Using Sun's kerberos module with IBM JRE ?
687626Nov 23 2011 — edited Nov 28 2011Is it possible to use Sun's Kerberos Login Module [com.sun.security.auth.module.Krb5LoginModule] within another JRE like IBM's ? We are planning to use SSO with Lotus Notes client as initiator. Notes client run IBM Java and has its own version of Kerberos Login Module com.ibm.security.auth.module.Krb5LoginModule.
Sun's version has a nice feature of fetching TGT's from inmemory LSA area which is not present in IBM's one. So with Sun we can make the SSO process totally transparent to end users and they are not prompted to renter the password at any point in time. A fresh TGT is issued and saved in windows in-memory LSA area each time an user unlocks his desktop session by entering his password. Sun's login module can fetch this TGT and perform the Kerberos authentication. Advantages with this approach is we don't need to maintain any credential cache's in user's file system and no need to refresh the TGT's in the credential cache as TGT's are automatically refreshed when user unlocks his desktop session and at no point we need to ask a password from user to refresh the TGT..
With IBM one we need to have and maintain credential cache and also need to renew the TGT's before its expiry. And to renew TGT's in case it expires we need to prompt for password from the user.
The Java agent running in Notes client use JAAS login. Since JAAS is a pluggable framework, I hoped it be possible to use Sun's Login Module. But I can see that the classes used by sun's kerberos module are in rt.jar and not available as an external pluggable jar. So will this configuration be supported ?