org.ietf.jgss.Oid Java Examples
The following examples show how to use
org.ietf.jgss.Oid.
You can vote up the ones you like or vote down the ones you don't like,
and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example #1
| Source File: KerberosUtil.java From zeppelin with Apache License 2.0 | 6 votes |
|
public static Oid getOidInstance(String oidName)
throws ClassNotFoundException, GSSException, NoSuchFieldException,
IllegalAccessException {
Class<?> oidClass;
if (IBM_JAVA) {
if ("NT_GSS_KRB5_PRINCIPAL".equals(oidName)) {
// IBM JDK GSSUtil class does not have field for krb5 principal oid
return new Oid("1.2.840.113554.1.2.2.1");
}
oidClass = Class.forName("com.ibm.security.jgss.GSSUtil");
} else {
oidClass = Class.forName("sun.security.jgss.GSSUtil");
}
Field oidField = oidClass.getDeclaredField(oidName);
return (Oid)oidField.get(oidClass);
}
Example #2
| Source File: SpnegoLifeTime.java From TencentKona-8 with GNU General Public License v2.0 | 6 votes |
|
public static void main(String[] args) throws Exception {
Oid oid = GSSUtil.GSS_SPNEGO_MECH_OID;
new OneKDC(null).writeJAASConf();
Context c, s;
c = Context.fromJAAS("client");
s = Context.fromJAAS("server");
c.startAsClient(OneKDC.SERVER, oid);
c.x().requestCredDeleg(true);
s.startAsServer(oid);
Context.handshake(c, s);
GSSCredential cred = s.delegated().cred();
cred.getRemainingInitLifetime(oid);
cred.getUsage(oid);
}
Example #3
| Source File: KerberosUtil.java From registry with Apache License 2.0 | 6 votes |
|
public static Oid getOidInstance(String oidName)
throws ClassNotFoundException, GSSException, NoSuchFieldException,
IllegalAccessException {
Class<?> oidClass;
if (IBM_JAVA) {
if ("NT_GSS_KRB5_PRINCIPAL".equals(oidName)) {
// IBM JDK GSSUtil class does not have field for krb5 principal oid
return new Oid("1.2.840.113554.1.2.2.1");
}
oidClass = Class.forName("com.ibm.security.jgss.GSSUtil");
} else {
oidClass = Class.forName("sun.security.jgss.GSSUtil");
}
Field oidField = oidClass.getDeclaredField(oidName);
return (Oid) oidField.get(oidClass);
}
Example #4
| Source File: Context.java From openjdk-jdk8u with GNU General Public License v2.0 | 6 votes |
|
/**
* Starts as a client
* @param target communication peer
* @param mech GSS mech
* @throws java.lang.Exception
*/
public void startAsClient(final String target, final Oid mech) throws Exception {
doAs(new Action() {
@Override
public byte[] run(Context me, byte[] dummy) throws Exception {
GSSManager m = GSSManager.getInstance();
me.x = (ExtendedGSSContext)m.createContext(
target.indexOf('@') < 0 ?
m.createName(target, null) :
m.createName(target, GSSName.NT_HOSTBASED_SERVICE),
mech,
cred,
GSSContext.DEFAULT_LIFETIME);
return null;
}
}, null);
}
Example #5
| Source File: OidFormat.java From openjdk-8 with GNU General Public License v2.0 | 6 votes |
|
static void testBad(String s) throws Exception {
System.err.println("Trying " + s);
try {
new ObjectIdentifier(s);
throw new Exception("should be invalid ObjectIdentifier");
} catch (IOException ioe) {
System.err.println(ioe);
}
try {
new Oid(s);
throw new Exception("should be invalid Oid");
} catch (GSSException gsse) {
;
}
try {
new EncryptedPrivateKeyInfo(s, new byte[8]);
throw new Exception("should be invalid algorithm");
} catch (NoSuchAlgorithmException e) {
;
}
}
Example #6
| Source File: SecurityRealmService.java From wildfly-core with GNU Lesser General Public License v2.1 | 6 votes |
|
private GSSKerberosCredential getGSSKerberosCredential(final String protocol, final String forHost)
throws GeneralSecurityException {
SubjectIdentity subjectIdentity = getSubjectIdentity(protocol, forHost);
if (subjectIdentity == null) {
throw ROOT_LOGGER.noSubjectIdentityForProtocolAndHost(protocol, forHost);
}
final GSSManager manager = GSSManager.getInstance();
try {
GSSCredential gssCredential = Subject.doAs(subjectIdentity.getSubject(),
(PrivilegedExceptionAction<GSSCredential>) () -> manager.createCredential(null,
GSSCredential.DEFAULT_LIFETIME, new Oid[] { KERBEROS_V5, SPNEGO }, GSSCredential.ACCEPT_ONLY));
return new GSSKerberosCredential(gssCredential);
} catch (PrivilegedActionException e) {
throw new GeneralSecurityException(e.getCause());
}
}
Example #7
| Source File: Context.java From jdk8u60 with GNU General Public License v2.0 | 6 votes |
|
/**
* Starts as a client
* @param target communication peer
* @param mech GSS mech
* @throws java.lang.Exception
*/
public void startAsClient(final String target, final Oid mech) throws Exception {
doAs(new Action() {
@Override
public byte[] run(Context me, byte[] dummy) throws Exception {
GSSManager m = GSSManager.getInstance();
me.x = (ExtendedGSSContext)m.createContext(
target.indexOf('@') < 0 ?
