initSecContext.
+ * + * When this flag is false, delegation will only be tried when the + * {@link GSSContext#requestCredDeleg(boolean) credentials delegation flag} + * is true. + *
+ * When this flag is true but the + * {@link GSSContext#requestCredDeleg(boolean) credentials delegation flag} + * is false, delegation will be only tried if the delegation policy permits + * delegation. + *
+ * When both this flag and the + * {@link GSSContext#requestCredDeleg(boolean) credentials delegation flag} + * are true, delegation will be always tried. However, if the delegation + * policy does not permit delegation, the value of + * {@link #getDelegPolicyState} will be false, even + * if delegation is performed successfully. + *
+ * In any case, if the delegation is not successful, the value returned + * by {@link GSSContext#getCredDelegState()} is false, and the value + * returned by {@link #getDelegPolicyState()} is also false. + *
+ * Not all mechanisms support delegation policy. Therefore, the
+ * application should check to see if the request was honored with the
+ * {@link #getDelegPolicyState() getDelegPolicyState} method. When
+ * delegation policy is not supported, requestDelegPolicy
+ * should return silently without throwing an exception.
+ *
+ * Note: for the Kerberos 5 mechanism, the delegation policy is expressed + * through the OK-AS-DELEGATE flag in the service ticket. When it's true, + * the KDC permits delegation to the target server. In a cross-realm + * environment, in order for delegation be permitted, all cross-realm TGTs + * on the authentication path must also have the OK-AS-DELAGATE flags set. + * @param state true if the policy should be respected + * @throws GSSException containing the following + * major error codes: + * {@link GSSException#FAILURE GSSException.FAILURE} + */ + public void requestDelegPolicy(boolean state) throws GSSException; + + /** + * Returns the delegation policy response. Called after a security context + * is established. This method can be only called on the initiator's side. + * See {@link ExtendedGSSContext#requestDelegPolicy}. + * @return the delegation policy response + */ + public boolean getDelegPolicyState(); } diff -r 365eb4449319 -r 4c792c19266e jdk/src/share/classes/org/ietf/jgss/GSSContext.java --- a/jdk/src/share/classes/org/ietf/jgss/GSSContext.java Wed Nov 25 08:24:58 2009 -0800 +++ b/jdk/src/share/classes/org/ietf/jgss/GSSContext.java Fri Nov 27 08:51:28 2009 +0800 @@ -1,5 +1,5 @@ /* - * Copyright 2000-2001 Sun Microsystems, Inc. All Rights Reserved. + * Copyright 2000-2009 Sun Microsystems, Inc. All Rights Reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -678,7 +678,7 @@ * are not definitive then the method will attempt to treat all * available bytes as part of the token.
* - * Other than the possible blocking behaviour described above, this + * Other than the possible blocking behavior described above, this * method is equivalent to the byte array based {@link #unwrap(byte[], * int, int, MessageProp) unwrap} method.
* @@ -826,7 +826,7 @@ * are not definitive then the method will attempt to treat all * available bytes as part of the token.
* - * Other than the possible blocking behaviour described above, this + * Other than the possible blocking behavior described above, this * method is equivalent to the byte array based {@link #verifyMIC(byte[], * int, int, byte[], int, int, MessageProp) verifyMIC} method.
* @@ -917,7 +917,7 @@ * getMutualAuthState} method.
*
* @param state a boolean value indicating whether mutual
- * authentication shouls be used or not.
+ * authentication should be used or not.
* @see #getMutualAuthState()
*
* @throws GSSException containing the following
@@ -928,7 +928,7 @@
/**
* Requests that replay detection be enabled for the
- * per-message security services after context establishemnt. This
+ * per-message security services after context establishment. This
* request can only be made on the context initiator's side and it has
* to be done prior to the first call to
* initSecContext. During context establishment replay
@@ -958,7 +958,7 @@
/**
* Requests that sequence checking be enabled for the
- * per-message security services after context establishemnt. This
+ * per-message security services after context establishment. This
* request can only be made on the context initiator's side and it has
* to be done prior to the first call to
* initSecContext. During context establishment sequence
diff -r 365eb4449319 -r 4c792c19266e jdk/src/share/classes/sun/net/www/protocol/http/spnego/NegotiatorImpl.java
--- a/jdk/src/share/classes/sun/net/www/protocol/http/spnego/NegotiatorImpl.java Wed Nov 25 08:24:58 2009 -0800
+++ b/jdk/src/share/classes/sun/net/www/protocol/http/spnego/NegotiatorImpl.java Fri Nov 27 08:51:28 2009 +0800
@@ -25,6 +25,7 @@
package sun.net.www.protocol.http.spnego;
+import com.sun.security.jgss.ExtendedGSSContext;
import java.io.IOException;
import org.ietf.jgss.GSSContext;
@@ -100,15 +101,10 @@
null,
GSSContext.DEFAULT_LIFETIME);
- // In order to support credential delegation in HTTP/SPNEGO,
- // we always request it before initSecContext. The current
- // implementation will check the OK-AS-DELEGATE flag inside
- // the service ticket of the web server, and only enable
- // delegation when this flag is set. This check is only
- // performed when the GSS caller is CALLER_HTTP_NEGOTIATE,
- // so all other normal GSS-API calls are not affected.
