Bug ID: JDK-8215032 Support Kerberos cross-realm referrals (RFC 6806)

Versions (Unresolved/Resolved/Fixed)

The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.

JDK 11	JDK 13	JDK 14	JDK 8	Other
11.0.6Fixed	13 b25Fixed	14Fixed	8u270Fixed	openjdk8u242Fixed

The goal of this enhancement is to support Kerberos cross-realm referrals in OpenJDK's client, according to RFC 6806 [1].

This enhancement includes support of:

 * Canonicalize flag and NT-ENTERPRISE principals in AS requests
 * Client referrals (AS requests)
 * Server referrals (TGS requests)
 * FAST - RFC 6806 Section 11
 * Referrals cache

--
[1] - https://tools.ietf.org/html/rfc6806.html

Fix Request (8u) I'd like to request a 8u backport of this enhancement. The reason is to enable JDK-8 users to use the OpenJDK Kerberos client in more complex and dynamic environments. This will also bring feature parity with other Kerberos clients, such as MIT's client in Linux. Patch does not apply cleanly to 8u so a review has been requested here: https://mail.openjdk.java.net/pipermail/jdk8u-dev/2019-November/010555.html
19-11-2019
Removing jdk11u-fix-yes label due to missing CSR for the backport. Will re-approve once CSR review was conducted successfully.
30-08-2019
Fix Request (jdk11u) I'd like to request a jdk11u backport of this enhancement. The reason is to enable JDK-11 users to use the OpenJDK Kerberos client in more complex and dynamic environments. This will also bring feature parity with other Kerberos clients, such as MIT's client in Linux. Patch applies cleanly to jdk11u except for a couple of copyright header dates. Update: even though the patch applies cleanly, a review process will be needed because of a missing dependency.
20-08-2019
Sure, when I said "(yes, I know about 8-pool and 11-pool, that is much more tedious)", I meant "hollow" backport issues with {8,11}-pool. That is too much work for the issue that might not end up backported at all. Simplicity, consistency with the "Bug" issues, much smaller red tape volume win here.
07-06-2019
Hmm, in that case I would have created backport issues (see the More drop down menu).
07-06-2019
Well, that is the easiest way to keep track of backports work (yes, I know about 8-pool and 11-pool, that is much more tedious). In some sense, "8" and "11" are affected by not having this enhancement, it would go better with synopsis like "OpenJDK does not support Kerberos cross-realm referrals (RFC 6806)", but it is what it is.
07-06-2019
[~shade] It's a little odd to have an Enhancement affecting previous versions of the JDK (how can they be affected if they don't support it?), can you explain why you added that?
07-06-2019
URL: http://hg.openjdk.java.net/jdk/jdk/rev/d65d3c37232c User: mbalao Date: 2019-06-06 14:56:26 +0000
06-06-2019
[~mbalao] This enhancement needs to be reviewed and pushed before Rampdown Phase 1 on 2019/06/13 to be included in JDK 13.
03-06-2019

CSR :	JDK-8223172 - Support Kerberos cross-realm referrals (RFC 6806)
Duplicate :	JDK-8237647 - LoginException: Message stream modified (41) for uppercase username with krb5
Duplicate :	JDK-6631053 - Support canonicalize in Kerberos configuration file
Relates :	JDK-8227061 - KDC.java test behaves incorrectly when AS-REQ contains a PAData not PA-ENC-TS-ENC
Relates :	JDK-8227437 - S4U2proxy cannot continue because server's TGT cannot be found
Relates :	JDK-8233946 - Add @since 13 annotation to KerberosPrincipal.KRB_NT_ENTERPRISE field
Relates :	JDK-8246193 - Possible NPE in ENC-PA-REP search in AS-REQ
Relates :	JDK-8227381 - GSS login fails with PREAUTH_FAILED
Relates :	JDK-8273894 - ConcurrentModificationException raised every time ReferralsCache drops referral
Relates :	JDK-8226719 - Kerberos login to Windows 2000 failed with "Inappropriate type of checksum in message"
Relates :	JDK-8250582 - Revert Principal Name type to NT-UNKNOWN when requesting TGS Kerberos tickets