1 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"> |
|
2 <html> |
|
3 <head> |
|
4 <!-- |
|
5 Copyright (c) 2000, 2017, Oracle and/or its affiliates. All rights reserved. |
|
6 DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
|
7 |
|
8 This code is free software; you can redistribute it and/or modify it |
|
9 under the terms of the GNU General Public License version 2 only, as |
|
10 published by the Free Software Foundation. Oracle designates this |
|
11 particular file as subject to the "Classpath" exception as provided |
|
12 by Oracle in the LICENSE file that accompanied this code. |
|
13 |
|
14 This code is distributed in the hope that it will be useful, but WITHOUT |
|
15 ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
|
16 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
|
17 version 2 for more details (a copy is included in the LICENSE file that |
|
18 accompanied this code). |
|
19 |
|
20 You should have received a copy of the GNU General Public License version |
|
21 2 along with this work; if not, write to the Free Software Foundation, |
|
22 Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
|
23 |
|
24 Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
|
25 or visit www.oracle.com if you need additional information or have any |
|
26 questions. |
|
27 --> |
|
28 |
|
29 </head> |
|
30 <body bgcolor="white"> |
|
31 |
|
32 This package presents a framework that allows application developers to |
|
33 make use of security services like authentication, data integrity and |
|
34 data confidentiality from a variety of underlying security mechanisms |
|
35 like Kerberos, using a unified API. The security mechanisms that an |
|
36 application can |
|
37 chose to use are identified with unique object identifiers. One example |
|
38 of such a mechanism is the Kerberos v5 GSS-API mechanism (object |
|
39 identifier 1.2.840.113554.1.2.2). This mechanism is available through |
|
40 the default instance of the GSSManager class.<p> |
|
41 |
|
42 The GSS-API is defined in a language independent way in |
|
43 <a href=http://www.ietf.org/rfc/rfc2743.txt>RFC 2743</a>. The Java |
|
44 language bindings are defined in |
|
45 <a href=http://www.ietf.org/rfc/rfc2853.txt>RFC 2853</a><p> |
|
46 |
|
47 An application starts out by instantiating a <code>GSSManager</code> |
|
48 which then serves as a factory for a security context. An application |
|
49 can use specific principal names and credentials that are also created |
|
50 using the GSSManager; or it can instantiate a |
|
51 context with system defaults. It then goes through a context |
|
52 establishment loop. Once a context is established with the |
|
53 peer, authentication is complete. Data protection such as integrity |
|
54 and confidentiality can then be obtained from this context.<p> |
|
55 |
|
56 The GSS-API does not perform any communication with the peer. It merely |
|
57 produces tokens that the application must somehow transport to the |
|
58 other end. |
|
59 |
|
60 <h3 id="useSubjectCredsOnly">Credential Acquisition</h3> |
|
61 The GSS-API itself does not dictate how an underlying mechanism |
|
62 obtains the credentials that are needed for authentication. It is |
|
63 assumed that prior to calling the GSS-API, these credentials are |
|
64 obtained and stored in a location that the mechanism provider is |
|
65 aware of. However, the default model in the Java platform will be |
|
66 that mechanism providers must obtain credentials only from the private |
|
67 or public credential sets associated with the |
|
68 {@link javax.security.auth.Subject Subject} in the |
|
69 current access control context. The Kerberos v5 |
|
70 mechanism will search for the required INITIATE and ACCEPT credentials |
|
71 ({@link javax.security.auth.kerberos.KerberosTicket KerberosTicket} and |
|
72 {@link javax.security.auth.kerberos.KerberosKey KerberosKey}) in |
|
73 the private credential set where as some other mechanism might look |
|
74 in the public set or in both. If the desired credential is not |
|
75 present in the appropriate sets of the current Subject, the GSS-API |
|
76 call must fail.<p> |
|
77 |
|
78 This model has the advantage that credential management |
|
79 is simple and predictable from the applications point of view. An |
|
80 application, given the right permissions, can purge the credentials in |
|
81 the Subject or renew them using standard Java API's. If it purged |
|
82 the credentials, it would be sure that the JGSS mechanism would fail, |
|
83 or if it renewed a time based credential it would be sure that a JGSS |
|
84 mechanism would succeed.<p> |
|
85 |
|
86 This model does require that a {@link |
|
87 javax.security.auth.login JAAS login} be performed in order to |
|
88 authenticate and populate a Subject that the JGSS mechanism can later |
|
89 utilize. However, applications have the ability to relax this |
|
90 restriction by means of a system property: |
|
91 <code>javax.security.auth.useSubjectCredsOnly</code>. By default |
|
92 this system property will be assumed to be <code>true</code> (even when |
|
93 it is unset) indicating that providers must only use the credentials |
|
94 that are present in the current Subject. However, if this property is |
|
95 explicitly set to false by the application, then it indicates that |
|
96 the provider is free to use any credentials cache of its choice. Such |
|
97 a credential cache might be a disk cache, an in-memory cache, or even |
|
98 just the current Subject itself. |
|
99 |
|
100 <h2>Related Documentation</h2> |
|
101 <p> |
|
102 For an online tutorial on using Java GSS-API, please see |
|
103 {@extLink security_guide_jgss_tutorial |
|
104 Introduction to JAAS and Java GSS-API}. |
|
105 </p> |
|
106 |
|
107 <!-- |
|
108 <h2>Package Specification</h2> |
|
109 |
|
110 ##### FILL IN ANY SPECS NEEDED BY JAVA COMPATIBILITY KIT ##### |
|
111 <ul> |
|
112 <li><a href="">##### REFER TO ANY FRAMEMAKER SPECIFICATION HERE #####</a> |
|
113 </ul> |
|
114 |
|
115 <h2>Related Documentation</h2> |
|
116 |
|
117 For overviews, tutorials, examples, guides, and tool documentation, please see: |
|
118 <ul> |
|
119 <li><a href="">##### REFER TO NON-SPEC DOCUMENTATION HERE #####</a> |
|
120 </ul> |
|
121 |
|
122 --> |
|
123 |
|
124 @since 1.4 |
|
125 </body> |
|
126 </html> |
|