jdk/src/share/classes/sun/security/krb5/Credentials.java
author psandoz
Mon, 16 Jun 2014 17:45:26 +0100
changeset 24969 afa6934dd8e8
parent 23010 6dadb192ad81
permissions -rw-r--r--
8041679: Replace uses of StringBuffer with StringBuilder within core library classes Reviewed-by: psandoz, alanb, xuelei, dfuchs, jfranck, prr, serb, chegar Contributed-by: otaviopolianasantana@gmail.com
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
     1
/*
23010
6dadb192ad81 8029235: Update copyright year to match last edit in jdk8 jdk repository for 2013
lana
parents: 19373
diff changeset
     2
 * Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
     3
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
90ce3da70b43 Initial load
duke
parents:
diff changeset
     4
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
     5
 * This code is free software; you can redistribute it and/or modify it
90ce3da70b43 Initial load
duke
parents:
diff changeset
     6
 * under the terms of the GNU General Public License version 2 only, as
5506
202f599c92aa 6943119: Rebrand source copyright notices
ohair
parents: 4336
diff changeset
     7
 * published by the Free Software Foundation.  Oracle designates this
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
     8
 * particular file as subject to the "Classpath" exception as provided
5506
202f599c92aa 6943119: Rebrand source copyright notices
ohair
parents: 4336
diff changeset
     9
 * by Oracle in the LICENSE file that accompanied this code.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    10
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    11
 * This code is distributed in the hope that it will be useful, but WITHOUT
90ce3da70b43 Initial load
duke
parents:
diff changeset
    12
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
90ce3da70b43 Initial load
duke
parents:
diff changeset
    13
 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
90ce3da70b43 Initial load
duke
parents:
diff changeset
    14
 * version 2 for more details (a copy is included in the LICENSE file that
90ce3da70b43 Initial load
duke
parents:
diff changeset
    15
 * accompanied this code).
90ce3da70b43 Initial load
duke
parents:
diff changeset
    16
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    17
 * You should have received a copy of the GNU General Public License version
90ce3da70b43 Initial load
duke
parents:
diff changeset
    18
 * 2 along with this work; if not, write to the Free Software Foundation,
90ce3da70b43 Initial load
duke
parents:
diff changeset
    19
 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    20
 *
5506
202f599c92aa 6943119: Rebrand source copyright notices
ohair
parents: 4336
diff changeset
    21
 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
202f599c92aa 6943119: Rebrand source copyright notices
ohair
parents: 4336
diff changeset
    22
 * or visit www.oracle.com if you need additional information or have any
202f599c92aa 6943119: Rebrand source copyright notices
ohair
parents: 4336
diff changeset
    23
 * questions.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    24
 */
90ce3da70b43 Initial load
duke
parents:
diff changeset
    25
90ce3da70b43 Initial load
duke
parents:
diff changeset
    26
/*
90ce3da70b43 Initial load
duke
parents:
diff changeset
    27
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    28
 *  (C) Copyright IBM Corp. 1999 All Rights Reserved.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    29
 *  Copyright 1997 The Open Group Research Institute.  All rights reserved.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    30
 */
90ce3da70b43 Initial load
duke
parents:
diff changeset
    31
90ce3da70b43 Initial load
duke
parents:
diff changeset
    32
package sun.security.krb5;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    33
90ce3da70b43 Initial load
duke
parents:
diff changeset
    34
import sun.security.krb5.internal.*;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    35
import sun.security.krb5.internal.ccache.CredentialsCache;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    36
import sun.security.krb5.internal.crypto.EType;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    37
import java.io.IOException;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    38
import java.util.Date;
6122
16fa7ed7ff1b 6867345: Turkish regional options cause NPE in sun.security.x509.AlgorithmId.algOID
xuelei
parents: 5974
diff changeset
    39
import java.util.Locale;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    40
import java.net.InetAddress;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    41
90ce3da70b43 Initial load
duke
parents:
diff changeset
    42
/**
90ce3da70b43 Initial load
duke
parents:
diff changeset
    43
 * This class encapsulates the concept of a Kerberos service
90ce3da70b43 Initial load
duke
parents:
diff changeset
    44
 * credential. That includes a Kerberos ticket and an associated
90ce3da70b43 Initial load
duke
parents:
diff changeset
    45
 * session key.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    46
 */
90ce3da70b43 Initial load
duke
parents:
diff changeset
    47
public class Credentials {
90ce3da70b43 Initial load
duke
parents:
diff changeset
    48
90ce3da70b43 Initial load
duke
parents:
diff changeset
    49
    Ticket ticket;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    50
    PrincipalName client;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    51
    PrincipalName server;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    52
    EncryptionKey key;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    53
    TicketFlags flags;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    54
    KerberosTime authTime;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    55
    KerberosTime startTime;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    56
    KerberosTime endTime;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    57
    KerberosTime renewTill;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    58
    HostAddresses cAddr;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    59
    EncryptionKey serviceKey;
3483
a16fce1820ef 6821190: more InquireType values for ExtendedGSSContext
weijun
parents: 2
diff changeset
    60
    AuthorizationData authzData;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    61
    private static boolean DEBUG = Krb5.DEBUG;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    62
    private static CredentialsCache cache;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    63
    static boolean alreadyLoaded = false;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    64
    private static boolean alreadyTried = false;
19373
4bb12c72a46f 8016594: Native Windows ccache still reads DES tickets
weijun
parents: 14413
diff changeset
    65
4bb12c72a46f 8016594: Native Windows ccache still reads DES tickets
weijun
parents: 14413
diff changeset
    66
    // Read native ticket with session key type in the given list
4bb12c72a46f 8016594: Native Windows ccache still reads DES tickets
weijun
parents: 14413
diff changeset
    67
    private static native Credentials acquireDefaultNativeCreds(int[] eTypes);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    68
90ce3da70b43 Initial load
duke
parents:
diff changeset
