Re: [keycloak-dev] [keycloak-user] Get a GSSCredential when user browser is not in Active Directory domain

I originally asked this on the user list but I'm making a change to Federation. I had asked on the dev list earlier about this on the dev as I started to see how this would work I got the Kerberos Ticket and serialized it to a Base 64 string. it deserializes to a GSSCredential Now I have to put the Base 64 token into the access token Any guidance? -----Original Message----- From: keycloak-user-bounces(a)lists.jboss.org <keycloak-user-bounces(a)lists.jboss.org&gt; On Behalf Of Chris Smith Sent: Thursday, February 7, 2019 2:17 AM To: Marek Posolda <mposolda(a)redhat.com>; Dmitry Telegin <dt(a)acutus.pro>; keycloak-user(a)lists.jboss.org Subject: Re: [keycloak-user] Get a GSSCredential when user browser is not in Active Directory domain So I made a small addition and stepped through the authenticate method public Subject authenticateSubject(String username, String password) throws LoginException { String principal = getKerberosPrincipal(username); logger.debug("Validating password of principal: " + principal); loginContext = new LoginContext("does-not-matter", null, createJaasCallbackHandler(principal, password), createJaasConfiguration()); loginContext.login(); logger.debug("Principal " + principal + " authenticated succesfully"); ** Subject subject = loginContext.getSubject(); ** for (KerberosTicket ticket : subject.getPrivateCredentials(KerberosTicket.class)) { ** System.out.println(ticket.getClient().getName()); ** } return loginContext.getSubject(); } The subject that is gotten from the loginContext has one KerberosTicket private credential Googling has not given me any insight on where I go from here. Do you have any suggestions? -----Original Message----- From: Marek Posolda <mposolda(a)redhat.com&gt; Sent: Tuesday, January 29, 2019 4:07 AM To: Dmitry Telegin <dt(a)acutus.pro>; Chris Smith <chris.smith(a)cmfirstgroup.com>; keycloak-user(a)lists.jboss.org Subject: Re: [keycloak-user] Get a GSSCredential when user browser is not in Active Directory domain +1 GSSCredential is used just during SPNEGO authentication. You may possibly change the built-in authentication flows or userStorage provider, so that after verification with username/password, the GSSCredential will be somehow obtained from the JAAS Subject used for the authentication (See class KerberosUsernamePasswordAuthenticator for the details). However I am not sure if this is really possible and it will require some more deep-dive into the Keycloak codebase and Kerberos implementation in JDK... Just a hint... Marek On 28/01/2019 07:21, Dmitry Telegin wrote: _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user