title: GSSException createCredential
body: <p><strong>Major edit: 2015-05-27:</strong> After some degree of success updated on where I'm currently stuck rather than leaving a rambling post....could really do with some pointers on this one - a little bogged down....</p>
  
  <p>I'm running some code on a Linux app server (WebSphere) that needs to authenticate to an IIS web service which is configured for "Integrated Authentication", but I'm having some problems forming the Authorization: Negotiate token.
  I should also say that I need to put this token into the HTTP header for a JAX-WS SOAP request that I will subsequently build.  I know my SOAP request itself works because we were using WS-Security Username token profile previously and it worked fine - trying to swap to kerberos is proving difficult...</p>
  
  <p>My problem is with initSecContext I think.  It appears that on the first call the context is configured in "some" way and there is some returned token data, but .isEstablished is false.  The problem I'm having is putting the initSecContext call into a loop - it seems IIS just closes the connection when I do this.  Can anyone give me some pointers - I seem to be taking the approach used by other posters and the Oracle samples (although the IBM/WebSphere sample only makes a single initSecContext call and doesn't check .isEstablished which seems odd to me based on the Oracle documentation).</p>
  
  <p>Anyway, the error I get is below (note the Ready: property seems to clearly say initSecContext needs to loop - to me at least);</p>
  
  <pre><code>[5/27/15 6:51:11:605 UTC] 0000004f SystemOut     O INFO: com.mycorp.kerberosKerberosTokenGenerator/getKerberosToken/run: After initSecContext:
  --- GSSContext ---
          Owner:          domainuser@MYDOMAIN.COM
          Peer:           HTTP/iishost.mycorp.com
          State:          initialized
          Lifetime:       indefinite
          Ready:          no
          Flags:
                  Confidentiality         off
                  Delegation              on
                  Integrity               off
                  MutualAuthn             on
                  ReplayDetection         off
                  SequenceDetection       off
                  DelegatedCred:          unknown
  --- End of GSSContext ---
  
  [5/27/15 6:51:11:605 UTC] 0000004f SystemOut     O INFO: com.mycorp.kerberosKerberosTokenGenerator/getKerberosToken/run: Context is not established, trying again
  [5/27/15 6:51:11:606 UTC] 0000004f SystemOut     O ERROR: com.mycorp.kerberosKerberosTokenGenerator/getKerberosToken/run: IOException during context establishment: Connection reset
  </code></pre>
  
  <p>My code is below;</p>
  
  <pre><code>            LoginContext lc = getLoginContext(contextName);
              final Subject subject = lc.getSubject();
  
              String b64Token = (String) Subject.doAs(subject, new PrivilegedExceptionAction() {
                  @Override
                  public Object run() throws PrivilegedActionException, GSSException {
                      // Create socket to server
                      Socket socket;
                      DataInputStream inStream = null;
                      DataOutputStream outStream = null;
                      try {
                          socket = new Socket("iishost.mycorp.com", 443);
                          inStream = new DataInputStream(socket.getInputStream());
                          outStream = new DataOutputStream(socket.getOutputStream());
                      } catch (IOException ex) {
                          System.out.println("Exception setting up server sockets: " + ex.getMessage());
                      }
                      GSSName gssName = manager.createName(userName, GSSName.NT_USER_NAME, KRB5_MECH_OID);
                      GSSCredential gssCred = manager.createCredential(gssName.canonicalize(KRB5_MECH_OID),
                              GSSCredential.DEFAULT_LIFETIME,
                              KRB5_MECH_OID,
                              GSSCredential.INITIATE_ONLY);
  
                      gssCred.add(gssName, GSSCredential.INDEFINITE_LIFETIME,
                              GSSCredential.INDEFINITE_LIFETIME,
                              SPNEGO_MECH_OID,
                              GSSCredential.INITIATE_ONLY);
                      GSSName gssServerName = manager.createName(servicePrincipal, KERBEROS_V5_PRINCIPAL_NAME);
                      GSSContext clientContext = manager.createContext(gssServerName.canonicalize(SPNEGO_MECH_OID),
                              SPNEGO_MECH_OID,
                              gssCred,
                              GSSContext.DEFAULT_LIFETIME);
                      clientContext.requestCredDeleg(true);
                      clientContext.requestMutualAuth(true);
                      byte[] token = new byte[0];
  
                      while (!clientContext.isEstablished()) {
                          try {
                              token = clientContext.initSecContext(token, 0, token.length);
  // IF I LOOK AT token HERE THERE IS CERTAINLY TOKEN DATA THERE - .isEstablished IS STILL FALSE                          
                              outStream.writeInt(token.length);
                              outStream.write(token);
                              outStream.flush();
  
                              // Check if we're done
                              if (!clientContext.isEstablished()) {
                                  token = new byte[inStream.readInt()];
                                  inStream.readFully(token);
                              }
                          } catch (IOException ex) {
  
  // THIS EXCEPTION IS THROWN ON SECOND ITERATION - LOOKS LIKE IIS CLOSES THE CONNECTION                      
                              System.out.println("IOException during context establishment: " + ex.getMessage());
                          }
                      }
                      String b64Token = Base64.encode(token);
                      clientContext.dispose();        // I'm assuming this won't invalidate the token in some way as I need to use it later
                      return b64Token;                
                  }
              });
  </code></pre>
  
  <p>This doc tells me I don't need to loop on initSecContext, but .isEstablished returns false for me: <a href="http://www-01.ibm.com/support/knowledgecenter/SS7K4U_8.5.5/com.ibm.websphere.zseries.doc/ae/tsec_SPNEGO_token.html?cp=SS7K4U_8.5.5%2F1-3-0-20-4-0&amp;lang=en" rel="nofollow">http://www-01.ibm.com/support/knowledgecenter/SS7K4U_8.5.5/com.ibm.websphere.zseries.doc/ae/tsec_SPNEGO_token.html?cp=SS7K4U_8.5.5%2F1-3-0-20-4-0&amp;lang=en</a></p>
  
  <p>The Oracle docs tell me I should: <a href="https://docs.oracle.com/javase/7/docs/api/org/ietf/jgss/GSSContext.html" rel="nofollow">https://docs.oracle.com/javase/7/docs/api/org/ietf/jgss/GSSContext.html</a></p>
  
  <p>My only hesitation is that from the Oracle docs it seems like I'm starting the application conversation, but what I'm trying to do it obtain the token only &amp; it's later on in my code when I will use JAX-WS to post my actual web service call (including the spnego/kerberos token in the http header)  - is this the cause of my issue?</p>