Java Code Examples for sun.security.krb5.Credentials#acquireServiceCreds()

The following examples show how to use sun.security.krb5.Credentials#acquireServiceCreds() . You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example 1
Source File: Krb5Util.java    From dragonwell8_jdk with GNU General Public License v2.0 4 votes vote down vote up 
/**
 * Retrieve the service ticket for serverPrincipal from caller's Subject
 * or from Subject obtained by logging in, or if not found, via the
 * Ticket Granting Service using the TGT obtained from the Subject.
 *
 * Caller must have permission to:
 *    - access and update Subject's private credentials
 *    - create LoginContext
 *    - read the auth.login.defaultCallbackHandler security property
 *
 * NOTE: This method is used by JSSE Kerberos Cipher Suites
 */
public static KerberosTicket getTicketFromSubjectAndTgs(GSSCaller caller,
    String clientPrincipal, String serverPrincipal, String tgsPrincipal,
    AccessControlContext acc)
    throws LoginException, KrbException, IOException {

    // 1. Try to find service ticket in acc subject
    Subject accSubj = Subject.getSubject(acc);
    KerberosTicket ticket = SubjectComber.find(accSubj,
        serverPrincipal, clientPrincipal, KerberosTicket.class);

    if (ticket != null) {
        return ticket;  // found it
    }

    Subject loginSubj = null;
    if (!GSSUtil.useSubjectCredsOnly(caller)) {
        // 2. Try to get ticket from login
        try {
            loginSubj = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
            ticket = SubjectComber.find(loginSubj,
                serverPrincipal, clientPrincipal, KerberosTicket.class);
            if (ticket != null) {
                return ticket; // found it
            }
        } catch (LoginException e) {
            // No login entry to use
            // ignore and continue
        }
    }

    // Service ticket not found in subject or login
    // Try to get TGT to acquire service ticket

    // 3. Try to get TGT from acc subject
    KerberosTicket tgt = SubjectComber.find(accSubj,
        tgsPrincipal, clientPrincipal, KerberosTicket.class);

    boolean fromAcc;
    if (tgt == null && loginSubj != null) {
        // 4. Try to get TGT from login subject
        tgt = SubjectComber.find(loginSubj,
            tgsPrincipal, clientPrincipal, KerberosTicket.class);
        fromAcc = false;
    } else {
        fromAcc = true;
    }

    // 5. Try to get service ticket using TGT
    if (tgt != null) {
        Credentials tgtCreds = ticketToCreds(tgt);
        Credentials serviceCreds = Credentials.acquireServiceCreds(
                    serverPrincipal, tgtCreds);
        if (serviceCreds != null) {
            ticket = credsToTicket(serviceCreds);

            // Store service ticket in acc's Subject
            if (fromAcc && accSubj != null && !accSubj.isReadOnly()) {
                accSubj.getPrivateCredentials().add(ticket);
            }
        }
    }
    return ticket;
}
Example 2
Source File: Krb5Util.java    From TencentKona-8 with GNU General Public License v2.0 4 votes vote down vote up 
/**
 * Retrieve the service ticket for serverPrincipal from caller's Subject
 * or from Subject obtained by logging in, or if not found, via the
 * Ticket Granting Service using the TGT obtained from the Subject.
 *
 * Caller must have permission to:
 *    - access and update Subject's private credentials
 *    - create LoginContext
 *    - read the auth.login.defaultCallbackHandler security property
 *
 * NOTE: This method is used by JSSE Kerberos Cipher Suites
 */
public static KerberosTicket getTicketFromSubjectAndTgs(GSSCaller caller,
    String clientPrincipal, String serverPrincipal, String tgsPrincipal,
    AccessControlContext acc)
    throws LoginException, KrbException, IOException {

    // 1. Try to find service ticket in acc subject
    Subject accSubj = Subject.getSubject(acc);
    KerberosTicket ticket = SubjectComber.find(accSubj,
        serverPrincipal, clientPrincipal, KerberosTicket.class);

    if (ticket != null) {
        return ticket;  // found it
    }

    Subject loginSubj = null;
    if (!GSSUtil.useSubjectCredsOnly(caller)) {
        // 2. Try to get ticket from login
        try {
            loginSubj = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
            ticket = SubjectComber.find(loginSubj,
                serverPrincipal, clientPrincipal, KerberosTicket.class);
            if (ticket != null) {
                return ticket; // found it
            }
        } catch (LoginException e) {
            // No login entry to use
            // ignore and continue
        }
    }

