jdk/src/share/lib/security/java.security-windows
author chegar
Fri, 06 Sep 2013 13:36:33 +0100
changeset 22308 8c0fcd365efc
parent 19600 fce5c0729a1c
parent 22305 a3308d25c711
child 22332 fba4c66089bb
permissions -rw-r--r--
Merge
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
     1
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
     2
# This is the "master security properties file".
90ce3da70b43 Initial load
duke
parents:
diff changeset
     3
#
13159
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
     4
# An alternate java.security properties file may be specified
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
     5
# from the command line via the system property
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
     6
#
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
     7
#    -Djava.security.properties=<URL>
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
     8
#
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
     9
# This properties file appends to the master security properties file.
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    10
# If both properties files specify values for the same key, the value
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    11
# from the command-line properties file is selected, as it is the last
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    12
# one loaded.
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    13
#
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    14
# Also, if you specify
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    15
#
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    16
#    -Djava.security.properties==<URL> (2 equals),
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    17
#
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    18
# then that properties file completely overrides the master security
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    19
# properties file.
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    20
#
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    21
# To disable the ability to specify an additional properties file from
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    22
# the command line, set the key security.overridePropertiesFile
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    23
# to false in the master security properties file. It is set to true
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    24
# by default.
b2bf5f74dd06 7133344: Document the java.security.properties system property feature in the java.security file
mullan
parents: 13046
diff changeset
    25
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    26
# In this file, various security properties are set for use by
90ce3da70b43 Initial load
duke
parents:
diff changeset
    27
# java.security classes. This is where users can statically register
90ce3da70b43 Initial load
duke
parents:
diff changeset
    28
# Cryptography Package Providers ("providers" for short). The term
90ce3da70b43 Initial load
duke
parents:
diff changeset
    29
# "provider" refers to a package or set of packages that supply a
90ce3da70b43 Initial load
duke
parents:
diff changeset
    30
# concrete implementation of a subset of the cryptography aspects of
90ce3da70b43 Initial load
duke
parents:
diff changeset
    31
# the Java Security API. A provider may, for example, implement one or
90ce3da70b43 Initial load
duke
parents:
diff changeset
    32
# more digital signature algorithms or message digest algorithms.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    33
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    34
# Each provider must implement a subclass of the Provider class.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    35
# To register a provider in this master security properties file,
90ce3da70b43 Initial load
duke
parents:
diff changeset
    36
# specify the Provider subclass name and priority in the format
90ce3da70b43 Initial load
duke
parents:
diff changeset
    37
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    38
#    security.provider.<n>=<className>
90ce3da70b43 Initial load
duke
parents:
diff changeset
    39
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    40
# This declares a provider, and specifies its preference
90ce3da70b43 Initial load
duke
parents:
diff changeset
    41
# order n. The preference order is the order in which providers are
90ce3da70b43 Initial load
duke
parents:
diff changeset
    42
# searched for requested algorithms (when no specific provider is
90ce3da70b43 Initial load
duke
parents:
diff changeset
    43
# requested). The order is 1-based; 1 is the most preferred, followed
90ce3da70b43 Initial load
duke
parents:
diff changeset
    44
# by 2, and so on.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    45
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    46
# <className> must specify the subclass of the Provider class whose
90ce3da70b43 Initial load
duke
parents:
diff changeset
    47
# constructor sets the values of various properties that are required
90ce3da70b43 Initial load
duke
parents:
diff changeset
    48
# for the Java Security API to look up the algorithms or other
90ce3da70b43 Initial load
duke
parents:
diff changeset
    49
# facilities implemented by the provider.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    50
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    51
# There must be at least one provider specification in java.security.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    52
# There is a default provider that comes standard with the JDK. It
90ce3da70b43 Initial load
duke
parents:
diff changeset
    53
# is called the "SUN" provider, and its Provider subclass
90ce3da70b43 Initial load
duke
parents:
diff changeset
    54
# named Sun appears in the sun.security.provider package. Thus, the
90ce3da70b43 Initial load
duke
parents:
diff changeset
    55
# "SUN" provider is registered via the following:
90ce3da70b43 Initial load
duke
parents:
diff changeset
    56
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    57
#    security.provider.1=sun.security.provider.Sun
90ce3da70b43 Initial load
duke
parents:
