--- a/jdk/src/java.security.jgss/share/classes/sun/security/krb5/PrincipalName.java	Thu May 19 19:45:04 2016 -0700
+++ b/jdk/src/java.security.jgss/share/classes/sun/security/krb5/PrincipalName.java	Fri May 20 11:15:05 2016 +0800
@@ -424,6 +424,9 @@
                 } catch (UnknownHostException | SecurityException e) {
                     // not canonicalized or no permission to do so, use old
                 }
+                if (hostName.endsWith(".")) {
+                    hostName = hostName.substring(0, hostName.length() - 1);
+                }
                 nameParts[1] = hostName.toLowerCase(Locale.ENGLISH);
             }
             nameStrings = nameParts;

--- a/jdk/test/sun/security/krb5/canonicalize/Test.java	Thu May 19 19:45:04 2016 -0700
+++ b/jdk/test/sun/security/krb5/canonicalize/Test.java	Fri May 20 11:15:05 2016 +0800
@@ -22,7 +22,7 @@
  */
 /*
  * @test
- * @bug 6682516
+ * @bug 6682516 8149521
  * @summary SPNEGO_HTTP_AUTH/WWW_KRB and SPNEGO_HTTP_AUTH/WWW_SPNEGO failed on all non-windows platforms
  * @modules java.security.jgss/sun.security.krb5
  * @run main/othervm  -Djava.security.krb5.conf=krb5.conf Test
@@ -44,9 +44,11 @@
         check("c1", "c1.this.domain");
         check("c1.this", "c1.this.domain");
         check("c1.this.domain", "c1.this.domain");
+        check("c1.this.domain.", "c1.this.domain");
 
         // canonicalized name goes IP, reject
         check("c2", "c2");
+        check("c2.", "c2");
 
         // canonicalized name goes strange, reject
         check("c3", "c3");
@@ -63,4 +65,4 @@
             throw new Exception("Output is " + pn);
         }
     }
-            }
+}