Relates :
|
|
Relates :
|
|
Relates :
|
|
Relates :
|
JDK-8055763 :
|
kerberos kinit implementations, support a "-r" option which allows users to obtain a renewable ticket. /usr/bin/kinit [-ARvV] [-p | -P] [-f | -F] [-a] [-c cache_name] [-C] [-E] [-k [-t keytab_file]] [-l lifetime] [-r renewable_life] [-s start_time] [-n] [-S service_name] [-X attribute[=value]] [-T armor_ccache] [principal] But Java's kinit implementation does not allow for a renewable options C:\Program Files\Java\jdk1.7.0_55\bin>kinit.exe -help Usage: kinit [-A] [-f] [-p] [-c cachename] [[-k [-t keytab_file_name]] [principal] [password] available options to Kerberos 5 ticket request: -A do not include addresses -f forwardable -p proxiable -c cache name (i.e., FILE:\d:\myProfiles\mykrb5cache) -k use keytab -t keytab file name principal the principal name (i.e., qweadf@ATHENA.MIT.EDU qweadf) password the principal's Kerberos password C:\Program Files\Java\jdk1.7.0_55\bin> http://docs.oracle.com/javase/7/docs/technotes/tools/windows/kinit.html Also,Can we add an extra function along with "renewable" that allows users to set the expiry time please? That is the "-l" option, which can be used to set the lifetime of the kerberos ticket. Here is the extract from the krb5 spec: -l lifetime (Time duration string.) Requests a ticket with the lifetime "lifetime". For example, kinit -l 5:30 or kinit -l 5h30m If the -l option is not specified, the default ticket lifetime (configured by each site) is used. Specifying a ticket lifetime longer than the maximum ticket lifetime (configured by each site) will not override the configured maximum ticket lifetime. Also, I noticed that Java Kinit doesn't honour the krb5.conf setting "ticket_lifetime" or "renew_lifetime". Not sure if it's something you want to support in Java, thought I would mention this as well.
|