From 6965364813baa0bb75d4525238dfa0e4631bce50 Mon Sep 17 00:00:00 2001 From: mposolda Date: Fri, 17 Apr 2015 18:43:04 +0200 Subject: [PATCH] Improve kerberos documentation a bit --- docbook/reference/en/en-US/modules/kerberos.xml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/docbook/reference/en/en-US/modules/kerberos.xml b/docbook/reference/en/en-US/modules/kerberos.xml index 31c8d10bd7..c4ff1be190 100644 --- a/docbook/reference/en/en-US/modules/kerberos.xml +++ b/docbook/reference/en/en-US/modules/kerberos.xml @@ -215,10 +215,11 @@ ktadd -k /tmp/http.keytab HTTP/www.mydomain.org@MYDOMAIN.ORG The scenario is supported by Keycloak, but there is tricky thing that SPNEGO authentication is done by Keycloak server but GSS credential will need to be used by your application. So you need to enable built-in gss delegation credential protocol mapper in admin console for your application. This will cause that Keycloak will deserialize GSS credential and transmit it to the application - in access token. Application will need to deserialize it and use it for further GSS calls against other services. + in access token. Application will need to deserialize it and use it for further GSS calls against other services. We have an example, which is showing it in details. It's in examples/kerberos + in the Keycloak appliance distribution or WAR distribution download. You can also check the example sources directly here . - GSSContext will need to + Once you deserialize the credential from the access token to the GSSCredential object, then GSSContext will need to be created with this credential passed to the method GSSManager.createContext for example like this: Note that you also need to configure forwardable kerberos tickets in krb5.conf file - and add support for delegated credentials to your browser. See the kerberos example from Keycloak example set for details. + and add support for delegated credentials to your browser. For details, see the kerberos example from Keycloak examples set as mentioned above.