39 import com.sun.security.auth.NTSidPrimaryGroupPrincipal; |
39 import com.sun.security.auth.NTSidPrimaryGroupPrincipal; |
40 import com.sun.security.auth.NTSidGroupPrincipal; |
40 import com.sun.security.auth.NTSidGroupPrincipal; |
41 import com.sun.security.auth.NTNumericCredential; |
41 import com.sun.security.auth.NTNumericCredential; |
42 |
42 |
43 /** |
43 /** |
44 * <p> This <code>LoginModule</code> |
44 * This {@code LoginModule} |
45 * renders a user's NT security information as some number of |
45 * renders a user's NT security information as some number of |
46 * <code>Principal</code>s |
46 * {@code Principal}s |
47 * and associates them with a <code>Subject</code>. |
47 * and associates them with a {@code Subject}. |
48 * |
48 * |
49 * <p> This LoginModule recognizes the debug option. |
49 * <p> This LoginModule recognizes the debug option. |
50 * If set to true in the login Configuration, |
50 * If set to true in the login Configuration, |
51 * debug messages will be output to the output stream, System.out. |
51 * debug messages will be output to the output stream, System.out. |
52 * |
52 * |
83 private NTSidPrimaryGroupPrincipal primaryGroup; // primary group |
83 private NTSidPrimaryGroupPrincipal primaryGroup; // primary group |
84 private NTSidGroupPrincipal groups[]; // supplementary groups |
84 private NTSidGroupPrincipal groups[]; // supplementary groups |
85 private NTNumericCredential iToken; // impersonation token |
85 private NTNumericCredential iToken; // impersonation token |
86 |
86 |
87 /** |
87 /** |
88 * Initialize this <code>LoginModule</code>. |
88 * Initialize this {@code LoginModule}. |
89 * |
89 * |
90 * <p> |
90 * @param subject the {@code Subject} to be authenticated. |
91 * |
91 * |
92 * @param subject the <code>Subject</code> to be authenticated. <p> |
92 * @param callbackHandler a {@code CallbackHandler} for communicating |
93 * |
|
94 * @param callbackHandler a <code>CallbackHandler</code> for communicating |
|
95 * with the end user (prompting for usernames and |
93 * with the end user (prompting for usernames and |
96 * passwords, for example). This particular LoginModule only |
94 * passwords, for example). This particular LoginModule only |
97 * extracts the underlying NT system information, so this |
95 * extracts the underlying NT system information, so this |
98 * parameter is ignored.<p> |
96 * parameter is ignored. |
99 * |
97 * |
100 * @param sharedState shared <code>LoginModule</code> state. <p> |
98 * @param sharedState shared {@code LoginModule} state. |
101 * |
99 * |
102 * @param options options specified in the login |
100 * @param options options specified in the login |
103 * <code>Configuration</code> for this particular |
101 * {@code Configuration} for this particular |
104 * <code>LoginModule</code>. |
102 * {@code LoginModule}. |
105 */ |
103 */ |
106 public void initialize(Subject subject, CallbackHandler callbackHandler, |
104 public void initialize(Subject subject, CallbackHandler callbackHandler, |
107 Map<String,?> sharedState, |
105 Map<String,?> sharedState, |
108 Map<String,?> options) |
106 Map<String,?> options) |
109 { |
107 { |
123 } |
121 } |
124 |
122 |
125 /** |
123 /** |
126 * Import underlying NT system identity information. |
124 * Import underlying NT system identity information. |
127 * |
125 * |
128 * <p> |
126 * @return true in all cases since this {@code LoginModule} |
129 * |
|
130 * @return true in all cases since this <code>LoginModule</code> |
|
131 * should not be ignored. |
127 * should not be ignored. |
132 * |
128 * |
133 * @exception FailedLoginException if the authentication fails. <p> |
129 * @exception FailedLoginException if the authentication fails. |
134 * |
130 * |
135 * @exception LoginException if this <code>LoginModule</code> |
131 * @exception LoginException if this {@code LoginModule} |
136 * is unable to perform the authentication. |
132 * is unable to perform the authentication. |
137 */ |
133 */ |
138 public boolean login() throws LoginException { |
134 public boolean login() throws LoginException { |
139 |
135 |
140 succeeded = false; // Indicate not yet successful |
136 succeeded = false; // Indicate not yet successful |
219 succeeded = true; |
215 succeeded = true; |
220 return succeeded; |
216 return succeeded; |
221 } |
217 } |
222 |
218 |
223 /** |
219 /** |
224 * <p> This method is called if the LoginContext's |
