title: Unable to authenticate with apache http client 4.5 using kerberos ticket cache
body: <p>I am executing an https request to a kerberos authenticated REST service. All is fine if I am using the keytab. However, I have a requirement that I should use the kerberos ticket cache file which is created when one logs in in the workstation using its password.</p>
  
  <p>I'll replace the domain with MY_DOMAINE.COM</p>
  
  <p>So, klist shows:</p>
  
  <pre><code>Ticket cache: FILE:/tmp/krb5cc_210007
  Default principal: dragomira@MY_DOMAINE.COM
  
  Valid starting     Expires            Service principal
  05/15/18 07:21:51  05/15/18 17:21:51  krbtgt/MY_DOMAINE.COM@MY_DOMAINE.COM
          renew until 05/22/18 06:18:22
  </code></pre>
  
  <p>Using curl like this works ok:</p>
  
  <pre><code>curl -k --negotiate -u :  'my_url' -v
  </code></pre>
  
  <p>Now, let's ho back to code. My login.conf is like this:</p>
  
  <pre><code>com.sun.security.jgss.login {
    com.sun.security.auth.module.Krb5LoginModule required
    client=TRUE
    doNotPrompt=true
    useTicketCache=true;
  };
  
  com.sun.security.jgss.initiate {
    com.sun.security.auth.module.Krb5LoginModule required
    client=TRUE
    doNotPrompt=true
    useTicketCache=true;
  };
  
  com.sun.security.jgss.accept {
    com.sun.security.auth.module.Krb5LoginModule required
    client=TRUE
    doNotPrompt=true
    useTicketCache=true;
  };
  </code></pre>
  
  <p>The relevant java code for my http client which is et up for kerberos is:</p>
  
  <pre><code>try {
      SSLContext sslContext = new SSLContextBuilder().loadTrustMaterial(null, (chain, authType) -&gt; true).build();
      HostnameVerifier hostnameVerifier = new NoopHostnameVerifier();
      Registry&lt;AuthSchemeProvider&gt; authSchemeRegistry = RegistryBuilder.&lt;AuthSchemeProvider&gt;create()
              .register(AuthSchemes.SPNEGO, new SPNegoSchemeFactory())
              .build();
      Credentials dummyCredentials = new NullCredentials();
      CredentialsProvider credProv = new BasicCredentialsProvider();
      credProv.setCredentials(new AuthScope(null, -1, null), dummyCredentials);
      this.httpClient = HttpClientBuilder.create()
              .setDefaultAuthSchemeRegistry(authSchemeRegistry)
              .setDefaultCredentialsProvider(credProv)
              .setSSLContext(sslContext)
              .setSSLHostnameVerifier(hostnameVerifier)
              .build();
  } catch (NoSuchAlgorithmException | KeyStoreException | KeyManagementException e) {
      throw new RuntimeException(e.getMessage(), e);
  }
  </code></pre>
  
  <p>Before this, I am setting these java proerties:</p>
  
  <pre><code>java.security.auth.login.config=/home/dragomira/kerberos/login.conf
  java.security.krb5.conf=/etc/krb5.conf
  sun.security.krb5.debug=true
  javax.security.auth.useSubjectCredsOnly=false
  </code></pre>
  
  <p>The output of the kerberos log is:</p>
  
  <p>Loaded from Java config</p>
  
  <pre><code>&gt;&gt;&gt;KinitOptions cache name is /tmp/krb5cc_210007
  &gt;&gt;&gt;DEBUG &lt;CCacheInputStream&gt;  client principal is dragomira@MY_DOMANIN.COM
  &gt;&gt;&gt;DEBUG &lt;CCacheInputStream&gt; server principal is krbtgt/MY_DOMANIN.COM@MY_DOMANIN.COM
  &gt;&gt;&gt;DEBUG &lt;CCacheInputStream&gt; key type: 18
  &gt;&gt;&gt;DEBUG &lt;CCacheInputStream&gt; auth time: Tue May 15 06:18:22 EDT 2018
  &gt;&gt;&gt;DEBUG &lt;CCacheInputStream&gt; start time: Tue May 15 07:21:51 EDT 2018
  &gt;&gt;&gt;DEBUG &lt;CCacheInputStream&gt; end time: Tue May 15 17:21:51 EDT 2018
  &gt;&gt;&gt;DEBUG &lt;CCacheInputStream&gt; renew_till time: Tue May 22 06:18:22 EDT 2018
  &gt;&gt;&gt; CCacheInputStream: readFlags()  FORWARDABLE; RENEWABLE; INITIAL; PRE_AUTH;
  &gt;&gt;&gt;DEBUG &lt;CCacheInputStream&gt;  client principal is dragomira@MY_DOMANIN.COM
  &gt;&gt;&gt;DEBUG &lt;CCacheInputStream&gt; server principal is HTTP/configuration.prd.int.MY_DOMANIN.COM@MY_DOMANIN.COM
  &gt;&gt;&gt;DEBUG &lt;CCacheInputStream&gt; key type: 23
  &gt;&gt;&gt;DEBUG &lt;CCacheInputStream&gt; auth time: Tue May 15 06:18:22 EDT 2018
  &gt;&gt;&gt;DEBUG &lt;CCacheInputStream&gt; start time: Tue May 15 07:57:49 EDT 2018
  &gt;&gt;&gt;DEBUG &lt;CCacheInputStream&gt; end time: Tue May 15 17:21:51 EDT 2018
  &gt;&gt;&gt;DEBUG &lt;CCacheInputStream&gt; renew_till time: Tue May 22 06:18:22 EDT 2018
  &gt;&gt;&gt; CCacheInputStream: readFlags()  FORWARDABLE; RENEWABLE; PRE_AUTH;
  &gt;&gt;&gt; unsupported key type found the default TGT: 18
  </code></pre>
  
  <p>So it would seem to me that the ticket is read but no credentials are extracted from it since i receive in the end 401.</p>
  
  <p>Must I do something special to apache http client 4.5 in order to use ticket tacke?</p>
  
  <p>Kind regards</p>