diff changeset
    58
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    59
# (The number 1 is used for the default provider.)
90ce3da70b43 Initial load
duke
parents:
diff changeset
    60
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    61
# Note: Providers can be dynamically registered instead by calls to
90ce3da70b43 Initial load
duke
parents:
diff changeset
    62
# either the addProvider or insertProviderAt method in the Security
90ce3da70b43 Initial load
duke
parents:
diff changeset
    63
# class.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    64
90ce3da70b43 Initial load
duke
parents:
diff changeset
    65
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    66
# List of providers and their preference orders (see above):
90ce3da70b43 Initial load
duke
parents:
diff changeset
    67
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
    68
security.provider.1=sun.security.provider.Sun
90ce3da70b43 Initial load
duke
parents:
diff changeset
    69
security.provider.2=sun.security.rsa.SunRsaSign
3492
e549cea58864 6840752: Provide out-of-the-box support for ECC algorithms
vinnie
parents: 3448
diff changeset
    70
security.provider.3=sun.security.ec.SunEC
e549cea58864 6840752: Provide out-of-the-box support for ECC algorithms
vinnie
parents: 3448
diff changeset
    71
security.provider.4=com.sun.net.ssl.internal.ssl.Provider
e549cea58864 6840752: Provide out-of-the-box support for ECC algorithms
vinnie
parents: 3448
diff changeset
    72
security.provider.5=com.sun.crypto.provider.SunJCE
e549cea58864 6840752: Provide out-of-the-box support for ECC algorithms
vinnie
parents: 3448
diff changeset
    73
security.provider.6=sun.security.jgss.SunProvider
e549cea58864 6840752: Provide out-of-the-box support for ECC algorithms
vinnie
parents: 3448
diff changeset
    74
security.provider.7=com.sun.security.sasl.Provider
e549cea58864 6840752: Provide out-of-the-box support for ECC algorithms
vinnie
parents: 3448
diff changeset
    75
security.provider.8=org.jcp.xml.dsig.internal.dom.XMLDSigRI
e549cea58864 6840752: Provide out-of-the-box support for ECC algorithms
vinnie
parents: 3448
diff changeset
    76
security.provider.9=sun.security.smartcardio.SunPCSC
e549cea58864 6840752: Provide out-of-the-box support for ECC algorithms
vinnie
parents: 3448
diff changeset
    77
security.provider.10=sun.security.mscapi.SunMSCAPI
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    78
90ce3da70b43 Initial load
duke
parents:
diff changeset
    79
#
16915
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
    80
# Sun Provider SecureRandom seed source.
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
    81
#
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
    82
# Select the primary source of seed data for the "SHA1PRNG" and
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
    83
# "NativePRNG" SecureRandom implementations in the "Sun" provider.
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
    84
# (Other SecureRandom implementations might also use this property.)
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
    85
#
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
    86
# On Unix-like systems (for example, Solaris/Linux/MacOS), the
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
    87
# "NativePRNG" and "SHA1PRNG" implementations obtains seed data from
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
    88
# special device files such as file:/dev/random.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    89
#
16915
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
    90
# On Windows systems, specifying the URLs "file:/dev/random" or
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
    91
# "file:/dev/urandom" will enable the native Microsoft CryptoAPI seeding
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
    92
# mechanism for SHA1PRNG.
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
    93
#
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
    94
# By default, an attempt is made to use the entropy gathering device
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
    95
# specified by the "securerandom.source" Security property.  If an
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
    96
# exception occurs while accessing the specified URL:
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
    97
#
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
    98
#     SHA1PRNG:
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
    99
#         the traditional system/thread activity algorithm will be used.
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
   100
#
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
   101
#     NativePRNG:
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
   102
#         a default value of /dev/random will be used.  If neither
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
   103
#         are available, the implementation will be disabled.
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
   104
#         "file" is the only currently supported protocol type.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   105
