Questions regarding GSSAPI implementation

[Nathan Widmyer]

I'm curious about implementing a system where there will need kerberized systems to connect to a secured Hadoop cluster.

I have a system like this:

Human credentials on Client -> Service1 -> Service2 -> Secure Hadoop

I'd like to SSO on the Client machine and maintain authentication all the way to Hadoop.

I found this page: https://www.ibm.com/developerworks/library/j-gss-sso/
In the client end of the sample code, I see it establishing human credentials of me (clientPeerName) and application credentials of the next machine (peerCredentials).

e.g.
GSSName clientPeerName = manager.createName(clientName, GSSName.NT_USER_NAME);
GSSName remotePeerName = manager.createName(serverName, GSSName.NT_USER_NAME);
System.out.println (">>> GSSClient... Getting client credentials");
GSSCredential peerCredentials = manager.createCredential(
clientPeerName, //The GSSName object of the client.
10*60, //Time for which credentials whill be valid.
kerberos, //Kerberos mecahnism identifier.
GSSCredential.INITIATE_ONLY //The client only intiates the secure context request.
);
GSSContext peerContext = manager.createContext(remotePeerName,
kerberos,
peerCredentials,
GSSContext.DEFAULT_LIFETIME );

But I see these lines:
byteToken = peerContext.initSecContext(byteToken, 0, byteToken.length);

if (byteToken != null) {
outStream.writeInt(byteToken.length);
outStream.write(byteToken );
outStream.flush();
}

So is byteToken the magic bytes?

In the server portion, once the server sets up it's credentials similar to above, it has these lines:

byteToken = new byte[inStream.readInt()];
inStream.readFully(byteToken);
byteToken = serverGSSContext.acceptSecContext(byteToken, 0, byteToken.length);

Is that reading the byteToken from the client and accepting the bytes into the secure context, and thus passes along the original user auth?

If two processes are already talking through an existing mechanism, can they still use it, or do I have to shuttle those bytes through wrap/unwrap too?
Can I just call an isAuthenticated() before the existing mechanism communicates?