Take the 2-minute tour ×

I am trying to set up a tomcat based intermediate server which will get delegated ticket from a java client and forward to a tomcat server/java server.

I have a tomcat servlet which handles delegated tickets. My issue is rather with the client

http://mydomain.example.com/examples/ is protected by a tomcat instance on a remote machine. in order to login I used :-

URL url = new URL("http://mydomain.example.com:8080/examples/"); InputStream ins = url.openConnection().getInputStream(); and then redirected the stream to a buffered reader.

However this method does not work for the delegated credential case.

Is there a flag or setting in urlconnection object? Is there another class(other than SpnegoHttpURLConnection that can acheive this ? )

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Use Subject.doAs and your URLConnection will run in the security context of your delegated credential.

share|improve this answer
so this would mean that I will have to manually create a subject and populate it, moreover I have to write a function like Subject.doAs(mysubname, url.openconnection.getinputstream()) ? If i am mistaken could you please correct my approach –  Khalian Feb 27 '13 at 11:43
Yes, that is correct. Add the GSSCredential to the private credentials set of the Subject instance. But you cannot simply perorm getInputStream as an arg, you have to wirte a PrivilegedAction. –  Michael-O Feb 27 '13 at 18:25
Ok one last question. When I am adding a gsscredential to the private credentials set of the subject instance, i need to enable some delegation flag/variable. but that can only be done by a gsscontext object. moreover the javadoc states that i cannot retrieve a delegcred(context.getDelegCred()) until i am at the acceptor side. So is there a way to enable delegation somehow on the client side before I add a gsscred to the private cred set? P.S - I am running the urlconnect code on client side –  Khalian Feb 28 '13 at 5:40
Hold on, your question does not seem to be clear enough. I have assumed that you are a server who wants to use delegated credential to impersonate the client. If you are Coming from the initiator site, you probably have to look at this: Java 7 and Java 6. Note that if your server is not trusted for delegation you won't receive any –  Michael-O Feb 28 '13 at 9:26
thats quite all right, I got it to work. I used the URLConnect calls on the client side and did exactly as you had stated earlier. I dont know how it worked exactly. I didnt even touch the code of the intermediate or the final server. They were made by others in my organisation. My way of testing was checking client name in final server. I wrapped my urlconnect and display calls in a priviledged action and populated subject with a logincontext call with krb5 login module. What i dont understand it is where exactly was the delegation flag set? The intermediate server is trusted for delegation –  Khalian Feb 28 '13 at 10:00

Your Answer