    // Service ticket not found in subject or login
    // Try to get TGT to acquire service ticket

    // 3. Try to get TGT from acc subject
    KerberosTicket tgt = SubjectComber.find(accSubj,
        tgsPrincipal, clientPrincipal, KerberosTicket.class);

    boolean fromAcc;
    if (tgt == null && loginSubj != null) {
        // 4. Try to get TGT from login subject
        tgt = SubjectComber.find(loginSubj,
            tgsPrincipal, clientPrincipal, KerberosTicket.class);
        fromAcc = false;
    } else {
        fromAcc = true;
    }

    // 5. Try to get service ticket using TGT
    if (tgt != null) {
        Credentials tgtCreds = ticketToCreds(tgt);
        Credentials serviceCreds = Credentials.acquireServiceCreds(
                    serverPrincipal, tgtCreds);
        if (serviceCreds != null) {
            ticket = credsToTicket(serviceCreds);

            // Store service ticket in acc's Subject
            if (fromAcc && accSubj != null && !accSubj.isReadOnly()) {
                accSubj.getPrivateCredentials().add(ticket);
            }
        }
    }
    return ticket;
}
Example 3
Source File: Krb5Util.java    From jdk8u60 with GNU General Public License v2.0 4 votes vote down vote up 
/**
 * Retrieve the service ticket for serverPrincipal from caller's Subject
 * or from Subject obtained by logging in, or if not found, via the
 * Ticket Granting Service using the TGT obtained from the Subject.
 *
 * Caller must have permission to:
 *    - access and update Subject's private credentials
 *    - create LoginContext
 *    - read the auth.login.defaultCallbackHandler security property
 *
 * NOTE: This method is used by JSSE Kerberos Cipher Suites
 */
public static KerberosTicket getTicketFromSubjectAndTgs(GSSCaller caller,
    String clientPrincipal, String serverPrincipal, String tgsPrincipal,
    AccessControlContext acc)
    throws LoginException, KrbException, IOException {

    // 1. Try to find service ticket in acc subject
    Subject accSubj = Subject.getSubject(acc);
    KerberosTicket ticket = SubjectComber.find(accSubj,
        serverPrincipal, clientPrincipal, KerberosTicket.class);

    if (ticket != null) {
        return ticket;  // found it
    }

    Subject loginSubj = null;
    if (!GSSUtil.useSubjectCredsOnly(caller)) {
        // 2. Try to get ticket from login
        try {
            loginSubj = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
            ticket = SubjectComber.find(loginSubj,
                serverPrincipal, clientPrincipal, KerberosTicket.class);
            if (ticket != null) {
                return ticket; // found it
            }
        } catch (LoginException e) {
            // No login entry to use
            // ignore and continue
        }
    }

    // Service ticket not found in subject or login
    // Try to get TGT to acquire service ticket

    // 3. Try to get TGT from acc subject
    KerberosTicket tgt = SubjectComber.find(accSubj,
        tgsPrincipal, clientPrincipal, KerberosTicket.class);

    boolean fromAcc;
    if (tgt == null && loginSubj != null) {
        // 4. Try to get TGT from login subject
        tgt = SubjectComber.find(loginSubj,
            tgsPrincipal, clientPrincipal, KerberosTicket.class);
        fromAcc = false;
    } else {
        fromAcc = true;
    }

    // 5. Try to get service ticket using TGT
    if (tgt != null) {
        Credentials tgtCreds = ticketToCreds(tgt);
        Credentials serviceCreds = Credentials.acquireServiceCreds(
                    serverPrincipal, tgtCreds);
        if (serviceCreds != null) {
            ticket = credsToTicket(serviceCreds);

            // Store service ticket in acc's Subject
            if (fromAcc && accSubj != null && !accSubj.isReadOnly()) {
                accSubj.getPrivateCredentials().add(ticket);
            }
        }
    }
    return ticket;
}
Example 4
Source File: Krb5Util.java    From openjdk-jdk8u with GNU General Public License v2.0 4 votes vote down vote up 
/**
 * Retrieve the service ticket for serverPrincipal from caller's Subject
 * or from Subject obtained by logging in, or if not found, via the
 * Ticket Granting Service using the TGT obtained from the Subject.
 *
 * Caller must have permission to:
 *    - access and update Subject's private credentials
 *    - create LoginContext
 *    - read the auth.login.defaultCallbackHandler security property
 *
 * NOTE: This method is used by JSSE Kerberos Cipher Suites
 */
public static KerberosTicket getTicketFromSubjectAndTgs(GSSCaller caller,
    String clientPrincipal, String serverPrincipal, String tgsPrincipal,
    AccessControlContext acc)
    throws LoginException, KrbException, IOException {

