}
private static void extractPassword( ChangePasswordContext changepwContext ) throws KerberosException, IOException
{
ChangePasswordRequest request = ( ChangePasswordRequest ) changepwContext.getRequest();
Authenticator authenticator = changepwContext.getAuthenticator();
CipherTextHandler cipherTextHandler = changepwContext.getCipherTextHandler();
// TODO - check ticket is for service authorized to change passwords
// ticket.getServerPrincipal().getName().equals(config.getChangepwPrincipal().getName()));
// TODO - check client principal in ticket is authorized to change password
// get the subsession key from the Authenticator
EncryptionKey subSessionKey = authenticator.getSubKey();
// decrypt the request's private message with the subsession key
EncryptedData encReqPrivPart = request.getPrivateMessage().getEncryptedPart();
EncKrbPrivPart privatePart;
try
{
privatePart = ( EncKrbPrivPart ) cipherTextHandler.unseal( EncKrbPrivPart.class, subSessionKey,
encReqPrivPart, KeyUsage.KRB_PRIV_ENC_PART_CHOSEN_KEY );
}
catch ( KerberosException ke )
{
throw new ChangePasswordException( ErrorType.KRB5_KPASSWD_SOFTERROR, ke );
}
ChangePasswordData passwordData = null;
if ( request.getVersionNumber() == ( short ) 1 )
{
// Use protocol version 0x0001, the legacy Kerberos change password protocol
ChangePasswordDataModifier modifier = new ChangePasswordDataModifier();
modifier.setNewPassword( privatePart.getUserData() );
passwordData = modifier.getChangePasswdData();