Examples of org.ietf.jgss.GSSContext

org.ietf.jgss.GSSContext
te a context using default credentials // and the implementation specific default mechanism GSSManager manager ... GSSName targetName ... GSSContext context = manager.createContext(targetName, null, null, GSSContext.INDEFINITE_LIFETIME); // set desired context options prior to context establishment context.requestConf(true); context.requestMutualAuth(true); context.requestReplayDet(true); context.requestSequenceDet(true); // establish a context between peers byte []inToken = new byte[0]; // Loop while there still is a token to be processed while (!context.isEstablished()) { byte[] outToken = context.initSecContext(inToken, 0, inToken.length); // send the output token if generated if (outToken != null) sendToken(outToken); if (!context.isEstablished()) { inToken = readToken(); } // display context information System.out.println("Remaining lifetime in seconds = " + context.getLifetime()); System.out.println("Context mechanism = " + context.getMech()); System.out.println("Initiator = " + context.getSrcName()); System.out.println("Acceptor = " + context.getTargName()); if (context.getConfState()) System.out.println("Confidentiality (i.e., privacy) is available"); if (context.getIntegState()) System.out.println("Integrity is available"); // perform wrap on an application supplied message, appMsg, // using QOP = 0, and requesting privacy service byte [] appMsg ... MessageProp mProp = new MessageProp(0, true); byte []tok = context.wrap(appMsg, 0, appMsg.length, mProp); sendToken(tok); // release the local-end of the context context.dispose(); @author Mayank Upadhyay @version 1.10, 11/17/05 @since 1.4

        try {
            GSSManager manager = GSSManager.getInstance();
            Oid krb5Oid = new Oid("1.3.6.1.5.5.2");
            GSSName gssName = manager.createName(targetName, GSSName.NT_USER_NAME);
            GSSCredential serverCreds = manager.createCredential(gssName, GSSCredential.INDEFINITE_LIFETIME, krb5Oid, GSSCredential.ACCEPT_ONLY);
            GSSContext gContext = manager.createContext(serverCreds);
            if (gContext == null) {
                log.debug("Failed to create a GSSContext");
            } else {
                while (!gContext.isEstablished()) {
                    token = gContext.acceptSecContext(token, 0, token.length);
                }
                if (gContext.isEstablished()) {
                    loginSucceeded = true;
                    srcName = gContext.getSrcName();
                    log.debug("A security context is successfully established" + gContext);
                    return loginSucceeded;
                } else {
                    log.error("Failed to establish a security context");
                    throw new LoginException("Failed to establish a security context");

View Full Code Here

        if (inputBuff == null) {
            inputBuff = new byte[0];
        }
        final GSSManager manager = getManager();
        final GSSName serverName = manager.createName("HTTP@" + authServer, GSSName.NT_HOSTBASED_SERVICE);
        final GSSContext gssContext = manager.createContext(
                serverName.canonicalize(oid), oid, null, GSSContext.DEFAULT_LIFETIME);
        gssContext.requestMutualAuth(true);
        gssContext.requestCredDeleg(true);
        return gssContext.initSecContext(inputBuff, 0, inputBuff.length);
    }

View Full Code Here

            response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
            return false;
        }


        LoginContext lc = null;
        GSSContext gssContext = null;
        byte[] outToken = null;
        try {
            try {
                lc = new LoginContext(getLoginConfigName());
                lc.login();
            } catch (LoginException e) {
                log.error(sm.getString("spnegoAuthenticator.serviceLoginFail"),
                        e);
                response.sendError(
                        HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
                return false;
            }
            // Assume the GSSContext is stateless
            // TODO: Confirm this assumption
            final GSSManager manager = GSSManager.getInstance();
            // IBM JDK only understands indefinite lifetime
            final int credentialLifetime;
            if (Globals.IS_IBM_JVM) {
                credentialLifetime = GSSCredential.INDEFINITE_LIFETIME;
            } else {
                credentialLifetime = GSSCredential.DEFAULT_LIFETIME;
            }
            final PrivilegedExceptionAction<GSSCredential> action =
                new PrivilegedExceptionAction<GSSCredential>() {
                    @Override
                    public GSSCredential run() throws GSSException {
                        return manager.createCredential(null,
                                credentialLifetime,
                                new Oid("1.3.6.1.5.5.2"),
                                GSSCredential.ACCEPT_ONLY);
                    }
                };
            gssContext = manager.createContext(Subject.doAs(lc.getSubject(), action));


            outToken = Subject.doAs(lc.getSubject(), new AcceptAction(gssContext, decoded));


