<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
Hi Nick,
<div><br>
</div>
<div>I’ve filed <a href="https://bugs.openjdk.org/browse/JDK-8349546">https://bugs.openjdk.org/browse/JDK-8349546</a>. It will be great if the same code could support nativeccache on both Mac and Linux.</div>
<div><br>
</div>
<div>If the test cannot be automated, feel free to add some instructions for manual testing.</div>
<div><br>
</div>
<div>Looking forward to your first OpenJDK contribution!</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Weijun<br id="lineBreakAtBeginningOfMessage">
<div><br>
<blockquote type="cite">
<div>On Feb 3, 2025, at 19:04, Hall, Nick <Nick.Hall@deshaw.com> wrote:</div>
<br class="Apple-interchange-newline">
<div>
<div>
<div dir="ltr">
<div dir="ltr" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt;">
Hi Sean,</div>
<div dir="ltr" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt;">
<br>
</div>
<div dir="ltr" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt;">
Thanks for your response - <span style="font-size: 12pt;">I confirm that my company is D. E. Shaw & Co.</span></div>
<div dir="ltr" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt;">
<span style="font-size: 12pt;"><br>
</span></div>
<div dir="ltr" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt;">
<span style="font-size: 12pt;">Let me know if I can provide any further information!</span></div>
<div dir="ltr" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt;">
<br>
</div>
<div dir="ltr" style="font-family: Aptos, Aptos_MSFontService, -apple-system, Roboto, Arial, Helvetica, sans-serif; font-size: 12pt;">
<span style="font-size: 12pt;">Nick</span><br>
</div>
<div id="ms-outlook-mobile-signature" dir="ltr">
<div></div>
</div>
<div id="mail-editor-reference-message-container" class="ms-outlook-mobile-reference-message">
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif"><b>From:</b> Sean Mullan <sean.mullan@oracle.com><br>
<b>Sent:</b> Monday, February 3, 2025 11:03 pm<br>
<b>To:</b> Hall, Nick <Nick.Hall@deshaw.com>; security-dev@openjdk.org <security-dev@openjdk.org><br>
<b>Subject:</b> Re: Linux support for java.security.jgss "nativeccache" functionality
<div> </div>
</font></div>
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><font size="2"><span style="font-size:11pt;">
<div class="PlainText">This message was sent by an external party.<br>
<br>
<br>
Hi Nick,<br>
<br>
This proposal does sound like it would be useful, so I think we can<br>
start some more discussions about it. Once we go a bit further in the<br>
discussions and we decide it is worthwhile, we can open a JBS issue for<br>
tracking purposes. For starters, can you confirm that your company is<br>
"D. E. Shaw & Co., LP"?<br>
<br>
--Sean<br>
<br>
On 1/31/25 12:04 PM, Hall, Nick wrote:<br>
> Hi,<br>
><br>
> The current OpenJDK code has “native” ccache support for both Windows/<br>
> Mac, allowing native Kerberos credential acquisition on those platforms<br>
> via the usual system library calls rather than the pure Java code. It<br>
> does not support Linux, meaning that only file based ccaches are<br>
> supported on that platform. I couldn’t find any other similar bug<br>
> reports/fixes/submissions, so have developed a patch that I’d like to<br>
> contribute to improve this support (for full disclosure, this is a<br>
> corporate submission approved by my employer, and the OCA has been<br>
> appropriately signed; this is my first time contributing to the OpenJDK).<br>
><br>
> The motivation for doing this is that the Linux Kerberos / GSS-API<br>
> system libraries support more than just file-based Kerberos credential<br>
> caches – in particular, we’re interested in supporting KCM, which is a<br>
> standard protocol for acquiring credentials via a service based cache –<br>
> there are two existing implementations in Heimdal Kerberos and the<br>
> RedHat SSSD. As it stands now, supporting KCM for Java processes means<br>
> running them inside a “kstart” shell which copies a KCM cache to a file<br>
> ccache for the process to use initially. This is an unergonomic<br>
> approach that we would like to avoid, as it’s a source of errors in our<br>
> environment.<br>
><br>
> The patch generalizes the Mac support to include Linux – the C code (ref<br>
> src/java.security.jgss/macosx/native/libosxkrb5/nativeccache.c) required<br>
> here is identical to the Mac version other than the header files (and<br>
> includes a bug fix to avoid a segfault caused by a null pointer deref,<br>
> which I suspect is a dormant bug on MacOSX too). The only other<br>
> required changes are in the Java code which loads the relevant libraries<br>
> and calls them, in both cases these are just changes to an existing<br>
> conditional.<br>
><br>
> I’d be interested in feedback, and had some questions about how to<br>
> approach the shared nature of the code between MacOSX and Linux based on<br>
> the options I’ve tried here:<br>
><br>
> * Option 1: duplicate the code, fix the headers and build a separate<br>
> Linux shared object. This has the disadvantage of a lot of<br>
> duplicated code, but keeps each platform’s libraries separate/distinct.<br>
> * Option 2: build a common shared object on both MacOSX and Linux for<br>
> the nativeccache functionality, using pre-processor directives to<br>
> select the correct set of header files for each platform. This has<br>
> the advantage of a smaller patch (lines of code), but introduces a<br>
> (no-op) change on MacOSX as a result. MacOSX has one additional<br>
> source file (SCDynamicStoreConfig) compiled into the library that<br>
> Linux does not have.<br>
><br>
> The draft code for option 2 can be found at <a href="https://github.com/nrhall/">
https://github.com/nrhall/</a><br>
> jdk/commit/7b57a48afff77ef80dbb6cd947bd0d0581c439c1 <<a href=""></a>https://github.com/<br>
> nrhall/jdk/commit/7b57a48afff77ef80dbb6cd947bd0d0581c439c1> (note that<br>
> the GH Actions jobs currently fail on Linux because the runner needs to<br>
> have at least libkrb5-dev installed, and that changes to autoconf/<br>
> dependencies will be needed to ensure these libs/headers are installed<br>
> at compile time at least – with some careful handling at library load<br>
> time to handle the error if not).<br>
><br>
> If there’s interest in pursuing this, I’d be happy to raise a PR -<br>
> please let me know if there are any questions!<br>
><br>
> Thanks,<br>
><br>
> Nick<br>
><br>
<br>
</div>
</span></font></div>
</div>
</div>
</div>
</blockquote>
</div>
<br>
</div>
</body>
</html>