-
- context.requestCredDeleg(true);
+ // Always respect delegation policy in HTTP/SPNEGO.
+ if (context instanceof ExtendedGSSContext) {
+ ((ExtendedGSSContext)context).requestDelegPolicy(true);
+ }
oneToken = context.initSecContext(new byte[0], 0, 0);
}
diff -r 365eb4449319 -r 4c792c19266e jdk/src/share/classes/sun/security/jgss/GSSContextImpl.java
--- a/jdk/src/share/classes/sun/security/jgss/GSSContextImpl.java Wed Nov 25 08:24:58 2009 -0800
+++ b/jdk/src/share/classes/sun/security/jgss/GSSContextImpl.java Fri Nov 27 08:51:28 2009 +0800
@@ -89,7 +89,8 @@
*/
class GSSContextImpl implements ExtendedGSSContext {
- private GSSManagerImpl gssManager = null;
+ private final GSSManagerImpl gssManager;
+ private final boolean initiator;
// private flags for the context state
private static final int PRE_INIT = 1;
@@ -99,14 +100,12 @@
// instance variables
private int currentState = PRE_INIT;
- private boolean initiator;
private GSSContextSpi mechCtxt = null;
private Oid mechOid = null;
private ObjectIdentifier objId = null;
private GSSCredentialImpl myCred = null;
- private GSSCredentialImpl delegCred = null;
private GSSNameImpl srcName = null;
private GSSNameImpl targName = null;
@@ -121,6 +120,7 @@
private boolean reqSequenceDetState = true;
private boolean reqCredDelegState = false;
private boolean reqAnonState = false;
+ private boolean reqDelegPolicyState = false;
/**
* Creates a GSSContextImp on the context initiator's side.
@@ -221,6 +221,7 @@
mechCtxt.requestSequenceDet(reqSequenceDetState);
mechCtxt.requestAnonymity(reqAnonState);
mechCtxt.setChannelBinding(channelBindings);
+ mechCtxt.requestDelegPolicy(reqDelegPolicyState);
objId = new ObjectIdentifier(mechOid.toString());
@@ -465,42 +466,42 @@
}
public void requestMutualAuth(boolean state) throws GSSException {
- if (mechCtxt == null)
+ if (mechCtxt == null && initiator)
reqMutualAuthState = state;
}
public void requestReplayDet(boolean state) throws GSSException {
- if (mechCtxt == null)
+ if (mechCtxt == null && initiator)
reqReplayDetState = state;
}
public void requestSequenceDet(boolean state) throws GSSException {
- if (mechCtxt == null)
+ if (mechCtxt == null && initiator)
reqSequenceDetState = state;
}
public void requestCredDeleg(boolean state) throws GSSException {
- if (mechCtxt == null)
+ if (mechCtxt == null && initiator)
reqCredDelegState = state;
}
public void requestAnonymity(boolean state) throws GSSException {
- if (mechCtxt == null)
+ if (mechCtxt == null && initiator)
reqAnonState = state;
}
public void requestConf(boolean state) throws GSSException {
- if (mechCtxt == null)
+ if (mechCtxt == null && initiator)
reqConfState = state;
}
public void requestInteg(boolean state) throws GSSException {
- if (mechCtxt == null)
+ if (mechCtxt == null && initiator)
reqIntegState = state;
}
public void requestLifetime(int lifetime) throws GSSException {
- if (mechCtxt == null)
+ if (mechCtxt == null && initiator)
reqLifetime = lifetime;
}
@@ -630,6 +631,8 @@
targName = null;
}
+ // ExtendedGSSContext methods:
+
@Override
public Object inquireSecContext(InquireType type) throws GSSException {
SecurityManager security = System.getSecurityManager();
@@ -641,4 +644,18 @@
}
return mechCtxt.inquireSecContext(type);
}
+
+ @Override
+ public void requestDelegPolicy(boolean state) throws GSSException {
+ if (mechCtxt == null && initiator)
