Description of problem: In F18 (I think) the default cred. cache location changed, but this new location was put into KRB5CCNAME so that programs not updated to the new location would still function. The setting of KRB5CCNAME was removed as per: https://mail.gnome.org/archives/commits-list/2013-May/msg05519.html However, java programs now use the wrong location (/tmp/krb5cc_uid). Version-Release number of selected component (if applicable): java version "1.7.0_25" OpenJDK Runtime Environment (fedora-2.3.10.10.fc19-x86_64) OpenJDK 64-Bit Server VM (build 23.7-b01, mixed mode) or gdm-3.8.3-2.fc19.x86_64 depending on your perspective. How reproducible: Always Steps to Reproduce: 1.Use,e.g. SampleClient and SampleServer from JAAS 2. 3. Actual results: Credential cache is not found at correct location. Using "-Dsun.security.krb5.debug=true" one can see: >>>KinitOptions cache name is /tmp/krb5cc_42001 Expected results: Uses cache in the new "standard" location. Additional info: Sample programs available at: http://docs.oracle.com/javase/7/docs/technotes/guides/security/jgss/tutorials/ClientServer.html My JAAS config for client: com.sun.security.jgss.initiate { com.sun.security.auth.module.Krb5LoginModule required useTicketCache=true ; }; My JAAS config for server; com.sun.security.jgss.accept { com.sun.security.auth.module.Krb5LoginModule required debug=true storeKey=true useKeyTab=true keyTab="/path/to/krb5.keytab" principal="myservice/host.example.com" doNotPrompt=true isInitiator=false; };
I have posted a fix to handle arbitrary credential cache locations: http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-August/024230.html
(In reply to Elliott Baron from comment #1) > I have posted a fix to handle arbitrary credential cache locations: > http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2013-August/024230.html Could you submit a fix to upstream jdk8 as well? It will be nice to have this fix in java-1.8.0-openjdk too. Thanks!
http://icedtea.classpath.org/hg/icedtea7-forest/jdk/rev/3e4e1a4ef584
Hi Andrew, Any chance to get a test build of this to verify?
I'll include it in the 2.4.2 update which should appear in Fedora soon (next week or so I hope).
java-1.7.0-openjdk-1.7.0.60-2.4.2.0.fc19.x86_64 (currently updates-testing) confirmed to fix the bug.
Released: http://blog.fuseyism.com/index.php/2013/09/23/icedtea-2-4-2-released/