title: Connect to Postgres DB with Kerberos from Java/Windows7
body: <p>I've looked everywhere and asked loads of people but no one is able to help me so far. I'm trying to connect to a postgres (9.6) database on a remote machine from my windows (7) laptop through a Java (8) application. We use Kerberos for securing access but i have a valid Kerberos account and can create tickets via de Ticket Manager. I can also log on to other 'services' which require Kerberos authentication, although not through java but via a browser.</p>
  
  <p>But whatever i try, i can't get my java program to work. Here's what i've got:</p>
  
  <p>krb5.ini</p>
  
  <pre><code>[libdefaults]
  default_realm = &lt;domain&gt;
  forwardable = true
  kdc_timesync = 1
  ccache_type = 4
  proxiable = true
  dns_lookup_kdc = true
  dns_lookup_realm = true
  
  [realms]
  &lt;domain&gt;.NET = {
      admin_server = &lt;domain-server&gt;
      default_domain = &lt;domain&gt;
  }
  
  [domain_realm]
  .&lt;domain&gt; = &lt;domain&gt;
  &lt;domain&gt;  = &lt;domain&gt;
  .local.nl.&lt;company&gt;.com = &lt;domain&gt;
  local.nl.&lt;company&gt;.com = &lt;domain&gt;
   [login]
  krb4_convert = true
  krb4_get_tickets = false
  </code></pre>
  
  <p>jaas.conf:</p>
  
  <pre><code>pgjdbc {
  com.sun.security.auth.module.Krb5LoginModule required
  refreshKrb5Config=true
  doNotPrompt=false
  useTicketCache=false
  renewTGT=false
  useKeyTab=true
  keyTab="&lt;location&gt;/&lt;filename&gt;.keytab"
  debug=true
  client=true
  principal="&lt;username&gt;@&lt;domain&gt;";
  };
  </code></pre>
  
  <p>.keytab file</p>
  
  <pre><code>public class KerberosPostgresClient {
  static {
          System.setProperty("java.security.krb5.conf","c:/tmp/krb5.ini");
          System.setProperty("java.security.krb5.realm","&lt;domain&gt;");
          System.setProperty("java.security.krb5.kdc","&lt;domain&gt;");
          System.setProperty("javax.security.auth.useSubjectCredsOnly","false");
          System.setProperty("java.security.auth.login.config","c:/tmp/jaas.conf"); }
  
  @Test
  public void test() throws Exception {
      String url = "jdbc:postgresql://&lt;hostname&gt;:&lt;port&gt;/&lt;database&gt;";
      Properties properties = new Properties();
      properties.setProperty("JAASConfigName", "pgjdbc");
      try (Connection conn = DriverManager.getConnection(url, connInfo)) {
          conn.createStatement();
      } catch (Exception e) {
          e.printStackTrace();
      }
  }
  }
  </code></pre>
  
  <p>The very simple java code can find the keytab, jaas.conf. I created the keytab file on a different machine but with the same principal and password.</p>
  
  <p>When i run the program i see:</p>
  
  <pre><code>Debug is  true storeKey false useTicketCache false useKeyTab true doNotPrompt false ticketCache is null isInitiator true KeyTab is c:/tmp/&lt;username&gt;.keytab refreshKrb5Config is true principal is &lt;username&gt;@&lt;domain&gt; tryFirstPass is false useFirstPass is false storePass is false clearPass is false
  Refreshing Kerberos configuration
  </code></pre>
  
  <p>and after a short while i get an exception:</p>
  
  <pre><code>[Krb5LoginModule] authentication failed 
  Receive timed out
  org.postgresql.util.PSQLException: GSS Authentication failed
  at org.postgresql.gss.MakeGSS.authenticate(MakeGSS.java:65)
  ....    
  Caused by: java.net.SocketTimeoutException: Receive timed out
  at java.net.DualStackPlainDatagramSocketImpl.socketReceiveOrPeekData(Native Method)
  at java.net.DualStackPlainDatagramSocketImpl.receive0(DualStackPlainDatagramSocketImpl.java:120)
  at java.net.AbstractPlainDatagramSocketImpl.receive(AbstractPlainDatagramSocketImpl.java:144)
  at java.net.DatagramSocket.receive(DatagramSocket.java:812)
  at sun.security.krb5.internal.UDPClient.receive(NetClient.java:206)
  at sun.security.krb5.KdcComm$KdcCommunication.run(KdcComm.java:411)
  at sun.security.krb5.KdcComm$KdcCommunication.run(KdcComm.java:364)
  at java.security.AccessController.doPrivileged(Native Method)
  at sun.security.krb5.KdcComm.send(KdcComm.java:348)
  at sun.security.krb5.KdcComm.sendIfPossible(KdcComm.java:253)
  at sun.security.krb5.KdcComm.send(KdcComm.java:229)
  at sun.security.krb5.KdcComm.send(KdcComm.java:200)
  at sun.security.krb5.KrbAsReqBuilder.send(KrbAsReqBuilder.java:316)
  at sun.security.krb5.KrbAsReqBuilder.action(KrbAsReqBuilder.java:361)
  at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:776)
  ... 45 more
  </code></pre>
  
  <p>I used to get other exceptions which indicated that it couldn't find the keytab file but with the above setup it seems to work. I can also ping the postgres database from my machine.</p>
  
  <p>I found: <a href="https://stackoverflow.com/questions/36731871/error-connecting-to-postgresql-9-4-with-mit-kerberos-via-jdbc-vs-cli">Error connecting to PostgreSQL 9.4 with MIT Kerberos via JDBC vs CLI</a> but has no solution</p>