The Kerberos network authentication protocol is defined in
RFC 4120. The Java
platform contains support for the client side of Kerberos via the
org. package. There might also be
a login module that implements
LoginModule to authenticate
Kerberos principals.
You can provide the name of your default realm and Key Distribution
Center (KDC) host for that realm using the system properties
java.security.krb5.realm and
java.security.krb5.kdc. Both properties must be set.
Alternatively, the java.security.krb5.conf system property
can be set to the location of an MIT style krb5.conf configuration
file. If none of these system properties are set, the krb5.conf
file is searched for in an implementation-specific manner. Typically,
an implementation will first look for a krb5.conf file in
<java-home>/conf/security and failing that, in an OS-specific
location.
The krb5.conf file is formatted in the Windows INI file style,
which contains a series of relations grouped into different sections.
Each relation contains a key and a value, the value can be an arbitrary
string or a boolean value. A boolean value can be one of "true", "false",
"yes", or "no", and values are case-insensitive.
| Modifier and Type | Class and Description |
|---|---|
| public class | DelegationPermission
Deprecated
for removal since 25. This permission cannot be used for controlling access to resources
as the Security Manager is no longer supported.
This class is for Kerberos delegation permissions.
|
| public class | EncryptionKey
This class encapsulates an EncryptionKey used in Kerberos. |
| pack-priv class | |
| public class | KerberosCredMessage
This class encapsulates a Kerberos 5 KRB_CRED message which can be used to send Kerberos credentials from one principal to another. |
| public class | KerberosKey
This class encapsulates a long term secret key for a Kerberos principal. |
| public class | KerberosPrincipal
This class encapsulates a Kerberos principal. |
| public class | KerberosTicket
This class encapsulates a Kerberos ticket and associated information as viewed from the client's point of view. |
| pack-priv class | KeyImpl
This class encapsulates a Kerberos encryption key. |
| public class | KeyTab
This class encapsulates a keytab file. |
| pack-priv class | |
| pack-priv class | |
| public class | ServicePermission
Deprecated
for removal since 25. This permission cannot be used for controlling access to resources
as the Security Manager is no longer supported.
A ServicePermission contains a service principal name and
a list of actions which specify the context the credential can be
used within.
|