m.createName(target, null) :
m.createName(target, GSSName.NT_HOSTBASED_SERVICE),
mech,
cred,
GSSContext.DEFAULT_LIFETIME);
return null;
}
}, null);
}
Example #8
| Source File: Context.java From jdk8u60 with GNU General Public License v2.0 | 6 votes |
|
/**
* Starts as a server with the specified service name
* @param name the service name
* @param mech GSS mech
* @throws java.lang.Exception
*/
public void startAsServer(final String name, final Oid mech, final boolean asInitiator) throws Exception {
doAs(new Action() {
@Override
public byte[] run(Context me, byte[] dummy) throws Exception {
GSSManager m = GSSManager.getInstance();
me.cred = m.createCredential(
name == null ? null :
(name.indexOf('@') < 0 ?
m.createName(name, null) :
m.createName(name, GSSName.NT_HOSTBASED_SERVICE)),
GSSCredential.INDEFINITE_LIFETIME,
mech,
asInitiator?
GSSCredential.INITIATE_AND_ACCEPT:
GSSCredential.ACCEPT_ONLY);
me.x = (ExtendedGSSContext)m.createContext(me.cred);
return null;
}
}, null);
}
Example #9
| Source File: SpnegoLifeTime.java From jdk8u-jdk with GNU General Public License v2.0 | 6 votes |
|
public static void main(String[] args) throws Exception {
Oid oid = GSSUtil.GSS_SPNEGO_MECH_OID;
new OneKDC(null).writeJAASConf();
Context c, s;
c = Context.fromJAAS("client");
s = Context.fromJAAS("server");
c.startAsClient(OneKDC.SERVER, oid);
c.x().requestCredDeleg(true);
s.startAsServer(oid);
Context.handshake(c, s);
GSSCredential cred = s.delegated().cred();
cred.getRemainingInitLifetime(oid);
cred.getUsage(oid);
}
Example #10
| Source File: KerberosUtil.java From big-c with Apache License 2.0 | 6 votes |
|
public static Oid getOidInstance(String oidName)
throws ClassNotFoundException, GSSException, NoSuchFieldException,
IllegalAccessException {
Class<?> oidClass;
if (IBM_JAVA) {
if ("NT_GSS_KRB5_PRINCIPAL".equals(oidName)) {
// IBM JDK GSSUtil class does not have field for krb5 principal oid
return new Oid("1.2.840.113554.1.2.2.1");
}
oidClass = Class.forName("com.ibm.security.jgss.GSSUtil");
} else {
oidClass = Class.forName("sun.security.jgss.GSSUtil");
}
Field oidField = oidClass.getDeclaredField(oidName);
return (Oid)oidField.get(oidClass);
}
Example #11
| Source File: OidFormat.java From jdk8u60 with GNU General Public License v2.0 | 6 votes |
|
static void testBad(String s) throws Exception {
System.err.println("Trying " + s);
try {
new ObjectIdentifier(s);
throw new Exception("should be invalid ObjectIdentifier");
} catch (IOException ioe) {
System.err.println(ioe);
}
try {
new Oid(s);
throw new Exception("should be invalid Oid");
} catch (GSSException gsse) {
;
}
try {
new EncryptedPrivateKeyInfo(s, new byte[8]);
throw new Exception("should be invalid algorithm");
} catch (NoSuchAlgorithmException e) {
;
}
}
Example #12
| Source File: Kerb5Context.java From jcifs-ng with GNU Lesser General Public License v2.1 | 5 votes |
|
Kerb5Context ( String host, String service, String name, int userLifetime, int contextLifetime, String realm ) throws GSSException {
GSSManager manager = GSSManager.getInstance();
GSSCredential clientCreds = null;
Oid mechOid = JGSS_KRB5_MECH_OID;
if ( realm != null ) {
this.serviceName = manager.createName(service + "/" + host + "@" + realm, JGSS_KRB5_NAME_OID, mechOid);
}
else {
this.serviceName = manager.createName(service + "@" + host, GSSName.NT_HOSTBASED_SERVICE, mechOid);
}
if ( log.isDebugEnabled() ) {
