title: How to generate login.conf and krb5.ini for use with Java Kerbernos Http Client to auth with Active Directory kerberos?
body: <p>I want to use Kerberos to do auth to an IIS kerberos protected web site from a Java application. The goal is to be able to use a keytab file to authenticate with a service account without specifying a username and password.</p>
  
  <p><a href="https://github.com/jumarko/kerberos-auth-example/blob/master/src/main/java/net/curiousprogrammer/auth/kerberos/example/KerberosAuthExample.java" rel="nofollow noreferrer" title="this describves how to do a kerberos auth using a keytab, i think">This describes how to use http client to auth using kerberos</a>. But it requires a couple special configuration files <strong>login.conf</strong> and <strong>krb5.ini</strong>.</p>
  
  <p>The format is the login conf is described here: <a href="https://docs.oracle.com/javase/8/docs/technotes/guides/security/jgss/tutorials/LoginConfigFile.html" rel="nofollow noreferrer">https://docs.oracle.com/javase/8/docs/technotes/guides/security/jgss/tutorials/LoginConfigFile.html</a></p>
  
  <p>The format of the krb5.ini file is described here: <a href="https://web.mit.edu/kerberos/krb5-1.12/doc/admin/conf_files/krb5_conf.html" rel="nofollow noreferrer">https://web.mit.edu/kerberos/krb5-1.12/doc/admin/conf_files/krb5_conf.html</a></p>
  
  <p>I also found some related sof articles (listed below).</p>
  
  <p>But none of them seem to describe the process of actually creating the <code>login.conf</code> file and the <code>krb5.conf</code>/<code>krb5.ini</code> file for use against Active Directory.</p>
  
  <p>What are steps to generating these files for use with a Windows Active Directory kerberos situation?</p>
  
  <p>Here's what I have so far, but I'm completely going off of examples I've found from friends and random links around the web.</p>
  
  <p><strong>login.conf</strong></p>
  
  <pre><code>KrbLogin {
    com.sun.security.auth.module.Krb5LoginModule required
    useKeyTab=true
    storeKey=true
    keyTab="file:///C:/kerb/kerberos500.keytab"
    useTicketCache=true
    principal="kerberos500@FUSIONIS.LIFE"
    debug=true;
  };
  
  com.sun.security.jgss.initiate {
    com.sun.security.auth.module.Krb5LoginModule required
    useKeyTab=true
    storeKey=true
    keyTab="/home/ndipiazza/lucidworks/httpclient-tester/kb.keytab"
    useTicketCache=true
    principal="kerberos500@FUSIONIS.LIFE"
    debug=true;
  };
  </code></pre>
  
  <p><strong>krb5.ini</strong></p>
  
  <pre><code>[libdefaults]
      default_realm = FUSIONIS.LIFE
      default_tkt_enctypes = aes128-cts-hmac-sha1-96 rc4-hmac
      default_tgs_enctypes = aes128-cts-hmac-sha1-96  rc4-hmac
      permitted_enctypes = aes128-cts-hmac-sha1-96 rc4-hmac
      dns_lookup_realm = false
      dns_lookup_kdc = false
      ticket_lifetime = 24h
      renew_lifetime = 7d
      forwardable = true
      udp_preference_limit = 1
  
  [realms]
  FUSIONIS.LIFE = {
     kdc = 192.168.1.71
     admin_server = 192.168.1.71
  }
  
  [domain_realm]
  .fusionis.life = FUSIONIS.LIFE
  fusionis.life = FUSIONIS.LIFE
  </code></pre>
  
  <p><strong>Create the keytab on Windows</strong></p>
  
  <pre><code>ktpass /princ kerberos500@FUSIONIS.LIFE /pass password /ptype KRB5_NT_PRINCIPAL /out kerberos500.keytab
  </code></pre>
  
  <p><strong>Creating the KeyTab on Ubuntu Linux</strong></p>
  
  <pre><code>ktutil
  addent -password -p kerberos500@FUSIONIS.LIFE -k 1 -e RC4-HMAC
  - it will ask you for password of kerberos500 -
  wkt kerberos500.keytab
  q
  </code></pre>
  
  <p>Related sofs:</p>
  
  <p><a href="https://stackoverflow.com/questions/21629132/httpclient-set-credentials-for-kerberos-authentication">HttpClient set credentials for Kerberos authentication</a></p>
  
  <p><a href="https://stackoverflow.com/questions/5804314/simple-kerberos-client-in-java">Simple Kerberos client in Java?</a></p>
  
  <p><a href="https://stackoverflow.com/questions/19640069/where-is-the-krb5-ini-file-in-alter-windows-file-gone">Where is the krb5.ini file in alter Windows file gone?</a></p>