Topic
  • 5 replies
  • Latest Post - ‏2013-01-21T13:10:08Z by SystemAdmin
evansri
evansri
9 Posts

Pinned topic Error getting Kerberos credentials from ticket cache

‏2009-12-20T13:48:48Z |
I am trying to set up a GSSContext using credentials from the local ticket cache on Linux, using the IBM JRE.

The operation fails with an UnsatisfiedLinkError:

JAAS parms: {useDefaultCcache=true, credsType=initiator}
Exception in thread "main" javax.security.auth.login.LoginException: java.lang.UnsatisfiedLinkError: NativeCreds (Not found in com.ibm.oti.vm.bootstrap.library.path)
at java.lang.ClassLoader.loadLibraryWithPath(ClassLoader.java:998)
at java.lang.ClassLoader.loadLibraryWithClassLoader(ClassLoader.java:962)
at java.lang.System.loadLibrary(System.java:487)
at com.ibm.security.krb5.b.run(b.java:2)
at java.security.AccessController.doPrivileged(AccessController.java:251)
at com.ibm.security.krb5.Credentials.b(Credentials.java:725)
at com.ibm.security.krb5.Credentials.getDefaultNativeCreds(Credentials.java:425)
at com.ibm.security.auth.module.Krb5LoginModule.l(Krb5LoginModule.java:774)
at com.ibm.security.auth.module.Krb5LoginModule.c(Krb5LoginModule.java:115)
at com.ibm.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:367)

Is this a problem in the IBM JRE for Linux? The same code works fine using the Sun JRE with the Sun Kerberos login module.

The JRE version is:

Java(TM) SE Runtime Environment (build pxi3260sr6ifix-20091015_01(SR6+152211+155930+156106))
IBM J9 VM (build 2.4, JRE 1.6.0 IBM J9 2.4 Linux x86-32 jvmxi3260sr6-20091001_43491 (JIT enabled, AOT enabled)
J9VM - 20091001_043491
JIT - r9_20090902_1330ifx1
GC - 20090817_AA)
JCL - 20091006_01
Updated on 2013-01-21T13:10:08Z at 2013-01-21T13:10:08Z by SystemAdmin
  • SulbigarShanawaz
    SulbigarShanawaz
    2 Posts

    Re: Error getting Kerberos credentials from ticket cache

    ‏2010-12-15T10:55:55Z  
    Did anyone resolve this issue I too face the same issue when trying to establish SFTP connection from the ELB module.

    Any help in this regard would be of great help.
  • SulbigarShanawaz
    SulbigarShanawaz
    2 Posts

    Re: Error getting Kerberos credentials from ticket cache

    ‏2010-12-15T10:57:51Z  
    Did anyone resolve this issue I too face the same issue when trying to establish SFTP connection from the ELB module.

    Any help in this regard would be of great help.
    Sorry that was EJB module.
  • Datta_1
    Datta_1
    1 Post

    Re: Error getting Kerberos credentials from ticket cache

    ‏2012-03-13T04:26:38Z  
    Sorry that was EJB module.
    We are also getting the error when trying to access SFTP service from WebSphere FTP adapter module.

    FTP server is on WINsshd SFTP
  • H693_Ganesh_C
    H693_Ganesh_C
    1 Post

    Re: Error getting Kerberos credentials from ticket cache

    ‏2012-05-24T07:01:12Z  
    • Datta_1
    • ‏2012-03-13T04:26:38Z
    We are also getting the error when trying to access SFTP service from WebSphere FTP adapter module.

    FTP server is on WINsshd SFTP
    Im getting this same exception while doing SFTP.

    Exception:
    java.lang.UnsatisfiedLinkError: NativeCreds (Not found in com.ibm.oti.vm.bootstrap.library.path)
    at java.lang.ClassLoader.loadLibraryWithPath(ClassLoader.java:1011) ~na:1.6.0
    at java.lang.ClassLoader.loadLibraryWithClassLoader(ClassLoader.java:975) ~na:1.6.0
    at java.lang.System.loadLibrary(System.java:469) ~na:1.6.0
    at com.ibm.security.krb5.b.run(b.java) ~na:6.0
    at java.security.AccessController.doPrivileged(AccessController.java:251) ~na:na
    at com.ibm.security.krb5.Credentials.b(Credentials.java:455) ~na:6.0
    at com.ibm.security.krb5.Credentials.getDefaultNativeCreds(Credentials.java:607) ~na:6.0
    at com.ibm.security.krb5.Credentials.acquireDefaultCreds(Credentials.java:348) ~na:6.0
    at com.ibm.security.jgss.mech.krb5.cc.b(cc.java:379) ~na:6.0
    at com.ibm.security.jgss.mech.krb5.cc.b(cc.java:264) ~na:6.0
    at com.ibm.security.jgss.mech.krb5.cc.b(cc.java:125) ~na:6.0
    at com.ibm.security.jgss.mech.krb5.cc.<init>(cc.java:489) ~na:6.0
    at com.ibm.security.jgss.mech.krb5.Krb5MechFactory.getCredentialElement(Krb5MechFactory.java:2) ~na:6.0
    at com.ibm.security.jgss.GSSManagerImpl.createMechCredential(GSSManagerImpl.java:13) ~na:6.0
    at com.ibm.security.jgss.GSSCredentialImpl.add(GSSCredentialImpl.java:265) ~na:6.0
    at com.ibm.security.jgss.GSSCredentialImpl.<init>(GSSCredentialImpl.java:83) ~na:6.0
    at com.ibm.security.jgss.GSSManagerImpl.createCredential(GSSManagerImpl.java:58) ~na:6.0
    at com.ibm.security.jgss.GSSContextImpl.b(GSSContextImpl.java:157) ~na:6.0
    at com.ibm.security.jgss.GSSContextImpl.<init>(GSSContextImpl.java:44) ~na:6.0
    at com.ibm.security.jgss.GSSManagerImpl.createContext(GSSManagerImpl.java:24) ~na:6.0
    at com.jcraft.jsch.jgss.GSSContextKrb5.create(GSSContextKrb5.java:82) ~jsch-0.1.44.jar:na
    at com.jcraft.jsch.UserAuthGSSAPIWithMIC.start(UserAuthGSSAPIWithMIC.java:125) ~jsch-0.1.44.jar:na
    at com.jcraft.jsch.Session.connect(Session.java:425) ~jsch-0.1.44.jar:na
    at com.jcraft.jsch.Session.connect(Session.java:154) ~jsch-0.1.44.jar:na