    69
    public Credentials(Ticket new_ticket,
90ce3da70b43 Initial load
duke
parents:
diff changeset
    70
                       PrincipalName new_client,
90ce3da70b43 Initial load
duke
parents:
diff changeset
    71
                       PrincipalName new_server,
90ce3da70b43 Initial load
duke
parents:
diff changeset
    72
                       EncryptionKey new_key,
90ce3da70b43 Initial load
duke
parents:
diff changeset
    73
                       TicketFlags new_flags,
90ce3da70b43 Initial load
duke
parents:
diff changeset
    74
                       KerberosTime authTime,
90ce3da70b43 Initial load
duke
parents:
diff changeset
    75
                       KerberosTime new_startTime,
90ce3da70b43 Initial load
duke
parents:
diff changeset
    76
                       KerberosTime new_endTime,
90ce3da70b43 Initial load
duke
parents:
diff changeset
    77
                       KerberosTime renewTill,
3483
a16fce1820ef 6821190: more InquireType values for ExtendedGSSContext
weijun
parents: 2
diff changeset
    78
                       HostAddresses cAddr,
a16fce1820ef 6821190: more InquireType values for ExtendedGSSContext
weijun
parents: 2
diff changeset
    79
                       AuthorizationData authzData) {
a16fce1820ef 6821190: more InquireType values for ExtendedGSSContext
weijun
parents: 2
diff changeset
    80
        this(new_ticket, new_client, new_server, new_key, new_flags,
a16fce1820ef 6821190: more InquireType values for ExtendedGSSContext
weijun
parents: 2
diff changeset
    81
                authTime, new_startTime, new_endTime, renewTill, cAddr);
a16fce1820ef 6821190: more InquireType values for ExtendedGSSContext
weijun
parents: 2
diff changeset
    82
        this.authzData = authzData;
a16fce1820ef 6821190: more InquireType values for ExtendedGSSContext
weijun
parents: 2
diff changeset
    83
    }
a16fce1820ef 6821190: more InquireType values for ExtendedGSSContext
weijun
parents: 2
diff changeset
    84
a16fce1820ef 6821190: more InquireType values for ExtendedGSSContext
weijun
parents: 2
diff changeset
    85
    public Credentials(Ticket new_ticket,
a16fce1820ef 6821190: more InquireType values for ExtendedGSSContext
weijun
parents: 2
diff changeset
    86
                       PrincipalName new_client,
a16fce1820ef 6821190: more InquireType values for ExtendedGSSContext
weijun
parents: 2
diff changeset
    87
                       PrincipalName new_server,
a16fce1820ef 6821190: more InquireType values for ExtendedGSSContext
weijun
parents: 2
diff changeset
    88
                       EncryptionKey new_key,
a16fce1820ef 6821190: more InquireType values for ExtendedGSSContext
weijun
parents: 2
diff changeset
    89
                       TicketFlags new_flags,
a16fce1820ef 6821190: more InquireType values for ExtendedGSSContext
weijun
parents: 2
diff changeset
    90
                       KerberosTime authTime,
a16fce1820ef 6821190: more InquireType values for ExtendedGSSContext
weijun
parents: 2
diff changeset
    91
                       KerberosTime new_startTime,
a16fce1820ef 6821190: more InquireType values for ExtendedGSSContext
weijun
parents: 2
diff changeset
    92
                       KerberosTime new_endTime,
a16fce1820ef 6821190: more InquireType values for ExtendedGSSContext
weijun
parents: 2
diff changeset
    93
                       KerberosTime renewTill,
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    94
                       HostAddresses cAddr) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
    95
        ticket = new_ticket;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    96
        client = new_client;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    97
        server = new_server;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    98
        key = new_key;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    99
        flags = new_flags;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   100
        this.authTime = authTime;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   101
        startTime = new_startTime;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   102
        endTime = new_endTime;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   103
        this.renewTill = renewTill;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   104
        this.cAddr = cAddr;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   105
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   106
90ce3da70b43 Initial load
duke
parents:
diff changeset
   107
    public Credentials(byte[] encoding,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   108
                       String client,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   109
                       String server,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   110
                       byte[] keyBytes,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   111
                       int keyType,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   112
                       boolean[] flags,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   113
                       Date authTime,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   114
                       Date startTime,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   115
                       Date endTime,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   116
                       Date renewTill,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   117
                       InetAddress[] cAddrs) throws KrbException, IOException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   118
        this(new Ticket(encoding),
90ce3da70b43 Initial load
duke
parents:
diff changeset
   119
             new PrincipalName(client, PrincipalName.KRB_NT_PRINCIPAL),
90ce3da70b43 Initial load
duke
parents:
diff changeset
   120
             new PrincipalName(server, PrincipalName.KRB_NT_SRV_INST),
90ce3da70b43 Initial load
duke
parents:
diff changeset
   121
             new EncryptionKey(keyType, keyBytes),
90ce3da70b43 Initial load
duke
parents:
diff changeset
   122
             (flags == null? null: new TicketFlags(flags)),
90ce3da70b43 Initial load
duke
parents:
diff changeset
   123
             (authTime == null? null: new KerberosTime(authTime)),
90ce3da70b43 Initial load
duke
parents:
diff changeset
   124
             (startTime == null? null: new KerberosTime(startTime)),
90ce3da70b43 Initial load
duke
parents:
diff changeset
   125
             (endTime == null? null: new KerberosTime(endTime)),
90ce3da70b43 Initial load
duke
parents:
diff changeset
   126
             (renewTill == null? null: new KerberosTime(renewTill)),
90ce3da70b43 Initial load
duke
parents:
diff changeset
   127
             null); // caddrs are in the encoding at this point
90ce3da70b43 Initial load
duke
parents:
diff changeset
   128
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   129
90ce3da70b43 Initial load
duke
parents:
diff changeset
   130
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   131
     * Acquires a service ticket for the specified service
90ce3da70b43 Initial load
duke
parents:
diff changeset
   132
     * principal. If the service ticket is not already available, it
90ce3da70b43 Initial load
duke
parents:
diff changeset
   133