+ reqDelegPolicyState = state;
+ }
+
+ @Override
+ public boolean getDelegPolicyState() {
+ if (mechCtxt != null)
+ return mechCtxt.getDelegPolicyState();
+ else
+ return reqDelegPolicyState;
+ }
}
diff -r 365eb4449319 -r 4c792c19266e jdk/src/share/classes/sun/security/jgss/krb5/InitialToken.java
--- a/jdk/src/share/classes/sun/security/jgss/krb5/InitialToken.java Wed Nov 25 08:24:58 2009 -0800
+++ b/jdk/src/share/classes/sun/security/jgss/krb5/InitialToken.java Fri Nov 27 08:51:28 2009 +0800
@@ -85,34 +85,41 @@
int size = CHECKSUM_LENGTH_SIZE + CHECKSUM_BINDINGS_SIZE +
CHECKSUM_FLAGS_SIZE;
- if (context.getCredDelegState()) {
- if (context.getCaller() instanceof HttpCaller &&
- !serviceTicket.getFlags()[Krb5.TKT_OPTS_DELEGATE]) {
- // When the caller is HTTP/SPNEGO and OK-AS-DELEGATE
- // is not present in the service ticket, delegation
- // is disabled.
- context.setCredDelegState(false);
- } else if (!tgt.isForwardable()) {
- // XXX log this resetting of delegation state
- context.setCredDelegState(false);
+ if (!tgt.isForwardable()) {
+ context.setCredDelegState(false);
+ context.setDelegPolicyState(false);
+ } else if (context.getCredDelegState()) {
+ if (context.getDelegPolicyState()) {
+ if (!serviceTicket.checkDelegate()) {
+ // delegation not permitted by server policy, mark it
+ context.setDelegPolicyState(false);
+ }
+ }
+ } else if (context.getDelegPolicyState()) {
+ if (serviceTicket.checkDelegate()) {
+ context.setCredDelegState(true);
} else {
- KrbCred krbCred = null;
- CipherHelper cipherHelper =
- context.getCipherHelper(serviceTicket.getSessionKey());
- if (useNullKey(cipherHelper)) {
- krbCred = new KrbCred(tgt, serviceTicket,
- EncryptionKey.NULL_KEY);
- } else {
- krbCred = new KrbCred(tgt, serviceTicket,
- serviceTicket.getSessionKey());
- }
- krbCredMessage = krbCred.getMessage();
- size += CHECKSUM_DELEG_OPT_SIZE +
- CHECKSUM_DELEG_LGTH_SIZE +
- krbCredMessage.length;
+ context.setDelegPolicyState(false);
}
}
+ if (context.getCredDelegState()) {
+ KrbCred krbCred = null;
+ CipherHelper cipherHelper =
+ context.getCipherHelper(serviceTicket.getSessionKey());
+ if (useNullKey(cipherHelper)) {
+ krbCred = new KrbCred(tgt, serviceTicket,
+ EncryptionKey.NULL_KEY);
+ } else {
+ krbCred = new KrbCred(tgt, serviceTicket,
+ serviceTicket.getSessionKey());
+ }
+ krbCredMessage = krbCred.getMessage();
+ size += CHECKSUM_DELEG_OPT_SIZE +
+ CHECKSUM_DELEG_LGTH_SIZE +
+ krbCredMessage.length;
+ }
+
checksumBytes = new byte[size];
checksumBytes[pos++] = CHECKSUM_FIRST_BYTES[0];
@@ -296,6 +303,7 @@
return delegCreds;
}
+ // Only called by acceptor
public void setContextFlags(Krb5Context context) {
// default for cred delegation is false
if ((flags & CHECKSUM_DELEG_FLAG) > 0)
diff -r 365eb4449319 -r 4c792c19266e jdk/src/share/classes/sun/security/jgss/krb5/Krb5Context.java
--- a/jdk/src/share/classes/sun/security/jgss/krb5/Krb5Context.java Wed Nov 25 08:24:58 2009 -0800
+++ b/jdk/src/share/classes/sun/security/jgss/krb5/Krb5Context.java Fri Nov 27 08:51:28 2009 +0800
@@ -78,6 +78,7 @@
private boolean sequenceDetState = true;
private boolean confState = true;
private boolean integState = true;
+ private boolean delegPolicyState = false;
private int mySeqNumber;
private int peerSeqNumber;
@@ -299,6 +300,21 @@
return sequenceDetState || replayDetState;
}
+ /**
+ * Requests that the deleg policy be respected.
