private static void processTimes( KerberosConfig config, KdcReq request, EncTicketPart newTicketPart,
Ticket tgt ) throws KerberosException
{
KerberosTime now = new KerberosTime();
newTicketPart.setAuthTime( tgt.getEncTicketPart().getAuthTime() );
KerberosTime startTime = request.getKdcReqBody().getFrom();
/*
* "If the requested starttime is absent, indicates a time in the past,
* or is within the window of acceptable clock skew for the KDC and the
* POSTDATE option has not been specified, then the starttime of the
* ticket is set to the authentication server's current time."
*/
if ( startTime == null || startTime.lessThan( now ) || startTime.isInClockSkew( config.getAllowableClockSkew() )
&& !request.getKdcReqBody().getKdcOptions().get( KdcOptions.POSTDATED ) )
{
startTime = now;
}
/*
* "If it indicates a time in the future beyond the acceptable clock skew,
* but the POSTDATED option has not been specified or the MAY-POSTDATE flag
* is not set in the TGT, then the error KDC_ERR_CANNOT_POSTDATE is
* returned."
*/
if ( startTime != null
&& startTime.greaterThan( now )
&& !startTime.isInClockSkew( config.getAllowableClockSkew() )
&& ( !request.getKdcReqBody().getKdcOptions().get( KdcOptions.POSTDATED ) || !tgt.getEncTicketPart()
.getFlags().isMayPosdate() ) )
{
throw new KerberosException( ErrorType.KDC_ERR_CANNOT_POSTDATE );
}
KerberosTime renewalTime = null;
KerberosTime kerberosEndTime = null;
if ( request.getKdcReqBody().getKdcOptions().get( KdcOptions.RENEW ) )
{
if ( !config.isRenewableAllowed() )
{
throw new KerberosException( ErrorType.KDC_ERR_POLICY );
}
if ( !tgt.getEncTicketPart().getFlags().isRenewable() )
{
throw new KerberosException( ErrorType.KDC_ERR_BADOPTION );
}
if ( tgt.getEncTicketPart().getRenewTill().lessThan( now ) )
{
throw new KerberosException( ErrorType.KRB_AP_ERR_TKT_EXPIRED );
}
echoTicket( newTicketPart, tgt );
newTicketPart.setStartTime( now );
KerberosTime tgtStartTime = ( tgt.getEncTicketPart().getStartTime() != null ) ?
tgt.getEncTicketPart().getStartTime() :
tgt.getEncTicketPart().getAuthTime();
long oldLife = tgt.getEncTicketPart().getEndTime().getTime() - tgtStartTime.getTime();
kerberosEndTime = new KerberosTime( Math.min( tgt.getEncTicketPart().getRenewTill().getTime(),
now.getTime() + oldLife ) );
newTicketPart.setEndTime( kerberosEndTime );
}
else
{
if ( newTicketPart.getStartTime() == null )
{
newTicketPart.setStartTime( now );
}
KerberosTime till;
if ( request.getKdcReqBody().getTill().isZero() )
{
till = KerberosTime.INFINITY;
}
else
{
till = request.getKdcReqBody().getTill();
}
/*
* The end time is the minimum of (a) the requested till time or (b)
* the start time plus maximum lifetime as configured in policy or (c)
* the end time of the TGT.
*/
List<KerberosTime> minimizer = new ArrayList<KerberosTime>();
minimizer.add( till );
minimizer.add( new KerberosTime( startTime.getTime() + config.getMaximumTicketLifetime() ) );
minimizer.add( tgt.getEncTicketPart().getEndTime() );
kerberosEndTime = Collections.min( minimizer );
newTicketPart.setEndTime( kerberosEndTime );
if ( request.getKdcReqBody().getKdcOptions().get( KdcOptions.RENEWABLE_OK )
&& kerberosEndTime.lessThan( request.getKdcReqBody().getTill() )
&& tgt.getEncTicketPart().getFlags().isRenewable() )
{
if ( !config.isRenewableAllowed() )
{
throw new KerberosException( ErrorType.KDC_ERR_POLICY );
}
// We set the RENEWABLE option for later processing.
request.getKdcReqBody().getKdcOptions().set( KdcOptions.RENEWABLE );
long rtime = Math.min( request.getKdcReqBody().getTill().getTime(), tgt.getEncTicketPart()
.getRenewTill().getTime() );
renewalTime = new KerberosTime( rtime );
}
}
if ( renewalTime == null )
{
renewalTime = request.getKdcReqBody().getRTime();
}
KerberosTime rtime;
if ( renewalTime != null && renewalTime.isZero() )
{
rtime = KerberosTime.INFINITY;
}
else
{
rtime = renewalTime;
}
if ( request.getKdcReqBody().getKdcOptions().get( KdcOptions.RENEWABLE )
&& tgt.getEncTicketPart().getFlags().isRenewable() )
{
if ( !config.isRenewableAllowed() )
{
throw new KerberosException( ErrorType.KDC_ERR_POLICY );
}
newTicketPart.setFlag( TicketFlag.RENEWABLE );
/*
* The renew-till time is the minimum of (a) the requested renew-till
* time or (b) the start time plus maximum renewable lifetime as
* configured in policy or (c) the renew-till time of the TGT.
*/
List<KerberosTime> minimizer = new ArrayList<KerberosTime>();
/*
* 'rtime' KerberosTime is OPTIONAL
*/
if ( rtime != null )
{
minimizer.add( rtime );
}
minimizer.add( new KerberosTime( startTime.getTime() + config.getMaximumRenewableLifetime() ) );
minimizer.add( tgt.getEncTicketPart().getRenewTill() );
newTicketPart.setRenewTill( Collections.min( minimizer ) );
}
/*