#
16915
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
   106
# The entropy gathering device can also be specified with the System
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
   107
# property "java.security.egd". For example:
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
   108
#
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
   109
#   % java -Djava.security.egd=file:/dev/random MainClass
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   110
#
16915
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
   111
# Specifying this System property will override the
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
   112
# "securerandom.source" Security property.
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
   113
#
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
   114
# In addition, if "file:/dev/random" or "file:/dev/urandom" is
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
   115
# specified, the "NativePRNG" implementation will be more preferred than
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
   116
# SHA1PRNG in the Sun provider.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   117
#
16915
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
   118
securerandom.source=file:/dev/random
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
   119
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
   120
#
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
   121
# A list of known strong SecureRandom implementations.
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
   122
#
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
   123
# To help guide applications in selecting a suitable strong
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
   124
# java.security.SecureRandom implementation, Java distributions should
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
   125
# indicate a list of known strong implementations using the property.
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
   126
#
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
   127
# This is a comma-separated list of algorithm and/or algorithm:provider
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
   128
# entries.
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
   129
#
675d1569af3e 6425477: Better support for generation of high entropy random numbers
wetmore
parents: 16744
diff changeset
   130
securerandom.strongAlgorithms=Windows-PRNG:SunMSCAPI
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   131
90ce3da70b43 Initial load
duke
parents:
diff changeset
   132
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   133
# Class to instantiate as the javax.security.auth.login.Configuration
90ce3da70b43 Initial load
duke
parents:
diff changeset
   134
# provider.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   135
#
19385
a7b34a4b1fcb 8016848: javax_security/auth/login tests fail in compact 1 and 2 profiles
mullan
parents: 18828
diff changeset
   136
login.configuration.provider=sun.security.provider.ConfigFile
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   137
90ce3da70b43 Initial load
duke
parents:
diff changeset
   138
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   139
# Default login configuration file
90ce3da70b43 Initial load
duke
parents:
diff changeset
   140
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   141
#login.config.url.1=file:${user.home}/.java.login.config
90ce3da70b43 Initial load
duke
parents:
diff changeset
   142
90ce3da70b43 Initial load
duke
parents:
diff changeset
   143
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   144
# Class to instantiate as the system Policy. This is the name of the class
90ce3da70b43 Initial load
duke
parents:
diff changeset
   145
# that will be used as the Policy object.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   146
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   147
policy.provider=sun.security.provider.PolicyFile
90ce3da70b43 Initial load
duke
parents:
diff changeset
   148
90ce3da70b43 Initial load
duke
parents:
diff changeset
   149
# The default is to have a single system-wide policy file,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   150
# and a policy file in the user's home directory.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   151
policy.url.1=file:${java.home}/lib/security/java.policy
90ce3da70b43 Initial load
duke
parents:
diff changeset
   152
policy.url.2=file:${user.home}/.java.policy
90ce3da70b43 Initial load
duke
parents:
diff changeset
   153
90ce3da70b43 Initial load
duke
parents:
diff changeset
   154
# whether or not we expand properties in the policy file
90ce3da70b43 Initial load
duke
parents:
diff changeset
   155
# if this is set to false, properties (${...}) will not be expanded in policy
90ce3da70b43 Initial load
duke
parents:
diff changeset
   156
# files.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   157
policy.expandProperties=true
90ce3da70b43 Initial load
duke
parents:
diff changeset
   158
90ce3da70b43 Initial load
duke
parents:
diff changeset
   159
# whether or not we allow an extra policy to be passed on the command line
90ce3da70b43 Initial load
duke
parents:
diff changeset
   160
# with -Djava.security.policy=somefile. Comment out this line to disable
90ce3da70b43 Initial load
duke
parents:
diff changeset
   161
# this feature.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   162
policy.allowSystemProperty=true
90ce3da70b43 Initial load
duke
parents:
diff changeset
   163
90ce3da70b43 Initial load
duke
parents:
diff changeset
   164
# whether or not we look into the IdentityScope for trusted Identities
90ce3da70b43 Initial load
duke
parents:
diff changeset
   165
# when encountering a 1.1 signed JAR file. If the identity is found
90ce3da70b43 Initial load
duke
parents:
diff changeset
   166
# and is trusted, we grant it AllPermission.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   167
policy.ignoreIdentityScope=false
90ce3da70b43 Initial load
duke
parents:
diff changeset
   168
90ce3da70b43 Initial load
duke
parents:
diff changeset
   169
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   170
# Default keystore type.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   171
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   172
keystore.type=jks
90ce3da70b43 Initial load
duke
parents:
diff changeset
   173
90ce3da70b43 Initial load
duke
parents:
diff changeset
   174
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   175
# List of comma-separated packages that start with or equal this string
90ce3da70b43 Initial load
duke
parents:
diff changeset
   176
# will cause a security exception to be thrown when
90ce3da70b43 Initial load
duke
parents:
diff changeset
   177
# passed to checkPackageAccess unless the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   178
# corresponding RuntimePermission ("accessClassInPackage."+package) has
90ce3da70b43 Initial load
duke
parents:
