{"action":"created","issue":{"url":"https://api.github.com/repos/ymartin59/java-kerberos-sfudemo/issues/1","labels_url":"https://api.github.com/repos/ymartin59/java-kerberos-sfudemo/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/ymartin59/java-kerberos-sfudemo/issues/1/comments","events_url":"https://api.github.com/repos/ymartin59/java-kerberos-sfudemo/issues/1/events","html_url":"https://github.com/ymartin59/java-kerberos-sfudemo/issues/1","id":116742167,"number":1,"title":"Several issues with the demo code","user":{"login":"michael-o","id":573017,"avatar_url":"https://avatars.githubusercontent.com/u/573017?v=3","gravatar_id":"","url":"https://api.github.com/users/michael-o","html_url":"https://github.com/michael-o","followers_url":"https://api.github.com/users/michael-o/followers","following_url":"https://api.github.com/users/michael-o/following{/other_user}","gists_url":"https://api.github.com/users/michael-o/gists{/gist_id}","starred_url":"https://api.github.com/users/michael-o/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michael-o/subscriptions","organizations_url":"https://api.github.com/users/michael-o/orgs","repos_url":"https://api.github.com/users/michael-o/repos","events_url":"https://api.github.com/users/michael-o/events{/privacy}","received_events_url":"https://api.github.com/users/michael-o/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-11-13T10:29:39Z","updated_at":"2015-12-06T10:46:43Z","closed_at":null,"body":"Hi Yves,\r\n\r\nyour code has some shortcomings:\r\n\r\n1. #main: `HTTP/webservice-host.domain.ltd` is not a valid SPN GSS-API expects. It expects a mech-neutral format `service@host` which will be converted to a mech-specific name with `canonicalize`. This will also work cross-realm.\r\n2. Rather use `host` than `HTTP` because a host ist always available with a machine principal.\r\n3. #main: Rather use for `targetUserName` `user@DOMAIN.TLD` to make it consistent.\r\n4. #generateToken does not indicate that the context is complete nor does it test that. It should clearly say that it is for demo purposes. Not doing so makes the entire stuff insecure.\r\n5. #startAsClient: don't request confidentiality if you do not intend to wrap the exchanged data.\r\n6. #startAsClient: don't request mutual authentication if you don't validate the response token from the server\r\n7. Line 198: That should read SPN and not SVN"},"comment":{"url":"https://api.github.com/repos/ymartin59/java-kerberos-sfudemo/issues/comments/162302660","html_url":"https://github.com/ymartin59/java-kerberos-sfudemo/issues/1#issuecomment-162302660","issue_url":"https://api.github.com/repos/ymartin59/java-kerberos-sfudemo/issues/1","id":162302660,"user":{"login":"ymartin59","id":2196184,"avatar_url":"https://avatars.githubusercontent.com/u/2196184?v=3","gravatar_id":"","url":"https://api.github.com/users/ymartin59","html_url":"https://github.com/ymartin59","followers_url":"https://api.github.com/users/ymartin59/followers","following_url":"https://api.github.com/users/ymartin59/following{/other_user}","gists_url":"https://api.github.com/users/ymartin59/gists{/gist_id}","starred_url":"https://api.github.com/users/ymartin59/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ymartin59/subscriptions","organizations_url":"https://api.github.com/users/ymartin59/orgs","repos_url":"https://api.github.com/users/ymartin59/repos","events_url":"https://api.github.com/users/ymartin59/events{/privacy}","received_events_url":"https://api.github.com/users/ymartin59/received_events","type":"User","site_admin":false},"created_at":"2015-12-06T10:46:43Z","updated_at":"2015-12-06T10:46:43Z","body":"Hello Michael,\r\nI have addressed most of your remarks.\r\nMay you confirm that `context.requestCredDeleg(true)` is the only required called to allow called service  to delegate to a next hop ?\r\nRegards\r\nYves Martin"}}