title: How to obtain a kerberos service ticket via GSS-API?
body: <p>Does anyone know how to get a service ticket from the Key Distribution Center (KDC) using the Java GSS-API?</p>
  
  <p>I have a thick-client-application that first authenticates via JAAS using the Krb5LoginModule to fetch the TGT from the ticket cache (background: Windows e.g. uses a kerberos implementation and stores the ticket granting ticket in a secure memory area). From the LoginManager I get the Subject object which contains the TGT. Now I hoped when I create a specific GSSCredential object for my service, the service ticket will be put into the Subject's private credentials as well (I've read so somewhere in the web). So I have tried the following:</p>
  
  <pre><code>// Exception handling ommitted
  LoginContext lc = new LoginContext("HelloEjbClient", new DialogCallbackHandler());
  lc.login()
  Subject.doAs(lc.getSubject(), new PrivilegedAction() {
  
      public Object run() {
          GSSManager manager = GSSManager.getInstance();
          GSSName clientName = manager.createName("clientUser", GSSName.NT_USER_NAME);
          GSSCredential clientCreds = manager.createCredential(clientName, 8 * 3600, createKerberosOid(), GSSCredential.INITIATE_ONLY);
  
          GSSName serverName = manager.createName("myService@localhost", GSSName.NT_HOSTBASED_SERVICE);
          manager.createCredential(serverName, GSSCredential.INDEFINITE_LIFETIME, createKerberosOid(), GSSCredential.INITIATE_ONLY);
          return null;
      }
  
      private Oid createKerberosOid() {
          return new Oid("1.2.840.113554.1.2.2");
      }
  
  });
  </code></pre>
  
  <p>Unfortunately I get a GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt).</p>