     * obtains a new one from the KDC.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   134
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   135
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   136
    public Credentials(Credentials tgt, PrincipalName service)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   137
        throws KrbException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   138
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   139
    */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   140
90ce3da70b43 Initial load
duke
parents:
diff changeset
   141
    public final PrincipalName getClient() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   142
        return client;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   143
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   144
90ce3da70b43 Initial load
duke
parents:
diff changeset
   145
    public final PrincipalName getServer() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   146
        return server;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   147
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   148
90ce3da70b43 Initial load
duke
parents:
diff changeset
   149
    public final EncryptionKey getSessionKey() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   150
        return key;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   151
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   152
90ce3da70b43 Initial load
duke
parents:
diff changeset
   153
    public final Date getAuthTime() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   154
        if (authTime != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   155
            return authTime.toDate();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   156
        } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   157
            return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   158
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   159
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   160
90ce3da70b43 Initial load
duke
parents:
diff changeset
   161
    public final Date getStartTime() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   162
        if (startTime != null)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   163
            {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   164
                return startTime.toDate();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   165
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   166
        return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   167
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   168
90ce3da70b43 Initial load
duke
parents:
diff changeset
   169
    public final Date getEndTime() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   170
        if (endTime != null)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   171
            {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   172
                return endTime.toDate();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   173
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   174
        return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   175
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   176
90ce3da70b43 Initial load
duke
parents:
diff changeset
   177
    public final Date getRenewTill() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   178
        if (renewTill != null)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   179
            {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   180
                return renewTill.toDate();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   181
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   182
        return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   183
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   184
90ce3da70b43 Initial load
duke
parents:
diff changeset
   185
    public final boolean[] getFlags() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   186
        if (flags == null) // Can be in a KRB-CRED
90ce3da70b43 Initial load
duke
parents:
diff changeset
   187
        return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   188
        return flags.toBooleanArray();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   189
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   190
90ce3da70b43 Initial load
duke
parents:
diff changeset
   191
    public final InetAddress[] getClientAddresses() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   192
90ce3da70b43 Initial load
duke
parents:
diff changeset
   193
        if (cAddr == null)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   194
        return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   195
90ce3da70b43 Initial load
duke
parents:
diff changeset
   196
        return cAddr.getInetAddresses();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   197
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   198
90ce3da70b43 Initial load
duke
parents:
diff changeset
   199
    public final byte[] getEncoded() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   200
        byte[] retVal = null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   201
        try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   202
            retVal = ticket.asn1Encode();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   203
        } catch (Asn1Exception e) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   204
            if (DEBUG)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   205
            System.out.println(e);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   206
        } catch (IOException ioe) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   207
            if (DEBUG)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   208
            System.out.println(ioe);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   209
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   210
        return retVal;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   211
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   212
90ce3da70b43 Initial load
duke
parents:
diff changeset
   213
    public boolean isForwardable() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   214
        return flags.get(Krb5.TKT_OPTS_FORWARDABLE);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   215
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   216
90ce3da70b43 Initial load
duke
parents:
diff changeset
   217
    public boolean isRenewable() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   218
        return flags.get(Krb5.TKT_OPTS_RENEWABLE);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   219
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   220
90ce3da70b43 Initial load
duke
parents:
diff changeset
   221
    public Ticket getTicket() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   222
        return ticket;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   223
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   224
90ce3da70b43 Initial load
duke
parents:
diff changeset
   225
    public TicketFlags getTicketFlags() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   226
