KdcRequest request = authContext.getRequest();
CipherTextHandler cipherTextHandler = authContext.getCipherTextHandler();
KerberosPrincipal serverPrincipal = request.getServerPrincipal();
EncryptionType encryptionType = authContext.getEncryptionType();
EncryptionKey serverKey = authContext.getServerEntry().getKeyMap().get( encryptionType );
KerberosPrincipal ticketPrincipal = request.getServerPrincipal();
EncTicketPartModifier newTicketBody = new EncTicketPartModifier();
KdcServer config = authContext.getConfig();
// The INITIAL flag indicates that a ticket was issued using the AS protocol.
newTicketBody.setFlag( TicketFlag.INITIAL );
// The PRE-AUTHENT flag indicates that the client used pre-authentication.
if ( authContext.isPreAuthenticated() )
{
newTicketBody.setFlag( TicketFlag.PRE_AUTHENT );
}
if ( request.getOption( KdcOptions.FORWARDABLE ) )
{
if ( !config.isForwardableAllowed() )
{
throw new KerberosException( ErrorType.KDC_ERR_POLICY );
}
newTicketBody.setFlag( TicketFlag.FORWARDABLE );
}
if ( request.getOption( KdcOptions.PROXIABLE ) )
{
if ( !config.isProxiableAllowed() )
{
throw new KerberosException( ErrorType.KDC_ERR_POLICY );
}
newTicketBody.setFlag( TicketFlag.PROXIABLE );
}
if ( request.getOption( KdcOptions.ALLOW_POSTDATE ) )
{
if ( !config.isPostdatedAllowed() )
{
throw new KerberosException( ErrorType.KDC_ERR_POLICY );
}
newTicketBody.setFlag( TicketFlag.MAY_POSTDATE );
}
if ( request.getOption( KdcOptions.RENEW ) || request.getOption( KdcOptions.VALIDATE )
|| request.getOption( KdcOptions.PROXY ) || request.getOption( KdcOptions.FORWARDED )
|| request.getOption( KdcOptions.ENC_TKT_IN_SKEY ) )
{
throw new KerberosException( ErrorType.KDC_ERR_BADOPTION );
}
EncryptionKey sessionKey = RandomKeyFactory.getRandomKey( authContext.getEncryptionType() );
newTicketBody.setSessionKey( sessionKey );
newTicketBody.setClientPrincipal( request.getClientPrincipal() );
newTicketBody.setTransitedEncoding( new TransitedEncoding() );