+ */
+ public final void requestDelegPolicy(boolean value) {
+ if (state == STATE_NEW && isInitiator())
+ delegPolicyState = value;
+ }
+
+ /**
+ * Is deleg policy respected?
+ */
+ public final boolean getDelegPolicyState() {
+ return delegPolicyState;
+ }
+
/*
* Anonymity is a little different in that after an application
* requests anonymity it will want to know whether the mechanism
@@ -422,6 +438,10 @@
integState = state;
}
+ final void setDelegPolicyState(boolean state) {
+ delegPolicyState = state;
+ }
+
/**
* Sets the channel bindings to be used during context
* establishment.
diff -r 365eb4449319 -r 4c792c19266e jdk/src/share/classes/sun/security/jgss/spi/GSSContextSpi.java
--- a/jdk/src/share/classes/sun/security/jgss/spi/GSSContextSpi.java Wed Nov 25 08:24:58 2009 -0800
+++ b/jdk/src/share/classes/sun/security/jgss/spi/GSSContextSpi.java Fri Nov 27 08:51:28 2009 +0800
@@ -124,6 +124,8 @@
public void requestInteg(boolean state) throws GSSException;
+ public void requestDelegPolicy(boolean state) throws GSSException;
+
public void setChannelBinding(ChannelBinding cb) throws GSSException;
public boolean getCredDelegState();
@@ -136,6 +138,8 @@
public boolean getAnonymityState();
+ public boolean getDelegPolicyState();
+
public boolean isTransferable() throws GSSException;
public boolean isProtReady();
diff -r 365eb4449319 -r 4c792c19266e jdk/src/share/classes/sun/security/jgss/spnego/SpNegoContext.java
--- a/jdk/src/share/classes/sun/security/jgss/spnego/SpNegoContext.java Wed Nov 25 08:24:58 2009 -0800
+++ b/jdk/src/share/classes/sun/security/jgss/spnego/SpNegoContext.java Fri Nov 27 08:51:28 2009 +0800
@@ -63,6 +63,7 @@
private boolean sequenceDetState = true;
private boolean confState = true;
private boolean integState = true;
+ private boolean delegPolicyState = false;
private GSSNameSpi peerName = null;
private GSSNameSpi myName = null;
@@ -154,6 +155,14 @@
}
/**
+ * Requests that deleg policy be respected.
+ */
+ public final void requestDelegPolicy(boolean value) throws GSSException {
+ if (state == STATE_NEW && isInitiator())
+ delegPolicyState = value;
+ }
+
+ /**
* Is integrity available?
*/
public final boolean getIntegState() {
@@ -161,6 +170,19 @@
}
/**
+ * Is deleg policy respected?
+ */
+ public final boolean getDelegPolicyState() {
+ if (isInitiator() && mechContext != null &&
+ mechContext instanceof ExtendedGSSContext &&
+ (state == STATE_IN_PROCESS || state == STATE_DONE)) {
+ return ((ExtendedGSSContext)mechContext).getDelegPolicyState();
+ } else {
+ return delegPolicyState;
+ }
+ }
+
+ /**
* Requests that credential delegation be done during context
* establishment.
*/
@@ -173,7 +195,7 @@
* Is credential delegation enabled?
*/
public final boolean getCredDelegState() {
- if (mechContext != null &&
+ if (isInitiator() && mechContext != null &&
(state == STATE_IN_PROCESS || state == STATE_DONE)) {
return mechContext.getCredDelegState();
} else {
@@ -201,30 +223,6 @@
return mutualAuthState;
}
- final void setCredDelegState(boolean state) {
- credDelegState = state;
- }
-
- final void setMutualAuthState(boolean state) {
- mutualAuthState = state;
- }
-
- final void setReplayDetState(boolean state) {
- replayDetState = state;
- }
-
- final void setSequenceDetState(boolean state) {
- sequenceDetState = state;
- }
-
- final void setConfState(boolean state) {
- confState = state;
- }
-
- final void setIntegState(boolean state) {
- integState = state;
- }
-
/**
* Returns the mechanism oid.