diff changeset
   179
# been granted.
16083
3d08cc685055 7201068: Better handling of UI elements
mullan
parents: 14206
diff changeset
   180
package.access=sun.,\
16895
2f7edbd000c4 8005432: Update access to JAX-WS
mkos
parents: 16894
diff changeset
   181
               com.sun.xml.internal.,\
16083
3d08cc685055 7201068: Better handling of UI elements
mullan
parents: 14206
diff changeset
   182
               com.sun.imageio.,\
16101
0229685a801f 8004175: Restricted packages added in java.security are missing in java.security-{macosx, solaris, windows}
mchung
parents: 16100
diff changeset
   183
               com.sun.istack.internal.,\
16109
eb00701a5769 8006446: Restrict MBeanServer access
dfuchs
parents: 16108
diff changeset
   184
               com.sun.jmx.,\
19600
fce5c0729a1c 8019830: Add com.sun.media.sound to the list of restricted package
mullan
parents: 19385
diff changeset
   185
               com.sun.media.sound.,\
22300
d669110735f4 8022945: Enhance JNDI implementation classes
weijun
parents: 18828
diff changeset
   186
               com.sun.naming.internal.,\
16108
e5fcdadc69b2 8006882: Proxy generated classes in sun.proxy package breaks JMockit
mchung
parents: 16106
diff changeset
   187
               com.sun.proxy.,\
16894
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   188
               com.sun.org.apache.bcel.internal.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   189
               com.sun.org.apache.regexp.internal.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   190
               com.sun.org.apache.xerces.internal.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   191
               com.sun.org.apache.xpath.internal.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   192
               com.sun.org.apache.xalan.internal.extensions.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   193
               com.sun.org.apache.xalan.internal.lib.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   194
               com.sun.org.apache.xalan.internal.res.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   195
               com.sun.org.apache.xalan.internal.templates.,\
16083
3d08cc685055 7201068: Better handling of UI elements
mullan
parents: 14206
diff changeset
   196
               com.sun.org.apache.xalan.internal.utils.,\
16894
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   197
               com.sun.org.apache.xalan.internal.xslt.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   198
               com.sun.org.apache.xalan.internal.xsltc.cmdline.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   199
               com.sun.org.apache.xalan.internal.xsltc.compiler.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   200
               com.sun.org.apache.xalan.internal.xsltc.trax.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   201
               com.sun.org.apache.xalan.internal.xsltc.util.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   202
               com.sun.org.apache.xml.internal.res.,\
18240
cda839ac048f 6741606: Integrate Apache Santuario
mullan
parents: 16920
diff changeset
   203
               com.sun.org.apache.xml.internal.security.,\
16894
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   204
               com.sun.org.apache.xml.internal.serializer.utils.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   205
               com.sun.org.apache.xml.internal.utils.,\
16893
5bed2c2c97dc 8003445: Adjust JAX-WS to focus on API
mullan
parents: 16109
diff changeset
   206
               com.sun.org.glassfish.,\
16744
b3ca7ed8e44f 8010393: Update JAX-WS RI to 2.2.9-b12941
alanb
parents: 16498
diff changeset
   207
               com.oracle.xmlns.internal.,\
b3ca7ed8e44f 8010393: Update JAX-WS RI to 2.2.9-b12941
alanb
parents: 16498
diff changeset
   208
               com.oracle.webservices.internal.,\
22308
chegar
parents: 19600 22305
diff changeset
   209
               oracle.jrockit.jfr.,\
18240
cda839ac048f 6741606: Integrate Apache Santuario
mullan
parents: 16920
diff changeset
   210
               org.jcp.xml.dsig.internal.,\
16897
4135997fea5e 8010944: Incorrectly separated package list in java.security-windows
chegar
parents: 16896
diff changeset
   211
               jdk.internal.,\
16901
chegar
parents: 16744 16897
diff changeset
   212
               jdk.nashorn.internal.,\
chegar
parents: 16744 16897
diff changeset
   213
               jdk.nashorn.tools.,\
16896
57c9a612a514 8007406: Improve accessibility of AccessBridge
raginip
parents: 16895
diff changeset
   214
               com.sun.java.accessibility.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   215
90ce3da70b43 Initial load
duke
parents:
diff changeset
   216
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   217
# List of comma-separated packages that start with or equal this string
90ce3da70b43 Initial load
duke
parents:
diff changeset
   218
# will cause a security exception to be thrown when
90ce3da70b43 Initial load
duke
parents:
diff changeset
   219
# passed to checkPackageDefinition unless the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   220
# corresponding RuntimePermission ("defineClassInPackage."+package) has
90ce3da70b43 Initial load
duke
parents:
diff changeset
   221
# been granted.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   222
#
13035
27b066eebe1f 7145239: Finetune package definition restriction
mullan
parents: 8769
diff changeset
   223
# by default, none of the class loaders supplied with the JDK call
27b066eebe1f 7145239: Finetune package definition restriction
mullan
parents: 8769
diff changeset
   224
# checkPackageDefinition.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   225
#
16083
3d08cc685055 7201068: Better handling of UI elements
mullan
parents: 14206
diff changeset
   226
package.definition=sun.,\
16895
2f7edbd000c4 8005432: Update access to JAX-WS
mkos
parents: 16894
diff changeset
   227
                   com.sun.xml.internal.,\
16083
3d08cc685055 7201068: Better handling of UI elements
mullan
parents: 14206
diff changeset
   228
                   com.sun.imageio.,\
16101
0229685a801f 8004175: Restricted packages added in java.security are missing in java.security-{macosx, solaris, windows}
