[ZOOKEEPER-1664] Kerberos auth doesn't work with native platform GSS integration

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.4.5, 3.5.0
• Component/s: java client, server

Environment

Linux (and likely also Solaris).

• Assignee: Unassigned
• Reporter: Boaz Kelmer
• Created: 13/Mar/13 18:58
• Updated: 11/Sep/13 22:00
• Resolved: 11/Sep/13 22:00

Description

Java on Linux/Solaris can be set up to use the native (via C library)
GSS implementation. This is configured by setting the system property
sun.security.jgss.native=true
When using this feature, ZooKeeper Sasl/JGSS authentication doesn't work.
The reason is explained in
http://docs.oracle.com/javase/6/docs/technotes/guides/security/jgss/jgss-features.html

"""
[when using native GSS...]
In addition, when performing operations as a particular Subject, e.g.
Subject.doAs(...) or Subject.doAsPrivileged(...), the to-be-used
GSSCredential should be added to Subject's private credential set.
Otherwise, the GSS operations will fail since no credential is found.
"""