[GR-51934] MacOS UnsatisfiedLinkError: sun.security.krb5.SCDynamicStoreConfig.getKerberosConfig

[jamesnetherton]

Describe the issue

On MacOS, I experience UnsatisfiedLinkError: sun.security.krb5.SCDynamicStoreConfig.getKerberosConfig at runtime when trying to run an application that uses the Apache Kudu Java client. It attempts to do authentication with Kerberos. See here.

It seems to work fine on Linux though.

I extracted the code into a simple standalone app with just a main() method and I get the same problem on MacOS.

Steps to reproduce the issue

1. Clone https://github.com/jamesnetherton/graalvm-kerberos-auth-demo
2. mvn clean package
3. native-image -jar target/kerberos-test-1.0-SNAPSHOT.jar
4. ./kerberos-test-1.0-SNAPSHOT

Describe GraalVM and your environment:

MacOS Sonoma 14.3 + M3 CPU.

 Java version: 21.0.2+13, vendor version: GraalVM CE 21.0.2+13.1
 Graal compiler: optimization level: 2, target machine: armv8-a
 C compiler: cc (apple, arm64, 15.0.0)

More details

Exception in thread "main" java.lang.UnsatisfiedLinkError: sun.security.krb5.SCDynamicStoreConfig.getKerberosConfig()Ljava/util/List; [symbol: Java_sun_security_krb5_SCDynamicStoreConfig_getKerberosConfig or Java_sun_security_krb5_SCDynamicStoreConfig_getKerberosConfig__]
        at org.graalvm.nativeimage.builder/com.oracle.svm.core.jni.access.JNINativeLinkage.getOrFindEntryPoint(JNINativeLinkage.java:152)
        at org.graalvm.nativeimage.builder/com.oracle.svm.core.jni.JNIGeneratedMethodSupport.nativeCallAddress(JNIGeneratedMethodSupport.java:54)
        at java.security.jgss@21.0.2/sun.security.krb5.SCDynamicStoreConfig.getKerberosConfig(Native Method)
        at java.security.jgss@21.0.2/sun.security.krb5.SCDynamicStoreConfig.getConfig(SCDynamicStoreConfig.java:70)
        at java.security.jgss@21.0.2/sun.security.krb5.Config.<init>(Config.java:223)
        at java.security.jgss@21.0.2/sun.security.krb5.Config.refresh(Config.java:153)
        at jdk.security.auth@21.0.2/com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:533)
        at java.base@21.0.2/javax.security.auth.login.LoginContext.invoke(LoginContext.java:754)
        at java.base@21.0.2/javax.security.auth.login.LoginContext$4.run(LoginContext.java:678)
        at java.base@21.0.2/javax.security.auth.login.LoginContext$4.run(LoginContext.java:676)
        at java.base@21.0.2/java.security.AccessController.executePrivileged(AccessController.java:114)
        at java.base@21.0.2/java.security.AccessController.doPrivileged(AccessController.java:714)
        at java.base@21.0.2/javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:676)
        at java.base@21.0.2/javax.security.auth.login.LoginContext.login(LoginContext.java:587)
        at org.test.Main.main(Main.java:29)
        at java.base@21.0.2/java.lang.invoke.LambdaForm$DMH/sa346b79c.invokeStaticInit(LambdaForm$DMH)

[fniephaus]

Thanks for raising this, @jamesnetherton. Looks like we have some special handling for this:

graal/substratevm/src/com.oracle.svm.core/src/com/oracle/svm/core/jdk/PlatformNativeLibrarySupport.java

Line 90 in 55433bb

"sun_security_krb5_SCDynamicStoreConfig_getKerberosConfig",

We'll soon look into fixing this...

[rohitsanj]

We're seeing the same issue reported by a user of the ide-sidecar project. @jamesnetherton were you able to come up with any workarounds?

@fniephaus would it be useful to have a configuration option or public method that allows modifying the defaultBuiltInPkgNativesBlocklist? Something like this.