Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8132111

Do not request for addresses for forwarded TGT

    Details

      Backports

        Description

        Java Kerberos was designed to provide the addresses of a service when requesting for a forwarded TGT. However, the field was never filled, because of a bug that the service principal does not have the KRB_NT_SRV_HST nameType.

        In JDK-8031111, we "fixed" this bug and the addresses field is now always sent.

        However, it is well known in the Kerberos community that it's difficult to get the correct addresses. For example, the service and the client might be inside a NAT but the KDC is not. If the addresses observed by the client and the KDC are different, such a ticket will be rejected when the service is trying to use it.

        For this reason, the addresses field in a forwarded TGT request is not used in practice. We will backout the changes made in JDK-8031111.

          Attachments

            Issue Links

              Activity

                People

                • Assignee:
                  weijun Weijun Wang
                  Reporter:
                  weijun Weijun Wang
                • Votes:
                  0 Vote for this issue
                  Watchers:
                  3 Start watching this issue

                  Dates

                  • Created:
                    Updated:
                    Resolved: