Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8044500

Add kinit options and krb5.conf flags that allow users to obtain renewable tickets and specify ticket lifetimes

XMLWordPrintable

    • b43
    • Verified

        kerberos kinit implementations, support a "-r" option which allows users to
        obtain a renewable ticket.

              /usr/bin/kinit [-ARvV] [-p | -P] [-f | -F] [-a] [-c cache_name]
                   [-C] [-E] [-k [-t keytab_file]] [-l lifetime]
                   [-r renewable_life] [-s start_time] [-n] [-S service_name]
                   [-X attribute[=value]] [-T armor_ccache] [principal]
         
        But Java's kinit implementation does not allow for a renewable options
         
         C:\Program Files\Java\jdk1.7.0_55\bin>kinit.exe -help
         Usage: kinit [-A] [-f] [-p] [-c cachename] [[-k [-t keytab_file_name]]
         [principal] [password]
                available options to Kerberos 5 ticket request:
                     -A do not include addresses
                     -f forwardable
                     -p proxiable
                     -c cache name (i.e., FILE:\d:\myProfiles\mykrb5cache)
                     -k use keytab
                     -t keytab file name
                     principal the principal name (i.e., qweadf@ATHENA.MIT.EDU qweadf)
                    password the principal's Kerberos password
         
         C:\Program Files\Java\jdk1.7.0_55\bin>
         
        http://docs.oracle.com/javase/7/docs/technotes/tools/windows/kinit.html

        Also,Can we add an extra function along with "renewable" that allows users to
        set the expiry time please? That is the "-l" option, which can be used to set
        the lifetime of the kerberos ticket. Here is the extract from the krb5 spec:

        -l lifetime
        (Time duration string.) Requests a ticket with the lifetime "lifetime".
        For example, kinit -l 5:30 or kinit -l 5h30m
        If the -l option is not specified, the default ticket lifetime (configured by each site) is used.
        Specifying a ticket lifetime longer than the maximum ticket lifetime
        (configured by each site) will not override the configured maximum ticket lifetime.

        Also, I noticed that Java Kinit doesn't honour the krb5.conf setting
        "ticket_lifetime" or "renew_lifetime". Not sure if it's something you want to
        support in Java, thought I would mention this as well.

          There are no Sub-Tasks for this issue.

              weijun Weijun Wang
              asaha Abhijit Saha
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated:
                Resolved: