Kerberos mini-howto

[njvack]

OK, I've gotten Kerberos to work in our environment. It's shockingly easy; here are the steps I went through:

* Build a JAAS app that'll test a krb login. I found and modified someone's test app for my purposes; my modified copy is up online. You'll need the java source and a context configuration file. Put them in the same directory.

* Compile KrbTester.java and run it:

javac KrbTester.java
java -Djava.security.auth.login.config=kerberos.conf KrbTester <username> <password>
# If that doesn't work, you may need to specify a realm and kdc:
java -Djava.security.krb5.kdc=kdc.your.realm -Djava.security.krb5.realm=YOUR.REALM -Djava.security.auth.login.config=kerberos.conf KrbTester <username> <password>

* The KDC and realm data can be found in /etc/krb5.conf on at least some linux systems.

* We seem to be set up so my username can just be my username; you may need to use username@YOUR.REALM instead.

* Once this gives you a shiny kerberos ticket, copy kerberos.conf into your pipeline directory and run the pipeline server with the same -D parameters you were using for KrbTester.

* Finally, connect to the server. The same username and password that got you a KrbTester ticket should get you in to the server.

Success!