A scenario that popped up recently was to login a user via Java code to Kerberos and retrieve a GSSCredential object containing the Kerberos ticket. I used Java 8, but this works since Java 7 onwards.
Java offers a Krb5LoginModule class which can be used in conjuction with a LoginContext to achieve this.
The flow is quite simple (once you have read all the Kerberos documentation):
- on the machine where the code runs, place a correct krb5.conf file in the default location for your OS (Windows uses krb5.ini) OR set the java.security.krb5.conf system property pointing to the file
- define a PasswordCallback handler class
- create a LoginContext with a configuration using Krb5LoginModule and provide the password callback handler. The configuration must force the login to request a user input, which will then be routed to the callback handler. It is possible to use a keytab or cache credentials, but it's not shown here
- login the user and get its KerberosTicket
- create a GSSCredentials object using the ticket
This procedure allows handling multiple login mechanisms in the application and even multiple Kerberos realms.
