context = mgr.createContext(creds);
// Send the matching mechanism back to the client
Buffer b = session.createBuffer(SshConstants.Message.SSH_MSG_USERAUTH_INFO_REQUEST, 0);
byte[] out = oid.getDER();
b.putBytes(out);
session.writePacket(b);
return null;
}
}
// No matching mechanism found
return Boolean.FALSE;
}
else
{
SshConstants.Message msg = buffer.getCommand();
if (!(msg == SshConstants.Message.SSH_MSG_USERAUTH_INFO_RESPONSE ||
msg == SshConstants.Message.SSH_MSG_USERAUTH_GSSAPI_MIC && context.isEstablished())) {
throw new SshException(SshConstants.SSH2_DISCONNECT_PROTOCOL_ERROR,
"Packet not supported by user authentication method");
}
log.debug("In krb5.next: msg = " + msg);
// If the context is established, this must be a MIC message
if (context.isEstablished()) {
if (msg != SshConstants.Message.SSH_MSG_USERAUTH_GSSAPI_MIC) {
return Boolean.FALSE;
}
// Make the MIC message so the token can be verified
Buffer msgbuf = new Buffer();
msgbuf.putString(session.getSessionId());
msgbuf.putByte(SshConstants.Message.SSH_MSG_USERAUTH_REQUEST.toByte());
msgbuf.putString(username.getBytes("UTF-8"));
msgbuf.putString(service);
msgbuf.putString("gssapi-with-mic");
byte[] msgbytes = msgbuf.getCompactData();
byte[] inmic = buffer.getBytes();
try {
context.verifyMIC(inmic, 0, inmic.length, msgbytes, 0, msgbytes.length, new MessageProp(false));
log.debug("MIC verified");
return Boolean.TRUE;
} catch (GSSException e) {
log.info("GSS verification error: {}", e.toString());
return Boolean.FALSE;
}
} else {
// Not established - new token to process
byte[] tok = buffer.getBytes();
byte[] out = context.acceptSecContext(tok, 0, tok.length);
boolean established = context.isEstablished();
// Validate identity if context is now established
if (established && identity == null) {
identity = context.getSrcName().toString();
log.info("GSS identity is {}", identity);
if (!auth.validateIdentity(session, identity)) {
return Boolean.FALSE;
}
}
// Send return token if necessary
if (out != null && out.length > 0) {
Buffer b = session.createBuffer(SshConstants.Message.SSH_MSG_USERAUTH_INFO_RESPONSE, 0);
b.putBytes(out);
session.writePacket(b);
return null;
} else {
return established;
}