*
@@ -653,6 +651,10 @@
throw gssException;
}
+ if (state == STATE_DONE) {
+ // now set the context flags for acceptor
+ setContextFlags();
+ }
return retVal;
}
@@ -703,28 +705,31 @@
return out;
}
+ // Only called on acceptor side. On the initiator side, most flags
+ // are already set at request. For those that might get chanegd,
+ // state from mech below is used.
private void setContextFlags() {
if (mechContext != null) {
// default for cred delegation is false
if (mechContext.getCredDelegState()) {
- setCredDelegState(true);
+ credDelegState = true;
}
// default for the following are true
if (!mechContext.getMutualAuthState()) {
- setMutualAuthState(false);
+ mutualAuthState = false;
}
if (!mechContext.getReplayDetState()) {
- setReplayDetState(false);
+ replayDetState = false;
}
if (!mechContext.getSequenceDetState()) {
- setSequenceDetState(false);
+ sequenceDetState = false;
}
if (!mechContext.getIntegState()) {
- setIntegState(false);
+ integState = false;
}
if (!mechContext.getConfState()) {
- setConfState(false);
+ confState = false;
}
}
}
@@ -837,6 +842,10 @@
mechContext.requestMutualAuth(mutualAuthState);
mechContext.requestReplayDet(replayDetState);
mechContext.requestSequenceDet(sequenceDetState);
+ if (mechContext instanceof ExtendedGSSContext) {
+ ((ExtendedGSSContext)mechContext).requestDelegPolicy(
+ delegPolicyState);
+ }
}
// pass token
@@ -1202,5 +1211,5 @@
"inquireSecContext not supported by underlying mech.");
}
}
+}
-}
diff -r 365eb4449319 -r 4c792c19266e jdk/src/share/classes/sun/security/jgss/wrapper/NativeGSSContext.java
--- a/jdk/src/share/classes/sun/security/jgss/wrapper/NativeGSSContext.java Wed Nov 25 08:24:58 2009 -0800
+++ b/jdk/src/share/classes/sun/security/jgss/wrapper/NativeGSSContext.java Fri Nov 27 08:51:28 2009 +0800
@@ -549,6 +549,9 @@
public void requestInteg(boolean state) throws GSSException {
changeFlags(GSS_C_INTEG_FLAG, state);
}
+ public void requestDelegPolicy(boolean state) throws GSSException {
+ // Not supported, ignore
+ }
public void requestLifetime(int lifetime) throws GSSException {
if (isInitiator && pContext == 0) {
this.lifetime = lifetime;
@@ -590,6 +593,9 @@
public boolean getIntegState() {
return checkFlags(GSS_C_INTEG_FLAG);
}
+ public boolean getDelegPolicyState() {
+ return false;
+ }
public int getLifetime() {
return cStub.getContextTime(pContext);
}
diff -r 365eb4449319 -r 4c792c19266e jdk/src/share/classes/sun/security/krb5/Credentials.java
--- a/jdk/src/share/classes/sun/security/krb5/Credentials.java Wed Nov 25 08:24:58 2009 -0800
+++ b/jdk/src/share/classes/sun/security/krb5/Credentials.java Fri Nov 27 08:51:28 2009 +0800
@@ -234,7 +234,19 @@
* @return true if OK-AS_DELEGATE flag is set, otherwise, return false.
*/
public boolean checkDelegate() {
- return (flags.get(Krb5.TKT_OPTS_DELEGATE));
+ return flags.get(Krb5.TKT_OPTS_DELEGATE);
+ }
+
+ /**
+ * Reset TKT_OPTS_DELEGATE to false, called at credentials acquirement
+ * when one of the cross-realm TGTs does not have the OK-AS-DELEGATE
+ * flag set. This info must be preservable and restorable through
+ * the Krb5Util.credsToTicket/ticketToCreds() methods so that even if
+ * the service ticket is cached it still remembers the cross-realm
+ * authentication result.