        return flags;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   227
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   228
3483
a16fce1820ef 6821190: more InquireType values for ExtendedGSSContext
weijun
parents: 2
diff changeset
   229
    public AuthorizationData getAuthzData() {
a16fce1820ef 6821190: more InquireType values for ExtendedGSSContext
weijun
parents: 2
diff changeset
   230
        return authzData;
a16fce1820ef 6821190: more InquireType values for ExtendedGSSContext
weijun
parents: 2
diff changeset
   231
    }
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   232
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   233
     * Checks if the service ticket returned by the KDC has the OK-AS-DELEGATE
90ce3da70b43 Initial load
duke
parents:
diff changeset
   234
     * flag set
90ce3da70b43 Initial load
duke
parents:
diff changeset
   235
     * @return true if OK-AS_DELEGATE flag is set, otherwise, return false.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   236
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   237
    public boolean checkDelegate() {
4336
4c792c19266e 6853328: Support OK-AS-DELEGATE flag
weijun
parents: 3949
diff changeset
   238
        return flags.get(Krb5.TKT_OPTS_DELEGATE);
4c792c19266e 6853328: Support OK-AS-DELEGATE flag
weijun
parents: 3949
diff changeset
   239
    }
4c792c19266e 6853328: Support OK-AS-DELEGATE flag
weijun
parents: 3949
diff changeset
   240
4c792c19266e 6853328: Support OK-AS-DELEGATE flag
weijun
parents: 3949
diff changeset
   241
    /**
4c792c19266e 6853328: Support OK-AS-DELEGATE flag
weijun
parents: 3949
diff changeset
   242
     * Reset TKT_OPTS_DELEGATE to false, called at credentials acquirement
4c792c19266e 6853328: Support OK-AS-DELEGATE flag
weijun
parents: 3949
diff changeset
   243
     * when one of the cross-realm TGTs does not have the OK-AS-DELEGATE
4c792c19266e 6853328: Support OK-AS-DELEGATE flag
weijun
parents: 3949
diff changeset
   244
     * flag set. This info must be preservable and restorable through
4c792c19266e 6853328: Support OK-AS-DELEGATE flag
weijun
parents: 3949
diff changeset
   245
     * the Krb5Util.credsToTicket/ticketToCreds() methods so that even if
4c792c19266e 6853328: Support OK-AS-DELEGATE flag
weijun
parents: 3949
diff changeset
   246
     * the service ticket is cached it still remembers the cross-realm
4c792c19266e 6853328: Support OK-AS-DELEGATE flag
weijun
parents: 3949
diff changeset
   247
     * authentication result.
4c792c19266e 6853328: Support OK-AS-DELEGATE flag
weijun
parents: 3949
diff changeset
   248
     */
4c792c19266e 6853328: Support OK-AS-DELEGATE flag
weijun
parents: 3949
diff changeset
   249
    public void resetDelegate() {
4c792c19266e 6853328: Support OK-AS-DELEGATE flag
weijun
parents: 3949
diff changeset
   250
        flags.set(Krb5.TKT_OPTS_DELEGATE, false);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   251
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   252
90ce3da70b43 Initial load
duke
parents:
diff changeset
   253
    public Credentials renew() throws KrbException, IOException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   254
        KDCOptions options = new KDCOptions();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   255
        options.set(KDCOptions.RENEW, true);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   256
        /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   257
         * Added here to pass KrbKdcRep.check:73
90ce3da70b43 Initial load
duke
parents:
diff changeset
   258
         */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   259
        options.set(KDCOptions.RENEWABLE, true);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   260
90ce3da70b43 Initial load
duke
parents:
diff changeset
   261
        return new KrbTgsReq(options,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   262
                             this,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   263
                             server,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   264
                             null, // from
90ce3da70b43 Initial load
duke
parents:
diff changeset
   265
                             null, // till
90ce3da70b43 Initial load
duke
parents:
diff changeset
   266
                             null, // rtime
90ce3da70b43 Initial load
duke
parents:
diff changeset
   267
                             null, // eTypes
90ce3da70b43 Initial load
duke
parents:
diff changeset
   268
                             cAddr,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   269
                             null,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   270
                             null,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   271
                             null).sendAndGetCreds();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   272
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   273
90ce3da70b43 Initial load
duke
parents:
diff changeset
   274
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   275
     * Returns a TGT for the given client principal from a ticket cache.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   276
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   277
     * @param princ the client principal. A value of null means that the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   278
     * default principal name in the credentials cache will be used.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   279
     * @param ticketCache the path to the tickets file. A value
90ce3da70b43 Initial load
duke
parents:
diff changeset
   280
     * of null will be accepted to indicate that the default
90ce3da70b43 Initial load
duke
parents:
diff changeset
   281
     * path should be searched
90ce3da70b43 Initial load
duke
parents:
diff changeset
   282
     * @returns the TGT credentials or null if none were found. If the tgt
90ce3da70b43 Initial load
duke
parents:
diff changeset
   283
     * expired, it is the responsibility of the caller to determine this.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   284
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   285
    public static Credentials acquireTGTFromCache(PrincipalName princ,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   286
                                                  String ticketCache)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   287
        throws KrbException, IOException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   288
90ce3da70b43 Initial load
duke
parents:
diff changeset
   289
        if (ticketCache == null) {
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents: 7183
diff changeset
   290
            // The default ticket cache on Windows and Mac is not a file.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   291
            String os = java.security.AccessController.doPrivileged(
90ce3da70b43 Initial load
duke
parents:
diff changeset
   292
                        new sun.security.action.GetPropertyAction("os.name"));
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents: 7183
diff changeset
   293
            if (os.toUpperCase(Locale.ENGLISH).startsWith("WINDOWS") ||
12538
211d6e82fe51 7130404: [macosx] "os.arch" value should be "x86_64" for compatibility with Apple JDK6
jmelvin