    // 1. Try to find service ticket in acc subject
    Subject accSubj = Subject.getSubject(acc);
    KerberosTicket ticket = SubjectComber.find(accSubj,
        serverPrincipal, clientPrincipal, KerberosTicket.class);

    if (ticket != null) {
        return ticket;  // found it
    }

    Subject loginSubj = null;
    if (!GSSUtil.useSubjectCredsOnly(caller)) {
        // 2. Try to get ticket from login
        try {
            loginSubj = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
            ticket = SubjectComber.find(loginSubj,
                serverPrincipal, clientPrincipal, KerberosTicket.class);
            if (ticket != null) {
                return ticket; // found it
            }
        } catch (LoginException e) {
            // No login entry to use
            // ignore and continue
        }
    }

    // Service ticket not found in subject or login
    // Try to get TGT to acquire service ticket

    // 3. Try to get TGT from acc subject
    KerberosTicket tgt = SubjectComber.find(accSubj,
        tgsPrincipal, clientPrincipal, KerberosTicket.class);

    boolean fromAcc;
    if (tgt == null && loginSubj != null) {
        // 4. Try to get TGT from login subject
        tgt = SubjectComber.find(loginSubj,
            tgsPrincipal, clientPrincipal, KerberosTicket.class);
        fromAcc = false;
    } else {
        fromAcc = true;
    }

    // 5. Try to get service ticket using TGT
    if (tgt != null) {
        Credentials tgtCreds = ticketToCreds(tgt);
        Credentials serviceCreds = Credentials.acquireServiceCreds(
                    serverPrincipal, tgtCreds);
        if (serviceCreds != null) {
            ticket = credsToTicket(serviceCreds);

            // Store service ticket in acc's Subject
            if (fromAcc && accSubj != null && !accSubj.isReadOnly()) {
                accSubj.getPrivateCredentials().add(ticket);
            }
        }
    }
    return ticket;
}
Example 5
Source File: Krb5Util.java    From openjdk-jdk8u-backup with GNU General Public License v2.0 4 votes vote down vote up 
/**
 * Retrieve the service ticket for serverPrincipal from caller's Subject
 * or from Subject obtained by logging in, or if not found, via the
 * Ticket Granting Service using the TGT obtained from the Subject.
 *
 * Caller must have permission to:
 *    - access and update Subject's private credentials
 *    - create LoginContext
 *    - read the auth.login.defaultCallbackHandler security property
 *
 * NOTE: This method is used by JSSE Kerberos Cipher Suites
 */
public static KerberosTicket getTicketFromSubjectAndTgs(GSSCaller caller,
    String clientPrincipal, String serverPrincipal, String tgsPrincipal,
    AccessControlContext acc)
    throws LoginException, KrbException, IOException {

    // 1. Try to find service ticket in acc subject
    Subject accSubj = Subject.getSubject(acc);
    KerberosTicket ticket = SubjectComber.find(accSubj,
        serverPrincipal, clientPrincipal, KerberosTicket.class);

    if (ticket != null) {
        return ticket;  // found it
    }

    Subject loginSubj = null;
    if (!GSSUtil.useSubjectCredsOnly(caller)) {
        // 2. Try to get ticket from login
        try {
            loginSubj = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
            ticket = SubjectComber.find(loginSubj,
                serverPrincipal, clientPrincipal, KerberosTicket.class);
            if (ticket != null) {
                return ticket; // found it
            }
        } catch (LoginException e) {
            // No login entry to use
            // ignore and continue
        }
    }

    // Service ticket not found in subject or login
    // Try to get TGT to acquire service ticket

    // 3. Try to get TGT from acc subject
    KerberosTicket tgt = SubjectComber.find(accSubj,
        tgsPrincipal, clientPrincipal, KerberosTicket.class);

    boolean fromAcc;
    if (tgt == null && loginSubj != null) {
        // 4. Try to get TGT from login subject
        tgt = SubjectComber.find(loginSubj,
            tgsPrincipal, clientPrincipal, KerberosTicket.class);
        fromAcc = false;
    } else {
        fromAcc = true;
    }

