sun.security.krb5.Credentials Java Examples

private Credentials renewCredentials(Credentials creds)
{
    Credentials lcreds;
    try {
        if (!creds.isRenewable())
            throw new RefreshFailedException("This ticket" +
                            " is not renewable");
        if (System.currentTimeMillis() > cred.getRenewTill().getTime())
            throw new RefreshFailedException("This ticket is past "
                                         + "its last renewal time.");
        lcreds = creds.renew();
        if (debug)
            System.out.println("Renewed Kerberos Ticket");
    } catch (Exception e) {
        lcreds = null;
        if (debug)
            System.out.println("Ticket could not be renewed : "
                            + e.getMessage());
    }
    return lcreds;
}
 

private static boolean isOld(Credentials creds)
{
    Date endTime = creds.getEndTime();
    if (endTime != null) {
        Date authTime = creds.getAuthTime();
        long now = System.currentTimeMillis();
        if (authTime != null) {
            // pass the mid between auth and end
            return now - authTime.getTime() > endTime.getTime() - now;
        } else {
            // will expire in less than 2 hours
            return now <= endTime.getTime() - 1000*3600*2L;
        }
    }
    return false;
}
 

private static boolean isOld(Credentials creds)
{
    Date endTime = creds.getEndTime();
    if (endTime != null) {
        Date authTime = creds.getAuthTime();
        long now = System.currentTimeMillis();
        if (authTime != null) {
            // pass the mid between auth and end
            return now - authTime.getTime() > endTime.getTime() - now;
        } else {
            // will expire in less than 2 hours
            return now <= endTime.getTime() - 1000*3600*2L;
        }
    }
    return false;
}
 

public static KerberosTicket credsToTicket(Credentials serviceCreds) {
    EncryptionKey sessionKey =  serviceCreds.getSessionKey();
    return new KerberosTicket(
        serviceCreds.getEncoded(),
        new KerberosPrincipal(serviceCreds.getClient().getName()),
        new KerberosPrincipal(serviceCreds.getServer().getName(),
                            KerberosPrincipal.KRB_NT_SRV_INST),
        sessionKey.getBytes(),
        sessionKey.getEType(),
        serviceCreds.getFlags(),
        serviceCreds.getAuthTime(),
        serviceCreds.getStartTime(),
        serviceCreds.getEndTime(),
        serviceCreds.getRenewTill(),
        serviceCreds.getClientAddresses());
}
 

public static Credentials ticketToCreds(KerberosTicket kerbTicket)
        throws KrbException, IOException {
    KerberosPrincipal clientAlias = KerberosSecrets
            .getJavaxSecurityAuthKerberosAccess()
            .kerberosTicketGetClientAlias(kerbTicket);
    KerberosPrincipal serverAlias = KerberosSecrets
            .getJavaxSecurityAuthKerberosAccess()
            .kerberosTicketGetServerAlias(kerbTicket);
    return new Credentials(
        kerbTicket.getEncoded(),
        kerbTicket.getClient().getName(),
        (clientAlias != null ? clientAlias.getName() : null),
        kerbTicket.getServer().getName(),
        (serverAlias != null ? serverAlias.getName() : null),
        kerbTicket.getSessionKey().getEncoded(),
        kerbTicket.getSessionKeyType(),
        kerbTicket.getFlags(),
        kerbTicket.getAuthTime(),
        kerbTicket.getStartTime(),
        kerbTicket.getEndTime(),
        kerbTicket.getRenewTill(),
        kerbTicket.getClientAddresses());
}
 

public static KerberosTicket credsToTicket(Credentials serviceCreds) {
    EncryptionKey sessionKey =  serviceCreds.getSessionKey();
    return new KerberosTicket(
        serviceCreds.getEncoded(),
        new KerberosPrincipal(serviceCreds.getClient().getName()),
        new KerberosPrincipal(serviceCreds.getServer().getName(),
                            KerberosPrincipal.KRB_NT_SRV_INST),
        sessionKey.getBytes(),
        sessionKey.getEType(),
        serviceCreds.getFlags(),
        serviceCreds.getAuthTime(),
        serviceCreds.getStartTime(),
        serviceCreds.getEndTime(),
        serviceCreds.getRenewTill(),
        serviceCreds.getClientAddresses());
}
 

