Q:

How do you set the Kerberos ticket lifetime from Java?

In my krb5.conf file, I have configured the ticket lifetime to 10 minutes (ticket_lifetime = 10m) for testing purposes. When I kinit from the command line and then run klist, I see that the ticket lifetime is 10 minutes. However, when I login from Java code, it seems that the ticket lifetime in my krb5.conf file is ignored and the default lifetime of 1 day is used. I have set -Dsun.security.krb5.debug=true and can see that my custom krb5.conf file is being loaded, yet the ticket_lifetime does not seem to be honored. Is this a limitation of the Java Kerberos implementation, or is there some other way to set the ticket lifetime from Java?

A:

This isn't possible with any currently released version of Java. Java 9 will honor the ticket_lifetime and renew_lifetime configurations. This OpenJDK ticket has more info: https://bugs.openjdk.java.net/browse/JDK-8044500

