title: How to read display name from kerberos service ticket
body: <p>After application service gets a Kerberos service ticket from the client over HTTP header. How we can read <code>cname</code> (aka UPN) from the ticket.</p>
  <p>I'm using ruby this ruby gem <a href="https://github.com/zenchild/gssapi" rel="nofollow noreferrer">https://github.com/zenchild/gssapi</a> reading service ticket from header (Authorization).
  And If I try to read display_name (cname) right after request come it's working fine.</p>
  <p>Result: <code>example@local.com</code></p>
  <p>But, When I do test with actual service token as a string and keytab file I'm getting error that no display name in memory.</p>
  <p><code>*** GSSAPI::GssApiError Exception: gss_display_name did not return GSS_S_COMPLETE but 131072:  An invalid name was supplied unknown mech-code 0 for mech unknown</code></p>
  <pre class="lang-rb prettyprint-override"><code>host = &quot;example.org&quot;
  service = &quot;HTTP/example.org@example.org&quot;
  token = &quot;Negotiate YIIGUAYGKwYBBQUCoIIGRDCCBkCgMDAuBgkqhk.....&quot;
  keytab = &quot;/home/ubuntu/keytab.keytab&quot;
  
  gss = GSSAPI::Simple.new(host, service, keytab)
  credResult = gss.acquire_credentials
  puts 'Read cred form keytab: ' + &quot;#{credResult}&quot;
  
  contextResult = gss.accept_context(Base64.strict_decode64(token))
  puts 'Hello, ' + &quot;#{gss.display_name}&quot;
  </code></pre>
  <p>From RFC 4178 docs (<a href="https://www.rfc-editor.org/rfc/rfc4120.html#section-5.5.1" rel="nofollow noreferrer">https://www.rfc-editor.org/rfc/rfc4120.html#section-5.5.1</a>) <code>cname</code> (UPN) should be in kerberos ticket's authenticator and able to decrypt and parse it with the app secret key.</p>
  <p>I suspect that the GSSAPI C library doing something over TCP protocol storing <code>cname</code> (UPN) somewhere in memory and memory address as stored global variable, not able to read it.</p>
  <p>Or I'm misunderstanding some part of GSSAPI implementation.</p>
  <p>Here are my questions</p>
  <ol>
  <li><p>Is it possible to get <code>cname</code> from service token as string?</p>
  </li>
  <li><p>How peoples do offline test with Kerberos authentication for application service?</p>
  </li>
  </ol>