parents: 12423
diff changeset
   294
                    os.toUpperCase(Locale.ENGLISH).contains("OS X")) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   295
                Credentials creds = acquireDefaultCreds();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   296
                if (creds == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   297
                    if (DEBUG) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   298
                        System.out.println(">>> Found no TGT's in LSA");
90ce3da70b43 Initial load
duke
parents:
diff changeset
   299
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   300
                    return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   301
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   302
                if (princ != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   303
                    if (creds.getClient().equals(princ)) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   304
                        if (DEBUG) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   305
                            System.out.println(">>> Obtained TGT from LSA: "
90ce3da70b43 Initial load
duke
parents:
diff changeset
   306
                                               + creds);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   307
                        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   308
                        return creds;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   309
                    } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   310
                        if (DEBUG) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   311
                            System.out.println(">>> LSA contains TGT for "
90ce3da70b43 Initial load
duke
parents:
diff changeset
   312
                                               + creds.getClient()
90ce3da70b43 Initial load
duke
parents:
diff changeset
   313
                                               + " not "
90ce3da70b43 Initial load
duke
parents:
diff changeset
   314
                                               + princ);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   315
                        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   316
                        return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   317
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   318
                } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   319
                    if (DEBUG) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   320
                        System.out.println(">>> Obtained TGT from LSA: "
90ce3da70b43 Initial load
duke
parents:
diff changeset
   321
                                           + creds);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   322
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   323
                    return creds;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   324
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   325
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   326
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   327
90ce3da70b43 Initial load
duke
parents:
diff changeset
   328
        /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   329
         * Returns the appropriate cache. If ticketCache is null, it is the
90ce3da70b43 Initial load
duke
parents:
diff changeset
   330
         * default cache otherwise it is the cache filename contained in it.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   331
         */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   332
        CredentialsCache ccache =
90ce3da70b43 Initial load
duke
parents:
diff changeset
   333
            CredentialsCache.getInstance(princ, ticketCache);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   334
12423
a69d7fadb9f8 7158329: NPE in sun.security.krb5.Credentials.acquireDefaultCreds()
weijun
parents: 12047
diff changeset
   335
        if (ccache == null) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   336
            return null;
12423
a69d7fadb9f8 7158329: NPE in sun.security.krb5.Credentials.acquireDefaultCreds()
weijun
parents: 12047
diff changeset
   337
        }
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   338
90ce3da70b43 Initial load
duke
parents:
diff changeset
   339
        sun.security.krb5.internal.ccache.Credentials tgtCred  =
90ce3da70b43 Initial load
duke
parents:
diff changeset
   340
            ccache.getDefaultCreds();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   341
12423
a69d7fadb9f8 7158329: NPE in sun.security.krb5.Credentials.acquireDefaultCreds()
weijun
parents: 12047
diff changeset
   342
        if (tgtCred == null) {
a69d7fadb9f8 7158329: NPE in sun.security.krb5.Credentials.acquireDefaultCreds()
weijun
parents: 12047
diff changeset
   343
            return null;
a69d7fadb9f8 7158329: NPE in sun.security.krb5.Credentials.acquireDefaultCreds()
weijun
parents: 12047
diff changeset
   344
        }
a69d7fadb9f8 7158329: NPE in sun.security.krb5.Credentials.acquireDefaultCreds()
weijun
parents: 12047
diff changeset
   345
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   346
        if (EType.isSupported(tgtCred.getEType())) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   347
            return tgtCred.setKrbCreds();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   348
        } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   349
            if (DEBUG) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   350
                System.out.println(
90ce3da70b43 Initial load
duke
parents:
diff changeset
   351
                    ">>> unsupported key type found the default TGT: " +
90ce3da70b43 Initial load
duke
parents:
diff changeset
   352
                    tgtCred.getEType());
90ce3da70b43 Initial load
duke
parents:
diff changeset
   353
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   354
            return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   355
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   356
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   357
90ce3da70b43 Initial load
duke
parents:
diff changeset
   358
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   359
     * Acquires default credentials.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   360
     * <br>The possible locations for default credentials cache is searched in
90ce3da70b43 Initial load
duke
parents:
diff changeset
   361
     * the following order:
90ce3da70b43 Initial load
duke
parents:
diff changeset
   362
     * <ol>
90ce3da70b43 Initial load
duke
parents:
diff changeset
   363
     * <li> The directory and cache file name specified by "KRB5CCNAME" system.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   364
     * property.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   365
     * <li> The directory and cache file name specified by "KRB5CCNAME"
90ce3da70b43 Initial load
duke
parents:
diff changeset
   366
     * environment variable.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   367
     * <li> A cache file named krb5cc_{user.name} at {user.home} directory.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   368
     * </ol>
90ce3da70b43 Initial load
duke