    Kindly help us for solving this.
  • SystemAdmin
    SystemAdmin
    2262 Posts

    Re: Error getting Kerberos credentials from ticket cache

    ‏2013-01-21T13:10:08Z  
    Im getting this same exception while doing SFTP.

    Exception:
    java.lang.UnsatisfiedLinkError: NativeCreds (Not found in com.ibm.oti.vm.bootstrap.library.path)
    at java.lang.ClassLoader.loadLibraryWithPath(ClassLoader.java:1011) ~na:1.6.0
    at java.lang.ClassLoader.loadLibraryWithClassLoader(ClassLoader.java:975) ~na:1.6.0
    at java.lang.System.loadLibrary(System.java:469) ~na:1.6.0
    at com.ibm.security.krb5.b.run(b.java) ~na:6.0
    at java.security.AccessController.doPrivileged(AccessController.java:251) ~na:na
    at com.ibm.security.krb5.Credentials.b(Credentials.java:455) ~na:6.0
    at com.ibm.security.krb5.Credentials.getDefaultNativeCreds(Credentials.java:607) ~na:6.0
    at com.ibm.security.krb5.Credentials.acquireDefaultCreds(Credentials.java:348) ~na:6.0
    at com.ibm.security.jgss.mech.krb5.cc.b(cc.java:379) ~na:6.0
    at com.ibm.security.jgss.mech.krb5.cc.b(cc.java:264) ~na:6.0
    at com.ibm.security.jgss.mech.krb5.cc.b(cc.java:125) ~na:6.0
    at com.ibm.security.jgss.mech.krb5.cc.<init>(cc.java:489) ~na:6.0
    at com.ibm.security.jgss.mech.krb5.Krb5MechFactory.getCredentialElement(Krb5MechFactory.java:2) ~na:6.0
    at com.ibm.security.jgss.GSSManagerImpl.createMechCredential(GSSManagerImpl.java:13) ~na:6.0
    at com.ibm.security.jgss.GSSCredentialImpl.add(GSSCredentialImpl.java:265) ~na:6.0
    at com.ibm.security.jgss.GSSCredentialImpl.<init>(GSSCredentialImpl.java:83) ~na:6.0
    at com.ibm.security.jgss.GSSManagerImpl.createCredential(GSSManagerImpl.java:58) ~na:6.0
    at com.ibm.security.jgss.GSSContextImpl.b(GSSContextImpl.java:157) ~na:6.0
    at com.ibm.security.jgss.GSSContextImpl.<init>(GSSContextImpl.java:44) ~na:6.0
    at com.ibm.security.jgss.GSSManagerImpl.createContext(GSSManagerImpl.java:24) ~na:6.0
    at com.jcraft.jsch.jgss.GSSContextKrb5.create(GSSContextKrb5.java:82) ~jsch-0.1.44.jar:na
    at com.jcraft.jsch.UserAuthGSSAPIWithMIC.start(UserAuthGSSAPIWithMIC.java:125) ~jsch-0.1.44.jar:na
    at com.jcraft.jsch.Session.connect(Session.java:425) ~jsch-0.1.44.jar:na
    at com.jcraft.jsch.Session.connect(Session.java:154) ~jsch-0.1.44.jar:na

    Kindly help us for solving this.
    Old post to repoy to, but I've just encountered and worked-around this issue so may be of use to someone else.

    If you set the PreferredAuthentications property on the JSch session's config but don't include "gssapi-with-mic" then this results in JSch not evening attempting the Kerberos method, and so you avoid the library loading which crashes out i.e. in your code add;

    config.put("PreferredAuthentications", "publickey,keyboard-interactive,password");
    session.setConfig(config);
    ...
    ...