log.debug("Service name is " + this.serviceName);
}
if ( name != null ) {
this.clientName = manager.createName(name, GSSName.NT_USER_NAME, mechOid);
clientCreds = manager.createCredential(this.clientName, userLifetime, mechOid, GSSCredential.INITIATE_ONLY);
}
else {
this.clientName = null;
}
this.gssContext = manager.createContext(this.serviceName, mechOid, clientCreds, contextLifetime);
this.gssContext.requestAnonymity(false);
this.gssContext.requestSequenceDet(false);
this.gssContext.requestConf(false);
this.gssContext.requestInteg(false);
this.gssContext.requestReplayDet(false);
// per spec these should be set
this.gssContext.requestMutualAuth(true);
this.gssContext.requestCredDeleg(true);
}
Example #13
| Source File: S4U2selfGSS.java From openjdk-jdk8u with GNU General Public License v2.0 | 5 votes |
|
public static void main(String[] args) throws Exception {
Oid mech;
if (args[0].equals("spnego")) {
mech = GSSUtil.GSS_SPNEGO_MECH_OID;
} else if (args[0].contains("krb5")) {
mech = GSSUtil.GSS_KRB5_MECH_OID;
} else {
throw new Exception("Unknown mech");
}
OneKDC kdc = new OneKDC(null);
kdc.writeJAASConf();
kdc.setOption(KDC.Option.ALLOW_S4U2SELF, Arrays.asList(
new String[]{OneKDC.USER + "@" + OneKDC.REALM}));
Map<String,List<String>> map = new HashMap<>();
map.put(OneKDC.USER + "@" + OneKDC.REALM, Arrays.asList(
new String[]{OneKDC.SERVER + "@" + OneKDC.REALM}));
kdc.setOption(KDC.Option.ALLOW_S4U2PROXY, map);
Context c, s;
System.setProperty("javax.security.auth.useSubjectCredsOnly", "false");
c = Context.fromThinAir();
s = Context.fromThinAir();
c = c.impersonate(OneKDC.USER2);
c.startAsClient(OneKDC.SERVER, mech);
s.startAsServer(mech);
Context.handshake(c, s);
String n1 = c.x().getSrcName().toString().split("@")[0];
String n2 = s.x().getSrcName().toString().split("@")[0];
if (!n1.equals(OneKDC.USER2) || !n2.equals(OneKDC.USER2)) {
throw new Exception("Impersonate failed");
}
s.dispose();
c.dispose();
}
Example #14
| Source File: GSSLibStub.java From hottub with GNU General Public License v2.0 | 5 votes |
|
static GSSLibStub getInstance(Oid mech) throws GSSException {
GSSLibStub s = table.get(mech);
if (s == null) {
s = new GSSLibStub(mech);
table.put(mech, s);
}
return s;
}
Example #15
| Source File: S4U2selfAsServer.java From openjdk-jdk8u with GNU General Public License v2.0 | 5 votes |
|
public static void main(String[] args) throws Exception {
Oid mech;
if (args[0].equals("spnego")) {
mech = GSSUtil.GSS_SPNEGO_MECH_OID;
} else if (args[0].contains("krb5")) {
mech = GSSUtil.GSS_KRB5_MECH_OID;
} else {
throw new Exception("Unknown mech");
}
OneKDC kdc = new OneKDC(null);
kdc.writeJAASConf();
kdc.setOption(KDC.Option.PREAUTH_REQUIRED, false);
Map<String,List<String>> map = new HashMap<>();
map.put(OneKDC.SERVER + "@" + OneKDC.REALM, Arrays.asList(
new String[]{OneKDC.BACKEND + "@" + OneKDC.REALM}));
kdc.setOption(KDC.Option.ALLOW_S4U2PROXY, map);
kdc.setOption(KDC.Option.ALLOW_S4U2SELF, Arrays.asList(
new String[]{OneKDC.SERVER + "@" + OneKDC.REALM}));
Context s, b;
s = Context.fromJAAS("server");
b = Context.fromJAAS("backend");
s.startAsServer(null, mech, false);
Context p = s.impersonate(OneKDC.USER);
p.startAsClient(OneKDC.BACKEND, mech);
b.startAsServer(mech);
Context.handshake(p, b);
p.startAsClient(OneKDC.BACKEND, mech);
b.startAsServer(mech);
Context.handshake(p, b);
}
Example #16
