-
Enhancement
-
Resolution: Fixed
-
P3
-
7
-
b43
-
Verified
Issue | Fix Version | Assignee | Priority | Status | Resolution | Resolved In Build |
---|---|---|---|---|---|---|
JDK-8084733 | emb-9 | Weijun Wang | P3 | Resolved | Fixed | team |
JDK-8239186 | openjdk8u252 | Andrew Hughes | P3 | Resolved | Fixed | b03 |
JDK-8237155 | openjdk8u242 | Andrew Hughes | P3 | Resolved | Fixed | b07 |
JDK-8240022 | openjdk7u | Andrew Hughes | P3 | Resolved | Fixed | master |
obtain a renewable ticket.
/usr/bin/kinit [-ARvV] [-p | -P] [-f | -F] [-a] [-c cache_name]
[-C] [-E] [-k [-t keytab_file]] [-l lifetime]
[-r renewable_life] [-s start_time] [-n] [-S service_name]
[-X attribute[=value]] [-T armor_ccache] [principal]
But Java's kinit implementation does not allow for a renewable options
C:\Program Files\Java\jdk1.7.0_55\bin>kinit.exe -help
Usage: kinit [-A] [-f] [-p] [-c cachename] [[-k [-t keytab_file_name]]
[principal] [password]
available options to Kerberos 5 ticket request:
-A do not include addresses
-f forwardable
-p proxiable
-c cache name (i.e., FILE:\d:\myProfiles\mykrb5cache)
-k use keytab
-t keytab file name
principal the principal name (i.e., qweadf@ATHENA.MIT.EDU qweadf)
password the principal's Kerberos password
C:\Program Files\Java\jdk1.7.0_55\bin>
http://docs.oracle.com/javase/7/docs/technotes/tools/windows/kinit.html
Also,Can we add an extra function along with "renewable" that allows users to
set the expiry time please? That is the "-l" option, which can be used to set
the lifetime of the kerberos ticket. Here is the extract from the krb5 spec:
-l lifetime
(Time duration string.) Requests a ticket with the lifetime "lifetime".
For example, kinit -l 5:30 or kinit -l 5h30m
If the -l option is not specified, the default ticket lifetime (configured by each site) is used.
Specifying a ticket lifetime longer than the maximum ticket lifetime
(configured by each site) will not override the configured maximum ticket lifetime.
Also, I noticed that Java Kinit doesn't honour the krb5.conf setting
"ticket_lifetime" or "renew_lifetime". Not sure if it's something you want to
support in Java, thought I would mention this as well.
- backported by
-
JDK-8084733 Add kinit options and krb5.conf flags that allow users to obtain renewable tickets and specify ticket lifetimes
- Resolved
-
JDK-8237155 Add kinit options and krb5.conf flags that allow users to obtain renewable tickets and specify ticket lifetimes
- Resolved
-
JDK-8239186 Add kinit options and krb5.conf flags that allow users to obtain renewable tickets and specify ticket lifetimes
- Resolved
-
JDK-8240022 Add kinit options and krb5.conf flags that allow users to obtain renewable tickets and specify ticket lifetimes
- Resolved
- relates to
-
JDK-8131051 KDC might issue a renewable ticket even if not requested
- Closed
-
JDK-8153932 Update Kerberos 5 GSS-API Mechanism technotes
- Resolved
-
JDK-8158827 kinit doesn't read forwardable & proxiable flags values from krb5.conf file
- Closed
-
JDK-8058290 JAAS Krb5LoginModule has suspect ticket-renewal logic, relies on clockskew grace
- Closed