private Credentials renewCredentials(Credentials creds)
{
    Credentials lcreds;
    try {
        if (!creds.isRenewable())
            throw new RefreshFailedException("This ticket" +
                            " is not renewable");
        if (System.currentTimeMillis() > cred.getRenewTill().getTime())
            throw new RefreshFailedException("This ticket is past "
                                         + "its last renewal time.");
        lcreds = creds.renew();
        if (debug)
            System.out.println("Renewed Kerberos Ticket");
    } catch (Exception e) {
        lcreds = null;
        if (debug)
            System.out.println("Ticket could not be renewed : "
                            + e.getMessage());
    }
    return lcreds;
}
 

private static boolean isOld(Credentials creds)
{
    Date endTime = creds.getEndTime();
    if (endTime != null) {
        Date authTime = creds.getAuthTime();
        long now = System.currentTimeMillis();
        if (authTime != null) {
            // pass the mid between auth and end
            return now - authTime.getTime() > endTime.getTime() - now;
        } else {
            // will expire in less than 2 hours
            return now <= endTime.getTime() - 1000*3600*2L;
        }
    }
    return false;
}
 

private Credentials renewCredentials(Credentials creds)
{
    Credentials lcreds;
    try {
        if (!creds.isRenewable())
            throw new RefreshFailedException("This ticket" +
                            " is not renewable");
        if (System.currentTimeMillis() > cred.getRenewTill().getTime())
            throw new RefreshFailedException("This ticket is past "
                                         + "its last renewal time.");
        lcreds = creds.renew();
        if (debug)
            System.out.println("Renewed Kerberos Ticket");
    } catch (Exception e) {
        lcreds = null;
        if (debug)
            System.out.println("Ticket could not be renewed : "
                            + e.getMessage());
    }
    return lcreds;
}
 

private Credentials renewCredentials(Credentials creds)
{
    Credentials lcreds;
    try {
        if (!creds.isRenewable())
            throw new RefreshFailedException("This ticket" +
                            " is not renewable");
        if (creds.getRenewTill() == null) {
            // Renewable ticket without renew-till. Illegal and ignored.
            return creds;
        }
        if (System.currentTimeMillis() > cred.getRenewTill().getTime())
            throw new RefreshFailedException("This ticket is past "
                                         + "its last renewal time.");
        lcreds = creds.renew();
        if (debug)
            System.out.println("Renewed Kerberos Ticket");
    } catch (Exception e) {
        lcreds = null;
        if (debug)
            System.out.println("Ticket could not be renewed : "
                            + e.getMessage());
    }
    return lcreds;
}
 

static Krb5CredElement tryImpersonation(GSSCaller caller,
        Krb5InitCredential initiator) throws GSSException {

    try {
        KerberosTicket proxy = initiator.proxyTicket;
        if (proxy != null) {
            Credentials proxyCreds = Krb5Util.ticketToCreds(proxy);
            return new Krb5ProxyCredential(initiator,
                    Krb5NameElement.getInstance(proxyCreds.getClient()),
                    proxyCreds.getTicket());
        } else {
            return initiator;
        }
    } catch (KrbException | IOException e) {
        throw new GSSException(GSSException.DEFECTIVE_CREDENTIAL, -1,
                "Cannot create proxy credential");
    }
}
 

public static KerberosTicket credsToTicket(Credentials serviceCreds) {
    EncryptionKey sessionKey =  serviceCreds.getSessionKey();
    return new KerberosTicket(
        serviceCreds.getEncoded(),
        new KerberosPrincipal(serviceCreds.getClient().getName()),
        new KerberosPrincipal(serviceCreds.getServer().getName(),
                            KerberosPrincipal.KRB_NT_SRV_INST),
        sessionKey.getBytes(),
        sessionKey.getEType(),
        serviceCreds.getFlags(),
        serviceCreds.getAuthTime(),
        serviceCreds.getStartTime(),
        serviceCreds.getEndTime(),
        serviceCreds.getRenewTill(),
        serviceCreds.getClientAddresses());
}
 