            if (outToken == null) {
                if (log.isDebugEnabled()) {
                    log.debug(sm.getString(
                            "spnegoAuthenticator.ticketValidateFail"));
                }
                // Start again
                response.setHeader("WWW-Authenticate", "Negotiate");
                response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
                return false;
            }


            principal = context.getRealm().authenticate(gssContext,
                    isStoreDelegatedCredential());
        } catch (GSSException e) {
            if (log.isDebugEnabled()) {
                log.debug(sm.getString("spnegoAuthenticator.ticketValidateFail"), e);
            }
            response.setHeader("WWW-Authenticate", "Negotiate");
            response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
            return false;
        } catch (PrivilegedActionException e) {
            log.error(sm.getString("spnegoAuthenticator.serviceLoginFail"), e);
            response.setHeader("WWW-Authenticate", "Negotiate");
            response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
            return false;
        } finally {
            if (gssContext != null) {
                try {
                    gssContext.dispose();
                } catch (GSSException e) {
                    // Ignore
                }
            }
            if (lc != null) {

View Full Code Here


        final String principal;
        final String tok = auth.substring("Negotiate".length() + 1);
        final byte[] gss = Base64.decode(tok);


        GSSContext context = null;
        byte[] token = null;
        context = MANAGER.createContext(getServerCredential(loginContext.getSubject()));
        token = context.acceptSecContext(gss, 0, gss.length);


        if (null == token) {
            return null;
        }


        resp.setHeader("WWW-Authenticate", "Negotiate" + ' ' + Base64.encodeBytes(token));


        if (!context.isEstablished()) {
            resp.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
            return null;
        }


        principal = context.getSrcName().toString();
        context.dispose();


        this.loginContext.logout();


        return principal;
    }

View Full Code Here

            response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
            return false;
        }


        LoginContext lc = null;
        GSSContext gssContext = null;
        byte[] outToken = null;
        try {
            try {
                lc = new LoginContext(getLoginConfigName());
                lc.login();
            } catch (LoginException e) {
                log.error(sm.getString("spnegoAuthenticator.serviceLoginFail"),
                        e);
                response.sendError(
                        HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
                return false;
            }
            // Assume the GSSContext is stateless
            // TODO: Confirm this assumption
            final GSSManager manager = GSSManager.getInstance();
            // IBM JDK only understands indefinite lifetime
            final int credentialLifetime;
            if (Globals.IS_IBM_JVM) {
                credentialLifetime = GSSCredential.INDEFINITE_LIFETIME;
            } else {
                credentialLifetime = GSSCredential.DEFAULT_LIFETIME;
            }
            final PrivilegedExceptionAction<GSSCredential> action =
                new PrivilegedExceptionAction<GSSCredential>() {
                    @Override
                    public GSSCredential run() throws GSSException {
                        return manager.createCredential(null,
                                credentialLifetime,
                                new Oid("1.3.6.1.5.5.2"),
                                GSSCredential.ACCEPT_ONLY);
                    }
                };
            gssContext = manager.createContext(Subject.doAs(lc.getSubject(), action));


            outToken = Subject.doAs(lc.getSubject(), new AcceptAction(gssContext, decoded));


            if (outToken == null) {
                if (log.isDebugEnabled()) {
                    log.debug(sm.getString(
                            "spnegoAuthenticator.ticketValidateFail"));
                }
                // Start again
                response.setHeader("WWW-Authenticate", "Negotiate");
                response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
                return false;
            }


            principal = context.getRealm().authenticate(gssContext,
                    isStoreDelegatedCredential());
        } catch (GSSException e) {
            if (log.isDebugEnabled()) {
                log.debug(sm.getString("spnegoAuthenticator.ticketValidateFail"), e);
            }
            response.setHeader("WWW-Authenticate", "Negotiate");
            response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
            return false;
        } catch (PrivilegedActionException e) {
            log.error(sm.getString("spnegoAuthenticator.serviceLoginFail"), e);
            response.setHeader("WWW-Authenticate", "Negotiate");
            response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
            return false;
        } finally {
            if (gssContext != null) {
                try {
                    gssContext.dispose();
                } catch (GSSException e) {
                    // Ignore
                }
            }
            if (lc != null) {

View Full Code Here

                    8 * 3600,
                    createKerberosOid(),
                    GSSCredential.INITIATE_ONLY );


                GSSName serverName = manager.createName( serviceName + "@" + hostName, GSSName.NT_HOSTBASED_SERVICE );
                GSSContext context = manager.createContext( serverName,
                    createKerberosOid(),
                    clientCred,
                    GSSContext.DEFAULT_LIFETIME );
                context.requestMutualAuth( true );
                context.requestConf( true );
                context.requestInteg( true );


                context.initSecContext( Strings.EMPTY_BYTES, 0, 0 );