+ */
+ public void resetDelegate() {
+ flags.set(Krb5.TKT_OPTS_DELEGATE, false);
}
public Credentials renew() throws KrbException, IOException {
diff -r 365eb4449319 -r 4c792c19266e jdk/src/share/classes/sun/security/krb5/internal/CredentialsUtil.java
--- a/jdk/src/share/classes/sun/security/krb5/internal/CredentialsUtil.java Wed Nov 25 08:24:58 2009 -0800
+++ b/jdk/src/share/classes/sun/security/krb5/internal/CredentialsUtil.java Fri Nov 27 08:51:28 2009 +0800
@@ -1,5 +1,5 @@
/*
- * Portions Copyright 2001-2004 Sun Microsystems, Inc. All Rights Reserved.
+ * Portions Copyright 2001-2009 Sun Microsystems, Inc. All Rights Reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@@ -117,6 +117,7 @@
// Get a list of realms to traverse
String[] realms = Realm.getRealmsList(localRealm, serviceRealm);
+ boolean okAsDelegate = true;
if (realms == null || realms.length == 0)
{
@@ -194,6 +195,15 @@
*/
newTgtRealm = newTgt.getServer().getInstanceComponent();
+ if (okAsDelegate && !newTgt.checkDelegate()) {
+ if (DEBUG)
+ {
+ System.out.println(">>> Credentials acquireServiceCreds: " +
+ "global OK-AS-DELEGATE turned off at " +
+ newTgt.getServer());
+ }
+ okAsDelegate = false;
+ }
if (DEBUG)
{
@@ -283,6 +293,9 @@
System.out.println(">>> Credentials acquireServiceCreds: returning creds:");
Credentials.printDebug(theCreds);
}
+ if (!okAsDelegate) {
+ theCreds.resetDelegate();
+ }
return theCreds;
}
throw new KrbApErrException(Krb5.KRB_AP_ERR_GEN_CRED,
diff -r 365eb4449319 -r 4c792c19266e jdk/test/sun/security/krb5/auto/Context.java
--- a/jdk/test/sun/security/krb5/auto/Context.java Wed Nov 25 08:24:58 2009 -0800
+++ b/jdk/test/sun/security/krb5/auto/Context.java Fri Nov 27 08:51:28 2009 +0800
@@ -72,7 +72,7 @@
public class Context {
private Subject s;
- private GSSContext x;
+ private ExtendedGSSContext x;
private boolean f; // context established?
private String name;
private GSSCredential cred; // see static method delegated().
@@ -147,8 +147,8 @@
@Override
public byte[] run(Context me, byte[] dummy) throws Exception {
GSSManager m = GSSManager.getInstance();
- me.x = m.createContext(
- target.indexOf('@') < 0 ?
+ me.x = (ExtendedGSSContext)m.createContext(
+ target.indexOf('@') < 0 ?
m.createName(target, null) :
m.createName(target, GSSName.NT_HOSTBASED_SERVICE),
mech,
@@ -170,7 +170,7 @@
@Override
public byte[] run(Context me, byte[] dummy) throws Exception {
GSSManager m = GSSManager.getInstance();
- me.x = m.createContext(m.createCredential(
+ me.x = (ExtendedGSSContext)m.createContext(m.createCredential(
null,
GSSCredential.INDEFINITE_LIFETIME,
mech,
@@ -193,7 +193,7 @@
*
* @return the GSSContext object
*/
- public GSSContext x() {
+ public ExtendedGSSContext x() {
return x;
}
@@ -255,6 +255,11 @@
if (x.getSequenceDetState()) {
sb.append("seq det, ");
}
+ if (x instanceof ExtendedGSSContext) {
+ if (((ExtendedGSSContext)x).getDelegPolicyState()) {
+ sb.append("deleg policy, ");
+ }
+ }
System.out.println("Context status of " + name + ": " + sb.toString());
System.out.println(x.getSrcName() + " -> " + x.getTargName());
} catch (Exception e) {
diff -r 365eb4449319 -r 4c792c19266e jdk/test/sun/security/krb5/auto/KDC.java
--- a/jdk/test/sun/security/krb5/auto/KDC.java Wed Nov 25 08:24:58 2009 -0800
+++ b/jdk/test/sun/security/krb5/auto/KDC.java Fri Nov 27 08:51:28 2009 +0800
@@ -63,6 +63,14 @@
* settings after calling a KDC method, call Config.refresh() to
* make sure your changes are reflected in the Config object.
*
+ * System properties recognized:
+ *