| Source File: JgssIntegrationTest.java From tutorials with MIT License | 5 votes |
|
@Before
public void setUp() throws SaslException, GSSException {
GSSManager manager = GSSManager.getInstance();
serverContext = manager.createContext((GSSCredential) null);
String serverPrinciple = SERVER_PRINCIPAL;
GSSName serverName = manager.createName(serverPrinciple, null);
Oid krb5Oid = new Oid(MECHANISM);
clientContext = manager.createContext(serverName, krb5Oid, (GSSCredential) null, GSSContext.DEFAULT_LIFETIME);
clientContext.requestMutualAuth(true);
clientContext.requestConf(true);
clientContext.requestInteg(true);
}
Example #17
| Source File: S4U2selfAsServer.java From jdk8u-jdk with GNU General Public License v2.0 | 5 votes |
|
public static void main(String[] args) throws Exception {
Oid mech;
if (args[0].equals("spnego")) {
mech = GSSUtil.GSS_SPNEGO_MECH_OID;
} else if (args[0].contains("krb5")) {
mech = GSSUtil.GSS_KRB5_MECH_OID;
} else {
throw new Exception("Unknown mech");
}
OneKDC kdc = new OneKDC(null);
kdc.writeJAASConf();
kdc.setOption(KDC.Option.PREAUTH_REQUIRED, false);
Map<String,List<String>> map = new HashMap<>();
map.put(OneKDC.SERVER + "@" + OneKDC.REALM, Arrays.asList(
new String[]{OneKDC.BACKEND + "@" + OneKDC.REALM}));
kdc.setOption(KDC.Option.ALLOW_S4U2PROXY, map);
kdc.setOption(KDC.Option.ALLOW_S4U2SELF, Arrays.asList(
new String[]{OneKDC.SERVER + "@" + OneKDC.REALM}));
Context s, b;
s = Context.fromJAAS("server");
b = Context.fromJAAS("backend");
s.startAsServer(null, mech, false);
Context p = s.impersonate(OneKDC.USER);
p.startAsClient(OneKDC.BACKEND, mech);
b.startAsServer(mech);
Context.handshake(p, b);
p.startAsClient(OneKDC.BACKEND, mech);
b.startAsServer(mech);
Context.handshake(p, b);
}
Example #18
| Source File: GSSLibStub.java From jdk8u_jdk with GNU General Public License v2.0 | 5 votes |
|
static GSSLibStub getInstance(Oid mech) throws GSSException {
GSSLibStub s = table.get(mech);
if (s == null) {
s = new GSSLibStub(mech);
table.put(mech, s);
}
return s;
}
Example #19
| Source File: GSSLibStub.java From dragonwell8_jdk with GNU General Public License v2.0 | 5 votes |
|
static GSSLibStub getInstance(Oid mech) throws GSSException {
GSSLibStub s = table.get(mech);
if (s == null) {
s = new GSSLibStub(mech);
table.put(mech, s);
}
return s;
}
Example #20
| Source File: S4U2selfAsServer.java From openjdk-8 with GNU General Public License v2.0 | 5 votes |
|
public static void main(String[] args) throws Exception {
Oid mech;
if (args[0].equals("spnego")) {
mech = GSSUtil.GSS_SPNEGO_MECH_OID;
} else if (args[0].contains("krb5")) {
mech = GSSUtil.GSS_KRB5_MECH_OID;
} else {
throw new Exception("Unknown mech");
}
OneKDC kdc = new OneKDC(null);
kdc.writeJAASConf();
kdc.setOption(KDC.Option.PREAUTH_REQUIRED, false);
Map<String,List<String>> map = new HashMap<>();
map.put(OneKDC.SERVER + "@" + OneKDC.REALM, Arrays.asList(
new String[]{OneKDC.BACKEND + "@" + OneKDC.REALM}));
kdc.setOption(KDC.Option.ALLOW_S4U2PROXY, map);
kdc.setOption(KDC.Option.ALLOW_S4U2SELF, Arrays.asList(
new String[]{OneKDC.SERVER + "@" + OneKDC.REALM}));
Context s, b;
s = Context.fromJAAS("server");
b = Context.fromJAAS("backend");
s.startAsServer(null, mech, false);
Context p = s.impersonate(OneKDC.USER);
p.startAsClient(OneKDC.BACKEND, mech);
b.startAsServer(mech);
Context.handshake(p, b);
p.startAsClient(OneKDC.BACKEND, mech);
b.startAsServer(mech);
Context.handshake(p, b);