    // 5. Try to get service ticket using TGT
    if (tgt != null) {
        Credentials tgtCreds = ticketToCreds(tgt);
        Credentials serviceCreds = Credentials.acquireServiceCreds(
                    serverPrincipal, tgtCreds);
        if (serviceCreds != null) {
            ticket = credsToTicket(serviceCreds);

            // Store service ticket in acc's Subject
            if (fromAcc && accSubj != null && !accSubj.isReadOnly()) {
                accSubj.getPrivateCredentials().add(ticket);
            }
        }
    }
    return ticket;
}
Example 6
Source File: Krb5Util.java    From openjdk-jdk9 with GNU General Public License v2.0 4 votes vote down vote up 
/**
 * Retrieve the service ticket for serverPrincipal from caller's Subject
 * or from Subject obtained by logging in, or if not found, via the
 * Ticket Granting Service using the TGT obtained from the Subject.
 *
 * Caller must have permission to:
 *    - access and update Subject's private credentials
 *    - create LoginContext
 *    - read the auth.login.defaultCallbackHandler security property
 *
 * NOTE: This method is used by JSSE Kerberos Cipher Suites
 */
public static KerberosTicket getTicketFromSubjectAndTgs(GSSCaller caller,
    String clientPrincipal, String serverPrincipal, String tgsPrincipal,
    AccessControlContext acc)
    throws LoginException, KrbException, IOException {

    // 1. Try to find service ticket in acc subject
    Subject accSubj = Subject.getSubject(acc);
    KerberosTicket ticket = SubjectComber.find(accSubj,
        serverPrincipal, clientPrincipal, KerberosTicket.class);

    if (ticket != null) {
        return ticket;  // found it
    }

    Subject loginSubj = null;
    if (!GSSUtil.useSubjectCredsOnly(caller)) {
        // 2. Try to get ticket from login
        try {
            loginSubj = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
            ticket = SubjectComber.find(loginSubj,
                serverPrincipal, clientPrincipal, KerberosTicket.class);
            if (ticket != null) {
                return ticket; // found it
            }
        } catch (LoginException e) {
            // No login entry to use
            // ignore and continue
        }
    }

    // Service ticket not found in subject or login
    // Try to get TGT to acquire service ticket

    // 3. Try to get TGT from acc subject
    KerberosTicket tgt = SubjectComber.find(accSubj,
        tgsPrincipal, clientPrincipal, KerberosTicket.class);

    boolean fromAcc;
    if (tgt == null && loginSubj != null) {
        // 4. Try to get TGT from login subject
        tgt = SubjectComber.find(loginSubj,
            tgsPrincipal, clientPrincipal, KerberosTicket.class);
        fromAcc = false;
    } else {
        fromAcc = true;
    }

    // 5. Try to get service ticket using TGT
    if (tgt != null) {
        Credentials tgtCreds = ticketToCreds(tgt);
        Credentials serviceCreds = Credentials.acquireServiceCreds(
                    serverPrincipal, tgtCreds);
        if (serviceCreds != null) {
            ticket = credsToTicket(serviceCreds);

            // Store service ticket in acc's Subject
            if (fromAcc && accSubj != null && !accSubj.isReadOnly()) {
                accSubj.getPrivateCredentials().add(ticket);
            }
        }
    }
    return ticket;
}
Example 7
Source File: Krb5Util.java    From jdk8u-jdk with GNU General Public License v2.0 4 votes vote down vote up 
/**
 * Retrieve the service ticket for serverPrincipal from caller's Subject
 * or from Subject obtained by logging in, or if not found, via the
 * Ticket Granting Service using the TGT obtained from the Subject.
 *
 * Caller must have permission to:
 *    - access and update Subject's private credentials
 *    - create LoginContext
 *    - read the auth.login.defaultCallbackHandler security property
 *
 * NOTE: This method is used by JSSE Kerberos Cipher Suites
 */
public static KerberosTicket getTicketFromSubjectAndTgs(GSSCaller caller,
    String clientPrincipal, String serverPrincipal, String tgsPrincipal,
    AccessControlContext acc)
    throws LoginException, KrbException, IOException {