parents:
diff changeset
   369
     * @return a <code>KrbCreds</code> object if the credential is found,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   370
     * otherwise return null.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   371
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   372
90ce3da70b43 Initial load
duke
parents:
diff changeset
   373
    // this method is intentionally changed to not check if the caller's
90ce3da70b43 Initial load
duke
parents:
diff changeset
   374
    // principal name matches cache file's principal name.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   375
    // It assumes that the GSS call has
90ce3da70b43 Initial load
duke
parents:
diff changeset
   376
    // the privilege to access the default cache file.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   377
19373
4bb12c72a46f 8016594: Native Windows ccache still reads DES tickets
weijun
parents: 14413
diff changeset
   378
    // This method is only called on Windows and Mac OS X, the native
4bb12c72a46f 8016594: Native Windows ccache still reads DES tickets
weijun
parents: 14413
diff changeset
   379
    // acquireDefaultNativeCreds is also available on these platforms.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   380
    public static synchronized Credentials acquireDefaultCreds() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   381
        Credentials result = null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   382
90ce3da70b43 Initial load
duke
parents:
diff changeset
   383
        if (cache == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   384
            cache = CredentialsCache.getInstance();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   385
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   386
        if (cache != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   387
            sun.security.krb5.internal.ccache.Credentials temp =
90ce3da70b43 Initial load
duke
parents:
diff changeset
   388
                cache.getDefaultCreds();
12423
a69d7fadb9f8 7158329: NPE in sun.security.krb5.Credentials.acquireDefaultCreds()
weijun
parents: 12047
diff changeset
   389
            if (temp != null) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   390
                if (DEBUG) {
12423
a69d7fadb9f8 7158329: NPE in sun.security.krb5.Credentials.acquireDefaultCreds()
weijun
parents: 12047
diff changeset
   391
                    System.out.println(">>> KrbCreds found the default ticket"
a69d7fadb9f8 7158329: NPE in sun.security.krb5.Credentials.acquireDefaultCreds()
weijun
parents: 12047
diff changeset
   392
                            + " granting ticket in credential cache.");
a69d7fadb9f8 7158329: NPE in sun.security.krb5.Credentials.acquireDefaultCreds()
weijun
parents: 12047
diff changeset
   393
                }
a69d7fadb9f8 7158329: NPE in sun.security.krb5.Credentials.acquireDefaultCreds()
weijun
parents: 12047
diff changeset
   394
                if (EType.isSupported(temp.getEType())) {
a69d7fadb9f8 7158329: NPE in sun.security.krb5.Credentials.acquireDefaultCreds()
weijun
parents: 12047
diff changeset
   395
                    result = temp.setKrbCreds();
a69d7fadb9f8 7158329: NPE in sun.security.krb5.Credentials.acquireDefaultCreds()
weijun
parents: 12047
diff changeset
   396
                } else {
a69d7fadb9f8 7158329: NPE in sun.security.krb5.Credentials.acquireDefaultCreds()
weijun
parents: 12047
diff changeset
   397
                    if (DEBUG) {
a69d7fadb9f8 7158329: NPE in sun.security.krb5.Credentials.acquireDefaultCreds()
weijun
parents: 12047
diff changeset
   398
                        System.out.println(
a69d7fadb9f8 7158329: NPE in sun.security.krb5.Credentials.acquireDefaultCreds()
weijun
parents: 12047
diff changeset
   399
                            ">>> unsupported key type found the default TGT: " +
a69d7fadb9f8 7158329: NPE in sun.security.krb5.Credentials.acquireDefaultCreds()
weijun
parents: 12047
diff changeset
   400
                            temp.getEType());
a69d7fadb9f8 7158329: NPE in sun.security.krb5.Credentials.acquireDefaultCreds()
weijun
parents: 12047
diff changeset
   401
                    }
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   402
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   403
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   404
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   405
        if (result == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   406
            // Doesn't seem to be a default cache on this system or
90ce3da70b43 Initial load
duke
parents:
diff changeset
   407
            // TGT has unsupported encryption type
90ce3da70b43 Initial load
duke
parents:
diff changeset
   408
90ce3da70b43 Initial load
duke
parents:
diff changeset
   409
            if (!alreadyTried) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   410
                // See if there's any native code to load
90ce3da70b43 Initial load
duke
parents:
diff changeset
   411
                try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   412
                    ensureLoaded();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   413
                } catch (Exception e) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   414
                    if (DEBUG) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   415
                        System.out.println("Can not load credentials cache");
90ce3da70b43 Initial load
duke
parents:
diff changeset
   416
                        e.printStackTrace();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   417
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   418
                    alreadyTried = true;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   419
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   420
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   421
            if (alreadyLoaded) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   422
                // There is some native code
19373
4bb12c72a46f 8016594: Native Windows ccache still reads DES tickets
weijun
parents: 14413
diff changeset
   423
                if (DEBUG) {
4bb12c72a46f 8016594: Native Windows ccache still reads DES tickets
weijun
parents: 14413
diff changeset
   424
                    System.out.println(">> Acquire default native Credentials");
4bb12c72a46f 8016594: Native Windows ccache still reads DES tickets
weijun
parents: 14413
diff changeset
   425
                }
4bb12c72a46f 8016594: Native Windows ccache still reads DES tickets
weijun
parents: 14413
diff changeset
   426
                try {
4bb12c72a46f 8016594: Native Windows ccache still reads DES tickets
weijun
parents: 14413
diff changeset
   427
                    result = acquireDefaultNativeCreds(
4bb12c72a46f 8016594: Native Windows ccache still reads DES tickets
weijun
parents: 14413
diff changeset
   428
                            EType.getDefaults("default_tkt_enctypes"));
4bb12c72a46f 8016594: Native Windows ccache still reads DES tickets
weijun
parents: 14413
diff changeset
   429
                } catch (KrbException ke) {
4bb12c72a46f 8016594: Native Windows ccache still reads DES tickets
weijun
parents: 14413
diff changeset
   430
                    // when there is no default_tkt_enctypes.
