sun.security.jgss.GSSCaller Java Examples

/**
 * Retrieves the ticket corresponding to the client/server principal
 * pair from the Subject in the specified AccessControlContext.
 * If the ticket can not be found in the Subject, and if
 * useSubjectCredsOnly is false, then obtain ticket from
 * a LoginContext.
 */
static KerberosTicket getTicket(GSSCaller caller,
    String clientPrincipal, String serverPrincipal,
    AccessControlContext acc) throws LoginException {

    // Try to get ticket from acc's Subject
    Subject accSubj = Subject.getSubject(acc);
    KerberosTicket ticket =
        SubjectComber.find(accSubj, serverPrincipal, clientPrincipal,
              KerberosTicket.class);

    // Try to get ticket from Subject obtained from GSSUtil
    if (ticket == null && !GSSUtil.useSubjectCredsOnly(caller)) {
        Subject subject = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
        ticket = SubjectComber.find(subject,
            serverPrincipal, clientPrincipal, KerberosTicket.class);
    }
    return ticket;
}
 

private void tryConstrainedDelegation() {
    if (state != STATE_IN_PROCESS && state != STATE_DONE) {
        return;
    }
    // We will only try constrained delegation once (if necessary).
    if (!isConstrainedDelegationTried) {
        if (delegatedCred == null) {
            if (DEBUG) {
                System.out.println(">>> Constrained deleg from " + caller);
            }
            // The constrained delegation part. The acceptor needs to have
            // isInitiator=true in order to get a TGT, either earlier at
            // logon stage, if useSubjectCredsOnly, or now.
            try {
                delegatedCred = new Krb5ProxyCredential(
                    Krb5InitCredential.getInstance(
                        GSSCaller.CALLER_ACCEPT, myName, lifetime),
                    peerName, serviceTicket);
            } catch (GSSException gsse) {
                // OK, delegatedCred is null then
            }
        }
        isConstrainedDelegationTried = true;
    }
}
 

private void tryConstrainedDelegation() {
    if (state != STATE_IN_PROCESS && state != STATE_DONE) {
        return;
    }
    // We will only try constrained delegation once (if necessary).
    if (!isConstrainedDelegationTried) {
        if (delegatedCred == null) {
            if (DEBUG) {
                System.out.println(">>> Constrained deleg from " + caller);
            }
            // The constrained delegation part. The acceptor needs to have
            // isInitiator=true in order to get a TGT, either earlier at
            // logon stage, if useSubjectCredsOnly, or now.
            try {
                delegatedCred = new Krb5ProxyCredential(
                    Krb5InitCredential.getInstance(
                        GSSCaller.CALLER_ACCEPT, myName, lifetime),
                    peerName, serviceTicket);
            } catch (GSSException gsse) {
                // OK, delegatedCred is null then
            }
        }
        isConstrainedDelegationTried = true;
    }
}
 

/**
 * Retrieves the ServiceCreds for the specified server principal from
 * the Subject in the specified AccessControlContext. If not found, and if
 * useSubjectCredsOnly is false, then obtain from a LoginContext.
 *
 * NOTE: This method is also used by JSSE Kerberos Cipher Suites
 */
public static ServiceCreds getServiceCreds(GSSCaller caller,
    String serverPrincipal, AccessControlContext acc)
            throws LoginException {

    Subject accSubj = Subject.getSubject(acc);
    ServiceCreds sc = null;
    if (accSubj != null) {
        sc = ServiceCreds.getInstance(accSubj, serverPrincipal);
    }
    if (sc == null && !GSSUtil.useSubjectCredsOnly(caller)) {
        Subject subject = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
        sc = ServiceCreds.getInstance(subject, serverPrincipal);
    }
    return sc;
}
 

/**
 * Retrieves the ServiceCreds for the specified server principal from
 * the Subject in the specified AccessControlContext. If not found, and if
 * useSubjectCredsOnly is false, then obtain from a LoginContext.
 *
 * NOTE: This method is also used by JSSE Kerberos Cipher Suites
 */
public static ServiceCreds getServiceCreds(GSSCaller caller,
    String serverPrincipal, AccessControlContext acc)
            throws LoginException {

    Subject accSubj = Subject.getSubject(acc);
    ServiceCreds sc = null;
    if (accSubj != null) {
        sc = ServiceCreds.getInstance(accSubj, serverPrincipal);
    }
    if (sc == null && !GSSUtil.useSubjectCredsOnly(caller)) {
        Subject subject = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
        sc = ServiceCreds.getInstance(subject, serverPrincipal);
    }
    return sc;
}
 

/**
 * Retrieves the ticket corresponding to the client/server principal
 * pair from the Subject in the specified AccessControlContext.
 * If the ticket can not be found in the Subject, and if
 * useSubjectCredsOnly is false, then obtain ticket from
 * a LoginContext.
 */
static KerberosTicket getTicket(GSSCaller caller,
    String clientPrincipal, String serverPrincipal,
    AccessControlContext acc) throws LoginException {

    // Try to get ticket from acc's Subject
    Subject accSubj = Subject.getSubject(acc);
    KerberosTicket ticket =
        SubjectComber.find(accSubj, serverPrincipal, clientPrincipal,
              KerberosTicket.class);

    // Try to get ticket from Subject obtained from GSSUtil
    if (ticket == null && !GSSUtil.useSubjectCredsOnly(caller)) {
        Subject subject = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
        ticket = SubjectComber.find(subject,
            serverPrincipal, clientPrincipal, KerberosTicket.class);
    }
    return ticket;
}
 

/**
 * Retrieves the ServiceCreds for the specified server principal from
 * the Subject in the specified AccessControlContext. If not found, and if
 * useSubjectCredsOnly is false, then obtain from a LoginContext.
 *
 * NOTE: This method is also used by JSSE Kerberos Cipher Suites
 */
public static ServiceCreds getServiceCreds(GSSCaller caller,
    String serverPrincipal, AccessControlContext acc)
            throws LoginException {

    Subject accSubj = Subject.getSubject(acc);
    ServiceCreds sc = null;
    if (accSubj != null) {
        sc = ServiceCreds.getInstance(accSubj, serverPrincipal);
    }
    if (sc == null && !GSSUtil.useSubjectCredsOnly(caller)) {
        Subject subject = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
        sc = ServiceCreds.getInstance(subject, serverPrincipal);
    }
    return sc;
}
 

static Krb5CredElement tryImpersonation(GSSCaller caller,
        Krb5InitCredential initiator) throws GSSException {

    try {
        KerberosTicket proxy = initiator.proxyTicket;
        if (proxy != null) {
            Credentials proxyCreds = Krb5Util.ticketToCreds(proxy);
            return new Krb5ProxyCredential(initiator,
                    Krb5NameElement.getInstance(proxyCreds.getClient()),
                    proxyCreds.getTicket());
        } else {
            return initiator;
        }
    } catch (KrbException | IOException e) {
        throw new GSSException(GSSException.DEFECTIVE_CREDENTIAL, -1,
                "Cannot create proxy credential");
    }
}
 

/**
 * Retrieves the initial TGT corresponding to the client principal
 * from the Subject in the specified AccessControlContext.
 * If the ticket can not be found in the Subject, and if
 * useSubjectCredsOnly is false, then obtain ticket from
 * a LoginContext.
 */
static KerberosTicket getInitialTicket(GSSCaller caller,
        String clientPrincipal,
        AccessControlContext acc) throws LoginException {

    // Try to get ticket from acc's Subject
    Subject accSubj = Subject.getSubject(acc);
    KerberosTicket ticket =
            SubjectComber.find(accSubj, null, clientPrincipal,
                    KerberosTicket.class);

    // Try to get ticket from Subject obtained from GSSUtil
    if (ticket == null && !GSSUtil.useSubjectCredsOnly(caller)) {
        Subject subject = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
        ticket = SubjectComber.find(subject,
                null, clientPrincipal, KerberosTicket.class);
    }
    return ticket;
}
 

static Krb5CredElement tryImpersonation(GSSCaller caller,
        Krb5InitCredential initiator) throws GSSException {

    try {
        KerberosTicket proxy = initiator.proxyTicket;
        if (proxy != null) {
            Credentials proxyCreds = Krb5Util.ticketToCreds(proxy);
            return new Krb5ProxyCredential(initiator,
                    Krb5NameElement.getInstance(proxyCreds.getClient()),
                    proxyCreds.getTicket());
        } else {
            return initiator;
        }
    } catch (KrbException | IOException e) {
        throw new GSSException(GSSException.DEFECTIVE_CREDENTIAL, -1,
                "Cannot create proxy credential");
    }
}
 

/**
 * Retrieves the initial TGT corresponding to the client principal
 * from the Subject in the specified AccessControlContext.
 * If the ticket can not be found in the Subject, and if
 * useSubjectCredsOnly is false, then obtain ticket from
 * a LoginContext.
 */
static KerberosTicket getInitialTicket(GSSCaller caller,
        String clientPrincipal,
        AccessControlContext acc) throws LoginException {

    // Try to get ticket from acc's Subject
    Subject accSubj = Subject.getSubject(acc);
    KerberosTicket ticket =
            SubjectComber.find(accSubj, null, clientPrincipal,
                    KerberosTicket.class);

    // Try to get ticket from Subject obtained from GSSUtil
    if (ticket == null && !GSSUtil.useSubjectCredsOnly(caller)) {
        Subject subject = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
        ticket = SubjectComber.find(subject,
                null, clientPrincipal, KerberosTicket.class);
    }
    return ticket;
}
 

/**
 * Retrieves the ServiceCreds for the specified server principal from
 * the Subject in the specified AccessControlContext. If not found, and if
 * useSubjectCredsOnly is false, then obtain from a LoginContext.
 *
 * NOTE: This method is also used by JSSE Kerberos Cipher Suites
 */
public static ServiceCreds getServiceCreds(GSSCaller caller,
    String serverPrincipal, AccessControlContext acc)
            throws LoginException {

    Subject accSubj = Subject.getSubject(acc);
    ServiceCreds sc = null;
    if (accSubj != null) {
        sc = ServiceCreds.getInstance(accSubj, serverPrincipal);
    }
    if (sc == null && !GSSUtil.useSubjectCredsOnly(caller)) {
        Subject subject = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
        sc = ServiceCreds.getInstance(subject, serverPrincipal);
    }
    return sc;
}
 

private void tryConstrainedDelegation() {
    if (state != STATE_IN_PROCESS && state != STATE_DONE) {
        return;
    }
    // We will only try constrained delegation once (if necessary).
    if (!isConstrainedDelegationTried) {
        if (delegatedCred == null) {
            if (DEBUG) {
                System.out.println(">>> Constrained deleg from " + caller);
            }
            // The constrained delegation part. The acceptor needs to have
            // isInitiator=true in order to get a TGT, either earlier at
            // logon stage, if useSubjectCredsOnly, or now.
            try {
                delegatedCred = new Krb5ProxyCredential(
                    Krb5InitCredential.getInstance(
                        GSSCaller.CALLER_ACCEPT, myName, lifetime),
                    peerName, serviceTicket);
            } catch (GSSException gsse) {
                // OK, delegatedCred is null then
            }
        }
        isConstrainedDelegationTried = true;
    }
}
 

private static KerberosTicket getTgt(GSSCaller caller, Krb5NameElement name,
                                             int initLifetime)
    throws GSSException {

    final String clientPrincipal;

    /*
     * Find the TGT for the realm that the client is in. If the client
     * name is not available, then use the default realm.
     */
    if (name != null) {
        clientPrincipal = (name.getKrb5PrincipalName()).getName();
    } else {
        clientPrincipal = null;
    }

    final AccessControlContext acc = AccessController.getContext();

    try {
        final GSSCaller realCaller = (caller == GSSCaller.CALLER_UNKNOWN)
                               ? GSSCaller.CALLER_INITIATE
                               : caller;
        return AccessController.doPrivileged(
            new PrivilegedExceptionAction<KerberosTicket>() {
            public KerberosTicket run() throws Exception {
                // It's OK to use null as serverPrincipal. TGT is almost
                // the first ticket for a principal and we use list.
                return Krb5Util.getTicket(
                    realCaller,
                    clientPrincipal, null, acc);
                    }});
    } catch (PrivilegedActionException e) {
        GSSException ge =
            new GSSException(GSSException.NO_CRED, -1,
                "Attempt to obtain new INITIATE credentials failed!" +
                " (" + e.getMessage() + ")");
        ge.initCause(e.getException());
        throw ge;
    }
}
 

static Krb5InitCredential getInstance(GSSCaller caller, Krb5NameElement name,
                               int initLifetime)
    throws GSSException {