/**
 * Saves the tickets to a ccache file.
 *
 * @param file pathname of the ccache file
 * @return true if created, false otherwise.
 */
public boolean ccache(String file) throws Exception {
    Set<KerberosTicket> tickets
            = s.getPrivateCredentials(KerberosTicket.class);
    if (tickets != null && !tickets.isEmpty()) {
        CredentialsCache cc = null;
        for (KerberosTicket t : tickets) {
            Credentials cred = Krb5Util.ticketToCreds(t);
            if (cc == null) {
                cc = CredentialsCache.create(cred.getClient(), file);
            }
            cc.update(cred.toCCacheCreds());
        }
        if (cc != null) {
            cc.save();
            return true;
        }
    }
    return false;
}
 

static Krb5CredElement tryImpersonation(GSSCaller caller,
        Krb5InitCredential initiator) throws GSSException {

    try {
        KerberosTicket proxy = initiator.proxyTicket;
        if (proxy != null) {
            Credentials proxyCreds = Krb5Util.ticketToCreds(proxy);
            return new Krb5ProxyCredential(initiator,
                    Krb5NameElement.getInstance(proxyCreds.getClient()),
                    proxyCreds.getTicket());
        } else {
            return initiator;
        }
    } catch (KrbException | IOException e) {
        throw new GSSException(GSSException.DEFECTIVE_CREDENTIAL, -1,
                "Cannot create proxy credential");
    }
}
 

public static Credentials ticketToCreds(KerberosTicket kerbTicket)
        throws KrbException, IOException {
    KerberosPrincipal clientAlias = KerberosSecrets
            .getJavaxSecurityAuthKerberosAccess()
            .kerberosTicketGetClientAlias(kerbTicket);
    KerberosPrincipal serverAlias = KerberosSecrets
            .getJavaxSecurityAuthKerberosAccess()
            .kerberosTicketGetServerAlias(kerbTicket);
    return new Credentials(
        kerbTicket.getEncoded(),
        kerbTicket.getClient().getName(),
        (clientAlias != null ? clientAlias.getName() : null),
        kerbTicket.getServer().getName(),
        (serverAlias != null ? serverAlias.getName() : null),
        kerbTicket.getSessionKey().getEncoded(),
        kerbTicket.getSessionKeyType(),
        kerbTicket.getFlags(),
        kerbTicket.getAuthTime(),
        kerbTicket.getStartTime(),
        kerbTicket.getEndTime(),
        kerbTicket.getRenewTill(),
        kerbTicket.getClientAddresses());
}
 

private Credentials renewCredentials(Credentials creds)
{
    Credentials lcreds;
    try {
        if (!creds.isRenewable())
            throw new RefreshFailedException("This ticket" +
                            " is not renewable");
        if (System.currentTimeMillis() > cred.getRenewTill().getTime())
            throw new RefreshFailedException("This ticket is past "
                                         + "its last renewal time.");
        lcreds = creds.renew();
        if (debug)
            System.out.println("Renewed Kerberos Ticket");
    } catch (Exception e) {
        lcreds = null;
        if (debug)
            System.out.println("Ticket could not be renewed : "
                            + e.getMessage());
    }
    return lcreds;
}
 

public static KerberosTicket credsToTicket(Credentials serviceCreds) {
    EncryptionKey sessionKey =  serviceCreds.getSessionKey();
    return new KerberosTicket(
        serviceCreds.getEncoded(),
        new KerberosPrincipal(serviceCreds.getClient().getName()),
        new KerberosPrincipal(serviceCreds.getServer().getName(),
                            KerberosPrincipal.KRB_NT_SRV_INST),
        sessionKey.getBytes(),
        sessionKey.getEType(),
        serviceCreds.getFlags(),
        serviceCreds.getAuthTime(),
        serviceCreds.getStartTime(),
        serviceCreds.getEndTime(),
        serviceCreds.getRenewTill(),
        serviceCreds.getClientAddresses());
}
 