}
Example #21
| Source File: S4U2selfAsServer.java From jdk8u_jdk with GNU General Public License v2.0 | 5 votes |
|
public static void main(String[] args) throws Exception {
Oid mech;
if (args[0].equals("spnego")) {
mech = GSSUtil.GSS_SPNEGO_MECH_OID;
} else if (args[0].contains("krb5")) {
mech = GSSUtil.GSS_KRB5_MECH_OID;
} else {
throw new Exception("Unknown mech");
}
OneKDC kdc = new OneKDC(null);
kdc.writeJAASConf();
kdc.setOption(KDC.Option.PREAUTH_REQUIRED, false);
Map<String,List<String>> map = new HashMap<>();
map.put(OneKDC.SERVER + "@" + OneKDC.REALM, Arrays.asList(
new String[]{OneKDC.BACKEND + "@" + OneKDC.REALM}));
kdc.setOption(KDC.Option.ALLOW_S4U2PROXY, map);
kdc.setOption(KDC.Option.ALLOW_S4U2SELF, Arrays.asList(
new String[]{OneKDC.SERVER + "@" + OneKDC.REALM}));
Context s, b;
s = Context.fromJAAS("server");
b = Context.fromJAAS("backend");
s.startAsServer(null, mech, false);
Context p = s.impersonate(OneKDC.USER);
p.startAsClient(OneKDC.BACKEND, mech);
b.startAsServer(mech);
Context.handshake(p, b);
p.startAsClient(OneKDC.BACKEND, mech);
b.startAsServer(mech);
Context.handshake(p, b);
}
Example #22
| Source File: S4U2proxy.java From openjdk-8 with GNU General Public License v2.0 | 5 votes |
|
public static void main(String[] args) throws Exception {
Oid mech;
if (args[0].equals("spnego")) {
mech = GSSUtil.GSS_SPNEGO_MECH_OID;
} else if (args[0].contains("krb5")) {
mech = GSSUtil.GSS_KRB5_MECH_OID;
} else {
throw new Exception("Unknown mech");
}
OneKDC kdc = new OneKDC(null);
kdc.writeJAASConf();
kdc.setOption(KDC.Option.PREAUTH_REQUIRED, false);
Map<String,List<String>> map = new HashMap<>();
map.put(OneKDC.SERVER + "@" + OneKDC.REALM, Arrays.asList(
new String[]{OneKDC.BACKEND + "@" + OneKDC.REALM}));
kdc.setOption(KDC.Option.ALLOW_S4U2PROXY, map);
Context c, s, b;
c = Context.fromJAAS("client");
s = Context.fromJAAS("server");
b = Context.fromJAAS("backend");
c.startAsClient(OneKDC.SERVER, mech);
s.startAsServer(null, mech, false);
Context.handshake(c, s);
Context p = s.delegated();
p.startAsClient(OneKDC.BACKEND, mech);
b.startAsServer(mech);
Context.handshake(p, b);
p.startAsClient(OneKDC.BACKEND, mech);
b.startAsServer(mech);
Context.handshake(p, b);
}
Example #23
| Source File: S4U2selfGSS.java From jdk8u-jdk with GNU General Public License v2.0 | 5 votes |
|
public static void main(String[] args) throws Exception {
Oid mech;
if (args[0].equals("spnego")) {
mech = GSSUtil.GSS_SPNEGO_MECH_OID;
} else if (args[0].contains("krb5")) {
mech = GSSUtil.GSS_KRB5_MECH_OID;
} else {
throw new Exception("Unknown mech");
}
OneKDC kdc = new OneKDC(null);
kdc.writeJAASConf();
kdc.setOption(KDC.Option.ALLOW_S4U2SELF, Arrays.asList(
new String[]{OneKDC.USER + "@" + OneKDC.REALM}));
Map<String,List<String>> map = new HashMap<>();
map.put(OneKDC.USER + "@" + OneKDC.REALM, Arrays.asList(
new String[]{OneKDC.SERVER + "@" + OneKDC.REALM}));
kdc.setOption(KDC.Option.ALLOW_S4U2PROXY, map);
Context c, s;
System.setProperty("javax.security.auth.useSubjectCredsOnly", "false");
c = Context.fromThinAir();
s = Context.fromThinAir();
c = c.impersonate(OneKDC.USER2);
c.startAsClient(OneKDC.SERVER, mech);
s.startAsServer(mech);
Context.handshake(c, s);
String n1 = c.x().getSrcName().toString().split("@")[0];
String n2 = s.x().getSrcName().toString().split("@")[0];
if (!n1.equals(OneKDC.USER2) || !n2.equals(OneKDC.USER2)) {
