* determined by the requirements of the constraints.
*/
List getConfigs() throws UnsupportedConstraintException {
if (errorCode != NO_ERROR) {
throw new UnsupportedConstraintException(
detailedExceptionMsg);
}
KerberosTicket[] tickets =
(KerberosTicket[]) AccessController.doPrivileged(
new PrivilegedAction() {
public Object run() {
return getTickets();
}
});
ArrayList configList = new ArrayList(configs.length);
/* This illustrates how a detailed failure msg is derived:
*
* |<-- stepsFromSuccess -->|
*
* TGT.forwardable
* TGT.yes
* perm.yes TGT.unforwardable
* TGT.no
* deleg.yes
* perm.no
*
*-------------------------------------------------------
*
* TGT.yes
* perm.yes
* TGT.no
* deleg.no
* perm.no
*
*/
int delegYesStepsFromSuccess = 3;
KerberosPrincipal delegYesCp = null;
int delegNoStepsFromSuccess = 2;
KerberosPrincipal delegNoCp = null;
HashMap hasPermMap = new HashMap();
for (int i = 0; i < configs.length; i++) {
AuthenticationPermission perm = getAuthenticationPermission(
configs[i].clientPrincipal, configs[i].deleg);
Boolean hasPerm = (Boolean) hasPermMap.get(perm);
if (hasPerm == null) {
try {
KerberosUtil.checkAuthPermission(perm);
hasPermMap.put(perm, Boolean.TRUE); // check succeed
} catch (SecurityException e) {
hasPermMap.put(perm, Boolean.FALSE); // check failed
continue;
}
} else if (hasPerm == Boolean.FALSE) {
continue;
} // else: permission check has been done and succeeded
if (configs[i].deleg) {
if (delegYesStepsFromSuccess > 2) {
delegYesStepsFromSuccess = 2; // record the 1st
delegYesCp = configs[i].clientPrincipal;
}
KerberosTicket t = findTicket(
tickets, configs[i].clientPrincipal);
if (t != null) {
if (delegYesStepsFromSuccess > 1) {
delegYesStepsFromSuccess = 1; // record the 1st
delegYesCp = configs[i].clientPrincipal;
}
if (t.isForwardable())
configList.add(configs[i]);
}
} else {
if (delegNoStepsFromSuccess > 1) {
delegNoStepsFromSuccess = 1; // record the 1st
delegNoCp = configs[i].clientPrincipal;
}
if (findTicket(tickets, configs[i].clientPrincipal) !=
null)
{
configList.add(configs[i]);
}
}
}
if (configList.size() == 0) { // no valid config found
if (delegNoStepsFromSuccess < delegYesStepsFromSuccess) {
switch (delegNoStepsFromSuccess) {
case 1:
throw new UnsupportedConstraintException(
"JAAS login has not been done properly, the " +
"subject associated with the current " +
"AccessControlContext does not contain a valid " +
"TGT for " + delegNoCp.getName());
case 2:
throw new SecurityException(
"Caller does not have any of the following " +
"acceptable permissions: " +
hasPermMap.keySet());
default:
throw new AssertionError("should not reach here");
}
} else {
switch (delegYesStepsFromSuccess) {
case 1:
throw new UnsupportedConstraintException(
"JAAS login has not been done properly, the " +
"subject associated with the current " +
"AccessControlContext contains a valid TGT for " +
delegYesCp.getName() + ", but the TGT is not " +
"forwardable.");
case 2:
throw new UnsupportedConstraintException(
"JAAS login has not been done properly, the " +
"subject associated with the current " +
"AccessControlContext does not contain a valid " +
"TGT for " + delegYesCp.getName());
default: