JDK-8144971 : NPE in OSB KerberosAuthenticator after upgrade to JDK 1.7.0_80
  • Type: Bug
  • Component: security-libs
  • Sub-Component: org.ietf.jgss
  • Affected Version: 7u80
  • Priority: P3
  • Status: Closed
  • Resolution: Not an Issue
  • Submitted: 2015-12-09
  • Updated: 2016-04-20
  • Resolved: 2016-04-20
Related Reports
Relates :  
JDK-8004488 - wrong permissions checked in krb5
Description
Submitter has an OSB Proxy secured using the OWSM policy
"oracle/wss11_kerberos_token_with_message_protection_basic128_service_policy".
 Accessing the Proxy works fine under 
JDK 1.7.0_21 but under JDK 1.7.0_80 it raises a NullPointerException:

java.lang.NullPointerException
at oracle.wsm.security.policy.scenario.processor.KerberosAuthenticator.<init>(Ker👓 berosAuthenticator.java:83)
at oracle.wsm.security.policy.scenario.processor.KerberosTokenProcessor.verify(Ke👓 rberosTokenProcessor.java:402)
at oracle.wsm.security.policy.scenario.executor.KerberosSecurityScenarioExecutor$1.run(KerberosSecurityScenarioExecutor.java:346)
at oracle.wsm.security.policy.scenario.executor.KerberosSecurityScenarioExecutor$1.run(KerberosSecurityScenarioExecutor.java:344)
at java.security.AccessController.doPrivileged(Native Method)

Submitter feels that this is related to a change made for JDK-8004488. This removes the following code lines from the commit method of the
Krb5LoginModule.

Krb5LoginModule.java (JDK 1.7.0_21)

1061:  // Compatibility; also add keys to privCredSet
1062:  for (KerberosKey key: ktab.getKeys(kerbClientPrinc)) {
1063:    privCredSet.add(new Krb5Util.KeysFromKeyTab(key));
1064:  }
Comments
This is related to the JDK-8004488 changes. I was in touch with Dev to confirm. Before the JDK-8004488 change, there were KerberosKey objects in a JAAS Subject's private credentials set. After that, no more. Both Subject and KerberosKey are public APIs. So I guess the problem is that this application code still assumes that there are KerberosKeys there. Instead, it can look for KeyTab objects now, and call its getKeys() method to read keys. Application code needs to be updated. Closing as not an issue for JDK.
20-04-2016