220 * This method is called if the LoginContext's |
225 * overall authentication succeeded |
221 * overall authentication succeeded |
226 * (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules |
222 * (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules |
227 * succeeded). |
223 * succeeded). |
228 * |
224 * |
229 * <p> If this LoginModule's own authentication attempt |
225 * <p> If this LoginModule's own authentication attempt |
230 * succeeded (checked by retrieving the private state saved by the |
226 * succeeded (checked by retrieving the private state saved by the |
231 * <code>login</code> method), then this method associates some |
227 * {@code login} method), then this method associates some |
232 * number of various <code>Principal</code>s |
228 * number of various {@code Principal}s |
233 * with the <code>Subject</code> located in the |
229 * with the {@code Subject} located in the |
234 * <code>LoginModuleContext</code>. If this LoginModule's own |
230 * {@code LoginModuleContext}. If this LoginModule's own |
235 * authentication attempted failed, then this method removes |
231 * authentication attempted failed, then this method removes |
236 * any state that was originally saved. |
232 * any state that was originally saved. |
237 * |
|
238 * <p> |
|
239 * |
233 * |
240 * @exception LoginException if the commit fails. |
234 * @exception LoginException if the commit fails. |
241 * |
235 * |
242 * @return true if this LoginModule's own login and commit |
236 * @return true if this LoginModule's own login and commit |
243 * attempts succeeded, or false otherwise. |
237 * attempts succeeded, or false otherwise. |
288 return true; |
282 return true; |
289 } |
283 } |
290 |
284 |
291 |
285 |
292 /** |
286 /** |
293 * <p> This method is called if the LoginContext's |
287 * This method is called if the LoginContext's |
294 * overall authentication failed. |
288 * overall authentication failed. |
295 * (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules |
289 * (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules |
296 * did not succeed). |
290 * did not succeed). |
297 * |
291 * |
298 * <p> If this LoginModule's own authentication attempt |
292 * <p> If this LoginModule's own authentication attempt |
299 * succeeded (checked by retrieving the private state saved by the |
293 * succeeded (checked by retrieving the private state saved by the |
300 * <code>login</code> and <code>commit</code> methods), |
294 * {@code login} and {@code commit} methods), |
301 * then this method cleans up any state that was originally saved. |
295 * then this method cleans up any state that was originally saved. |
302 * |
|
303 * <p> |
|
304 * |
296 * |
305 * @exception LoginException if the abort fails. |
297 * @exception LoginException if the abort fails. |
306 * |
298 * |
307 * @return false if this LoginModule's own login and/or commit attempts |
299 * @return false if this LoginModule's own login and/or commit attempts |
308 * failed, and true otherwise. |
300 * failed, and true otherwise. |
334 } |
326 } |
335 |
327 |
336 /** |
328 /** |
337 * Logout the user. |
329 * Logout the user. |
338 * |
330 * |
339 * <p> This method removes the <code>NTUserPrincipal</code>, |
331 * <p> This method removes the {@code NTUserPrincipal}, |
340 * <code>NTDomainPrincipal</code>, <code>NTSidUserPrincipal</code>, |
332 * {@code NTDomainPrincipal}, {@code NTSidUserPrincipal}, |
341 * <code>NTSidDomainPrincipal</code>, <code>NTSidGroupPrincipal</code>s, |
333 * {@code NTSidDomainPrincipal}, {@code NTSidGroupPrincipal}s, |
342 * and <code>NTSidPrimaryGroupPrincipal</code> |
334 * and {@code NTSidPrimaryGroupPrincipal} |
343 * that may have been added by the <code>commit</code> method. |
335 * that may have been added by the {@code commit} method. |
344 * |
|
345 * <p> |
|
346 * |
336 * |
347 * @exception LoginException if the logout fails. |
337 * @exception LoginException if the logout fails. |
348 * |
338 * |
349 * @return true in all cases since this <code>LoginModule</code> |
339 * @return true in all cases since this {@code LoginModule} |
350 * should not be ignored. |
340 * should not be ignored. |
351 */ |
341 */ |
352 public boolean logout() throws LoginException { |
342 public boolean logout() throws LoginException { |
353 |
343 |
354 if (subject.isReadOnly()) { |
344 if (subject.isReadOnly()) { |