title: Does Java integration with native kerberos support impersonation?
body: <p>I have the following setup (using java 11).<br>
  A user enters his browser, sends request to a java backend secured with kerberos.<br>
  Server responds with &quot;Negotiate...&quot;, browser responds with user ticket.<br>
  Then java backend impersonates that user and goes to postgres pretending to be that user.<br>
  Impersonation is done with the following code:</p>
  <pre><code>((ExtendedGSSCredential) serviceCredentials).impersonate(gssName);
  </code></pre>
  <p>The code for impersonate() method (from jdk):</p>
  <pre><code>public GSSCredential impersonate(GSSName name) throws GSSException {
          if (destroyed) {
              throw new IllegalStateException(&quot;This credential is &quot; +
                                          &quot;no longer valid&quot;);
          }
          Oid mech = tempCred.getMechanism();
          GSSNameSpi nameElement = (name == null ? null :
                                    ((GSSNameImpl)name).getElement(mech));
          GSSCredentialSpi cred = tempCred.impersonate(nameElement);
          return (cred == null ?
              null : GSSManagerImpl.wrap(new GSSCredentialImpl(gssManager, cred)));
  }
  </code></pre>
  <p>The class of tempCred here SpNegoCredElement and it supports impersonate method.<br>
  This works with the default java kerberos implementation.
  <br>
  <br>
  Now I want to use a native GSS-API kerberos (linux with libgssapi_krb5.so.2).
  For that I start java process with the following options:</p>
  <pre><code>-Dsun.security.jgss.native=true -Djavax.security.auth.useSubjectCredsOnly=false
  </code></pre>
  <p>The code above doesn't work with this setup because now the variable tempCred is of type GSSCredElement and it has the following implementation of impersonate() method:</p>
  <pre><code>@Override
      public GSSCredentialSpi impersonate(GSSNameSpi name) throws GSSException {
          throw new GSSException(GSSException.FAILURE, -1,
                  &quot;Not supported yet&quot;);
  }
  </code></pre>
  <p>So it simply throws an exception.<br>
  Does anyone know why it doesn't support impersonation?<br>
  How can I make impersonation work with native GSS-API?</p>