mchung
parents: 16100
diff changeset
   229
                   com.sun.istack.internal.,\
16109
eb00701a5769 8006446: Restrict MBeanServer access
dfuchs
parents: 16108
diff changeset
   230
                   com.sun.jmx.,\
19600
fce5c0729a1c 8019830: Add com.sun.media.sound to the list of restricted package
mullan
parents: 19385
diff changeset
   231
                   com.sun.media.sound.,\
22300
d669110735f4 8022945: Enhance JNDI implementation classes
weijun
parents: 18828
diff changeset
   232
                   com.sun.naming.internal.,\
16108
e5fcdadc69b2 8006882: Proxy generated classes in sun.proxy package breaks JMockit
mchung
parents: 16106
diff changeset
   233
                   com.sun.proxy.,\
16894
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   234
                   com.sun.org.apache.bcel.internal.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   235
                   com.sun.org.apache.regexp.internal.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   236
                   com.sun.org.apache.xerces.internal.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   237
                   com.sun.org.apache.xpath.internal.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   238
                   com.sun.org.apache.xalan.internal.extensions.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   239
                   com.sun.org.apache.xalan.internal.lib.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   240
                   com.sun.org.apache.xalan.internal.res.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   241
                   com.sun.org.apache.xalan.internal.templates.,\
16083
3d08cc685055 7201068: Better handling of UI elements
mullan
parents: 14206
diff changeset
   242
                   com.sun.org.apache.xalan.internal.utils.,\
16894
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   243
                   com.sun.org.apache.xalan.internal.xslt.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   244
                   com.sun.org.apache.xalan.internal.xsltc.cmdline.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   245
                   com.sun.org.apache.xalan.internal.xsltc.compiler.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   246
                   com.sun.org.apache.xalan.internal.xsltc.trax.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   247
                   com.sun.org.apache.xalan.internal.xsltc.util.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   248
                   com.sun.org.apache.xml.internal.res.,\
18240
cda839ac048f 6741606: Integrate Apache Santuario
mullan
parents: 16920
diff changeset
   249
                   com.sun.org.apache.xml.internal.security.,\
16894
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   250
                   com.sun.org.apache.xml.internal.serializer.utils.,\
2cbed903304a 6657673: Issues with JAXP
joehw
parents: 16893
diff changeset
   251
                   com.sun.org.apache.xml.internal.utils.,\
16893
5bed2c2c97dc 8003445: Adjust JAX-WS to focus on API
mullan
parents: 16109
diff changeset
   252
                   com.sun.org.glassfish.,\
16744
b3ca7ed8e44f 8010393: Update JAX-WS RI to 2.2.9-b12941
alanb
parents: 16498
diff changeset
   253
                   com.oracle.xmlns.internal.,\
b3ca7ed8e44f 8010393: Update JAX-WS RI to 2.2.9-b12941
alanb
parents: 16498
diff changeset
   254
                   com.oracle.webservices.internal.,\
22308
chegar
parents: 19600 22305
diff changeset
   255
                   oracle.jrockit.jfr.,\
18240
cda839ac048f 6741606: Integrate Apache Santuario
mullan
parents: 16920
diff changeset
   256
                   org.jcp.xml.dsig.internal.,\
16897
4135997fea5e 8010944: Incorrectly separated package list in java.security-windows
chegar
parents: 16896
diff changeset
   257
                   jdk.internal.,\
16901
chegar
parents: 16744 16897
diff changeset
   258
                   jdk.nashorn.internal.,\
chegar
parents: 16744 16897
diff changeset
   259
                   jdk.nashorn.tools.,\
16896
57c9a612a514 8007406: Improve accessibility of AccessBridge
raginip
parents: 16895
diff changeset
   260
                   com.sun.java.accessibility.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   261
90ce3da70b43 Initial load
duke
parents:
diff changeset
   262
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   263
# Determines whether this properties file can be appended to
90ce3da70b43 Initial load
duke
parents:
diff changeset
   264
# or overridden on the command line via -Djava.security.properties
90ce3da70b43 Initial load
duke
parents:
diff changeset
   265
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   266
security.overridePropertiesFile=true
90ce3da70b43 Initial load
duke
parents:
diff changeset
   267
90ce3da70b43 Initial load
duke
parents:
diff changeset
   268
#
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   269
# Determines the default key and trust manager factory algorithms for
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   270
# the javax.net.ssl package.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   271
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   272
ssl.KeyManagerFactory.algorithm=SunX509
90ce3da70b43 Initial load
duke
parents:
diff changeset
   273
ssl.TrustManagerFactory.algorithm=PKIX
90ce3da70b43 Initial load
duke
parents:
diff changeset
   274
90ce3da70b43 Initial load
duke
parents:
diff changeset
   275
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   276
# The Java-level namelookup cache policy for successful lookups:
90ce3da70b43 Initial load
duke
parents:
diff changeset
   277
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   278
# any negative value: caching forever
90ce3da70b43 Initial load
duke
parents:
diff changeset
   279
# any positive value: the number of seconds to cache an address for
90ce3da70b43 Initial load
duke
parents:
diff changeset
   280
# zero: do not cache
90ce3da70b43 Initial load
duke
parents:
diff changeset
   281
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   282
# default value is forever (FOREVER). For security reasons, this
90ce3da70b43 Initial load
duke
parents:
