Re: Authenticating LDAP connection with current windows user's credentials?
bugnthecode wrote:
If you need help understanding this let me know. I'll do what I can.
The program kinit.exe in your JDK will help in making sure that your
java installation can properly read your kerberos ticket. Again, this
may or may not work with a batch job since I don't know if Windows will
store the Kerberos ticket the same way (or at all) for a batch job user
who authenticates. A rendition of the code above was given to me by a
co-worker who also used it in an application that was meant to be run by
users interactively. It works fine for me (as long as you do the
configuration in krb5.ini exactly and of course if you get the code
right too).
HTH
Brandon
Brandon, thanks so much for the code! This was killing me trying to
figure out on my own. I've been playing with this for the past couple
of days, and every once in a while I experience a period of time where
I get some kind of privileged exception being thrown, and in the debug
output the cause is something along the lines of not being able to
find the kerberos server, or that it get response 126 when expecting
14.
I've been able to make slight modifications to the configuration
(specifying the type of encryption in the krb5.ini file) and it will
start working again. I still need to do some extensive testing before
allowing this to run by itself unattended though. Have you seen this
before? It just happens with no modifications being made! I run it,
and it's fine, then run it 2 minutes later and it won't authenticate
properly.
Thanks again for your help with this.
Will
I haven't seen that behavior before. Maybe I got lucky with mine. You
may want to make sure that the kerberos server it uses is the right
server all the time (in case it is contacting the wrong server
sometimes). Java doesn't use the OS's DNS cache from what I can tell so
it is possible to use a hostname and to have it resolve to a different
IP every time you run the program. If you are specifying an IP address
that will mitigate those issues.
Also check the ADS Security log to see if it reports anything useful.
I don't recall having to make any changes to the server-side but if I
think of anything I'll post it.
I'm glad I could be of some help.