<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Please review the change below:<div class=""><br class=""></div><div class=""><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: "SF Mono"; background-color: rgb(255, 255, 255);" class=""><b class="">diff --git a/src/java.security.jgss/share/classes/javax/security/auth/kerberos/KerberosPrincipal.java b/src/java.security.jgss/share/classes/javax/security/auth/kerberos/KerberosPrincipal.java</b></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: "SF Mono"; color: rgb(252, 85, 85); background-color: rgb(255, 255, 255);" class=""><b class="">--- a/src/java.security.jgss/share/classes/javax/security/auth/kerberos/KerberosPrincipal.java</b></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: "SF Mono"; color: rgb(85, 255, 85); background-color: rgb(255, 255, 255);" class=""><b class="">+++ b/src/java.security.jgss/share/classes/javax/security/auth/kerberos/KerberosPrincipal.java</b></div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: "SF Mono"; color: rgb(187, 0, 187); background-color: rgb(255, 255, 255);" class="">@@ -106,10 +106,19 @@</div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: "SF Mono"; background-color: rgb(255, 255, 255);" class=""> *</div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: "SF Mono"; background-color: rgb(255, 255, 255);" class=""> * <p>If the input name does not contain a realm, the default realm</div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: "SF Mono"; background-color: rgb(255, 255, 255);" class=""> * is used. The default realm can be specified either in a Kerberos</div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: "SF Mono"; color: rgb(187, 0, 4); background-color: rgb(255, 255, 255);" class="">- * configuration file or via the java.security.krb5.realm</div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: "SF Mono"; color: rgb(25, 187, 3); background-color: rgb(255, 255, 255);" class="">+ * configuration file or via the {@systemproperty java.security.krb5.realm}</div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: "SF Mono"; background-color: rgb(255, 255, 255);" class=""> * system property. For more information, see the</div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: "SF Mono"; background-color: rgb(255, 255, 255);" class=""> * {@extLink security_guide_jgss_tutorial Kerberos Requirements}.</div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: "SF Mono"; color: rgb(187, 0, 4); background-color: rgb(255, 255, 255);" class="">- * Additionally, if a security manager is</div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: "SF Mono"; color: rgb(25, 187, 3); background-color: rgb(255, 255, 255);" class="">+ *</div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: "SF Mono"; color: rgb(25, 187, 3); background-color: rgb(255, 255, 255);" class="">+ * <p>Please note that when this class or any other Kerberos-related class</div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: "SF Mono"; color: rgb(25, 187, 3); background-color: rgb(255, 255, 255);" class="">+ * is initially loaded and initialized, it might read the default realm</div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: "SF Mono"; color: rgb(25, 187, 3); background-color: rgb(255, 255, 255);" class="">+ * from the Kerberos configuration file or via the</div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: "SF Mono"; color: rgb(25, 187, 3); background-color: rgb(255, 255, 255);" class="">+ * java.security.krb5.realm system property. The default realm is cached</div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: "SF Mono"; color: rgb(25, 187, 3); background-color: rgb(255, 255, 255);" class="">+ * (even if there is none) and any calls to subsequently set or change</div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: "SF Mono"; color: rgb(25, 187, 3); background-color: rgb(255, 255, 255);" class="">+ * the default realm by setting the java.security.krb5.realm system</div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: "SF Mono"; color: rgb(25, 187, 3); background-color: rgb(255, 255, 255);" class="">+ * property might be ignored.</div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: "SF Mono"; color: rgb(25, 187, 3); background-color: rgb(255, 255, 255);" class="">+ *</div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: "SF Mono"; color: rgb(25, 187, 3); background-color: rgb(255, 255, 255);" class="">+ * <p>Additionally, if a security manager is</div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: "SF Mono"; background-color: rgb(255, 255, 255);" class=""> * installed, a {@link ServicePermission} must be granted and the service</div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: "SF Mono"; background-color: rgb(255, 255, 255);" class=""> * principal of the permission must minimally be inside the</div><div style="margin: 0px; font-stretch: normal; font-size: 11px; line-height: normal; font-family: "SF Mono"; background-color: rgb(255, 255, 255);" class=""> * {@code KerberosPrincipal}'s realm. For example, if the result of</div></div><div class=""><br class=""></div><div class="">Here, the "Kerberos-related" class could be KeyTab as shown in this bug or something else like JAAS login configured with a Krb5LoginModule, or a JGSS call that touched the Kerberos 5 mechanism.</div><div class=""><br class=""></div><div class="">I used several "might" because this is just a hint but not a specified behavior and I don't want to restrict any evolution of the underlying implementation. For the same reason there is no test, although it's quite easy to trigger such a case. I've added a noreg-doc label.</div><div class=""><br class=""></div><div class="">Also, I assume there is no need for a CSR. This is not about compatibility or any new specification.</div><div class=""><br class=""></div><div class="">Thanks,</div><div class="">Max</div><div class=""><br class=""></div><div class=""><br class=""></div></body></html>