Windows support of native GSS-API in Java 6

Question

From http://java.sun.com/developer/technicalArticles/J2SE/security/#3:

Note: These two system properties are ignored when applications run on operating systems that do not yet support this feature, for example, MS Windows.

That document is from 2006, so things could have changed but I've not found a definitive answer.

I would like to know if the latest release of Sun Java 6 for Windows support native GSS today (to get the TGT without tinkering with the registry).

Amylolysis

It appears the HTTP Commons folks have found a JNA solution - https://mcmap.net/q/368873/-simple-kerberos-client-in-java – Soliz

Answer 1

Nope

From http://hg.openjdk.java.net/jdk6/jdk6-gate/jdk/file/78235ae077a1/src/share/classes/sun/security/jgss/GSSManagerImpl.java (47):

   47     static {
   48         USE_NATIVE =
   49             AccessController.doPrivileged(new PrivilegedAction<Boolean>() {
   50                     public Boolean run() {
   51                             String osname = System.getProperty("os.name");
   52                             if (osname.startsWith("SunOS") ||
   53                                 osname.startsWith("Linux")) {
   54                                 return new Boolean(System.getProperty
   55                                     (USE_NATIVE_PROP));
   56                             }
   57                             return Boolean.FALSE;
   58                     }
   59             });
   60 

Calmative

That would be worth a bounty for a contributed patch! – Soliz

Isn't this a reference to the OpenJDK implementation? This is not the source from Sun. You need to consult the documentation or try it. The code in Open JDK does not match 100% to the Sun implementation of this stuff. – Fyrd

True but OpenJDK is often very close. Try it and you'll see it doesn't work. The Sun doc also says it doesn't work in Windows, as referenced by the original question. – Calmative

Just checked, windows is still not supported in jdk1.8.0 it seems, but they added OSX. – Tardigrade

There is indeed a patch for this submitted by an Oracle employee in 2009 but never admitted into the JDK. You can read more about it here (see section "UPDATE1"). Sad. – Nikko

Answer 2

Finally, native support for the Windows SSPI (the Windows somewhat equivalent of the GSS-API) is in JDK 11 onwards:

https://mcmap.net/q/646582/-is-there-a-way-in-java-or-a-command-line-util-to-obtain-a-kerberos-ticket-for-a-service-using-the-native-sspi-api

Recap:

• You must be using at least JDK 11.0.10.
• You must set -Dsun.security.jgss.native=true
• The new feature isn't yet reflected in the Accessing Native GSS-API page so you'll have to rely on the bug tracker tickets (see above link) and/or release notes in order to understand the new feature.

Nikko