title: Kerberos user principals in Keytab and KDC with JAAS
body: <p>I'm building a simple Jaas loginmodule. This uses the following code:</p>
  
  <pre><code>public class Jaas {
      private static String name;
      private static final boolean verbose = false;
  
      public static void main(String[] args) throws Exception {
          if (args.length &gt; 0) {
              name = args[0];
          } else {
              name = "client";
          }
  
          // Create action to perform
          PrivilegedExceptionAction action = new MyAction();
  
          loginAndAction(name, action);
      }
  
      static void loginAndAction(String name, PrivilegedExceptionAction action)
          throws LoginException, PrivilegedActionException {
  
          // Create a callback handler
          CallbackHandler callbackHandler = new TextCallbackHandler();
  
          LoginContext context = null;
  
          try {
              // Create a LoginContext with a callback handler
              context = new LoginContext(name, callbackHandler);
  
              // Perform authentication
              context.login();
          } catch (LoginException e) {
              System.err.println("Login failed");
              e.printStackTrace();
              System.exit(-1);
          }
  
          // Perform action as authenticated user
          Subject subject = context.getSubject();
          if (verbose) {
              System.out.println(subject.toString());
          } else {
              System.out.println("Authenticated principal: " +
                  subject.getPrincipals());
          }
  
          Subject.doAs(subject, action);
  
          context.logout();
      }
  
      // Action to perform
      static class MyAction implements PrivilegedExceptionAction {
          MyAction() {
          }
  
          public Object run() throws Exception {
              // Replace the following with an action to be performed
              // by authenticated user
              System.out.println("Performing secure action ...");
              return null;
          }
      }
  }
  </code></pre>
  
  <p>This is run using:</p>
  
  <pre><code>java -Djava.security.auth.login.config=jaas-krb5.conf Jaas client
  </code></pre>
  
  <p>jaas-krb5:</p>
  
  <pre><code>client{
      com.sun.security.auth.module.Krb5LoginModule required
      principal="name@Host.COM";
  };
  server{
      com.sun.security.auth.module.Krb5LoginModule required
      useKeyTab=true
      storeKey=true
      KeyTab=myKeyTab.keytab
      principal="host.name.com";
  };
  </code></pre>
  
  <p>and within the myKeyTab we have the following principal:</p>
  
  <pre><code>slot KVNO Principal
  ---- ---- ---------------------------------------------------------------------
     1    4        name@Host.COM
  </code></pre>
  
  <p>So i've compiled and run but when logging in I always get an error:</p>
  
  <pre><code>Kerberos password for name@Host.COM: //I enter the password
  Login failed
  </code></pre>
  
  <p>with the stacktrace:</p>
  
  <pre><code>javax.security.auth.login.LoginException: Cannot get kdc for realm Host.COM
          at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:696)
          at com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:542)
          at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
          at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
          at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
          at java.lang.reflect.Method.invoke(Method.java:597)
          at javax.security.auth.login.LoginContext.invoke(LoginContext.java:769)
          at javax.security.auth.login.LoginContext.access$000(LoginContext.java:186)
          at javax.security.auth.login.LoginContext$4.run(LoginContext.java:683)
          at java.security.AccessController.doPrivileged(Native Method)
          at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)
          at javax.security.auth.login.LoginContext.login(LoginContext.java:579)
          at Jaas.loginAndAction(Jaas.java:77)
          at Jaas.main(Jaas.java:61)
  Caused by: KrbException: Cannot get kdc for realm Host.COM
          at sun.security.krb5.KrbKdcReq.send(KrbKdcReq.java:195)
          at sun.security.krb5.KrbKdcReq.send(KrbKdcReq.java:174)
          at sun.security.krb5.KrbAsReq.send(KrbAsReq.java:431)
          at sun.security.krb5.Credentials.sendASRequest(Credentials.java:400)
          at sun.security.krb5.Credentials.acquireTGT(Credentials.java:350)
          at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:662)
  </code></pre>
  
  <p>My Question is:</p>
  
  <p>I think I've got a fundamental misunderstanding on what's occurring between the KDC/ Keytab and the user entry. My understanding is that the principal is what is validated against, if so, how do I enter new principals and assign passwords?</p>
  
  <p>My aim is to simply add a test principal to the keytab and use that for running this log in script.</p>