How to do S4U2Proxy without S4U2Self

ymartin59 / java-kerberos-sfudemo

Java 8 Kerberos MS-SFU Demonstration Code

Apache License 2.0

13 stars 8 forks source link

How to do S4U2Proxy without S4U2Self #8

Open Jacc0 opened 4 years ago

Jacc0 commented 4 years ago

Hi, I was wondering if you can help me to get S4U2Proxy working without S4U2Self. I do not get the end users TGT and my service principle is not allowed to do s4u2Self "protocol transition". How do I get The service ticket for the second service? or can I just connect to the second sevice with the service ticket I received from the end user?

Thanks for your responds

bhushan1987 commented 4 years ago

Hi Jacc0, Yes, you can ask for service ticket for second service, provided you have the service ticket for your service. The code is little different than protocol transition. Take a look here, where i have summarized all the possible delegation mechanisms and sample source code. https://stackoverflow.com/questions/39743700/java-spnego-authentication-kerberos-constrained-delegation-kcd-to-backend-se/57377671#57377671

Let me know if this helps you.