// Get the service ticket
KerberosClientExceptionAction action =
new KerberosClientExceptionAction(clientPrincipals.iterator().next(), serviceName,
isUsernameServiceNameForm, requestCredDeleg,
delegatedCredential, false, false);
KerberosContext krbCtx = null;
try {
krbCtx = (KerberosContext) Subject.doAs(clientSubject, action);
// Get the secret key from KerberosContext if available, otherwise use Kerberos ticket's session key
Key sessionKey = krbCtx.getSecretKey();
if (sessionKey != null) {
secretKey = new SecretKeySpec(sessionKey.getEncoded(), sessionKey.getAlgorithm());
} else {
KerberosTicket serviceTicket = getKerberosTicket(clientSubject, tgt);
secretKey = serviceTicket.getSessionKey();
}
setToken(krbCtx.getKerberosToken());
}
catch (PrivilegedActionException e) {
Throwable cause = e.getCause();
if (cause instanceof WSSecurityException) {
throw (WSSecurityException) cause;
}
else {
throw new WSSecurityException(
ErrorCode.FAILURE, "kerberosServiceTicketError", new Object[] {}, cause
);
}
} finally {
if (krbCtx != null) {
krbCtx.dispose();
}
}
if (LOG.isDebugEnabled()) {
LOG.debug("Successfully retrieved a service ticket");
}