Kerberos Login Handler and multiple KDCs

[Douglas E. Engert]

P.S.
also look at the https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass
and the look a the examples of whats in the login.config file
for com.sun.security.auth.module.Krb5LoginModule
You might be able to add the refreshKrb5Config = "true"


On 4/3/2012 4:23 PM, Douglas E. Engert wrote:
>
>
> On 4/3/2012 3:07 PM, Martin B. Smith wrote:
>> On 04/03/2012 04:02 PM, Cantor, Scott wrote:
>>> My guess is there's state in the module somewhere, and the IdP is causing the state to be maintained and yours isn't. The state itself is probably in the Kerberos library in Java.
>>
>> hey Scott,
>>
>> I'm currently in the process of trying to reproduce the differences between my trivial example and UsernamePasswordLoginServlet which is what appears to be doing the JAAS API calls in the IdP.
>>
>> Everything looks the same so far between the caller I wrote and the caller in the IdP, but I'll report back if I find anything as I go.
>>
>> Thanks for the advice.
>
> It is not clear why you consider it a problem that the first KDC is not used all the time.
>
> But it may have to do with the refreshKrb5Config option of the Krb5LoginModule. Having this option
> implies that some information is cached between logins.
>
>    http://docs.oracle.com/javase/6/docs/jre/api/security/jaas/spec/com/sun/security/auth/module/Krb5LoginModule.html
>
> The version of java-kerberos-idp-login-handler we are running does set refreshKrb5Config = true in
> src/main/java/ch/SWITCH/aai/idp/kerberos/krbLoginModul.java
>
>>
>>
>> --
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>

-- 

  Douglas E. Engert  <DEEngert at anl.gov>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444