title: Enable detailed logging for Kerberos in Java
body: <p>I have a Java-based web application that takes the contents of a web form containing a username and password and authenticates using Kerberos to a Windows-based domain.</p>
  <p>The KDC address is apparently configured to map to different IP addresses at each lookup and this can be confirmed by using the ping command from the command line.</p>
  <p>The call responds immediately for most requests but the response is slow (5-10 seconds or even longer) intermittently. I think this may be due to which domain controller is used.</p>
  <p>I've tried to turn on Kerberos logging but the IP address of the domain controller is not shown. How can I turn on more detailed logging to try to identify dodgy domain controllers please?</p>
  <p>The code extract sources the <code>kerb.conf</code> and <code>kerb_context.conf</code> from the filesystem.</p>
  <p>The <code>kerb.conf</code> is:</p>
  <pre><code>[libdefaults]
  default_realm = EXAMPLE.COM
  
  [realms]
  CYMRU.NHS.UK = {
          kdc = example.com:88
          admin_server = example.com
          kpasswd_server = example.com
  }
  </code></pre>
  <p>The kerb_context.conf is:</p>
  <pre><code> primaryLoginContext {
          com.sun.security.auth.module.Krb5LoginModule required
          useTicketCache=false
          refreshKrb5Config=true
          debug=true;
  };
  </code></pre>
  <p>The example source is:</p>
  <pre><code>static NadexUser executePerformLogin(String username, String password) throws LoginException {
              char[] passwd = password.toCharArray();
              String kerbConf = ERXFileUtilities.pathForResourceNamed(&quot;nadex/kerb.conf&quot;, &quot;RSCorp&quot;, null);
              String kerbContextConf = ERXFileUtilities.pathURLForResourceNamed(&quot;nadex/kerb_context.conf&quot;, &quot;RSCorp&quot;, null).toExternalForm();
              System.setProperty(&quot;java.security.krb5.conf&quot;, kerbConf);
              System.setProperty(&quot;java.security.auth.login.config&quot;, kerbContextConf);
              try {
                      LoginContext lc = new LoginContext(&quot;primaryLoginContext&quot;, new UserNamePasswordCallbackHandler(username, password));
                      lc.login();
                      return new _NadexUser(lc.getSubject());
              }
              catch (javax.security.auth.login.LoginException le) {
                      throw new LoginException(&quot;Failed to login : &quot; + le.getLocalizedMessage(), le);
              }
      }
  </code></pre>