FULL PRODUCT VERSION :
java version "1.7.0"
Java(TM) SE Runtime Environment (build 1.7.0-b147)
Java HotSpot(TM) Client VM (build 21.0-b17, mixed mode, sharing)

A DESCRIPTION OF THE PROBLEM :
The call to LoginContext.login() fails with an exception if the LoginContext is configured to use Krb5LoginModule with the following options:

storeKey="true"
useKeyTab="false"
isInitiator="false"

This appears to be a regression due to an attempt to solve bug '6941083'.

The following source code is taken from Kb5LoginModule.attemptAuthentication(false):

if (ktab == null) {
        promptForPass(getPasswdFromSharedState);
        builder = new KrbAsReqBuilder(principal, password);
        if (isInitiator) {
                // XXX Even if isInitiator=false, it might be
                // better to do an AS-REQ so that keys can be
                // updated with PA info
                cred = builder.action().getCreds();
        }
        if (storeKey) {
                encKeys = builder.getKeys();
                // When encKeys is empty, the login actually fails.
                // For compatibility, exception is thrown in commit().
        }
}

This code path results builder.getGeys() being called while the builder's state is 'INIT'.
The builder asserts via checkState() that the state is REQ_OK, hence an exception.

This is a regression, as JRE6 and prior versions called EncryptionKey.acquireSecretKeys()
to obtain the keys in this case.

REGRESSION. Last worked in version 6u26

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
See the executable test case below. Program should be run on a Windows machine that is joined to a domain. Replace 'REALM', 'KDC', 'DOMAIN_USER' and 'DOMAIN_USER_PWD' as appropriate before running

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
"Login succeeded" printed to console
ACTUAL -
"Login failed" printed to console.
Exception stacktrace printed to strerr

ERROR MESSAGES/STACK TRACES THAT OCCUR :
javax.security.auth.login.LoginException: java.lang.IllegalStateException: Cannot get keys at REQ_OK state
at sun.security.krb5.KrbAsReqBuilder.checkState(Unknown Source)
at sun.security.krb5.KrbAsReqBuilder.getKeys(Unknown Source)
at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Unknown Source)
at com.sun.security.auth.module.Krb5LoginModule.login(Unknown Source)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at javax.security.auth.login.LoginContext.invoke(Unknown Source)
at javax.security.auth.login.LoginContext.access$000(Unknown Source)
at javax.security.auth.login.LoginContext$4.run(Unknown Source)
at javax.security.auth.login.LoginContext$4.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.login.LoginContext.invokePriv(Unknown Source)
at javax.security.auth.login.LoginContext.login(Unknown Source)
at LoginModuleExample.main(LoginModuleExample.java:43)

at javax.security.auth.login.LoginContext.invoke(Unknown Source)
at javax.security.auth.login.LoginContext.access$000(Unknown Source)
at javax.security.auth.login.LoginContext$4.run(Unknown Source)
at javax.security.auth.login.LoginContext$4.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.login.LoginContext.invokePriv(Unknown Source)
at javax.security.auth.login.LoginContext.login(Unknown Source)
at LoginModuleExample.main(LoginModuleExample.java:43)

REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
import java.util.HashMap;
import java.util.Map;

import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.NameCallback;
import javax.security.auth.callback.PasswordCallback;
import javax.security.auth.login.AppConfigurationEntry;
import javax.security.auth.login.AppConfigurationEntry.LoginModuleControlFlag;
import javax.security.auth.login.Configuration;
import javax.security.auth.login.LoginContext;

import com.sun.security.auth.module.Krb5LoginModule;

public class LoginModuleExample {

// Replace with the realm and KDC of the Windows domain.
private static final String REALM = "DEV-DEM.RECOMMIND.COM";
private static final String KDC = "AU-DEV-DC01.dev-dem.recommind.com";

// Replace with the username and password of any account on the
// above domain. Account needs to be enabled and not locked out.
private static final String DOMAIN_USER = "sgr";
private static final String DOMAIN_USER_PWD = "0rodriguez)";

private static final String EXAMPLE_SERVER_LOGIN = "example-server";

/**
* @param args
*/
public static void main(String[] args) {

System.setProperty("java.security.krb5.realm", REALM);
System.setProperty("java.security.krb5.kdc", KDC);

Configuration.setConfiguration(new CustomConfiguration());

try {
CallbackHandler handler = getUsernamePasswordHandler(DOMAIN_USER, DOMAIN_USER_PWD);

LoginContext loginContext = new LoginContext(EXAMPLE_SERVER_LOGIN, handler);

loginContext.login();

System.out.println("Login succeeded");
}
catch (Exception e) {

System.out.println("Login failed");
e.printStackTrace();
}

}

private static CallbackHandler getUsernamePasswordHandler(final String username, final String password) {

final CallbackHandler handler = new CallbackHandler() {

public void handle(final Callback[] callback) {
for (int i = 0; i < callback.length; i++) {
if (callback[i] instanceof NameCallback) {
final NameCallback nameCallback = (NameCallback) callback[i];
nameCallback.setName(username);
}
else if (callback[i] instanceof PasswordCallback) {
final PasswordCallback passCallback = (PasswordCallback) callback[i];
passCallback.setPassword(password.toCharArray());
}
}
}
};

return handler;
}

final static class CustomConfiguration extends Configuration {

@Override
public AppConfigurationEntry[] getAppConfigurationEntry(String name) {

AppConfigurationEntry[] entries = new AppConfigurationEntry[0];

if (name.equals(EXAMPLE_SERVER_LOGIN)) {
String krbModule = Krb5LoginModule.class.getName();
LoginModuleControlFlag flag = LoginModuleControlFlag.REQUIRED;
Map<String, String> options = new HashMap<String, String>();

options.put("storeKey", "true");
options.put("useKeyTab", "false");
options.put("isInitiator", "false");

AppConfigurationEntry entry = new AppConfigurationEntry(krbModule, flag, options);

entries = new AppConfigurationEntry[] { entry };
}

return entries;
}
}
}

---------- END SOURCE ----------