diff changeset
   283
# caching is made forever when a security manager is set. When a security
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   284
# manager is not set, the default behavior in this implementation
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   285
# is to cache for 30 seconds.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   286
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   287
# NOTE: setting this to anything other than the default value can have
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   288
#       serious security implications. Do not set it unless
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   289
#       you are sure you are not exposed to DNS spoofing attack.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   290
#
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   291
#networkaddress.cache.ttl=-1
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   292
90ce3da70b43 Initial load
duke
parents:
diff changeset
   293
# The Java-level namelookup cache policy for failed lookups:
90ce3da70b43 Initial load
duke
parents:
diff changeset
   294
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   295
# any negative value: cache forever
90ce3da70b43 Initial load
duke
parents:
diff changeset
   296
# any positive value: the number of seconds to cache negative lookup results
90ce3da70b43 Initial load
duke
parents:
diff changeset
   297
# zero: do not cache
90ce3da70b43 Initial load
duke
parents:
diff changeset
   298
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   299
# In some Microsoft Windows networking environments that employ
90ce3da70b43 Initial load
duke
parents:
diff changeset
   300
# the WINS name service in addition to DNS, name service lookups
90ce3da70b43 Initial load
duke
parents:
diff changeset
   301
# that fail may take a noticeably long time to return (approx. 5 seconds).
90ce3da70b43 Initial load
duke
parents:
diff changeset
   302
# For this reason the default caching policy is to maintain these
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   303
# results for 10 seconds.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   304
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   305
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   306
networkaddress.cache.negative.ttl=10
90ce3da70b43 Initial load
duke
parents:
diff changeset
   307
90ce3da70b43 Initial load
duke
parents:
diff changeset
   308
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   309
# Properties to configure OCSP for certificate revocation checking
90ce3da70b43 Initial load
duke
parents:
diff changeset
   310
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   311
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   312
# Enable OCSP
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   313
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   314
# By default, OCSP is not used for certificate revocation checking.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   315
# This property enables the use of OCSP when set to the value "true".
90ce3da70b43 Initial load
duke
parents:
diff changeset
   316
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   317
# NOTE: SocketPermission is required to connect to an OCSP responder.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   318
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   319
# Example,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   320
#   ocsp.enable=true
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   321
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   322
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   323
# Location of the OCSP responder
90ce3da70b43 Initial load
duke
parents:
diff changeset
   324
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   325
# By default, the location of the OCSP responder is determined implicitly
90ce3da70b43 Initial load
duke
parents:
diff changeset
   326
# from the certificate being validated. This property explicitly specifies
90ce3da70b43 Initial load
duke
parents:
diff changeset
   327
# the location of the OCSP responder. The property is used when the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   328
# Authority Information Access extension (defined in RFC 3280) is absent
90ce3da70b43 Initial load
duke
parents:
diff changeset
   329
# from the certificate or when it requires overriding.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   330
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   331
# Example,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   332
#   ocsp.responderURL=http://ocsp.example.net:80
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   333
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   334
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   335
# Subject name of the OCSP responder's certificate
90ce3da70b43 Initial load
duke
parents:
diff changeset
   336
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   337
# By default, the certificate of the OCSP responder is that of the issuer
90ce3da70b43 Initial load
duke
parents:
diff changeset
   338
# of the certificate being validated. This property identifies the certificate
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   339
# of the OCSP responder when the default does not apply. Its value is a string
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   340
# distinguished name (defined in RFC 2253) which identifies a certificate in
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   341
# the set of certificates supplied during cert path validation. In cases where
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   342
# the subject name alone is not sufficient to uniquely identify the certificate
90ce3da70b43 Initial load
duke
parents:
diff changeset
   343
# then both the "ocsp.responderCertIssuerName" and
90ce3da70b43 Initial load
duke
parents:
diff changeset
   344
# "ocsp.responderCertSerialNumber" properties must be used instead. When this
90ce3da70b43 Initial load
duke
parents:
diff changeset
   345
# property is set then those two properties are ignored.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   346
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   347