throw new Exception("Impersonate failed");
}
s.dispose();
c.dispose();
}
Example #24
| Source File: S4U2selfGSS.java From TencentKona-8 with GNU General Public License v2.0 | 5 votes |
|
public static void main(String[] args) throws Exception {
Oid mech;
if (args[0].equals("spnego")) {
mech = GSSUtil.GSS_SPNEGO_MECH_OID;
} else if (args[0].contains("krb5")) {
mech = GSSUtil.GSS_KRB5_MECH_OID;
} else {
throw new Exception("Unknown mech");
}
OneKDC kdc = new OneKDC(null);
kdc.writeJAASConf();
kdc.setOption(KDC.Option.ALLOW_S4U2SELF, Arrays.asList(
new String[]{OneKDC.USER + "@" + OneKDC.REALM}));
Map<String,List<String>> map = new HashMap<>();
map.put(OneKDC.USER + "@" + OneKDC.REALM, Arrays.asList(
new String[]{OneKDC.SERVER + "@" + OneKDC.REALM}));
kdc.setOption(KDC.Option.ALLOW_S4U2PROXY, map);
Context c, s;
System.setProperty("javax.security.auth.useSubjectCredsOnly", "false");
c = Context.fromThinAir();
s = Context.fromThinAir();
c = c.impersonate(OneKDC.USER2);
c.startAsClient(OneKDC.SERVER, mech);
s.startAsServer(mech);
Context.handshake(c, s);
String n1 = c.x().getSrcName().toString().split("@")[0];
String n2 = s.x().getSrcName().toString().split("@")[0];
if (!n1.equals(OneKDC.USER2) || !n2.equals(OneKDC.USER2)) {
throw new Exception("Impersonate failed");
}
s.dispose();
c.dispose();
}
Example #25
| Source File: GSSLibStub.java From jdk8u-dev-jdk with GNU General Public License v2.0 | 5 votes |
|
static GSSLibStub getInstance(Oid mech) throws GSSException {
GSSLibStub s = table.get(mech);
if (s == null) {
s = new GSSLibStub(mech);
table.put(mech, s);
}
return s;
}
Example #26
| Source File: S4U2selfGSS.java From jdk8u_jdk with GNU General Public License v2.0 | 5 votes |
|
public static void main(String[] args) throws Exception {
Oid mech;
if (args[0].equals("spnego")) {
mech = GSSUtil.GSS_SPNEGO_MECH_OID;
} else if (args[0].contains("krb5")) {
mech = GSSUtil.GSS_KRB5_MECH_OID;
} else {
throw new Exception("Unknown mech");
}
OneKDC kdc = new OneKDC(null);
kdc.writeJAASConf();
kdc.setOption(KDC.Option.ALLOW_S4U2SELF, Arrays.asList(
new String[]{OneKDC.USER + "@" + OneKDC.REALM}));
Map<String,List<String>> map = new HashMap<>();
map.put(OneKDC.USER + "@" + OneKDC.REALM, Arrays.asList(
new String[]{OneKDC.SERVER + "@" + OneKDC.REALM}));
kdc.setOption(KDC.Option.ALLOW_S4U2PROXY, map);
Context c, s;
System.setProperty("javax.security.auth.useSubjectCredsOnly", "false");
c = Context.fromThinAir();
s = Context.fromThinAir();
c = c.impersonate(OneKDC.USER2);
c.startAsClient(OneKDC.SERVER, mech);
s.startAsServer(mech);
Context.handshake(c, s);
String n1 = c.x().getSrcName().toString().split("@")[0];
String n2 = s.x().getSrcName().toString().split("@")[0];
if (!n1.equals(OneKDC.USER2) || !n2.equals(OneKDC.USER2)) {
throw new Exception("Impersonate failed");
}
s.dispose();
c.dispose();
}
Example #27
| Source File: S4U2selfAsServer.java From openjdk-jdk9 with GNU General Public License v2.0 | 5 votes |
|
public static void main(String[] args) throws Exception {
Oid mech;
if (args[0].equals("spnego")) {
mech = GSSUtil.GSS_SPNEGO_MECH_OID;
} else if (args[0].contains("krb5")) {
mech = GSSUtil.GSS_KRB5_MECH_OID;
} else {
throw new Exception("Unknown mech");
}
OneKDC kdc = new OneKDC(null);
kdc.writeJAASConf();
kdc.setOption(KDC.Option.PREAUTH_REQUIRED, false);
Map<String,List<String>> map = new HashMap<>();
