javax.security.auth.kerberos (Java SE 23 & JDK 23)
Description: declaration: module: java.security.jgss, package: javax.security.auth.kerberos
Keywords: javax.security.auth.kerberos package

# Package javax.security.auth.kerberos

package javax.security.auth.kerberos
This package contains utility classes related to the Kerberos network authentication protocol. They do not provide much Kerberos support themselves.

The Kerberos network authentication protocol is defined in RFC 4120. The Java platform contains support for the client side of Kerberos via the `org.ietf.jgss` package. There might also be a login module that implements `LoginModule` to authenticate Kerberos principals.

You can provide the name of your default realm and Key Distribution Center (KDC) host for that realm using the system properties `java.security.krb5.realm` and `java.security.krb5.kdc`. Both properties must be set. Alternatively, the `java.security.krb5.conf` system property can be set to the location of an MIT style `krb5.conf` configuration file. If none of these system properties are set, the `krb5.conf` file is searched for in an implementation-specific manner. Typically, an implementation will first look for a `krb5.conf` file in `<java-home>/conf/security` and failing that, in an OS-specific location.

The `krb5.conf` file is formatted in the Windows INI file style, which contains a series of relations grouped into different sections. Each relation contains a key and a value, the value can be an arbitrary string or a boolean value. A boolean value can be one of "true", "false", "yes", or "no", and values are case-insensitive.

Since:
  1.4

- Related Packages
  Module
  Package
  Description
  java.base
  javax.security.auth
  This package provides a framework for authentication and authorization.
  java.base
  javax.security.auth.callback
  This package provides the classes necessary for services to interact with applications in order to retrieve information (authentication data including usernames or passwords, for example) or to display information (error and warning messages, for example).
  java.base
  javax.security.auth.login
  This package provides a pluggable authentication framework.
  java.base
  javax.security.auth.spi
  This package provides the interface to be used for implementing pluggable authentication modules.
  java.base
  javax.security.auth.x500
  This package contains the classes that should be used to store X500 Principal and X500 Private Credentials in a Subject.
- Classes
  Class
  Description
  DelegationPermission
  This class is used to restrict the usage of the Kerberos delegation model, ie: forwardable and proxiable tickets.
  EncryptionKey
  This class encapsulates an EncryptionKey used in Kerberos.
  KerberosCredMessage
  This class encapsulates a Kerberos 5 KRB_CRED message which can be used to send Kerberos credentials from one principal to another.
  KerberosKey
  This class encapsulates a long term secret key for a Kerberos principal.
  KerberosPrincipal
  This class encapsulates a Kerberos principal.
  KerberosTicket
  This class encapsulates a Kerberos ticket and associated information as viewed from the client's point of view.
  KeyTab
  This class encapsulates a keytab file.
  ServicePermission
  This class is used to protect Kerberos services and the credentials necessary to access those services.