Key searchSessionKey ( Subject subject ) throws GSSException { /* The kerberos session key is not accessible via the JGSS API IBM and Oracle both implement a similar API to make an ExtendedGSSContext available. The older implementation to find the session key is still available as a fallback, but it is not expected, that it works. From "JCIFS with Kerberos doesn't work on JDK 7": https://bugs.openjdk.java.net/browse/JDK-8031973: This is a bug in JCIFS. It seems the SMB packet it generates that includes the AP-REQ token also includes something else that should be encrypted with the *context* session key. The standard GSS-API does not provide such a method so it looks up the service ticket in the subject and use its *ticket* session key instead. The context session key is not the ticket session key if sub key is used. Possible patch: Fix jcifs.smb.Kerb5Context's searchSessionKey() method to call Oracle JDK's ExtendedGSSContext::inquireSecContext(InquireType.KRB5_GET_SESSION_KEY) to get the real session key. The classes are defined in com.sun.security.jgss. */ if ( extendedGSSContextClass == null || inquireTypeSessionKey == null || inquireSecContext == null || gssContext == null ) { if ( log . level > 0 && ( ! deprecationWarningPrinted ) ) { log . print ( "WARNING: Kerberos Session Key is extracted from Kerberos Ticket. This is known to be problematic (See: https://bugs.openjdk.java.net/browse/JDK-8031973)." ) ; deprecationWarningPrinted = true ; } MIEName src = new MIEName ( gssContext . getSrcName ( ) . export ( ) ) ; MIEName targ = new MIEName ( gssContext . getTargName ( ) . export ( ) ) ; for ( KerberosTicket ticket : subject . getPrivateCredentials ( KerberosTicket . class ) ) { MIEName client = new MIEName ( gssContext . getMech ( ) , ticket . getClient ( ) . getName ( ) ) ; MIEName server = new MIEName ( gssContext . getMech ( ) , ticket . getServer ( ) . getName ( ) ) ; if ( src . equals ( client ) && targ . equals ( server ) ) { return ticket . getSessionKey ( ) ; } } return null ; } else { if ( extendedGSSContextClass . isAssignableFrom ( gssContext . getClass ( ) ) ) { try { return ( Key ) inquireSecContext . invoke ( gssContext , new Object [ ] { inquireTypeSessionKey } ) ; } catch ( IllegalAccessException | IllegalArgumentException | InvocationTargetException ex ) { log . print ( "Reflective access to ExtendedGSSContext failed" ) ; ex . printStackTrace ( log ) ; } } return null ; } }
Extract the context session key from the gssContext . The subject is only used if no support for extraction of the session key is not possible with an API and is used as a fallback method .