11:41 a.m.
I have a web app that is secured by KC and uses Active Directory to authenticate users.
I have a requirement to get a Kerberos ticket (GSSCredential) to connect to an IBM i
Server.
SSO/EIM is successfully setup on the IBM i.
My Web app is following the instructions at
https://www.keycloak.org/docs/latest/server_admin/index.html#credential-d...
My servlet code
KeycloakPrincipal<KeycloakSecurityContext> kcp =
(KeycloakPrincipal<KeycloakSecurityContext>)request.getUserPrincipal();
AccessToken at = kcp.getKeycloakSecurityContext().getToken();
String username = at.getPreferredUsername();
System.out.println(at.getName());
wtr.append("Windows User: ").append(username).append('\n');
// Retrieve kerberos credential from accessToken and deserialize it
Map<String, Object> otherClaims = at.getOtherClaims();
String otherClaim =
(String)otherClaims.get(KerberosConstants.GSS_DELEGATION_CREDENTIAL);
GSSCredential gssCredential =
KerberosSerializationUtils.deserializeCredential(otherClaim);
The otherClaims map is always empty.
KerberosSerializationUtils.deserializeCredential(otherClaim); throws this exception since
otherClaim is null;
org.keycloak.common.util.KerberosSerializationUtils$KerberosSerializationException: Null
credential given as input. Did you enable kerberos credential delegation for your web
browser and mapping of gss credential to access token?, Java version: 1.8.0_192, runtime
version: 1.8.0_192-b12, vendor: Oracle Corporation, os: 6.2
at
org.keycloak.common.util.KerberosSerializationUtils.deserializeCredential(KerberosSerializationUtils.java:70)
at testing.LogIn.doGet(LogIn.java:71)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:622)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:729)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:292)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207)
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:212)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:94)
at
org.keycloak.adapters.tomcat.AbstractAuthenticatedActionsValve.invoke(AbstractAuthenticatedActionsValve.java:67)
at
org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:604)
at
org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorValve.invoke(AbstractKeycloakAuthenticatorValve.java:181)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:141)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:80)
at
org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:620)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:502)
at
org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1152)
at
org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:684)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1539)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1495)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Thread.java:748)
Kerbos delegation is enabled in the browser and mapping of gss credential to access token
What am I missing?