title: Using Java 8 S4U2Proxy - A good example needed
body: <p>I am trying to use S4U2Proxy introduced in Java 8. Unfortunately I was not successfull in finding those many examples. My requirement is the client would send its certificate. I should then delegate (using kerberos) his request, connect to KDC, get the TGT, get the service ticket to contact another server on user's behalf and then finally contact the actual service by providing the service ticket. If java 8 does not provide a clean approach, can you pls point me to other utilities which might solve my requirement.</p>
  
  <pre><code>Subject.doAs(subject, new PrivilegedAction&lt;Object&gt;() {
          @Override
          public Object run() {
              GSSManager manager = GSSManager.getInstance();
              GSSCredential self  = null;
              try {
                  GSSName selfUser = manager.createName("serviceWhoWantstoImpersonate", GSSName.NT_USER_NAME);
                  Oid krb5Oid = new Oid( "1.2.840.113554.1.2.2");
                  self = manager.createCredential(selfUser.canonicalize(krb5Oid), GSSCredential.DEFAULT_LIFETIME, krb5Oid, GSSCredential.INITIATE_ONLY);
                  GSSName user = manager.createName(clientName, GSSName.NT_USER_NAME);
                  GSSCredential impCred = ((ExtendedGSSCredential) self).impersonate(user);
              } catch (GSSException e) {
                  e.printStackTrace();
              }
  
              return null;
          }
      });
  </code></pre>
  
  <p>Obviously there will be questions about how the SPN has been set in the KDC? Whether that service account is authorized for delegation? Has the right SPN been assigned to that service account? When the user "monkey" denies all sort of delegation? etc etc. Right now I feel I have made the right settings in KDC. My problem is the above is occurs even before it hits the KDC. Any valid inputs will help.</p>
  
  <p>EDIT:
  After some reasearch, I was able to perform the S4u2self and s4u2proxy using java 8. Surpised that atleast one example should have been provided by Oracle documentation. Anyhow, I am now moving to next stage.
  Now another scenario that I have to handle is cross-domain kerberos certificate delegation. From the java 8 documentation that I have seen so far, it infers that currently cross-realm is not supported. Is it still true?</p>