map.put(OneKDC.SERVER + "@" + OneKDC.REALM, Arrays.asList(
new String[]{OneKDC.BACKEND + "@" + OneKDC.REALM}));
kdc.setOption(KDC.Option.ALLOW_S4U2PROXY, map);
kdc.setOption(KDC.Option.ALLOW_S4U2SELF, Arrays.asList(
new String[]{OneKDC.SERVER + "@" + OneKDC.REALM}));
Context s, b;
s = Context.fromJAAS("server");
b = Context.fromJAAS("backend");
s.startAsServer(null, mech, false);
Context p = s.impersonate(OneKDC.USER);
p.startAsClient(OneKDC.BACKEND, mech);
b.startAsServer(mech);
Context.handshake(p, b);
p.startAsClient(OneKDC.BACKEND, mech);
b.startAsServer(mech);
Context.handshake(p, b);
}
Example #28
| Source File: AbstractSpnegoNegotiatorTest.java From elasticsearch-hadoop with Apache License 2.0 | 4 votes |
|
@Test
public void testSuccessfulNegotiate() throws IOException, GSSException, InterruptedException {
// Mechanisms
final GSSManager gssManager = GSSManager.getInstance();
final Oid spnegoOid = new Oid("1.3.6.1.5.5.2");
// Configure logins
Configuration configuration = new Configuration();
SecurityUtil.setAuthenticationMethod(UserGroupInformation.AuthenticationMethod.KERBEROS, configuration);
UserGroupInformation.setConfiguration(configuration);
// Login as Server
UserGroupInformation server = UserGroupInformation.loginUserFromKeytabAndReturnUGI(KerberosSuite.PRINCIPAL_SERVER, KEYTAB_FILE.getAbsolutePath());
final GSSName gssServicePrincipalName = gssManager.createName(KerberosSuite.PRINCIPAL_SERVER, GSSName.NT_USER_NAME);
final GSSCredential gssServiceCredential = server.doAs(new PrivilegedExceptionAction<GSSCredential>() {
@Override
public GSSCredential run() throws Exception {
return gssManager.createCredential(
gssServicePrincipalName,
GSSCredential.DEFAULT_LIFETIME,
spnegoOid,
GSSCredential.ACCEPT_ONLY
);
}
});
final GSSContext serverCtx = gssManager.createContext(gssServiceCredential);
// Login as Client and Create negotiator
UserGroupInformation client = UserGroupInformation.loginUserFromKeytabAndReturnUGI(KerberosSuite.PRINCIPAL_CLIENT, KEYTAB_FILE.getAbsolutePath());
final SpnegoNegotiator spnegoNegotiator = client.doAs(new PrivilegedExceptionAction<SpnegoNegotiator>() {
@Override
public SpnegoNegotiator run() throws Exception {
return new SpnegoNegotiator(KerberosSuite.PRINCIPAL_CLIENT, KerberosSuite.PRINCIPAL_SERVER);
}
});
byte[] token = new byte[0];
boolean authenticated = false;
for (int idx = 0; idx < 100; idx++) {
if (!spnegoNegotiator.established()) {
if (token.length > 0) {
spnegoNegotiator.setTokenData(Base64.encodeBase64String(token));
}
String baseToken = client.doAs(new PrivilegedExceptionAction<String>() {
@Override
public String run() throws Exception {
return spnegoNegotiator.send();
}
});
token = Base64.decodeBase64(baseToken);
}
if (!spnegoNegotiator.established() && serverCtx.isEstablished()) {
fail("Server is established, but client is not.");
}
if (!serverCtx.isEstablished()) {
final byte[] currentToken = token;
token = server.doAs(new PrivilegedExceptionAction<byte[]>() {
@Override
public byte[] run() throws Exception {
return serverCtx.acceptSecContext(currentToken, 0, currentToken.length);
}
});
}
if (serverCtx.isEstablished() && spnegoNegotiator.established()) {
authenticated = true;
break;
}
}
assertThat(authenticated, is(true));
assertThat(serverCtx.isEstablished(), is(true));
assertThat(spnegoNegotiator.established(), is(true));
spnegoNegotiator.close();
assertThat(spnegoNegotiator.established(), is(false));
