Kerberos auth with java times out on external network Code Answer

Hello Developer, Hope you guys are doing great. Today at Tutorial Guruji Official website, we are sharing the answer of Kerberos auth with java times out on external network without wasting too much if your time.

The question is published on by Tutorial Guruji team.

I followed this article to create a java program for testing kerberos authentication: https://docs.oracle.com/javase/jndi/tutorial/ldap/security/gssapi.html

The only thing I changed were the configuration files.

The program works fine when I point the DNS settings of my windows client to my internal windows DNS/Kerb server but it times out when I use a separate public DNS server, even though: 1. My internal server has ports tcp/udp 88 open 2. My external server has the SRV records needed (_kerberos._tcp and _kerberos._udp on port 88) 3. I’m able to achieve kerberos authentication, with and without a user certificate, using my iPad which is not using my windows server’s DNS

Both the iPad and my other clients are using the same network (my home wifi) and I’ve also tried by sharing out the data connection from my cell phone.

Given #3 above and the fact that the java program works from a client that uses my internal DNS, I’m a bit baffled as to why my java program wouldn’t work in both scenarios (i.e. using the internal or external DNS server).

Do you have any suggestions?

Answer

From GitBook Hadoop and Kerberos: The Madness Beyond the Gate section Error Messages to Fear

Switching Kerberos to use TCP rather than UDP makes [some bizarre issues] go away …
Note also UDP is a lot slower to time out … Kerberos waits ~90 seconds before timing out, which is a long time to notice there’s a problem …

In /etc/krb5.conf

[libdefaults]
  udp_preference_limit = 1

PS: the “~90 seconds before timing out” may refer specifically to the Java-specific defaults i.e.

kdc_timeout = 30000
max_retries = 3


Generally speaking, UDP seems to be a root cause for many weird Kerberos issues, cf. How to save Kerberos Service Ticket using a Windows Java client? for instance.
Disabling it systematically might be a “good practise”.
We are here to answer your question about Kerberos auth with java times out on external network - If you find the proper solution, please don't forgot to share this with your team members.

Related Posts

Tutorial Guruji