1 /*

     2  * Copyright (c) 2009, 2013, Oracle and/or its affiliates. All rights reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.  Oracle designates this

     8  * particular file as subject to the "Classpath" exception as provided

     9  * by Oracle in the LICENSE file that accompanied this code.

    10  *

    11  * This code is distributed in the hope that it will be useful, but WITHOUT

    12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    14  * version 2 for more details (a copy is included in the LICENSE file that

    15  * accompanied this code).

    16  *

    17  * You should have received a copy of the GNU General Public License version

    18  * 2 along with this work; if not, write to the Free Software Foundation,

    19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    20  *

    21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    22  * or visit www.oracle.com if you need additional information or have any

    23  * questions.

    24  */

    25 

    26 package sun.security.ssl.krb5;

    27 

    28 import java.security.AccessControlContext;

    29 import java.security.Permission;

    30 import java.security.Principal;

    31 import java.util.Set;

    32 import javax.crypto.SecretKey;

    33 import javax.security.auth.Subject;

    34 import javax.security.auth.kerberos.KerberosKey;

    35 import javax.security.auth.kerberos.KeyTab;

    36 import javax.security.auth.kerberos.ServicePermission;

    37 import javax.security.auth.login.LoginException;

    38 

    39 import sun.security.jgss.GSSCaller;

    40 import sun.security.jgss.krb5.Krb5Util;

    41 import sun.security.jgss.krb5.ServiceCreds;

    42 import sun.security.krb5.PrincipalName;

    43 import sun.security.ssl.Krb5Proxy;

    44 

    45 /**

    46  * An implementation of Krb5Proxy that simply delegates to the appropriate

    47  * Kerberos APIs.

    48  */

    49 public class Krb5ProxyImpl implements Krb5Proxy {

    50 

    51     public Krb5ProxyImpl() { }

    52 

    53     @Override

    54     public Subject getClientSubject(AccessControlContext acc)

    55             throws LoginException {

    56         return Krb5Util.getSubject(GSSCaller.CALLER_SSL_CLIENT, acc);

    57     }

    58 

    59     @Override

    60     public Subject getServerSubject(AccessControlContext acc)

    61             throws LoginException {

    62         return Krb5Util.getSubject(GSSCaller.CALLER_SSL_SERVER, acc);

    63     }

    64 

    65     @Override

    66     public Object getServiceCreds(AccessControlContext acc)

    67             throws LoginException {

    68         ServiceCreds serviceCreds =

    69             Krb5Util.getServiceCreds(GSSCaller.CALLER_SSL_SERVER, null, acc);

    70         return serviceCreds;

    71     }

    72 

    73     @Override

    74     public String getServerPrincipalName(Object serviceCreds) {

    75         return ((ServiceCreds)serviceCreds).getName();

    76     }

    77 

    78     @Override

    79     public String getPrincipalHostName(Principal principal) {

    80         if (principal == null) {

    81            return null;

    82         }

    83         String hostName = null;

    84         try {

    85             PrincipalName princName =

    86                 new PrincipalName(principal.getName(),

    87                         PrincipalName.KRB_NT_SRV_HST);

    88             String[] nameParts = princName.getNameStrings();

    89             if (nameParts.length >= 2) {

    90                 hostName = nameParts[1];

    91             }

    92         } catch (Exception e) {

    93             // ignore

    94         }

    95         return hostName;

    96     }

    97 

    98 

    99     @Override

   100     public Permission getServicePermission(String principalName,

   101             String action) {

   102         return new ServicePermission(principalName, action);

   103     }

   104 

   105     @Override

   106     public boolean isRelated(Subject subject, Principal princ) {

   107         if (princ == null) return false;

   108         Set<Principal> principals =

   109                 subject.getPrincipals(Principal.class);

   110         if (principals.contains(princ)) {

   111             // bound to this principal

   112             return true;

   113         }

   114         for (KeyTab pc: subject.getPrivateCredentials(KeyTab.class)) {

   115             if (!pc.isBound()) {

   116                 return true;

   117             }

   118         }

   119         return false;

   120     }

   121 }