title: Kerberos: GSSContext name of the context initiator is null
body: <p>I'm trying to integrate SSO via Kerberos/SPNEGO in my application as described here <a href="https://docs.spring.io/spring-security-kerberos/docs/1.0.2.BUILD-SNAPSHOT/reference/htmlsingle/#samples-sec-server-win-auth" rel="nofollow noreferrer">https://docs.spring.io/spring-security-kerberos/docs/1.0.2.BUILD-SNAPSHOT/reference/htmlsingle/#samples-sec-server-win-auth</a></p>
  
  <p>My context.xml looks like this:</p>
  
  <pre><code> &lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;beans xmlns="http://www.springframework.org/schema/beans"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns:sec="http://www.springframework.org/schema/security"
         xmlns:context="http://www.springframework.org/schema/context"
         xsi:schemaLocation="
      http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd
      http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
      http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd"&gt;
  
  
      &lt;sec:authentication-manager alias="authenticationManager"&gt;
          &lt;sec:authentication-provider ref="kerberosAuthenticationProvider"/&gt;
          &lt;sec:authentication-provider ref="kerberosServiceAuthenticationProvider"/&gt;
      &lt;/sec:authentication-manager&gt;
  
      &lt;bean id="kerberosAuthenticationProvider" class="org.springframework.security.kerberos.authentication.KerberosAuthenticationProvider"&gt;
          &lt;property name="kerberosClient"&gt;
              &lt;bean class="org.springframework.security.kerberos.authentication.sun.SunJaasKerberosClient"&gt;
                  &lt;property name="debug" value="true"/&gt;
              &lt;/bean&gt;
          &lt;/property&gt;
          &lt;property name="userDetailsService" ref="userDetailsService"/&gt;
      &lt;/bean&gt;
  
      &lt;bean class="org.springframework.security.kerberos.authentication.sun.GlobalSunJaasKerberosConfig"&gt;
          &lt;property name="debug" value="true"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="spnegoEntryPoint" class="org.springframework.security.kerberos.web.authentication.SpnegoEntryPoint"&gt;
          &lt;constructor-arg value="/login"/&gt;
      &lt;/bean&gt;
  
      &lt;bean id="spnegoAuthenticationProcessingFilter"
            class="org.springframework.security.kerberos.web.authentication.SpnegoAuthenticationProcessingFilter"&gt;
          &lt;property name="authenticationManager" ref="authenticationManager" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="kerberosServiceAuthenticationProvider"
            class="org.springframework.security.kerberos.authentication.KerberosServiceAuthenticationProvider"&gt;
          &lt;property name="ticketValidator"&gt;
              &lt;bean class="org.springframework.security.kerberos.authentication.sun.SunJaasKerberosTicketValidator"&gt;
                  &lt;property name="servicePrincipal" value="${myapp.kerberos.servicePrincipal}" /&gt;
                  &lt;property name="keyTabLocation" value="${myapp.kerberos.keytabLocation}" /&gt;
                  &lt;property name="debug" value="true" /&gt;
                  &lt;property name="holdOnToGSSContext" value="true"/&gt;
              &lt;/bean&gt;
          &lt;/property&gt;
          &lt;property name="userDetailsService" ref="userDetailsService" /&gt;
      &lt;/bean&gt;
  
      &lt;bean id="kerberosLdapContextSource" class="org.springframework.security.kerberos.client.ldap.KerberosLdapContextSource"&gt;
          &lt;constructor-arg value="${myapp.ldap.ldapServerUrl}"/&gt;
          &lt;property name="loginConfig"&gt;
              &lt;bean class="org.springframework.security.kerberos.client.config.SunJaasKrb5LoginConfig"&gt;
                  &lt;property name="keyTabLocation" value="${myapp.kerberos.keytabLocation}"/&gt;
                  &lt;property name="servicePrincipal" value="${myapp.kerberos.servicePrincipal}"/&gt;
                  &lt;property name="debug" value="true"/&gt;
                  &lt;property name="isInitiator" value="true"/&gt;
                  &lt;property name="useTicketCache" value="true"/&gt;
              &lt;/bean&gt;
          &lt;/property&gt;
      &lt;/bean&gt;
  
      &lt;sec:ldap-user-service id="ldapUserDetailsService" server-ref="kerberosLdapContextSource" 
      user-search-filter="(| (userPrincipalName={0}) (sAMAccountName={0}))" /&gt;
  &lt;/beans&gt;
  </code></pre>
  
  <p>I can access the secret part of my application when explicitely opening login-form and entering AD-credentials (So it seems to work in general).</p>
  
  <p>When I try to access secret part without previous explicit login (something like /myapp/administration) I get a BadCredentialsException with "GSSContext name of the context initiator is null."</p>
  
  <pre><code>2018-05-11 16:10:07,578 [http-apr-8080-exec-3] WARN  org.springframework.security.kerberos.web.authentication.SpnegoAuthenticationProcessingFilter - Negotiate Header was invalid: Negotiate YHcG(...)==
  org.springframework.security.authentication.BadCredentialsException: GSSContext name of the context initiator is null
      at org.springframework.security.kerberos.authentication.sun.SunJaasKerberosTicketValidator$KerberosValidateAction.run(SunJaasKerberosTicketValidator.java:173)
      at org.springframework.security.kerberos.authentication.sun.SunJaasKerberosTicketValidator$KerberosValidateAction.run(SunJaasKerberosTicketValidator.java:153)
      at java.security.AccessController.doPrivileged(Native Method)
      at javax.security.auth.Subject.doAs(Subject.java:422)
      at org.springframework.security.kerberos.authentication.sun.SunJaasKerberosTicketValidator.validateTicket(SunJaasKerberosTicketValidator.java:68)
      at org.springframework.security.kerberos.authentication.KerberosServiceAuthenticationProvider.authenticate(KerberosServiceAuthenticationProvider.java:64)
      at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:174)
      at org.springframework.security.kerberos.web.authentication.SpnegoAuthenticationProcessingFilter.doFilter(SpnegoAuthenticationProcessingFilter.java:145)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
      at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:200)
  </code></pre>
  
  <p>I think exception says that the TGT send back from client to Kerberos was modified/isn't as expected, so client isn't assumed to be trustworthy to receive Service Ticket. But I'm not quite sure if this is correct.</p>
  
  <p>So.... what am I missing?</p>