PrincipalName serverPrincipal = request.getKdcReqBody().getSName();
LOG_KRB.debug( "--> Generating ticket for {}", serverPrincipal );
EncryptionType encryptionType = authContext.getEncryptionType();
EncryptionKey serverKey = authContext.getServerEntry().getKeyMap().get( encryptionType );
PrincipalName ticketPrincipal = request.getKdcReqBody().getSName();
EncTicketPart encTicketPart = new EncTicketPart();
KerberosConfig config = authContext.getConfig();
// The INITIAL flag indicates that a ticket was issued using the AS protocol.
TicketFlags ticketFlags = new TicketFlags();
encTicketPart.setFlags( ticketFlags );
ticketFlags.setFlag( TicketFlag.INITIAL );
// The PRE-AUTHENT flag indicates that the client used pre-authentication.
if ( authContext.isPreAuthenticated() )
{
ticketFlags.setFlag( TicketFlag.PRE_AUTHENT );
}
if ( request.getKdcReqBody().getKdcOptions().get( KdcOptions.FORWARDABLE ) )
{
if ( !config.isForwardableAllowed() )
{
LOG_KRB.error( "Ticket cannot be generated, because Forwadable is not allowed" );
throw new KerberosException( ErrorType.KDC_ERR_POLICY );
}
ticketFlags.setFlag( TicketFlag.FORWARDABLE );
}
if ( request.getKdcReqBody().getKdcOptions().get( KdcOptions.PROXIABLE ) )
{
if ( !config.isProxiableAllowed() )
{
LOG_KRB.error( "Ticket cannot be generated, because proxyiable is not allowed" );
throw new KerberosException( ErrorType.KDC_ERR_POLICY );
}
ticketFlags.setFlag( TicketFlag.PROXIABLE );
}
if ( request.getKdcReqBody().getKdcOptions().get( KdcOptions.ALLOW_POSTDATE ) )
{
if ( !config.isPostdatedAllowed() )
{
LOG_KRB.error( "Ticket cannot be generated, because Posdate is not allowed" );
throw new KerberosException( ErrorType.KDC_ERR_POLICY );
}
ticketFlags.setFlag( TicketFlag.MAY_POSTDATE );
}
KdcOptions kdcOptions = request.getKdcReqBody().getKdcOptions();
if ( kdcOptions.get( KdcOptions.RENEW )
|| kdcOptions.get( KdcOptions.VALIDATE )
|| kdcOptions.get( KdcOptions.PROXY )
|| kdcOptions.get( KdcOptions.FORWARDED )
|| kdcOptions.get( KdcOptions.ENC_TKT_IN_SKEY ) )
{
String msg = "";
if ( kdcOptions.get( KdcOptions.RENEW ) )
{
msg = "Ticket cannot be generated, as it's a renew";
}
if ( kdcOptions.get( KdcOptions.VALIDATE ) )
{
msg = "Ticket cannot be generated, as it's a validate";
}
if ( kdcOptions.get( KdcOptions.PROXY ) )
{
msg = "Ticket cannot be generated, as it's a proxy";
}
if ( kdcOptions.get( KdcOptions.FORWARDED ) )
{
msg = "Ticket cannot be generated, as it's forwarded";
}
if ( kdcOptions.get( KdcOptions.ENC_TKT_IN_SKEY ) )
{
msg = "Ticket cannot be generated, as it's a user-to-user ";
}
if ( LOG_KRB.isDebugEnabled() )
{
LOG_KRB.debug( msg );
}
throw new KerberosException( ErrorType.KDC_ERR_BADOPTION, msg );
}
EncryptionKey sessionKey = RandomKeyFactory.getRandomKey( authContext.getEncryptionType() );
encTicketPart.setKey( sessionKey );
encTicketPart.setCName( request.getKdcReqBody().getCName() );
encTicketPart.setCRealm( request.getKdcReqBody().getRealm() );
encTicketPart.setTransited( new TransitedEncoding() );