    KerberosTicket tgt = getTgt(caller, name, initLifetime);
    if (tgt == null)
        throw new GSSException(GSSException.NO_CRED, -1,
                               "Failed to find any Kerberos tgt");

    if (name == null) {
        String fullName = tgt.getClient().getName();
        name = Krb5NameElement.getInstance(fullName,
                                   Krb5MechFactory.NT_GSS_KRB5_PRINCIPAL);
    }

    return new Krb5InitCredential(name,
                                  tgt.getEncoded(),
                                  tgt.getClient(),
                                  tgt.getServer(),
                                  tgt.getSessionKey().getEncoded(),
                                  tgt.getSessionKeyType(),
                                  tgt.getFlags(),
                                  tgt.getAuthTime(),
                                  tgt.getStartTime(),
                                  tgt.getEndTime(),
                                  tgt.getRenewTill(),
                                  tgt.getClientAddresses());
}
 

/**
 * Retrieves the caller's Subject, or Subject obtained by logging in
 * via the specified caller.
 *
 * Caller must have permission to:
 *    - access the Subject
 *    - create LoginContext
 *    - read the auth.login.defaultCallbackHandler security property
 *
 * NOTE: This method is used by JSSE Kerberos Cipher Suites
 */
public static Subject getSubject(GSSCaller caller,
    AccessControlContext acc) throws LoginException {

    // Try to get the Subject from acc
    Subject subject = Subject.getSubject(acc);

    // Try to get Subject obtained from GSSUtil
    if (subject == null && !GSSUtil.useSubjectCredsOnly(caller)) {
        subject = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
    }
    return subject;
}
 

static Krb5AcceptCredential getInstance(final GSSCaller caller, Krb5NameElement name)
    throws GSSException {

    final String serverPrinc = (name == null? null:
        name.getKrb5PrincipalName().getName());
    final AccessControlContext acc = AccessController.getContext();

    ServiceCreds creds = null;
    try {
        creds = AccessController.doPrivileged(
                    new PrivilegedExceptionAction<ServiceCreds>() {
            public ServiceCreds run() throws Exception {
                return Krb5Util.getServiceCreds(
                    caller == GSSCaller.CALLER_UNKNOWN ? GSSCaller.CALLER_ACCEPT: caller,
                    serverPrinc, acc);
            }});
    } catch (PrivilegedActionException e) {
        GSSException ge =
            new GSSException(GSSException.NO_CRED, -1,
                "Attempt to obtain new ACCEPT credentials failed!");
        ge.initCause(e.getException());
        throw ge;
    }

    if (creds == null)
        throw new GSSException(GSSException.NO_CRED, -1,
                               "Failed to find any Kerberos credentails");

    if (name == null) {
        String fullName = creds.getName();
        if (fullName != null) {
            name = Krb5NameElement.getInstance(fullName,
                                   Krb5MechFactory.NT_GSS_KRB5_PRINCIPAL);
        }
    }

    return new Krb5AcceptCredential(name, creds);
}
 

static Krb5InitCredential getInstance(GSSCaller caller, Krb5NameElement name,
                               int initLifetime)
    throws GSSException {

    KerberosTicket tgt = getTgt(caller, name, initLifetime);
    if (tgt == null)
        throw new GSSException(GSSException.NO_CRED, -1,
                               "Failed to find any Kerberos tgt");

    if (name == null) {
        String fullName = tgt.getClient().getName();
        name = Krb5NameElement.getInstance(fullName,
                                   Krb5MechFactory.NT_GSS_KRB5_PRINCIPAL);
    }

    return new Krb5InitCredential(name,
                                  tgt.getEncoded(),
                                  tgt.getClient(),
                                  tgt.getServer(),
                                  tgt.getSessionKey().getEncoded(),
                                  tgt.getSessionKeyType(),
                                  tgt.getFlags(),
                                  tgt.getAuthTime(),
                                  tgt.getStartTime(),
                                  tgt.getEndTime(),
                                  tgt.getRenewTill(),
                                  tgt.getClientAddresses());
}
 

