IBM Semeru Runtime Certified Edition for z/OS, Kerberos and mssql-jdbc don't work together #2576

src/main/java/com/microsoft/sqlserver/jdbc/JaasConfiguration.java

@@ -19,26 +19,32 @@
     private final Configuration delegate;
     private AppConfigurationEntry[] defaultValue;
 
-    private static AppConfigurationEntry[] generateDefaultConfiguration() {
-        if (Util.isIBM()) {
-            Map<String, String> confDetailsWithoutPassword = new HashMap<>();
-            confDetailsWithoutPassword.put("useDefaultCcache", "true");
-            Map<String, String> confDetailsWithPassword = new HashMap<>();
-            // We generated a two configurations fallback that is suitable for password and password-less authentication
-            // See
-            // https://www.ibm.com/support/knowledgecenter/SSYKE2_8.0.0/com.ibm.java.security.component.80.doc/security-component/jgssDocs/jaas_login_user.html
-            final String ibmLoginModule = "com.ibm.security.auth.module.Krb5LoginModule";
-            return new AppConfigurationEntry[] {
-                    new AppConfigurationEntry(ibmLoginModule, AppConfigurationEntry.LoginModuleControlFlag.SUFFICIENT,
-                            confDetailsWithoutPassword),
-                    new AppConfigurationEntry(ibmLoginModule, AppConfigurationEntry.LoginModuleControlFlag.SUFFICIENT,
-                            confDetailsWithPassword)};
-        } else {
+    private static AppConfigurationEntry[] generateDefaultConfiguration() throws SQLServerException {
+        try {
+            Class.forName("com.sun.security.auth.module.Krb5LoginModule");
             Map<String, String> confDetails = new HashMap<>();
             confDetails.put("useTicketCache", "true");
             return new AppConfigurationEntry[] {
                     new AppConfigurationEntry("com.sun.security.auth.module.Krb5LoginModule",
                             AppConfigurationEntry.LoginModuleControlFlag.REQUIRED, confDetails)};
+        } catch (ClassNotFoundException e) {
+            try {
+                Class.forName("com.ibm.security.auth.module.Krb5LoginModule");
+                Map<String, String> confDetailsWithoutPassword = new HashMap<>();
+                confDetailsWithoutPassword.put("useDefaultCcache", "true");
+                Map<String, String> confDetailsWithPassword = new HashMap<>();
+                // We generated a two configurations fallback that is suitable for password and password-less authentication
+                // See
+                // https://www.ibm.com/support/knowledgecenter/SSYKE2_8.0.0/com.ibm.java.security.component.80.doc/security-component/jgssDocs/jaas_login_user.html
+                final String ibmLoginModule = "com.ibm.security.auth.module.Krb5LoginModule";
+                return new AppConfigurationEntry[] {
+                        new AppConfigurationEntry(ibmLoginModule, AppConfigurationEntry.LoginModuleControlFlag.SUFFICIENT,
+                                confDetailsWithoutPassword),
+                        new AppConfigurationEntry(ibmLoginModule, AppConfigurationEntry.LoginModuleControlFlag.SUFFICIENT,
+                                confDetailsWithPassword)};
+            } catch (ClassNotFoundException ex) {
+                throw new SQLServerException(SQLServerException.getErrString("R_moduleNotFound"), null);
+            }
         }
     }
 
@@ -47,8 +53,10 @@
      * 
      * @param delegate
      *        a possibly null delegate
+     * @throws SQLServerException
+     *         if neither Kerberos module is found: com.sun.security.auth.module.Krb5LoginModule or com.ibm.security.auth.module.Krb5LoginModule
      */
-    JaasConfiguration(Configuration delegate) {
+    JaasConfiguration(Configuration delegate) throws SQLServerException {
         this.delegate = delegate;
         this.defaultValue = generateDefaultConfiguration();
     }

src/main/java/com/microsoft/sqlserver/jdbc/KerbAuthentication.java

@@ -13,7 +13,7 @@
 import java.util.logging.Level;
 
 import javax.security.auth.Subject;
-import javax.security.auth.login.Configuration;
+//import javax.security.auth.login.Configuration;
 import javax.security.auth.login.LoginContext;
 import javax.security.auth.login.LoginException;
 
@@ -42,11 +42,15 @@ final class KerbAuthentication extends SSPIAuthentication {
     private boolean useDefaultNativeGSSCredential = false;
     private GSSContext peerContext = null;
 
-    static {
-        // Overrides the default JAAS configuration loader.
-        // This one will forward to the default one in all cases but the default configuration is empty.
-        Configuration.setConfiguration(new JaasConfiguration(Configuration.getConfiguration()));
-    }
+    // static {
+    //     // Overrides the default JAAS configuration loader.
+    //     // This one will forward to the default one in all cases but the default configuration is empty.
+    //     try {
+    //         Configuration.setConfiguration(new JaasConfiguration(Configuration.getConfiguration()));
+    //     } catch (SQLServerException e) {
+    //         e.printStackTrace();
+    //     }
+    // }
 
     /**
      * Initializes the Kerberos client security context

src/test/java/com/microsoft/sqlserver/jdbc/KerberosTest.java

@@ -92,6 +92,28 @@ private static void createKerberosConnection(String connectionString) throws Exc
         }
     }
 
+    /**
+     * Test to verify the Kerberos module used 
+     */
+    @Test
+    public void testKerberosConnectionWithDefaultJaasConfig() {
+        try {
+            // Set a mock JAAS configuration using the existing method
+            overwriteJaasConfig();
+
+            String connectionString = connectionStringKerberos + ";useDefaultJaasConfig=true;";
+            createKerberosConnection(connectionString);
+
+            Configuration config = Configuration.getConfiguration();
+            AppConfigurationEntry[] entries = config.getAppConfigurationEntry("CLIENT_CONTEXT_NAME");
+            Assertions.assertNotNull(entries);
+            Assertions.assertTrue(entries.length > 0);
+            Assertions.assertEquals("com.sun.security.auth.module.Krb5LoginModule", entries[0].getLoginModuleName());
+        } catch (Exception e) {
+            Assertions.fail("Exception was thrown: " + e.getMessage());
+        }
+    }
+
     /**
      * Overwrites the default JAAS config. Call before making a connection.
      */