public static Credentials ticketToCreds(KerberosTicket kerbTicket)
        throws KrbException, IOException {
    KerberosPrincipal clientAlias = KerberosSecrets
            .getJavaxSecurityAuthKerberosAccess()
            .kerberosTicketGetClientAlias(kerbTicket);
    KerberosPrincipal serverAlias = KerberosSecrets
            .getJavaxSecurityAuthKerberosAccess()
            .kerberosTicketGetServerAlias(kerbTicket);
    return new Credentials(
        kerbTicket.getEncoded(),
        kerbTicket.getClient().getName(),
        (clientAlias != null ? clientAlias.getName() : null),
        kerbTicket.getServer().getName(),
        (serverAlias != null ? serverAlias.getName() : null),
        kerbTicket.getSessionKey().getEncoded(),
        kerbTicket.getSessionKeyType(),
        kerbTicket.getFlags(),
        kerbTicket.getAuthTime(),
        kerbTicket.getStartTime(),
        kerbTicket.getEndTime(),
        kerbTicket.getRenewTill(),
        kerbTicket.getClientAddresses());
}
 

private static boolean isOld(Credentials creds)
{
    Date endTime = creds.getEndTime();
    if (endTime != null) {
        Date authTime = creds.getAuthTime();
        long now = System.currentTimeMillis();
        if (authTime != null) {
            // pass the mid between auth and end
            return now - authTime.getTime() > endTime.getTime() - now;
        } else {
            // will expire in less than 2 hours
            return now <= endTime.getTime() - 1000*3600*2L;
        }
    }
    return false;
}
 

private static KerberosTicket getKerberosTicket ( KerberosPrincipal principal, String password, Long expire ) throws Exception {
    PrincipalName principalName = convertPrincipal(principal);
    KrbAsReqBuilder builder = new KrbAsReqBuilder(principalName, password != null ? password.toCharArray() : new char[0]);

    if ( expire != null ) {
        System.out.println("Request expires " + expire);
        KerberosTime till = new KerberosTime(expire);
        Field tillF = builder.getClass().getDeclaredField("till");
        tillF.setAccessible(true);
        tillF.set(builder, till);
    }

    Credentials creds = builder.action().getCreds();
    builder.destroy();

    KerberosTicket ticket = Krb5Util.credsToTicket(creds);
    System.out.println("Ends " + ticket.getEndTime().getTime());
    return ticket;
}
 

private Credentials renewCredentials(Credentials creds)
{
    Credentials lcreds;
    try {
        if (!creds.isRenewable())
            throw new RefreshFailedException("This ticket" +
                            " is not renewable");
        if (System.currentTimeMillis() > cred.getRenewTill().getTime())
            throw new RefreshFailedException("This ticket is past "
                                         + "its last renewal time.");
        lcreds = creds.renew();
        if (debug)
            System.out.println("Renewed Kerberos Ticket");
    } catch (Exception e) {
        lcreds = null;
        if (debug)
            System.out.println("Ticket could not be renewed : "
                            + e.getMessage());
    }
    return lcreds;
}
 

private Credentials renewCredentials(Credentials creds)
{
    Credentials lcreds;
    try {
        if (!creds.isRenewable())
            throw new RefreshFailedException("This ticket" +
                            " is not renewable");
        if (System.currentTimeMillis() > cred.getRenewTill().getTime())
            throw new RefreshFailedException("This ticket is past "
                                         + "its last renewal time.");
        lcreds = creds.renew();
        if (debug)
            System.out.println("Renewed Kerberos Ticket");
    } catch (Exception e) {
        lcreds = null;
        if (debug)
            System.out.println("Ticket could not be renewed : "
                            + e.getMessage());
    }
    return lcreds;
}
 

