我想使用 keytab 识别针对 ADS 的服务。它在 Java 8 上成功，但在 Java 6 或 Java 7 上不成功。两者都因错误而失败GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos Key)。
在这两种情况下，我都使用isInitiator=true，因为如果没有，它会失败。据我所知，Java 8 在文件中找到了作为接受者的发起者凭证：
>>> KeyTab: load() entry length: 70; type: 23
Looking for keys for: HTTP/server.firm.com@FIRM.COM
Added key: 23version: 3
KdcAccessibility: reset
Looking for keys for: HTTP/server.firm.com@FIRM.COM
Added key: 23version: 3
...
Search Subject for Kerberos V5 INIT cred (HTTP/server.firm.com@FIRM.COM sun.security.jgss.krb5.Krb5InitCredential)
Found ticket for HTTP/server.firm.com@FIRM.COM to go to krbtgt/FIRM.COM@FIRM.COM expiring on Fri Aug 28 19:21:38 CEST 2015
Search Subject for Kerberos V5 ACCEPT cred (HTTP/server.firm.com@FIRM.COM, sun.security.jgss.krb5.Krb5AcceptCredential)
Found ticket for HTTP/server.firm.com@FIRM.COM to go to krbtgt/FIRM.COM@FIRM.COM expiring on Fri Aug 28 19:21:38 CEST 2015
较旧的 java 实现仅找到启动器之一，并在他们想要使用接受器时生成异常：
>>> KeyTab: load() entry length: 70; type: 23
Added key: 23version: 3
Search Subject for Kerberos V5 INIT cred (HTTP/server.firm.com@FIRM.COM, sun.security.jgss.krb5.Krb5InitCredential)
Found ticket for HTTP/server.firm.com@FIRM.COM to go to krbtgt/FIRM.COM@FIRM.COM expiring on Fri Aug 28 19:20:35 CEST 2015
Search Subject for Kerberos V5 ACCEPT cred (HTTP/server.firm.com@FIRM.COM, sun.security.jgss.krb5.Krb5AcceptCredential)
Exception in thread "main" java.lang.Error: GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos Key)
at test.KerberosTicketRetriever$TicketCreatorAction.run(KerberosTicketRetriever.java:97)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAsPrivileged(Subject.java:454)
at ff.support.kerberos.KerberosTicketRetriever.retrieveTicket(KerberosTicketRetriever.java:223)
at ff.support.kerberos.KerberosTicketRetriever.main(KerberosTicketRetriever.java:292)
Caused by: GSSException: No valid credentials provided (Mechanism level: Failed to find any Kerberos Key)
at sun.security.jgss.krb5.Krb5AcceptCredential.getInstance(Krb5AcceptCredential.java:95)
at sun.security.jgss.krb5.Krb5MechFactory.getCredentialElement(Krb5MechFactory.java:111)
at sun.security.jgss.GSSManagerImpl.getCredentialElement(GSSManagerImpl.java:178)
at sun.security.jgss.GSSCredentialImpl.add(GSSCredentialImpl.java:422)
at sun.security.jgss.GSSCredentialImpl.<init>(GSSCredentialImpl.java:42)
at sun.security.jgss.GSSManagerImpl.createCredential(GSSManagerImpl.java:139)
at ff.support.kerberos.KerberosTicketRetriever$TicketCreatorAction.createTicket(KerberosTicketRetriever.java:116)
at ff.support.kerberos.KerberosTicketRetriever$TicketCreatorAction.run(KerberosTicketRetriever.java:93)
... 4 more
keytab 本身只包含一个键：
C:\> jdk\bin\klist -K -e -t -k myFile.keytab
Key tab: myFile.keytab, 1 entry found.
[1] Service principal: HTTP/server.firm.com@FIRM.COM
KVNO: 3
Key type: 23
Key: 0x2e6a4379b2ba26385d687a5e9d3bc6d
Time stamp: Jan 01, 1970 01:00
我不太明白什么时候 keytab 是发起者，什么时候不是发起者，以及为什么不同版本的 java 会导致不同的结果。有人可以帮忙吗？