4bb12c72a46f 8016594: Native Windows ccache still reads DES tickets
weijun
parents: 14413
diff changeset
   431
                }
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   432
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   433
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   434
        return result;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   435
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   436
90ce3da70b43 Initial load
duke
parents:
diff changeset
   437
    /**
90ce3da70b43 Initial load
duke
parents:
diff changeset
   438
     * Acquires credentials for a specified service using initial credential.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   439
     * When the service has a different realm
90ce3da70b43 Initial load
duke
parents:
diff changeset
   440
     * from the initial credential, we do cross-realm authentication
90ce3da70b43 Initial load
duke
parents:
diff changeset
   441
     * - first, we use the current credential to get
90ce3da70b43 Initial load
duke
parents:
diff changeset
   442
     * a cross-realm credential from the local KDC, then use that
90ce3da70b43 Initial load
duke
parents:
diff changeset
   443
     * cross-realm credential to request service credential
90ce3da70b43 Initial load
duke
parents:
diff changeset
   444
     * from the foreigh KDC.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   445
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   446
     * @param service the name of service principal using format
90ce3da70b43 Initial load
duke
parents:
diff changeset
   447
     * components@realm
90ce3da70b43 Initial load
duke
parents:
diff changeset
   448
     * @param ccreds client's initial credential.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   449
     * @exception IOException if an error occurs in reading the credentials
90ce3da70b43 Initial load
duke
parents:
diff changeset
   450
     * cache
90ce3da70b43 Initial load
duke
parents:
diff changeset
   451
     * @exception KrbException if an error occurs specific to Kerberos
90ce3da70b43 Initial load
duke
parents:
diff changeset
   452
     * @return a <code>Credentials</code> object.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   453
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   454
90ce3da70b43 Initial load
duke
parents:
diff changeset
   455
    public static Credentials acquireServiceCreds(String service,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   456
                                                  Credentials ccreds)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   457
        throws KrbException, IOException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   458
        return CredentialsUtil.acquireServiceCreds(service, ccreds);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   459
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   460
14413
e954df027393 6355584: Introduce constrained Kerberos delegation
weijun
parents: 13247
diff changeset
   461
    public static Credentials acquireS4U2selfCreds(PrincipalName user,
e954df027393 6355584: Introduce constrained Kerberos delegation
weijun
parents: 13247
diff changeset
   462
            Credentials ccreds) throws KrbException, IOException {
e954df027393 6355584: Introduce constrained Kerberos delegation
weijun
parents: 13247
diff changeset
   463
        return CredentialsUtil.acquireS4U2selfCreds(user, ccreds);
e954df027393 6355584: Introduce constrained Kerberos delegation
weijun
parents: 13247
diff changeset
   464
    }
e954df027393 6355584: Introduce constrained Kerberos delegation
weijun
parents: 13247
diff changeset
   465
e954df027393 6355584: Introduce constrained Kerberos delegation
weijun
parents: 13247
diff changeset
   466
    public static Credentials acquireS4U2proxyCreds(String service,
e954df027393 6355584: Introduce constrained Kerberos delegation
weijun
parents: 13247
diff changeset
   467
            Ticket second, PrincipalName client, Credentials ccreds)
e954df027393 6355584: Introduce constrained Kerberos delegation
weijun
parents: 13247
diff changeset
   468
        throws KrbException, IOException {
e954df027393 6355584: Introduce constrained Kerberos delegation
weijun
parents: 13247
diff changeset
   469
        return CredentialsUtil.acquireS4U2proxyCreds(
e954df027393 6355584: Introduce constrained Kerberos delegation
weijun
parents: 13247
diff changeset
   470
                service, second, client, ccreds);
e954df027393 6355584: Introduce constrained Kerberos delegation
weijun
parents: 13247
diff changeset
   471
    }
e954df027393 6355584: Introduce constrained Kerberos delegation
weijun
parents: 13247
diff changeset
   472
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   473
    public CredentialsCache getCache() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   474
        return cache;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   475
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   476
90ce3da70b43 Initial load
duke
parents:
diff changeset
   477
    public EncryptionKey getServiceKey() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   478
        return serviceKey;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   479
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   480
90ce3da70b43 Initial load
duke
parents:
diff changeset
   481
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   482
     * Prints out debug info.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   483
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   484
    public static void printDebug(Credentials c) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   485
