[security-dev 00034]: Re: JGSS: Re-construct Credentials.acquireTGTFromCache

[Max (Weijun) Wang]

Hi Andrew

The current CredentialsCache.getInstance() on Windows should always  
return the file cache, right? Inside the acquireDefaultCreds()  
method, if cache.getDefaultCreds() returns a non-null object which  
has the correct eType, then LSA is never read.

Take this for example:

1. User login Active Directory as A
2. User's JAAS login config includes "principal=A"

Now, acquireTGTFromCache returns the TGT for A in LSA. However, if

3. User run "kinit B" and generate a file cache for user B

acquireTGTFromCache returns NULL, since the TGT for B in fcache is  
first returned and then ignored.

On Jan 2, 2008, at 8:39 PM, Andrew Fan wrote:

> Just as the comments, "// The default ticket cache on Windows is  
> not a file." So I don't think there are some credentials missed, or  
> won't get read.
>
> For the send question, the current CredentialsCache is implemented  
> as a file based cache.  It's a good idea that we adjust the  
> CredentialsCache to accept LSA on windows platform.  I made a few  
> updates on MemoryCredentialsCache, and CredentialsCache  to accept   
> MemoryCredentialsCache months ago, I haven't test it completely. I  
> never thought about that it could be used to improve the  
> acquireTGTFromCache.

Oh, this is cool. The whole ccache picture for Windows may include  
file cache, MIT-style in-memory cache, Windows LSA cache. Does this  
mean there should return 3 kinds of CredentialsCache objects? Is  
something like CredentialsCache.getAllInstances() needed?

Thanks
Max

>
> Andrew
>
> Weijun Max Wang wrote:
>> Hi All
>>
>> Current sun.security.krb5.Credentials's acquireTGTFromCache method  
>> looks
>> like --
>>
>> Cred acquireTGTFromCache(princ, fcache) {
>>   if (fcache not specified) {
>>     if (Windows) {
>>       cred = function {
>>         get default TGT from default file cache;
>>         if (found && etypeSupported) return it;
>>         else return one from LSA;
>>       }
>>       if (princ specified && princ is not princ in cred)
>>         return null;
>>       else
>>         return cred;
>>     }
>>   }
>>   read cred for princ in fcache
>>   if (found && etypeSupported) return it;
>>   else return null;
>> }
>>
>> It seems there's a chance on Windows that the default TGT in default
>> file cache (fcache == null) is not for princ, but maybe there's  
>> one for
>> princ in LSA. It won't get read.
>>
>> Right? Shall we just move the whole fcache to the beginning and  
>> only use
>> LSA as a fallback?
>>
>> Thanks
>> Max
>>
>>
>