# Example,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   348
#   ocsp.responderCertSubjectName="CN=OCSP Responder, O=XYZ Corp"
90ce3da70b43 Initial load
duke
parents:
diff changeset
   349
90ce3da70b43 Initial load
duke
parents:
diff changeset
   350
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   351
# Issuer name of the OCSP responder's certificate
90ce3da70b43 Initial load
duke
parents:
diff changeset
   352
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   353
# By default, the certificate of the OCSP responder is that of the issuer
90ce3da70b43 Initial load
duke
parents:
diff changeset
   354
# of the certificate being validated. This property identifies the certificate
90ce3da70b43 Initial load
duke
parents:
diff changeset
   355
# of the OCSP responder when the default does not apply. Its value is a string
90ce3da70b43 Initial load
duke
parents:
diff changeset
   356
# distinguished name (defined in RFC 2253) which identifies a certificate in
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   357
# the set of certificates supplied during cert path validation. When this
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   358
# property is set then the "ocsp.responderCertSerialNumber" property must also
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   359
# be set. When the "ocsp.responderCertSubjectName" property is set then this
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   360
# property is ignored.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   361
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   362
# Example,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   363
#   ocsp.responderCertIssuerName="CN=Enterprise CA, O=XYZ Corp"
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   364
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   365
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   366
# Serial number of the OCSP responder's certificate
90ce3da70b43 Initial load
duke
parents:
diff changeset
   367
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   368
# By default, the certificate of the OCSP responder is that of the issuer
90ce3da70b43 Initial load
duke
parents:
diff changeset
   369
# of the certificate being validated. This property identifies the certificate
90ce3da70b43 Initial load
duke
parents:
diff changeset
   370
# of the OCSP responder when the default does not apply. Its value is a string
90ce3da70b43 Initial load
duke
parents:
diff changeset
   371
# of hexadecimal digits (colon or space separators may be present) which
90ce3da70b43 Initial load
duke
parents:
diff changeset
   372
# identifies a certificate in the set of certificates supplied during cert path
90ce3da70b43 Initial load
duke
parents:
diff changeset
   373
# validation. When this property is set then the "ocsp.responderCertIssuerName"
90ce3da70b43 Initial load
duke
parents:
diff changeset
   374
# property must also be set. When the "ocsp.responderCertSubjectName" property
90ce3da70b43 Initial load
duke
parents:
diff changeset
   375
# is set then this property is ignored.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   376
#
90ce3da70b43 Initial load
duke
parents:
diff changeset
   377
# Example,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   378
#   ocsp.responderCertSerialNumber=2A:FF:00
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   379
6311
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   380
#
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   381
# Policy for failed Kerberos KDC lookups:
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   382
#
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   383
# When a KDC is unavailable (network error, service failure, etc), it is
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   384
# put inside a blacklist and accessed less often for future requests. The
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   385
# value (case-insensitive) for this policy can be:
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   386
#
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   387
# tryLast
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   388
#    KDCs in the blacklist are always tried after those not on the list.
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   389
#
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   390
# tryLess[:max_retries,timeout]
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   391
#    KDCs in the blacklist are still tried by their order in the configuration,
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   392
#    but with smaller max_retries and timeout values. max_retries and timeout
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   393
#    are optional numerical parameters (default 1 and 5000, which means once
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   394
#    and 5 seconds). Please notes that if any of the values defined here is
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   395
#    more than what is defined in krb5.conf, it will be ignored.
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   396
#
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   397
# Whenever a KDC is detected as available, it is removed from the blacklist.
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   398
# The blacklist is reset when krb5.conf is reloaded. You can add
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   399
# refreshKrb5Config=true to a JAAS configuration file so that krb5.conf is
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   400
# reloaded whenever a JAAS authentication is attempted.
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   401
#
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   402
# Example,
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   403
#   krb5.kdc.bad.policy = tryLast
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   404
#   krb5.kdc.bad.policy = tryLess:2,2000
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   405
krb5.kdc.bad.policy = tryLast
1448d18935b5 6976536: Solaris JREs do not have the krb5.kdc.bad.policy configured by default.
