author | weijun |
Thu, 17 Jun 2010 13:46:15 +0800 | |
changeset 5802 | ea99d72d3c19 |
parent 5774 | 4b9857e483c1 |
child 7172 | 01308fd663b3 |
permissions | -rw-r--r-- |
5774
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
1 |
/* |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
2 |
* Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved. |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
3 |
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
4 |
* |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
5 |
* This code is free software; you can redistribute it and/or modify it |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
6 |
* under the terms of the GNU General Public License version 2 only, as |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
7 |
* published by the Free Software Foundation. |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
8 |
* |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
9 |
* This code is distributed in the hope that it will be useful, but WITHOUT |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
10 |
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
11 |
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
12 |
* version 2 for more details (a copy is included in the LICENSE file that |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
13 |
* accompanied this code). |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
14 |
* |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
15 |
* You should have received a copy of the GNU General Public License version |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
16 |
* 2 along with this work; if not, write to the Free Software Foundation, |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
17 |
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
18 |
* |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
19 |
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
20 |
* or visit www.oracle.com if you need additional information or have any |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
21 |
* questions. |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
22 |
*/ |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
23 |
|
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
24 |
/* |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
25 |
* @test |
5802
ea99d72d3c19
6959292: regression: cannot login if session key and preauth does not use the same etype
weijun
parents:
5774
diff
changeset
|
26 |
* @bug 6932525 6951366 6959292 |
5774
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
27 |
* @summary kerberos login failure on win2008 with AD set to win2000 compat mode |
5802
ea99d72d3c19
6959292: regression: cannot login if session key and preauth does not use the same etype
weijun
parents:
5774
diff
changeset
|
28 |
* and cannot login if session key and preauth does not use the same etype |
5774
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
29 |
*/ |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
30 |
import com.sun.security.auth.module.Krb5LoginModule; |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
31 |
import java.io.File; |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
32 |
import sun.security.krb5.Config; |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
33 |
import sun.security.krb5.EncryptedData; |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
34 |
import sun.security.krb5.PrincipalName; |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
35 |
import sun.security.krb5.internal.crypto.EType; |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
36 |
import sun.security.krb5.internal.ktab.KeyTab; |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
37 |
|
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
38 |
public class W83 { |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
39 |
public static void main(String[] args) throws Exception { |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
40 |
|
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
41 |
W83 x = new W83(); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
42 |
|
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
43 |
// Cannot use OneKDC. kinit command cannot resolve |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
44 |
// hostname kdc.rabbit.hole |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
45 |
KDC kdc = new KDC(OneKDC.REALM, "127.0.0.1", 0, true); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
46 |
kdc.addPrincipal(OneKDC.USER, OneKDC.PASS); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
47 |
kdc.addPrincipalRandKey("krbtgt/" + OneKDC.REALM); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
48 |
KDC.saveConfig(OneKDC.KRB5_CONF, kdc); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
49 |
System.setProperty("java.security.krb5.conf", OneKDC.KRB5_CONF); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
50 |
Config.refresh(); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
51 |
|
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
52 |
kdc.writeKtab(OneKDC.KTAB); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
53 |
new File(OneKDC.KRB5_CONF).deleteOnExit(); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
54 |
new File(OneKDC.KTAB).deleteOnExit(); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
55 |
|
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
56 |
KeyTab ktab = KeyTab.getInstance(OneKDC.KTAB); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
57 |
for (int etype: EType.getBuiltInDefaults()) { |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
58 |
if (etype != EncryptedData.ETYPE_ARCFOUR_HMAC) { |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
59 |
ktab.deleteEntry(new PrincipalName(OneKDC.USER), etype); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
60 |
} |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
61 |
} |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
62 |
ktab.save(); |
5802
ea99d72d3c19
6959292: regression: cannot login if session key and preauth does not use the same etype
weijun
parents:
5774
diff
changeset
|
63 |
|
ea99d72d3c19
6959292: regression: cannot login if session key and preauth does not use the same etype
weijun
parents:
5774
diff
changeset
|
64 |
// For 6932525 and 6951366, make sure the etypes sent in 2nd AS-REQ |
ea99d72d3c19