/**
 * Constructor for Krb5Context to be called on the context initiator's
 * side.
 */
Krb5Context(GSSCaller caller, Krb5NameElement peerName, Krb5CredElement myCred,
            int lifetime)
    throws GSSException {

    if (peerName == null)
        throw new IllegalArgumentException("Cannot have null peer name");

    this.caller = caller;
    this.peerName = peerName;
    this.myCred = myCred;
    this.lifetime = lifetime;
    this.initiator = true;
}
 

/**
 * Retrieves the ticket corresponding to the client/server principal
 * pair from the Subject in the specified AccessControlContext.
 */
static KerberosTicket getServiceTicket(GSSCaller caller,
    String clientPrincipal, String serverPrincipal,
    AccessControlContext acc) throws LoginException {

    // Try to get ticket from acc's Subject
    Subject accSubj = Subject.getSubject(acc);
    KerberosTicket ticket =
        SubjectComber.find(accSubj, serverPrincipal, clientPrincipal,
              KerberosTicket.class);

    return ticket;
}
 

/**
 * Constructor for Krb5Context to be called on the context initiator's
 * side.
 */
Krb5Context(GSSCaller caller, Krb5NameElement peerName, Krb5CredElement myCred,
            int lifetime)
    throws GSSException {

    if (peerName == null)
        throw new IllegalArgumentException("Cannot have null peer name");

    this.caller = caller;
    this.peerName = peerName;
    this.myCred = myCred;
    this.lifetime = lifetime;
    this.initiator = true;
}
 

@Override
public Object getServiceCreds(AccessControlContext acc)
        throws LoginException {
    ServiceCreds serviceCreds =
        Krb5Util.getServiceCreds(GSSCaller.CALLER_SSL_SERVER, null, acc);
    return serviceCreds;
}
 

/**
 * Constructor for Krb5Context to be called on the context acceptor's
 * side.
 */
Krb5Context(GSSCaller caller, Krb5CredElement myCred)
    throws GSSException {
    this.caller = caller;
    this.myCred = myCred;
    this.initiator = false;
}
 

private static KerberosTicket getTgt(GSSCaller caller, Krb5NameElement name,
                                             int initLifetime)
    throws GSSException {

    final String clientPrincipal;

    /*
     * Find the TGT for the realm that the client is in. If the client
     * name is not available, then use the default realm.
     */
    if (name != null) {
        clientPrincipal = (name.getKrb5PrincipalName()).getName();
    } else {
        clientPrincipal = null;
    }

    final AccessControlContext acc = AccessController.getContext();

    try {
        final GSSCaller realCaller = (caller == GSSCaller.CALLER_UNKNOWN)
                               ? GSSCaller.CALLER_INITIATE
                               : caller;
        return AccessController.doPrivileged(
            new PrivilegedExceptionAction<KerberosTicket>() {
            public KerberosTicket run() throws Exception {
                // It's OK to use null as serverPrincipal. TGT is almost
                // the first ticket for a principal and we use list.
                return Krb5Util.getTicket(
                    realCaller,
                    clientPrincipal, null, acc);
                    }});
    } catch (PrivilegedActionException e) {
        GSSException ge =
            new GSSException(GSSException.NO_CRED, -1,
                "Attempt to obtain new INITIATE credentials failed!" +
                " (" + e.getMessage() + ")");
        ge.initCause(e.getException());
        throw ge;
    }
}
 

/**
 * Constructor for Krb5Context to be called on the context initiator's
 * side.
 */
Krb5Context(GSSCaller caller, Krb5NameElement peerName, Krb5CredElement myCred,
            int lifetime)
    throws GSSException {

    if (peerName == null)
        throw new IllegalArgumentException("Cannot have null peer name");

    this.caller = caller;
    this.peerName = peerName;
    this.myCred = myCred;
    this.lifetime = lifetime;
    this.initiator = true;
}
 

static Krb5AcceptCredential getInstance(final GSSCaller caller, Krb5NameElement name)
    throws GSSException {

    final String serverPrinc = (name == null? null:
        name.getKrb5PrincipalName().getName());
    final AccessControlContext acc = AccessController.getContext();

