Java Security

Announcement

For appeals, questions and feedback about Oracle Forums, please email oracle-forums-moderators_us@oracle.com. Technical questions should be asked in the appropriate category. Thank you!

Kerberos - tampering with ticket cache

843811Apr 2 2004 — edited Dec 21 2007

Hello,

sorry if this is allready posted here, I couldn't fing it.
I'm using the Kerberos ver.5 Login Modul in JAAS to authenticate users (Java version is 1.4.2). I'm also using SSO mechanisms of Kerberos, so with kinit I make a ticket for myself into the ticket cache and I'm using it withou re-contacting the KDC nor requiring password again.

But I just find out, that when I take a HexEditor, and edit the ticket cache, I could easily change my name in that ticket (eg. to "admin" or other). After this the JAAS Login Modul does not recognize the change, and yells "admin" succesfully logged in. Now letting anybody work with admin privileges is not what I dreamed about! This is not the bug that I can live with!

Is there any method to recognize that the Ticket Cache was tampered with? Or any other suggestions?
Thanks in advance

Locked Post

New comments cannot be posted to this locked post.

Locked on Jan 18 2008

Added on Apr 2 2004

#other-security-apis-tools-and-issues

26 comments

3,129 views