Kerberos Login Handler and multiple KDCs

[Cantor, Scott]

> You're right -- I should clarify. We're doing,
> 
> "JAAS via the UsernamePassword handler." I seem to get different
> behavior using JAAS in the 2.3.x IdP compared to when I do it by hand in
> a trivial example program (specifically, selecting a KDC is behaving
> differently).

Ok, then my second reply is wrong. The terminology is a problem because that contribution for SPNEGO *is* called "KerberosLoginHandler". I probably would not have called it that because SPNEGO is not Kerberos, and when people think we have a Kerberos handler, they usually mean the JAAS thing.

> It sounds like you're recommending I look at the JAAS configuration in
> our IdP. I'll revisit it.

What I'm suggesting is that any difference is by definition due to a difference between what the IdP does with JAAS and what your test program does. Obviously the JAAS module is the same code in both, so that leaves the code calling it.

My guess is there's state in the module somewhere, and the IdP is causing the state to be maintained and yours isn't. The state itself is probably in the Kerberos library in Java.

-- Scott