Creating SPNEGO tokens for J2EE, .NET, Java™, web service clients for HTTP requests
You can create a Simple and Protected GSS-API Negotiation (SPNEGO) token for your applications and insert this token into the HTTP headers to authenticate to the WebSphere® Application Server.
Procedure
- Create a client GSS credential. Choose one of the following
4 options:
- Create a GSS credential for the Kerberos credential
cache. For example:
System.setProperty("javax.security.auth.useSubjectCredsOnly", "false"); Oid krb5MechOid = new Oid("1.2.840.113554.1.2.2"); Oid spnegoMechOid = new Oid("1.3.6.1.5.5.2"); GSSManager manager = GSSManager.getInstance(); GSSName gssUserName = manager.createName(userName, GSSName.NT_USER_NAME, krb5MechOid); clientGssCreds = manager.createCredential(gssUserName.canonicalize(krb5MechOid), GSSCredential.INDEFINITE_LIFETIME, krb5MechOid, GSSCredential.INITIATE_ONLY); clientGssCreds.add (gssUserName, GSSCredential.INDEFINITE_LIFETIME, GSSCredential.INDEFINITE_LIFETIME, spnegoMechOid, GSSCredential.INITIATE_ONLY);
- Create a GSS credential from a subject that has Kerberos
tickets. For example:
Oid krb5MechOid = new Oid("1.2.840.113554.1.2.2"); Oid spnegoMechOid = new Oid("1.3.6.1.5.5.2"); GSSManager manager = GSSManager.getInstance(); clientGssCreds = (GSSCredential) Subject.doAs(subject, new PrivilegedExceptionAction() { public Object run() throws GSSException, Exception { try { gssName = manager.createName( userName, GSSName.NT_USER_NAME, getKrb5MechOid()); GSSCredential gssCred = manager.createCredential( gssName.canonicalize(krb5MechOid), GSSCredential.DEFAULT_LIFETIME, krb5MechOid, GSSCredential.INITIATE_ONLY); gssCred.add (gssUserName, GSSCredential.INDEFINITE_LIFETIME, GSSCredential.INDEFINITE_LIFETIME, spnegoMechOid, GSSCredential.INITIATE_ONLY); return gssCred; } catch (GSSException gsse) { } catch (Exception e) { } return null; } });
- Create a GSS credential after calling the WSKRB5Login
login module. For example:
Oid krb5MechOid = new Oid("1.2.840.113554.1.2.2"); Oid spnegoMechOid = new Oid("1.3.6.1.5.5.2"); System.setProperty("javax.security.auth.useSubjectCredsOnly", "true"); GSSManager manager = GSSManager.getInstance(); GSSName gssUserName = manager.createName(userName, GSSName.NT_USER_NAME, krb5MechOid); clientGssCreds = manager.createCredential(gssUserName.canonicalize(krb5MechOid), GSSCredential.INDEFINITE_LIFETIME, krb5MechOid, GSSCredential.INITIATE_ONLY); clientGssCreds.add (gssUserName, GSSCredential.INDEFINITE_LIFETIME, GSSCredential.INDEFINITE_LIFETIME, spnegoMechOid, GSSCredential.INITIATE_ONLY);
- Create a GSS credential using the Microsoft native Kerberos credential cache. For example:
Oid krb5MechOid = new Oid("1.2.840.113554.1.2.2"); Oid spnegoMechOid = new Oid("1.3.6.1.5.5.2"); System.setProperty("javax.security.auth.useSubjectCredsOnly", "false"); GSSManager manager = GSSManager.getInstance(); clientGssCreds = manager.createCredential(null, GSSCredential.INDEFINITE_LIFETIME, krb5MechOid, GSSCredential.INITIATE_ONLY); clientGssCreds.add(null, GSSCredential.INDEFINITE_LIFETIME, GSSCredential.INDEFINITE_LIFETIME, spnegoMechOid, GSSCredential.INITIATE_ONLY);
Note: The MSLSA: credential cache relies on the ability to extract the entire Kerberos ticket, including the session key from the Kerberos LSA. . In an attempt to increase security, Microsoft has begun to implement a feature by which they no longer export the session keys for Ticket Getting Tickets, which can cause them to be useless to the IBM® JGSS when attempts are made to request additional service tickets. This new feature has been seen in Windows 2003 Server and Windows XP SP2 Beta. Microsoft has provided the following registry key to disable this new feature:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters AllowTGTSessionKey = 0x01 (DWORD)
On Windows XP SP2 Beta 1 the key is specified as:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos AllowTGTSessionKey = 0x01 (DWORD)
- Create a GSS credential for the Kerberos credential
cache. For example:
- After you have created a client GSS credential, you can
now create the SPNEGO token and insert it in the HTTP header as in
the following example:
// create target server SPN GSSName gssServerName = manager.createName(targetServerSpn, GSSName.NT_USER_NAME); GSSContext clientContext = manager.createContext(gssServerName.canonicalize(spnegoMechOid), spnegoMechOid, clientGssCreds, GSSContext.DEFAULT_LIFETIME); // optional enable GSS credential delegation clientContext.requestCredDeleg(true); byte[] spnegoToken = new byte[0]; // create a SPNEGO token for the target server spnegoToken = clientContext.initSecContext(spnegoToken, 0, spnegoToken.length); URL url = new URL(targetUrl); HttpURLConnection con= (HttpURLConnection) url.openConnection(); try { // insert SPNEGO token in the HTTP header con.setRequestProperty("Authorization", "Negotiate " + Base64.encode(spnegoToken)); con.getResponseCode(); } catch (IOException e) { } catch (Exception ex) { }
Results
Your application might need a Kerberos configuration file
(krb5.ini or krb5.conf). Read about Creating a Kerberos configuration file for
more information.
Related tasks:
Related reference:


File name: tsec_SPNEGO_token.html