                // byte[] outToken = context.initSecContext( Strings.EMPTY_BYTES, 0, 0 );
                // System.out.println(new BASE64Encoder().encode(outToken));
                context.dispose();


                return null;
            }
            catch ( GSSException gsse )
            {

View Full Code Here

    byte[] token = Base64.decode(response);


    try {
      GSSManager gssManager = GSSManager.getInstance();
      GSSCredential gssCred = gssManager.createCredential(null, GSSCredential.DEFAULT_LIFETIME, SPNEGO_MECH_OID, GSSCredential.ACCEPT_ONLY);
      GSSContext gssContext = gssManager.createContext(gssCred);
      byte[] tokenForPeer = gssContext.acceptSecContext(token, 0, token.length);
      if (!gssContext.isEstablished()) {
        throw new AuthException("Couldn't establish GSS context");
      }
      if (tokenForPeer != null) {
        Logger.warn("Ignoring token for peer");
      }
      Logger.debug("Authenticated "+gssContext.getSrcName()+" with "+gssContext.getTargName());
      return makeAuthUser(gssContext);
    } catch (GSSException e) {
      throw new AuthException("SPNEGO authentication failed: " + e);
    }
  }

View Full Code Here

        byte[] serviceTicket = getServiceTicket(authPair[1]);
        
        try {
            Subject serviceSubject = loginAndGetSubject();
            
            GSSContext gssContext = createGSSContext();


            Subject.doAs(serviceSubject, new ValidateServiceTicketAction(gssContext, serviceTicket));
            
            GSSName srcName = gssContext.getSrcName();
            if (srcName == null) {
                throw new NotAuthorizedException(getFaultResponse());
            }
            
            String complexUserName = srcName.toString();
            
            String simpleUserName = complexUserName;
            int index = simpleUserName.lastIndexOf('@');
            if (index > 0) {
                simpleUserName = simpleUserName.substring(0, index);
            }
            if (!gssContext.getCredDelegState()) {
                gssContext.dispose();
                gssContext = null;
            }
            Message m = JAXRSUtils.getCurrentMessage();
            m.put(SecurityContext.class, 
                new KerberosSecurityContext(new KerberosPrincipal(simpleUserName,

View Full Code Here

        GSSName serverName = manager.createName(spn, null);


        GSSCredential delegatedCred = 
            (GSSCredential)message.getContextualProperty(GSSCredential.class.getName());
        
        GSSContext context = manager
                .createContext(serverName.canonicalize(oid), oid, delegatedCred, GSSContext.DEFAULT_LIFETIME);
        
        context.requestCredDeleg(isCredDelegationRequired(message));


        // If the delegated cred is not null then we only need the context to
        // immediately return a ticket based on this credential without attempting
        // to log on again 
        return getToken(delegatedCred == null ? authPolicy : null,

View Full Code Here

    private byte[] getToken(AuthorizationPolicy authPolicy, String spn, Oid oid) throws GSSException, 
        LoginException {
        GSSManager manager = GSSManager.getInstance();
        GSSName serverName = manager.createName(spn, null);


        GSSContext context = manager
                .createContext(serverName.canonicalize(oid), oid, null, GSSContext.DEFAULT_LIFETIME);
        // TODO Do we need mutual auth. Will the code we have really work with
        // mutual auth?
        context.requestMutualAuth(true);
        // TODO Credential delegation could be a security hole if it was not
        // intended. Both settings should be configurable
        context.requestCredDeleg(true);


        return getToken(authPolicy, context);
    }

View Full Code Here

0 1 2 3 4 5 6 7 8 9

TOP

Related Classes of org.ietf.jgss.GSSContext

au.net.ocean.httpclient.auth.spnego.SPNegoAuthScheme

au.net.ocean.httpclient.auth.spnego.SPNegoHTTPClient

com.feth.play.module.pa.providers.wwwauth.negotiate.SpnegoAuthProvider

com.sun.xml.ws.security.impl.kerberos.KerberosLogin

com.sun.xml.ws.security.impl.kerberos.KerberosLogin$KerberosClientSetupAction

com.sun.xml.ws.security.impl.kerberos.KerberosLogin$KerberosServerSetupAction

com.xebialabs.overthere.cifs.winrm.WsmanKerberosScheme

com.xebialabs.overthere.cifs.winrm.WsmanSPNegoScheme

io.undertow.security.impl.GSSAPIAuthenticationMechanism$AcceptSecurityContext

io.undertow.server.security.SpnegoAuthenticationTestCase

All source code are property of their respective owners. Java is a trademark of Sun Microsystems, Inc and owned by ORACLE Inc. Contact coftware#gmail.com.