.
>
> Using the jcifs-ext code as a guide it was pretty easy for us to create exactly what we needed.
Yes, the peculiararities of the jcifs-ext SPNEGO classes using reflextion
has made it difficult for me to accept it into the stock distro. And
thus jcifs-krb5 (which uses those classes) is a separate package.
Mike
--
Michael B Allen
PHP Active Directory SSO
http://www.ioplex.com/
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
