Re: [keycloak-user] GSS delegation credential mapper

On 08/08/18 13:33, Paolo Tedesco wrote: I think nothing else is needed on Keycloak side. For the Kerberos, there is a need to configure the tickets as "forwardable" in the kerberos client configuration (usually in /etc/krb5.conf ). There might be also a need to configure browser (For example in FF it is "|network.negotiate-auth.delegation-uris" ). | ||Good thing to detect, if the delegation is missing at the SPNEGO flow side or at Keycloak side is to enable DEBUG logging at least for the category: org.keycloak.federation.kerberos.impl.SPNEGOAuthenticator . After successful login, you should see some message (see sources here): String message =new StringBuilder("SPNEGO Security context accepted with token: " +responseToken) .append(", established: ").append(gssContext.isEstablished()) .append(", credDelegState: ").append(gssContext.getCredDelegState()) .append(", mutualAuthState: ").append(gssContext.getMutualAuthState()) .append(", lifetime: ").append(gssContext.getLifetime()) .append(", confState: ").append(gssContext.getConfState()) .append(", integState: ").append(gssContext.getIntegState()) .append(", srcName: ").append(gssContext.getSrcName()) .append(", targName: ").append(gssContext.getTargName()) .toString(); log.debug(message); If you see the credDelegState is null, you know that you need to figure at the Kerberos/SPNEGO flow level. Otherwise at Keycloak level. For inspiration, you can take a look at the "kerberos" example from the Keycloak-examples distribution, which is showing delegation. Marek