        System.out.println(">>> DEBUG: ----Credentials----");
90ce3da70b43 Initial load
duke
parents:
diff changeset
   486
        System.out.println("\tclient: " + c.client.toString());
90ce3da70b43 Initial load
duke
parents:
diff changeset
   487
        System.out.println("\tserver: " + c.server.toString());
13247
74902cfeb9c6 6966259: Make PrincipalName and Realm immutable
weijun
parents: 12538
diff changeset
   488
        System.out.println("\tticket: sname: " + c.ticket.sname.toString());
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   489
        if (c.startTime != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   490
            System.out.println("\tstartTime: " + c.startTime.getTime());
90ce3da70b43 Initial load
duke
parents:
diff changeset
   491
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   492
        System.out.println("\tendTime: " + c.endTime.getTime());
90ce3da70b43 Initial load
duke
parents:
diff changeset
   493
        System.out.println("        ----Credentials end----");
90ce3da70b43 Initial load
duke
parents:
diff changeset
   494
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   495
90ce3da70b43 Initial load
duke
parents:
diff changeset
   496
90ce3da70b43 Initial load
duke
parents:
diff changeset
   497
    static void ensureLoaded() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   498
        java.security.AccessController.doPrivileged(
90ce3da70b43 Initial load
duke
parents:
diff changeset
   499
                new java.security.PrivilegedAction<Void> () {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   500
                        public Void run() {
12538
211d6e82fe51 7130404: [macosx] "os.arch" value should be "x86_64" for compatibility with Apple JDK6
jmelvin
parents: 12423
diff changeset
   501
                                if (System.getProperty("os.name").contains("OS X")) {
12047
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents: 7183
diff changeset
   502
                                    System.loadLibrary("osxkrb5");
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents: 7183
diff changeset
   503
                                } else {
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents: 7183
diff changeset
   504
                                    System.loadLibrary("w2k_lsa_auth");
320a714614e9 7113349: Initial changeset for Macosx port to jdk
michaelm
parents: 7183
diff changeset
   505
                                }
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   506
                                return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   507
                        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   508
                });
90ce3da70b43 Initial load
duke
parents:
diff changeset
   509
        alreadyLoaded = true;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   510
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   511
90ce3da70b43 Initial load
duke
parents:
diff changeset
   512
    public String toString() {
24969
afa6934dd8e8 8041679: Replace uses of StringBuffer with StringBuilder within core library classes
psandoz
parents: 23010
diff changeset
   513
        StringBuilder sb = new StringBuilder("Credentials:");
afa6934dd8e8 8041679: Replace uses of StringBuffer with StringBuilder within core library classes
psandoz
parents: 23010
diff changeset
   514
        sb.append(    "\n      client=").append(client);
afa6934dd8e8 8041679: Replace uses of StringBuffer with StringBuilder within core library classes
psandoz
parents: 23010
diff changeset
   515
        sb.append(    "\n      server=").append(server);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   516
        if (authTime != null) {
24969
afa6934dd8e8 8041679: Replace uses of StringBuffer with StringBuilder within core library classes
psandoz
parents: 23010
diff changeset
   517
            sb.append("\n    authTime=").append(authTime);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   518
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   519
        if (startTime != null) {
24969
afa6934dd8e8 8041679: Replace uses of StringBuffer with StringBuilder within core library classes
psandoz
parents: 23010
diff changeset
   520
            sb.append("\n   startTime=").append(startTime);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   521
        }
24969
afa6934dd8e8 8041679: Replace uses of StringBuffer with StringBuilder within core library classes
psandoz
parents: 23010
diff changeset
   522
        sb.append(    "\n     endTime=").append(endTime);
afa6934dd8e8 8041679: Replace uses of StringBuffer with StringBuilder within core library classes
psandoz
parents: 23010
diff changeset
   523
        sb.append(    "\n   renewTill=").append(renewTill);
afa6934dd8e8 8041679: Replace uses of StringBuffer with StringBuilder within core library classes
psandoz
parents: 23010
diff changeset
   524
        sb.append(    "\n       flags=").append(flags);
afa6934dd8e8 8041679: Replace uses of StringBuffer with StringBuilder within core library classes
psandoz
parents: 23010
diff changeset
   525
        sb.append(    "\nEType (skey)=").append(key.getEType());
afa6934dd8e8 8041679: Replace uses of StringBuffer with StringBuilder within core library classes
psandoz
parents: 23010
diff changeset
   526
        sb.append(    "\n   (tkt key)=").append(ticket.encPart.eType);
afa6934dd8e8 8041679: Replace uses of StringBuffer with StringBuilder within core library classes
psandoz
parents: 23010
diff changeset
   527
        return sb.toString();
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   528
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   529
90ce3da70b43 Initial load
duke
parents:
diff changeset
   530
}