    ServiceCreds creds = null;
    try {
        creds = AccessController.doPrivileged(
                    new PrivilegedExceptionAction<ServiceCreds>() {
            public ServiceCreds run() throws Exception {
                return Krb5Util.getServiceCreds(
                    caller == GSSCaller.CALLER_UNKNOWN ? GSSCaller.CALLER_ACCEPT: caller,
                    serverPrinc, acc);
            }});
    } catch (PrivilegedActionException e) {
        GSSException ge =
            new GSSException(GSSException.NO_CRED, -1,
                "Attempt to obtain new ACCEPT credentials failed!");
        ge.initCause(e.getException());
        throw ge;
    }

    if (creds == null)
        throw new GSSException(GSSException.NO_CRED, -1,
                               "Failed to find any Kerberos credentails");

    if (name == null) {
        String fullName = creds.getName();
        if (fullName != null) {
            name = Krb5NameElement.getInstance(fullName,
                                   Krb5MechFactory.NT_GSS_KRB5_PRINCIPAL);
        }
    }

    return new Krb5AcceptCredential(name, creds);
}
 

private static KerberosTicket getTgt(GSSCaller caller, Krb5NameElement name,
                                             int initLifetime)
    throws GSSException {

    final String clientPrincipal;

    /*
     * Find the TGT for the realm that the client is in. If the client
     * name is not available, then use the default realm.
     */
    if (name != null) {
        clientPrincipal = (name.getKrb5PrincipalName()).getName();
    } else {
        clientPrincipal = null;
    }

    final AccessControlContext acc = AccessController.getContext();

    try {
        final GSSCaller realCaller = (caller == GSSCaller.CALLER_UNKNOWN)
                               ? GSSCaller.CALLER_INITIATE
                               : caller;
        return AccessController.doPrivileged(
            new PrivilegedExceptionAction<KerberosTicket>() {
            public KerberosTicket run() throws Exception {
                // It's OK to use null as serverPrincipal. TGT is almost
                // the first ticket for a principal and we use list.
                return Krb5Util.getInitialTicket(
                    realCaller,
                    clientPrincipal, acc);
                    }});
    } catch (PrivilegedActionException e) {
        GSSException ge =
            new GSSException(GSSException.NO_CRED, -1,
                "Attempt to obtain new INITIATE credentials failed!" +
                " (" + e.getMessage() + ")");
        ge.initCause(e.getException());
        throw ge;
    }
}
 

static Krb5InitCredential getInstance(GSSCaller caller, Krb5NameElement name,
                               int initLifetime)
    throws GSSException {

    KerberosTicket tgt = getTgt(caller, name, initLifetime);
    if (tgt == null)
        throw new GSSException(GSSException.NO_CRED, -1,
                               "Failed to find any Kerberos tgt");

    if (name == null) {
        String fullName = tgt.getClient().getName();
        name = Krb5NameElement.getInstance(fullName,
                                   Krb5MechFactory.NT_GSS_KRB5_PRINCIPAL);
    }

    return new Krb5InitCredential(name,
                                  tgt.getEncoded(),
                                  tgt.getClient(),
                                  tgt.getServer(),
                                  tgt.getSessionKey().getEncoded(),
                                  tgt.getSessionKeyType(),
                                  tgt.getFlags(),
                                  tgt.getAuthTime(),
                                  tgt.getStartTime(),
                                  tgt.getEndTime(),
                                  tgt.getRenewTill(),
                                  tgt.getClientAddresses());
}
 

@Override
public Object getServiceCreds(AccessControlContext acc)
        throws LoginException {
    ServiceCreds serviceCreds =
        Krb5Util.getServiceCreds(GSSCaller.CALLER_SSL_SERVER, null, acc);
    return serviceCreds;
}
 

/**
 * Retrieves the caller's Subject, or Subject obtained by logging in
 * via the specified caller.
 *
 * Caller must have permission to:
 *    - access the Subject
 *    - create LoginContext
 *    - read the auth.login.defaultCallbackHandler security property
 *
 * NOTE: This method is used by JSSE Kerberos Cipher Suites
 */
public static Subject getSubject(GSSCaller caller,
    AccessControlContext acc) throws LoginException {

    // Try to get the Subject from acc
    Subject subject = Subject.getSubject(acc);

    // Try to get Subject obtained from GSSUtil
    if (subject == null && !GSSUtil.useSubjectCredsOnly(caller)) {
        subject = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
    }
    return subject;
}