if ( request.getOption( KdcOptions.FORWARDABLE ) )
{
if ( !config.isForwardableAllowed() )
{
throw new KerberosException( ErrorType.KDC_ERR_POLICY );
}
if ( !tgt.getEncTicketPart().getFlags().isForwardable() )
{
throw new KerberosException( ErrorType.KDC_ERR_BADOPTION );
}
newTicketBody.setFlag( TicketFlag.FORWARDABLE );
}
if ( request.getOption( KdcOptions.FORWARDED ) )
{
if ( !config.isForwardableAllowed() )
{
throw new KerberosException( ErrorType.KDC_ERR_POLICY );
}
if ( !tgt.getEncTicketPart().getFlags().isForwardable() )
{
throw new KerberosException( ErrorType.KDC_ERR_BADOPTION );
}
if ( request.getAddresses() != null && request.getAddresses().getAddresses() != null
&& request.getAddresses().getAddresses().length > 0 )
{
newTicketBody.setClientAddresses( request.getAddresses() );
}
else
{
if ( !config.isEmptyAddressesAllowed() )
{
throw new KerberosException( ErrorType.KDC_ERR_POLICY );
}
}
newTicketBody.setFlag( TicketFlag.FORWARDED );
}
if ( tgt.getEncTicketPart().getFlags().isForwarded() )
{
newTicketBody.setFlag( TicketFlag.FORWARDED );
}
if ( request.getOption( KdcOptions.PROXIABLE ) )
{
if ( !config.isProxiableAllowed() )
{
throw new KerberosException( ErrorType.KDC_ERR_POLICY );
}
if ( !tgt.getEncTicketPart().getFlags().isProxiable() )
{
throw new KerberosException( ErrorType.KDC_ERR_BADOPTION );
}
newTicketBody.setFlag( TicketFlag.PROXIABLE );
}
if ( request.getOption( KdcOptions.PROXY ) )
{
if ( !config.isProxiableAllowed() )
{
throw new KerberosException( ErrorType.KDC_ERR_POLICY );
}
if ( !tgt.getEncTicketPart().getFlags().isProxiable() )
{
throw new KerberosException( ErrorType.KDC_ERR_BADOPTION );
}
if ( request.getAddresses() != null && request.getAddresses().getAddresses() != null
&& request.getAddresses().getAddresses().length > 0 )
{
newTicketBody.setClientAddresses( request.getAddresses() );
}
else
{
if ( !config.isEmptyAddressesAllowed() )
{
throw new KerberosException( ErrorType.KDC_ERR_POLICY );
}
}
newTicketBody.setFlag( TicketFlag.PROXY );
}
if ( request.getOption( KdcOptions.ALLOW_POSTDATE ) )
{
if ( !config.isPostdatedAllowed() )
{
throw new KerberosException( ErrorType.KDC_ERR_POLICY );
}
if ( !tgt.getEncTicketPart().getFlags().isMayPosdate() )
{
throw new KerberosException( ErrorType.KDC_ERR_BADOPTION );
}
newTicketBody.setFlag( TicketFlag.MAY_POSTDATE );
}
/*
* "Otherwise, if the TGT has the MAY-POSTDATE flag set, then the resulting
* ticket will be postdated, and the requested starttime is checked against
* the policy of the local realm. If acceptable, the ticket's starttime is
* set as requested, and the INVALID flag is set. The postdated ticket MUST
* be validated before use by presenting it to the KDC after the starttime
* has been reached. However, in no case may the starttime, endtime, or
* renew-till time of a newly-issued postdated ticket extend beyond the
* renew-till time of the TGT."
*/
if ( request.getOption( KdcOptions.POSTDATED ) )
{
if ( !config.isPostdatedAllowed() )
{
throw new KerberosException( ErrorType.KDC_ERR_POLICY );
}
if ( !tgt.getEncTicketPart().getFlags().isMayPosdate() )
{
throw new KerberosException( ErrorType.KDC_ERR_BADOPTION );
}
newTicketBody.setFlag( TicketFlag.POSTDATED );
newTicketBody.setFlag( TicketFlag.INVALID );
newTicketBody.setStartTime( request.getFrom() );
}
if ( request.getOption( KdcOptions.VALIDATE ) )
{
if ( !config.isPostdatedAllowed() )
{
throw new KerberosException( ErrorType.KDC_ERR_POLICY );
}
if ( !tgt.getEncTicketPart().getFlags().isInvalid() )
{
throw new KerberosException( ErrorType.KDC_ERR_POLICY );
}
KerberosTime startTime = ( tgt.getEncTicketPart().getStartTime() != null ) ?
tgt.getEncTicketPart().getStartTime() :
tgt.getEncTicketPart().getAuthTime();
if ( startTime.greaterThan( new KerberosTime() ) )
{
throw new KerberosException( ErrorType.KRB_AP_ERR_TKT_NYV );
}
echoTicket( newTicketBody, tgt );
newTicketBody.clearFlag( TicketFlag.INVALID );
}
if ( request.getOption( KdcOptions.RESERVED ) )
{
throw new KerberosException( ErrorType.KDC_ERR_BADOPTION );
}
}