Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose a user process has authenticated itself against domain's directory server via kerberos, and then attempts opens a network socket to my server application.

My server application has a white-list of users from the domain directory server.

How does my server app authenticate the user from the directory based on this socket opening attempt?

(To keep things simple - let's say my server is written in Java, and the directory server is Active Directory)

EDIT My question is about how the client asks for an authentication token.

share|improve this question

migrated from Jun 30 '11 at 22:31

This question came from our site for professional and enthusiast programmers.

Are you writing your server application or are you trying to amend an existing application? What Java Kerberos/GSS libraries have you found? Have you tried using any of them? – sarnold Jun 30 '11 at 21:31
up vote 1 down vote accepted

Essentially, you need to use the Java Authentication and Authorization Service (JAAS) to get your server talking with Active Directory's KDC. The server will ask the client for an authentication token, which it can give to the KDC to validate the client, and then proceed from there based on the white-list.

This article has a fairly extensive example, including code, for performing these tasks.

share|improve this answer
My question was about how the client asks for an authentication token. Could you provide more detail? – Hawkeye Jun 30 '11 at 22:55
I apologize, I read "How does my server app authenticate the user" in the question and went with that. The "GSS client and server applications" section of my second link goes into more detail, but basically, the client app would ask the user for an Active Directory-recognized username and password and then use JAAS to get a Kerberos TGT from the KDC (it sounds like you have that part covered), and then the app would attempt to connect to the server and initiate a GSS session, handing the server a Kerberos ticket to authenticate its user. – Handyman5 Jun 30 '11 at 23:08

The way client asks for auth tokens depends on :

  1. Language / Library used by the client
  2. OS where client would be deployed

Usually client will rely on API exposed by OS to obtain tokens.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.