1 /*

     2  * Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.

     8  *

     9  * This code is distributed in the hope that it will be useful, but WITHOUT

    10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    12  * version 2 for more details (a copy is included in the LICENSE file that

    13  * accompanied this code).

    14  *

    15  * You should have received a copy of the GNU General Public License version

    16  * 2 along with this work; if not, write to the Free Software Foundation,

    17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    18  *

    19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    20  * or visit www.oracle.com if you need additional information or have any

    21  * questions.

    22  */

    23 

    24 /*

    25  * @test

    26  * @bug 8058290

    27  * @summary JAAS Krb5LoginModule has suspect ticket-renewal logic,

    28  *          relies on clockskew grace

    29  * @modules java.base/sun.net.spi.nameservice

    30  *          java.base/sun.security.util

    31  *          java.security.jgss/sun.security.krb5

    32  *          java.security.jgss/sun.security.krb5.internal

    33  *          java.security.jgss/sun.security.krb5.internal.ccache

    34  *          java.security.jgss/sun.security.krb5.internal.crypto

    35  *          java.security.jgss/sun.security.krb5.internal.ktab

    36  * @compile -XDignore.symbol.file Renew.java

    37  * @run main/othervm Renew 1

    38  * @run main/othervm Renew 2

    39  * @run main/othervm Renew 3

    40  */

    41 

    42 import sun.security.krb5.Config;

    43 

    44 import java.nio.file.Files;

    45 import java.nio.file.Paths;

    46 import java.util.Arrays;

    47 import java.util.Date;

    48 import javax.security.auth.kerberos.KerberosTicket;

    49 

    50 public class Renew {

    51 

    52     public static void main(String[] args) throws Exception {

    53 

    54         // Three test cases:

    55         // 1. renewTGT=false

    56         // 2. renewTGT=true with a short life time, renew will happen

    57         // 3. renewTGT=true with a long life time, renew won't happen

    58         int test = Integer.parseInt(args[0]);

    59 

    60         OneKDC k = new OneKDC(null);

    61         KDC.saveConfig(OneKDC.KRB5_CONF, k,

    62                 "renew_lifetime = 1d",

    63                 "ticket_lifetime = " + (test == 2? "10s": "8h"));

    64         Config.refresh();

    65         k.writeJAASConf();

    66 

    67         // KDC would save ccache in a file

    68         System.setProperty("test.kdc.save.ccache", "cache.here");

    69 

    70         Files.write(Paths.get(OneKDC.JAAS_CONF), Arrays.asList(

    71                 "first {",

    72                 "   com.sun.security.auth.module.Krb5LoginModule required;",

    73                 "};",

    74                 "second {",

    75                 "   com.sun.security.auth.module.Krb5LoginModule required",

    76                 "   doNotPrompt=true",

    77                 "   renewTGT=" + (test != 1),

    78                 "   useTicketCache=true",

    79                 "   ticketCache=cache.here;",

    80                 "};"

    81         ));

    82 

    83         Context c;

    84 

    85         // The first login uses username and password

    86         c = Context.fromUserPass(OneKDC.USER, OneKDC.PASS, false);

    87         Date d1 = c.s().getPrivateCredentials(KerberosTicket.class).iterator().next().getAuthTime();

    88 

    89         // 6s is longer than half of 10s

    90         Thread.sleep(6000);

    91 

    92         // The second login uses the cache

    93         c = Context.fromJAAS("second");

    94         Date d2 = c.s().getPrivateCredentials(KerberosTicket.class).iterator().next().getAuthTime();

    95 

    96         if (test == 2) {

    97             if (d1.equals(d2)) {

    98                 throw new Exception("Ticket not renewed");

    99             }

   100         } else {

   101             if (!d1.equals(d2)) {

   102                 throw new Exception("Ticket renewed");

   103             }

   104         }

   105     }

   106 }