/**
 * Saves the tickets to a ccache file.
 *
 * @param file pathname of the ccache file
 * @return true if created, false otherwise.
 */
public boolean ccache(String file) throws Exception {
    Set<KerberosTicket> tickets
            = s.getPrivateCredentials(KerberosTicket.class);
    if (tickets != null && !tickets.isEmpty()) {
        CredentialsCache cc = null;
        for (KerberosTicket t : tickets) {
            Credentials cred = Krb5Util.ticketToCreds(t);
            if (cc == null) {
                cc = CredentialsCache.create(cred.getClient(), file);
            }
            cc.update(cred.toCCacheCreds());
        }
        if (cc != null) {
            cc.save();
            return true;
        }
    }
    return false;
}
 

public static KerberosTicket credsToTicket(Credentials serviceCreds) {
    EncryptionKey sessionKey =  serviceCreds.getSessionKey();
    return new KerberosTicket(
        serviceCreds.getEncoded(),
        new KerberosPrincipal(serviceCreds.getClient().getName()),
        new KerberosPrincipal(serviceCreds.getServer().getName(),
                            KerberosPrincipal.KRB_NT_SRV_INST),
        sessionKey.getBytes(),
        sessionKey.getEType(),
        serviceCreds.getFlags(),
        serviceCreds.getAuthTime(),
        serviceCreds.getStartTime(),
        serviceCreds.getEndTime(),
        serviceCreds.getRenewTill(),
        serviceCreds.getClientAddresses());
}
 

public static KerberosTicket credsToTicket(Credentials serviceCreds) {
    EncryptionKey sessionKey =  serviceCreds.getSessionKey();
    return new KerberosTicket(
        serviceCreds.getEncoded(),
        new KerberosPrincipal(serviceCreds.getClient().getName()),
        new KerberosPrincipal(serviceCreds.getServer().getName(),
                            KerberosPrincipal.KRB_NT_SRV_INST),
        sessionKey.getBytes(),
        sessionKey.getEType(),
        serviceCreds.getFlags(),
        serviceCreds.getAuthTime(),
        serviceCreds.getStartTime(),
        serviceCreds.getEndTime(),
        serviceCreds.getRenewTill(),
        serviceCreds.getClientAddresses());
}
 

public static KerberosTicket credsToTicket(Credentials serviceCreds) {
    EncryptionKey sessionKey =  serviceCreds.getSessionKey();
    return new KerberosTicket(
        serviceCreds.getEncoded(),
        new KerberosPrincipal(serviceCreds.getClient().getName()),
        new KerberosPrincipal(serviceCreds.getServer().getName(),
                            KerberosPrincipal.KRB_NT_SRV_INST),
        sessionKey.getBytes(),
        sessionKey.getEType(),
        serviceCreds.getFlags(),
        serviceCreds.getAuthTime(),
        serviceCreds.getStartTime(),
        serviceCreds.getEndTime(),
        serviceCreds.getRenewTill(),
        serviceCreds.getClientAddresses());
}
 

public Credentials getInitCred() {
    if (destroyed) {
        throw new IllegalStateException("This object is destroyed");
    }
    if (tgt == null) {
        return null;
    }
    try {
        return Krb5Util.ticketToCreds(tgt);
    } catch (KrbException | IOException e) {
        return null;
    }
}
 

private static boolean isCurrent(Credentials creds)
{
    Date endTime = creds.getEndTime();
    if (endTime != null) {
        return (System.currentTimeMillis() <= endTime.getTime());
    }
    return true;
}
 

public Credentials getInitCred() {
    if (destroyed) {
        throw new IllegalStateException("This object is destroyed");
    }
    if (tgt == null) {
        return null;
    }
    try {
        return Krb5Util.ticketToCreds(tgt);
    } catch (KrbException | IOException e) {
        return null;
    }
}
 

private static boolean isCurrent(Credentials creds)
{
    Date endTime = creds.getEndTime();
    if (endTime != null) {
        return (System.currentTimeMillis() <= endTime.getTime());
    }
    return true;
}