0

Suppose a user process has authenticated itself against domain's directory server via kerberos, and then attempts opens a network socket to my server application.

My server application has a white-list of users from the domain directory server.

How does my server app authenticate the user from the directory based on this socket opening attempt?

(To keep things simple - let's say my server is written in Java, and the directory server is Active Directory)


EDIT My question is about how the client asks for an authentication token.

1
  • Are you writing your server application or are you trying to amend an existing application? What Java Kerberos/GSS libraries have you found? Have you tried using any of them?
    – sarnold
    Jun 30, 2011 at 21:31

2 Answers 2

1

Essentially, you need to use the Java Authentication and Authorization Service (JAAS) to get your server talking with Active Directory's KDC. The server will ask the client for an authentication token, which it can give to the KDC to validate the client, and then proceed from there based on the white-list.

This article has a fairly extensive example, including code, for performing these tasks.

2
  • My question was about how the client asks for an authentication token. Could you provide more detail?
    – Hawkeye
    Jun 30, 2011 at 22:55
  • I apologize, I read "How does my server app authenticate the user" in the question and went with that. The "GSS client and server applications" section of my second link goes into more detail, but basically, the client app would ask the user for an Active Directory-recognized username and password and then use JAAS to get a Kerberos TGT from the KDC (it sounds like you have that part covered), and then the app would attempt to connect to the server and initiate a GSS session, handing the server a Kerberos ticket to authenticate its user.
    – Handyman5
    Jun 30, 2011 at 23:08
0

The way client asks for auth tokens depends on :

  1. Language / Library used by the client
  2. OS where client would be deployed

Usually client will rely on API exposed by OS to obtain tokens.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .