Examples of org.apache.directory.shared.kerberos.messages.Authenticator

Package org.apache.directory.shared.kerberos.messages

Examples of org.apache.directory.shared.kerberos.messages.Authenticator

org.apache.directory.shared.kerberos.messages.Authenticator

A structure to hold the authenticator data. It will store the object described by the ASN.1 grammar :

 Authenticator   ::= [APPLICATION 2] SEQUENCE  { authenticator-vno       [0] INTEGER (5), crealm                  [1] Realm, cname                   [2] , cksum                   [3]  OPTIONAL, cusec                   [4] Microseconds, ctime                   [5] KerberosTime, subkey                  [6]  OPTIONAL, seq-number              [7] UInt32 OPTIONAL, authorization-data      [8]  OPTIONAL }

@author Apache Directory Project

        {
            throw new KerberosException( ErrorType.KRB_AP_ERR_BAD_INTEGRITY, de );
        }


        // get the decoded Authenticator
        Authenticator authenticator = ( ( AuthenticatorContainer ) authenticatorContainer ).getAuthenticator();


        return authenticator;
    }

View Full Code Here

        catch ( DecoderException de )
        {
            fail( de.getMessage() );
        }


        Authenticator authenticator = ( ( AuthenticatorContainer ) authenticatorContainer ).getAuthenticator();


        // Check the encoding
        int length = authenticator.computeLength();


        // Check the length
        assertEquals( 0x95, length );


        // Check the encoding
        ByteBuffer encodedPdu = ByteBuffer.allocate( length );


        try
        {
            encodedPdu = authenticator.encode( encodedPdu );


            // Check the length
            assertEquals( 0x95, encodedPdu.limit() );
            assertEquals( decodedPdu, Strings.dumpBytes( encodedPdu.array() ) );
        }

View Full Code Here

     * @throws KerberosException
     */
    protected EncryptedData getAuthenticator( KerberosPrincipal clientPrincipal, KdcReqBody requestBody,
        ChecksumType checksumType ) throws EncoderException, KerberosException
    {
        Authenticator authenticator = new Authenticator();


        clientMicroSeconds = random.nextInt( 999999 );


        authenticator.setVersionNumber( 5 );
        authenticator.setCName( new PrincipalName( clientPrincipal.getName(), clientPrincipal.getNameType() ) );
        authenticator.setCRealm( clientPrincipal.getRealm() );
        authenticator.setCTime( now );
        authenticator.setCusec( clientMicroSeconds );
        authenticator.setSubKey( subSessionKey );
        authenticator.setSeqNumber( sequenceNumber );


        Checksum checksum = getBodyChecksum( requestBody, checksumType );
        authenticator.setCksum( checksum );


        EncryptedData encryptedAuthenticator = lockBox.seal( sessionKey, authenticator,
            KeyUsage.TGS_REQ_PA_TGS_REQ_PADATA_AP_REQ_TGS_SESS_KEY );


        return encryptedAuthenticator;

View Full Code Here

        ReplayCache replayCache = tgsContext.getConfig().getReplayCache();
        boolean emptyAddressesAllowed = tgsContext.getConfig().isEmptyAddressesAllowed();
        InetAddress clientAddress = tgsContext.getClientAddress();
        CipherTextHandler cipherTextHandler = tgsContext.getCipherTextHandler();


        Authenticator authenticator = verifyAuthHeader( authHeader, tgt, serverKey, clockSkew, replayCache,
            emptyAddressesAllowed, clientAddress, cipherTextHandler,
            KeyUsage.TGS_REQ_PA_TGS_REQ_PADATA_AP_REQ_TGS_SESS_KEY, isValidate );


        tgsContext.setAuthenticator( authenticator );
    }

View Full Code Here

    private static void generateTicket( TicketGrantingContext tgsContext ) throws KerberosException,
        InvalidTicketException
    {
        KdcReq request = tgsContext.getRequest();
        Ticket tgt = tgsContext.getTgt();
        Authenticator authenticator = tgsContext.getAuthenticator();
        CipherTextHandler cipherTextHandler = tgsContext.getCipherTextHandler();
        KerberosPrincipal ticketPrincipal = KerberosUtils.getKerberosPrincipal(
            request.getKdcReqBody().getSName(), request.getKdcReqBody().getRealm() );


        EncryptionType encryptionType = tgsContext.getEncryptionType();
        EncryptionKey serverKey = tgsContext.getRequestPrincipalEntry().getKeyMap().get( encryptionType );


        KdcServer config = tgsContext.getConfig();


        EncTicketPart newTicketPart = new EncTicketPart();


        newTicketPart.setClientAddresses( tgt.getEncTicketPart().getClientAddresses() );


        processFlags( config, request, tgt, newTicketPart );


        EncryptionKey sessionKey = RandomKeyFactory.getRandomKey( tgsContext.getEncryptionType() );
        newTicketPart.setKey( sessionKey );


        newTicketPart.setCName( tgt.getEncTicketPart().getCName() );
        newTicketPart.setCRealm( tgt.getEncTicketPart().getCRealm() );


        if ( request.getKdcReqBody().getEncAuthorizationData() != null )
        {
            byte[] authorizationData = cipherTextHandler.decrypt( authenticator.getSubKey(), request.getKdcReqBody()
                .getEncAuthorizationData(), KeyUsage.TGS_REQ_KDC_REQ_BODY_AUTHZ_DATA_ENC_WITH_TGS_SESS_KEY );
            AuthorizationData authData = KerberosDecoder.decodeAuthorizationData( authorizationData );
            authData.addEntry( tgt.getEncTicketPart().getAuthorizationData().getCurrentAD() );
            newTicketPart.setAuthorizationData( authData );
        }

View Full Code Here

        }


        EncTgsRepPart encTgsRepPart = new EncTgsRepPart();
        encTgsRepPart.setEncKdcRepPart( encKdcRepPart );


        Authenticator authenticator = tgsContext.getAuthenticator();


        EncryptedData encryptedData;


        if ( authenticator.getSubKey() != null )
        {
            encryptedData = cipherTextHandler.seal( authenticator.getSubKey(), encTgsRepPart,
                KeyUsage.TGS_REP_ENC_PART_TGS_AUTHNT_SUB_KEY );
        }
        else
        {
            encryptedData = cipherTextHandler.seal( tgt.getEncTicketPart().getKey(), encTgsRepPart,

View Full Code Here

        ticket.setEncTicketPart( encPart );


        byte[] authenticatorData = lockBox.decrypt( ticket.getEncTicketPart().getKey(), authHeader.getAuthenticator(),
            authenticatorKeyUsage );


        Authenticator authenticator = KerberosDecoder.decodeAuthenticator( authenticatorData );


        if ( !authenticator.getCName().getNameString().equals( ticket.getEncTicketPart().getCName().getNameString() ) )
        {
            throw new KerberosException( ErrorType.KRB_AP_ERR_BADMATCH );
        }


        if ( ticket.getEncTicketPart().getClientAddresses() != null )
        {
            if ( !ticket.getEncTicketPart().getClientAddresses().contains( new HostAddress( clientAddress ) ) )
            {
                throw new KerberosException( ErrorType.KRB_AP_ERR_BADADDR );
            }
        }
        else
        {
            if ( !emptyAddressesAllowed )
            {
                throw new KerberosException( ErrorType.KRB_AP_ERR_BADADDR );
            }
        }


        KerberosPrincipal serverPrincipal = KerberosUtils.getKerberosPrincipal( ticket.getSName(), ticket.getRealm() );
        KerberosPrincipal clientPrincipal = KerberosUtils.getKerberosPrincipal( authenticator.getCName(),
            authenticator.getCRealm() );
        KerberosTime clientTime = authenticator.getCtime();
        int clientMicroSeconds = authenticator.getCusec();


        if ( replayCache != null )
        {
            if ( replayCache.isReplay( serverPrincipal, clientPrincipal, clientTime, clientMicroSeconds ) )
            {
                throw new KerberosException( ErrorType.KRB_AP_ERR_REPEAT );
            }


            replayCache.save( serverPrincipal, clientPrincipal, clientTime, clientMicroSeconds );
        }


        if ( !authenticator.getCtime().isInClockSkew( clockSkew ) )
        {
            throw new KerberosException( ErrorType.KRB_AP_ERR_SKEW );
        }


        /*

View Full Code Here

    
    
    private static void processPasswordChange( ChangePasswordContext changepwContext ) throws KerberosException
    {
        PrincipalStore store = changepwContext.getStore();
        Authenticator authenticator = changepwContext.getAuthenticator();
        String newPassword = changepwContext.getPassword();
        KerberosPrincipal clientPrincipal = KerberosUtils.getKerberosPrincipal( 
            authenticator.getCName(),
            authenticator.getCRealm() );


        // usec and seq-number must be present per MS but aren't in legacy kpasswd
        // seq-number must have same value as authenticator
        // ignore r-address

View Full Code Here

        ReplayCache replayCache = changepwContext.getConfig().getReplayCache();
        boolean emptyAddressesAllowed = changepwContext.getConfig().isEmptyAddressesAllowed();
        InetAddress clientAddress = changepwContext.getClientAddress();
        CipherTextHandler cipherTextHandler = changepwContext.getCipherTextHandler();


        Authenticator authenticator = KerberosUtils.verifyAuthHeader( authHeader, ticket, serverKey, clockSkew, replayCache,
            emptyAddressesAllowed, clientAddress, cipherTextHandler, KeyUsage.AP_REQ_AUTHNT_SESS_KEY, false );


        ChangePasswordRequest request = ( ChangePasswordRequest ) changepwContext.getRequest();


        if ( request.getVersionNumber() == 1 && !ticket.getEncTicketPart().getFlags().isInitial() )

View Full Code Here

    
    
    private static void extractPassword( ChangePasswordContext changepwContext ) throws KerberosException, IOException
    {
        ChangePasswordRequest request = ( ChangePasswordRequest ) changepwContext.getRequest();
        Authenticator authenticator = changepwContext.getAuthenticator();
        CipherTextHandler cipherTextHandler = changepwContext.getCipherTextHandler();


        // TODO - check ticket is for service authorized to change passwords
        // ticket.getServerPrincipal().getName().equals(config.getChangepwPrincipal().getName()));


        // TODO - check client principal in ticket is authorized to change password


        // get the subsession key from the Authenticator
        EncryptionKey subSessionKey = authenticator.getSubKey();


        // decrypt the request's private message with the subsession key
        EncryptedData encReqPrivPart = request.getPrivateMessage().getEncryptedPart();


        EncKrbPrivPart privatePart;

View Full Code Here

0 1 2 3 4 5

TOP

Related Classes of org.apache.directory.shared.kerberos.messages.Authenticator

org.apache.directory.kerberos.client.KdcConnection

org.apache.directory.kerberos.client.KpasswdDecode

org.apache.directory.server.changepw.protocol.ChangepwProtocolHandlerTest

org.apache.directory.server.changepw.service.ChangePasswordService

org.apache.directory.server.changepw.service.CheckPasswordPolicy

org.apache.directory.server.kerberos.changepwd.service.ChangePasswordService

org.apache.directory.server.kerberos.kdc.ticketgrant.TicketGrantingService

org.apache.directory.server.kerberos.protocol.AbstractTicketGrantingServiceTest

org.apache.directory.server.kerberos.protocol.codec.KerberosDecoder

org.apache.directory.server.kerberos.protocol.KerberosDecoder

All source code are property of their respective owners. Java is a trademark of Sun Microsystems, Inc and owned by ORACLE Inc. Contact coftware#gmail.com.