Topic
5 replies Latest Post - ‏2013-01-21T13:10:08Z by SystemAdmin
evansri
evansri
9 Posts
ACCEPTED ANSWER

Pinned topic Error getting Kerberos credentials from ticket cache

‏2009-12-20T13:48:48Z |
I am trying to set up a GSSContext using credentials from the local ticket cache on Linux, using the IBM JRE.

The operation fails with an UnsatisfiedLinkError:

JAAS parms: {useDefaultCcache=true, credsType=initiator}
Exception in thread "main" javax.security.auth.login.LoginException: java.lang.UnsatisfiedLinkError: NativeCreds (Not found in com.ibm.oti.vm.bootstrap.library.path)
at java.lang.ClassLoader.loadLibraryWithPath(ClassLoader.java:998)
at java.lang.ClassLoader.loadLibraryWithClassLoader(ClassLoader.java:962)
at java.lang.System.loadLibrary(System.java:487)
at com.ibm.security.krb5.b.run(b.java:2)
at java.security.AccessController.doPrivileged(AccessController.java:251)
at com.ibm.security.krb5.Credentials.b(Credentials.java:725)
at com.ibm.security.krb5.Credentials.getDefaultNativeCreds(Credentials.java:425)
at com.ibm.security.auth.module.Krb5LoginModule.l(Krb5LoginModule.java:774)
at com.ibm.security.auth.module.Krb5LoginModule.c(Krb5LoginModule.java:115)
at com.ibm.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:367)

Is this a problem in the IBM JRE for Linux? The same code works fine using the Sun JRE with the Sun Kerberos login module.

The JRE version is:

Java(TM) SE Runtime Environment (build pxi3260sr6ifix-20091015_01(SR6+152211+155930+156106))
IBM J9 VM (build 2.4, JRE 1.6.0 IBM J9 2.4 Linux x86-32 jvmxi3260sr6-20091001_43491 (JIT enabled, AOT enabled)
J9VM - 20091001_043491
JIT - r9_20090902_1330ifx1
GC - 20090817_AA)
JCL - 20091006_01
Updated on 2013-01-21T13:10:08Z at 2013-01-21T13:10:08Z by SystemAdmin
  • SulbigarShanawaz
    SulbigarShanawaz
    2 Posts
    ACCEPTED ANSWER

    Re: Error getting Kerberos credentials from ticket cache

    ‏2010-12-15T10:55:55Z  in response to evansri
    Did anyone resolve this issue I too face the same issue when trying to establish SFTP connection from the ELB module.

    Any help in this regard would be of great help.
    • SulbigarShanawaz
      SulbigarShanawaz
      2 Posts
      ACCEPTED ANSWER

      Re: Error getting Kerberos credentials from ticket cache

      ‏2010-12-15T10:57:51Z  in response to SulbigarShanawaz
      Sorry that was EJB module.
      • Datta_1
        Datta_1
        1 Post
        ACCEPTED ANSWER

        Re: Error getting Kerberos credentials from ticket cache

        ‏2012-03-13T04:26:38Z  in response to SulbigarShanawaz
        We are also getting the error when trying to access SFTP service from WebSphere FTP adapter module.

        FTP server is on WINsshd SFTP
        • H693_Ganesh_C
          H693_Ganesh_C
          1 Post
          ACCEPTED ANSWER

          Re: Error getting Kerberos credentials from ticket cache

          ‏2012-05-24T07:01:12Z  in response to Datta_1
          Im getting this same exception while doing SFTP.

          Exception:
          java.lang.UnsatisfiedLinkError: NativeCreds (Not found in com.ibm.oti.vm.bootstrap.library.path)
          at java.lang.ClassLoader.loadLibraryWithPath(ClassLoader.java:1011) ~na:1.6.0
          at java.lang.ClassLoader.loadLibraryWithClassLoader(ClassLoader.java:975) ~na:1.6.0
          at java.lang.System.loadLibrary(System.java:469) ~na:1.6.0
          at com.ibm.security.krb5.b.run(b.java) ~na:6.0
          at java.security.AccessController.doPrivileged(AccessController.java:251) ~na:na
          at com.ibm.security.krb5.Credentials.b(Credentials.java:455) ~na:6.0
          at com.ibm.security.krb5.Credentials.getDefaultNativeCreds(Credentials.java:607) ~na:6.0
          at com.ibm.security.krb5.Credentials.acquireDefaultCreds(Credentials.java:348) ~na:6.0
          at com.ibm.security.jgss.mech.krb5.cc.b(cc.java:379) ~na:6.0
          at com.ibm.security.jgss.mech.krb5.cc.b(cc.java:264) ~na:6.0
          at com.ibm.security.jgss.mech.krb5.cc.b(cc.java:125) ~na:6.0
          at com.ibm.security.jgss.mech.krb5.cc.<init>(cc.java:489) ~na:6.0
          at com.ibm.security.jgss.mech.krb5.Krb5MechFactory.getCredentialElement(Krb5MechFactory.java:2) ~na:6.0
          at com.ibm.security.jgss.GSSManagerImpl.createMechCredential(GSSManagerImpl.java:13) ~na:6.0
          at com.ibm.security.jgss.GSSCredentialImpl.add(GSSCredentialImpl.java:265) ~na:6.0
          at com.ibm.security.jgss.GSSCredentialImpl.<init>(GSSCredentialImpl.java:83) ~na:6.0
          at com.ibm.security.jgss.GSSManagerImpl.createCredential(GSSManagerImpl.java:58) ~na:6.0
          at com.ibm.security.jgss.GSSContextImpl.b(GSSContextImpl.java:157) ~na:6.0
          at com.ibm.security.jgss.GSSContextImpl.<init>(GSSContextImpl.java:44) ~na:6.0
          at com.ibm.security.jgss.GSSManagerImpl.createContext(GSSManagerImpl.java:24) ~na:6.0
          at com.jcraft.jsch.jgss.GSSContextKrb5.create(GSSContextKrb5.java:82) ~jsch-0.1.44.jar:na
          at com.jcraft.jsch.UserAuthGSSAPIWithMIC.start(UserAuthGSSAPIWithMIC.java:125) ~jsch-0.1.44.jar:na
          at com.jcraft.jsch.Session.connect(Session.java:425) ~jsch-0.1.44.jar:na
          at com.jcraft.jsch.Session.connect(Session.java:154) ~jsch-0.1.44.jar:na

          Kindly help us for solving this.
          • SystemAdmin
            SystemAdmin
            2262 Posts
            ACCEPTED ANSWER

            Re: Error getting Kerberos credentials from ticket cache

            ‏2013-01-21T13:10:08Z  in response to H693_Ganesh_C
            Old post to repoy to, but I've just encountered and worked-around this issue so may be of use to someone else.

            If you set the PreferredAuthentications property on the JSch session's config but don't include "gssapi-with-mic" then this results in JSch not evening attempting the Kerberos method, and so you avoid the library loading which crashes out i.e. in your code add;

            config.put("PreferredAuthentications", "publickey,keyboard-interactive,password");
            session.setConfig(config);
            ...
            ...