}
Example #29
| Source File: S4U2proxy.java From TencentKona-8 with GNU General Public License v2.0 | 4 votes |
|
public static void main(String[] args) throws Exception {
Oid mech;
if (args[0].equals("spnego")) {
mech = GSSUtil.GSS_SPNEGO_MECH_OID;
} else if (args[0].contains("krb5")) {
mech = GSSUtil.GSS_KRB5_MECH_OID;
} else {
throw new Exception("Unknown mech");
}
OneKDC kdc = new OneKDC(null);
kdc.writeJAASConf();
kdc.setOption(KDC.Option.PREAUTH_REQUIRED, false);
Map<String,List<String>> map = new HashMap<>();
map.put(OneKDC.SERVER + "@" + OneKDC.REALM, Arrays.asList(
new String[]{OneKDC.BACKEND + "@" + OneKDC.REALM}));
kdc.setOption(KDC.Option.ALLOW_S4U2PROXY, map);
Context c, s, b;
c = Context.fromJAAS("client");
s = Context.fromJAAS("server");
b = Context.fromJAAS("backend");
c.startAsClient(OneKDC.SERVER, mech);
s.startAsServer(null, mech, false);
Context.handshake(c, s);
Context p = s.delegated();
p.startAsClient(OneKDC.BACKEND, mech);
// 8044215: requestCredDeleg is useless and harmless
p.x().requestCredDeleg(true);
b.startAsServer(mech);
Context.handshake(p, b);
p.startAsClient(OneKDC.BACKEND, mech);
b.startAsServer(mech);
Context.handshake(p, b);
}
Example #30
| Source File: S4U2self.java From TencentKona-8 with GNU General Public License v2.0 | 4 votes |
|
public static void main(String[] args) throws Exception {
// Test case, different policy settings in KDC:
// | ALLOW_S4U2SELF on
// | USER USER2 none
// ALLOW_S4U2PORXY |-------------------------
// USER to BACKEND | 0 1 2
// USER2 to BACKEND | 3
// USER to SERVER | 4
// none | 5
//
// 0 should succeed, all other fail
int test = 0;
Oid mech;
if (args[0].equals("spnego")) {
mech = GSSUtil.GSS_SPNEGO_MECH_OID;
} else if (args[0].contains("krb5")) {
mech = GSSUtil.GSS_KRB5_MECH_OID;
test = Integer.parseInt(args[1]);
} else {
throw new Exception("Unknown mech");
}
OneKDC kdc = new OneKDC(null);
kdc.writeJAASConf();
switch (test) {
case 1:
kdc.setOption(KDC.Option.ALLOW_S4U2SELF, Arrays.asList(
new String[]{OneKDC.USER2 + "@" + OneKDC.REALM}));
break;
case 2:
// No S4U2self
break;
default:
kdc.setOption(KDC.Option.ALLOW_S4U2SELF, Arrays.asList(
new String[]{OneKDC.USER + "@" + OneKDC.REALM}));
break;
}
Map<String,List<String>> map = new HashMap<>();
switch (test) {
case 3:
map.put(OneKDC.USER2 + "@" + OneKDC.REALM, Arrays.asList(
new String[]{OneKDC.BACKEND + "@" + OneKDC.REALM}));
kdc.setOption(KDC.Option.ALLOW_S4U2PROXY, map);
break;
case 4:
map.put(OneKDC.USER + "@" + OneKDC.REALM, Arrays.asList(
new String[]{OneKDC.SERVER + "@" + OneKDC.REALM}));
kdc.setOption(KDC.Option.ALLOW_S4U2PROXY, map);
break;
case 5:
// No S4U2proxy set
break;
default:
map.put(OneKDC.USER + "@" + OneKDC.REALM, Arrays.asList(
new String[]{OneKDC.BACKEND + "@" + OneKDC.REALM}));
kdc.setOption(KDC.Option.ALLOW_S4U2PROXY, map);
break;
}
Context c, s;
c = Context.fromJAAS("client");
c = c.impersonate(OneKDC.USER2);
c.status();
c.startAsClient(OneKDC.BACKEND, mech);
s = Context.fromJAAS("backend");
s.startAsServer(mech);
Context.handshake(c, s);
Context.transmit("i say high --", c, s);
Context.transmit(" you say low", s, c);
c.status();
s.status();
String n1 = c.x().getSrcName().toString().split("@")[0];
String n2 = s.x().getSrcName().toString().split("@")[0];
if (!n1.equals(OneKDC.USER2) || !n2.equals(OneKDC.USER2)) {
throw new Exception("Impersonate failed");
}
s.dispose();
c.dispose();
}
