Kerberos Login Handler and multiple KDCs

[Martin B. Smith]

On 04/03/2012 03:46 PM, Cantor, Scott wrote:
>> I specifically meant the LoginHandler code used in the IdP.
> I don't know what login handler you mean. The only Kerberos code I'm aware of is the SPNEGO stuff, which is very different, and the JAAS module, which is not IdP code. There is no "Kerberos" login handler in the standard IdP for doing password checking against Kerberos. That's JAAS via the UsernamePassword handler.
>
>> >  I've been
>> >  unable to reproduce the 'bad' behavior with the Sun/Oracle JAAS module
>> >  when I directly use it in plain-old Java code. So I'm pretty sure I can
>> >  rule out the Sun/Oracle JAAS module.
> Unless you're not using it, there is no other possible source. The issue is either that code, or how it's loaded and managed in the JAAS layer.
>
> -- Scott

hey Scott,

You're right -- I should clarify. We're doing,

"JAAS via the UsernamePassword handler." I seem to get different 
behavior using JAAS in the 2.3.x IdP compared to when I do it by hand in 
a trivial example program (specifically, selecting a KDC is behaving 
differently).

It sounds like you're recommending I look at the JAAS configuration in 
our IdP. I'll revisit it.

Thanks,
-- 
Martin B. Smith
smithmb at ufl.edu - (352) 273-1374
CNS/Open Systems Group
University of Florida

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4893 bytes
Desc: S/MIME Cryptographic Signature
Url : http://shibboleth.net/pipermail/users/attachments/20120403/981a3a80/attachment.bin