6959292: regression: cannot login if session key and preauth does not use the same etype
weijun
parents:
5774
diff
changeset
|
65 |
// is not restricted to that of preauth |
ea99d72d3c19
6959292: regression: cannot login if session key and preauth does not use the same etype
weijun
parents:
5774
diff
changeset
|
66 |
kdc.setOption(KDC.Option.ONLY_RC4_TGT, true); |
ea99d72d3c19
6959292: regression: cannot login if session key and preauth does not use the same etype
weijun
parents:
5774
diff
changeset
|
67 |
x.go(); |
ea99d72d3c19
6959292: regression: cannot login if session key and preauth does not use the same etype
weijun
parents:
5774
diff
changeset
|
68 |
|
ea99d72d3c19
6959292: regression: cannot login if session key and preauth does not use the same etype
weijun
parents:
5774
diff
changeset
|
69 |
// For 6959292, make sure that when etype for enc-part in 2nd AS-REQ |
ea99d72d3c19
6959292: regression: cannot login if session key and preauth does not use the same etype
weijun
parents:
5774
diff
changeset
|
70 |
// is different from that of preauth, client can still decrypt it |
ea99d72d3c19
6959292: regression: cannot login if session key and preauth does not use the same etype
weijun
parents:
5774
diff
changeset
|
71 |
kdc.setOption(KDC.Option.ONLY_RC4_PREAUTH, true); |
5774
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
72 |
x.go(); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
73 |
} |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
74 |
|
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
75 |
void go() throws Exception { |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
76 |
Krb5LoginModule krb5 = new Krb5LoginModule(); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
77 |
StringBuffer error = new StringBuffer(); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
78 |
try { |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
79 |
Context.fromUserPass(OneKDC.USER, OneKDC.PASS, false); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
80 |
} catch (Exception e) { |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
81 |
error.append("Krb5LoginModule password login error\n"); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
82 |
} |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
83 |
try { |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
84 |
Context.fromUserKtab(OneKDC.USER, OneKDC.KTAB, false); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
85 |
} catch (Exception e) { |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
86 |
error.append("Krb5LoginModule keytab login error\n"); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
87 |
} |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
88 |
try { |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
89 |
Class.forName("sun.security.krb5.internal.tools.Kinit"); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
90 |
String cmd = System.getProperty("java.home") + |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
91 |
System.getProperty("file.separator") + |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
92 |
"bin" + |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
93 |
System.getProperty("file.separator") + |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
94 |
"kinit"; |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
95 |
|
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
96 |
int p = execute( |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
97 |
cmd, |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
98 |
"-J-Djava.security.krb5.conf=" + OneKDC.KRB5_CONF, |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
99 |
"-c", "cache1", |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
100 |
OneKDC.USER, |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
101 |
new String(OneKDC.PASS)); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
102 |
if (p != 0) { |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
103 |
error.append("kinit password login error\n"); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
104 |
} |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
105 |
p = execute( |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
106 |
cmd, |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
107 |
"-J-Djava.security.krb5.conf=" + OneKDC.KRB5_CONF, |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
108 |
"-c", "cache2", |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
109 |
"-k", "-t", OneKDC.KTAB, |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
110 |
OneKDC.USER); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
111 |
if (p != 0) { |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
112 |
error.append("kinit keytab login error\n"); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
113 |
} |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
114 |
} catch (ClassNotFoundException cnfe) { |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
115 |
System.out.println("No kinit, test ignored."); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
116 |
// Ignore, not on windows |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
117 |
} |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
118 |
if (error.length() != 0) { |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
119 |
throw new Exception(error.toString()); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
120 |
} |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
121 |
} |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
122 |
|
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
123 |
private static int execute(String... args) throws Exception { |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
124 |
for (String arg: args) { |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
125 |
System.out.printf("%s ", arg); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
126 |
} |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
127 |
System.out.println(); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
128 |
Process p = Runtime.getRuntime().exec(args); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
129 |
return p.waitFor(); |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
130 |
} |
4b9857e483c1
6951366: kerberos login failure on win2008 with AD set to win2000 compat mode
weijun
parents:
diff
changeset
|
131 |
} |