title: Using GSSManager to validate a Kerberos ticket
body: <p>I have the following code:</p>
  
  <pre><code>public static void main(String args[]){
      try {
          //String ticket = "Negotiate YIGCBg...==";
          //byte[] kerberosTicket = ticket.getBytes();
          byte[] kerberosTicket = Base64.decode("YIGCBg...==");
          GSSContext context = GSSManager.getInstance().createContext((GSSCredential) null);
          context.acceptSecContext(kerberosTicket, 0, kerberosTicket.length);
          String user = context.getSrcName().toString();
          context.dispose();
      } catch (GSSException e) {
          e.printStackTrace();
      } catch (Base64DecodingException e) {
          e.printStackTrace();
      }
  }
  </code></pre>
  
  <p>Of course it fails. Here's the exception: </p>
  
  <p><code>GSSException: Defective token detected (Mechanism level: GSSHeader did not find the right tag)</code></p>
  
  <p>I don't know what I'm supposed to do to solve this. Honestly, I don't really understand Kerberos.</p>
  
  <p>I got this ticket by sending a 401 with the appropriate header <code>WWW-Authenticate</code> with 'Negotiate' as the value. The browser immediately issued the same request again with an <code>authorization</code> header containing this ticket.</p>
  
  <p>I was hoping I could validate the ticket and determine who the user is.</p>
  
  <p>Do I need a keytab file? If so, what credentials would I run this under? I'm trying to use the Kerberos ticket for auth for a web-site. Would the credentials be the credentials from IIS?</p>
  
  <p>What am I missing? </p>
  
  <hr>
  
  <p><strong>Update 1</strong>
  From Michael-O's reply, I did a bit more googling and found <a href="http://dmdaa.wordpress.com/2010/10/16/how-to-obtain-and-authenticate-kerberos-and-spnego-tokens-with-jgss/" rel="noreferrer">this article</a>, which led me to <a href="http://msdn.microsoft.com/en-us/library/ms995330.aspx" rel="noreferrer">this article</a>.</p>
  
  <p>On <code>table 3</code>, I found <code>1.3.6.1.5.5.2    SPNEGO</code>.</p>
  
  <p>I have now added that to my credentials following the example from the first article. Here's my code:</p>
  
  <pre><code>public static void main(String args[]){
      try {            
          Oid mechOid = new Oid("1.3.6.1.5.5.2");
  
          GSSManager manager = GSSManager.getInstance();
  
          GSSCredential myCred = manager.createCredential(null,
                  GSSCredential.DEFAULT_LIFETIME,
                  mechOid,
                  GSSCredential.ACCEPT_ONLY);
  
          GSSContext context = manager.createContext(myCred);
  
          byte[] ticket = Base64.decode("YIGCBg...==");
          context.acceptSecContext(ticket, 0, ticket.length);
          String user = context.getSrcName().toString();
          context.dispose();
      } catch (GSSException e) {
          e.printStackTrace();
      } catch (Base64DecodingException e) {
          e.printStackTrace();
      }
  }
  </code></pre>
  
  <p>But now the code is failing on <code>createCredential</code> with this error:</p>
  
  <pre><code>GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos credentails)
  </code></pre>
  
  <hr>
  
  <p>Here's the entire ticket: <code>YIGCBgYrBgEFBQKgeDB2oDAwLgYKKwYBBAGCNwICCgYJKoZIgvcSAQICBgkqhkiG9xIBAgIGCisGAQQBgjcCAh6iQgRATlRMTVNTUAABAAAAl7II4g4ADgAyAAAACgAKACgAAAAGAbEdAAAAD0xBUFRPUC0yNDVMSUZFQUNDT1VOVExMQw==</code></p>