weijun
parents: 3492
diff changeset
   406
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   407
# Algorithm restrictions for certification path (CertPath) processing
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   408
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   409
# In some environments, certain algorithms or key lengths may be undesirable
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   410
# for certification path building and validation.  For example, "MD2" is
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   411
# generally no longer considered to be a secure hash algorithm.  This section
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   412
# describes the mechanism for disabling algorithms based on algorithm name
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   413
# and/or key length.  This includes algorithms used in certificates, as well
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   414
# as revocation information such as CRLs and signed OCSP Responses.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   415
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   416
# The syntax of the disabled algorithm string is described as this Java
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   417
# BNF-style:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   418
#   DisabledAlgorithms:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   419
#       " DisabledAlgorithm { , DisabledAlgorithm } "
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   420
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   421
#   DisabledAlgorithm:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   422
#       AlgorithmName [Constraint]
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   423
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   424
#   AlgorithmName:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   425
#       (see below)
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   426
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   427
#   Constraint:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   428
#       KeySizeConstraint
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   429
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   430
#   KeySizeConstraint:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   431
#       keySize Operator DecimalInteger
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   432
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   433
#   Operator:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   434
#       <= | < | == | != | >= | >
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   435
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   436
#   DecimalInteger:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   437
#       DecimalDigits
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   438
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   439
#   DecimalDigits:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   440
#       DecimalDigit {DecimalDigit}
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   441
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   442
#   DecimalDigit: one of
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   443
#       1 2 3 4 5 6 7 8 9 0
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   444
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   445
# The "AlgorithmName" is the standard algorithm name of the disabled
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   446
# algorithm. See "Java Cryptography Architecture Standard Algorithm Name
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   447
# Documentation" for information about Standard Algorithm Names.  Matching
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   448
# is performed using a case-insensitive sub-element matching rule.  (For
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   449
# example, in "SHA1withECDSA" the sub-elements are "SHA1" for hashing and
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   450
# "ECDSA" for signatures.)  If the assertion "AlgorithmName" is a
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   451
# sub-element of the certificate algorithm name, the algorithm will be
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   452
# rejected during certification path building and validation.  For example,
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   453
# the assertion algorithm name "DSA" will disable all certificate algorithms
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   454
# that rely on DSA, such as NONEwithDSA, SHA1withDSA.  However, the assertion
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   455
# will not disable algorithms related to "ECDSA".
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   456
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   457
# A "Constraint" provides further guidance for the algorithm being specified.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   458
# The "KeySizeConstraint" requires a key of a valid size range if the
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   459
# "AlgorithmName" is of a key algorithm.  The "DecimalInteger" indicates the
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   460
# key size specified in number of bits.  For example, "RSA keySize <= 1024"
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   461
# indicates that any RSA key with key size less than or equal to 1024 bits
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   462
# should be disabled, and "RSA keySize < 1024, RSA keySize > 2048" indicates
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   463
# that any RSA key with key size less than 1024 or greater than 2048 should
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   464
# be disabled. Note that the "KeySizeConstraint" only makes sense to key
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   465
# algorithms.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   466
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   467
# Note: This property is currently used by Oracle's PKIX implementation. It
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   468
# is not guaranteed to be examined and used by other implementations.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   469
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   470
# Example:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   471
#   jdk.certpath.disabledAlgorithms=MD2, DSA, RSA keySize < 2048
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   472
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   473
#
14929
59377f4b9919 7109274: Restrict the use of certificates with RSA keys less than 1024 bits
xuelei
parents: 14229
diff changeset
   474
jdk.certpath.disabledAlgorithms=MD2, RSA keySize < 1024
7040
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   475
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   476
# Algorithm restrictions for Secure Socket Layer/Transport Layer Security
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   477
# (SSL/TLS) processing
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   478
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   479
# In some environments, certain algorithms or key lengths may be undesirable
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   480
# when using SSL/TLS.  This section describes the mechanism for disabling
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   481
# algorithms during SSL/TLS security parameters negotiation, including cipher
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   482
# suites selection, peer authentication and key exchange mechanisms.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   483
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   484
# For PKI-based peer authentication and key exchange mechanisms, this list
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   485
# of disabled algorithms will also be checked during certification path
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   486
# building and validation, including algorithms used in certificates, as
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   487
# well as revocation information such as CRLs and signed OCSP Responses.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   488
# This is in addition to the jdk.certpath.disabledAlgorithms property above.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   489
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   490
# See the specification of "jdk.certpath.disabledAlgorithms" for the
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   491
# syntax of the disabled algorithm string.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   492
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   493
# Note: This property is currently used by Oracle's JSSE implementation.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   494
# It is not guaranteed to be examined and used by other implementations.
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   495
#
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   496
# Example:
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   497
#   jdk.tls.disabledAlgorithms=MD5, SHA1, DSA, RSA keySize < 2048
659824c2a550 6792180: Enhance to reject weak algorithms or conform to crypto recommendations
xuelei
parents: 6311
diff changeset
   498