    // 1. Try to find service ticket in acc subject
    Subject accSubj = Subject.getSubject(acc);
    KerberosTicket ticket = SubjectComber.find(accSubj,
        serverPrincipal, clientPrincipal, KerberosTicket.class);

    if (ticket != null) {
        return ticket;  // found it
    }

    Subject loginSubj = null;
    if (!GSSUtil.useSubjectCredsOnly(caller)) {
        // 2. Try to get ticket from login
        try {
            loginSubj = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
            ticket = SubjectComber.find(loginSubj,
                serverPrincipal, clientPrincipal, KerberosTicket.class);
            if (ticket != null) {
                return ticket; // found it
            }
        } catch (LoginException e) {
            // No login entry to use
            // ignore and continue
        }
    }

    // Service ticket not found in subject or login
    // Try to get TGT to acquire service ticket

    // 3. Try to get TGT from acc subject
    KerberosTicket tgt = SubjectComber.find(accSubj,
        tgsPrincipal, clientPrincipal, KerberosTicket.class);

    boolean fromAcc;
    if (tgt == null && loginSubj != null) {
        // 4. Try to get TGT from login subject
        tgt = SubjectComber.find(loginSubj,
            tgsPrincipal, clientPrincipal, KerberosTicket.class);
        fromAcc = false;
    } else {
        fromAcc = true;
    }

    // 5. Try to get service ticket using TGT
    if (tgt != null) {
        Credentials tgtCreds = ticketToCreds(tgt);
        Credentials serviceCreds = Credentials.acquireServiceCreds(
                    serverPrincipal, tgtCreds);
        if (serviceCreds != null) {
            ticket = credsToTicket(serviceCreds);

            // Store service ticket in acc's Subject
            if (fromAcc && accSubj != null && !accSubj.isReadOnly()) {
                accSubj.getPrivateCredentials().add(ticket);
            }
        }
    }
    return ticket;
}
Example 8
Source File: Krb5Util.java    From hottub with GNU General Public License v2.0 4 votes vote down vote up 
/**
 * Retrieve the service ticket for serverPrincipal from caller's Subject
 * or from Subject obtained by logging in, or if not found, via the
 * Ticket Granting Service using the TGT obtained from the Subject.
 *
 * Caller must have permission to:
 *    - access and update Subject's private credentials
 *    - create LoginContext
 *    - read the auth.login.defaultCallbackHandler security property
 *
 * NOTE: This method is used by JSSE Kerberos Cipher Suites
 */
public static KerberosTicket getTicketFromSubjectAndTgs(GSSCaller caller,
    String clientPrincipal, String serverPrincipal, String tgsPrincipal,
    AccessControlContext acc)
    throws LoginException, KrbException, IOException {

    // 1. Try to find service ticket in acc subject
    Subject accSubj = Subject.getSubject(acc);
    KerberosTicket ticket = SubjectComber.find(accSubj,
        serverPrincipal, clientPrincipal, KerberosTicket.class);

    if (ticket != null) {
        return ticket;  // found it
    }

    Subject loginSubj = null;
    if (!GSSUtil.useSubjectCredsOnly(caller)) {
        // 2. Try to get ticket from login
        try {
            loginSubj = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
            ticket = SubjectComber.find(loginSubj,
                serverPrincipal, clientPrincipal, KerberosTicket.class);
            if (ticket != null) {
                return ticket; // found it
            }
        } catch (LoginException e) {
            // No login entry to use
            // ignore and continue
        }
    }

    // Service ticket not found in subject or login
    // Try to get TGT to acquire service ticket

    // 3. Try to get TGT from acc subject
    KerberosTicket tgt = SubjectComber.find(accSubj,
        tgsPrincipal, clientPrincipal, KerberosTicket.class);

    boolean fromAcc;
    if (tgt == null && loginSubj != null) {
        // 4. Try to get TGT from login subject
        tgt = SubjectComber.find(loginSubj,
            tgsPrincipal, clientPrincipal, KerberosTicket.class);
        fromAcc = false;
    } else {
        fromAcc = true;
    }

    // 5. Try to get service ticket using TGT
    if (tgt != null) {
        Credentials tgtCreds = ticketToCreds(tgt);
        Credentials serviceCreds = Credentials.acquireServiceCreds(
                    serverPrincipal, tgtCreds);
        if (serviceCreds != null) {
            ticket = credsToTicket(serviceCreds);

            // Store service ticket in acc's Subject
            if (fromAcc && accSubj != null && !accSubj.isReadOnly()) {
                accSubj.getPrivateCredentials().add(ticket);
            }
        }
    }
    return ticket;
}
Example 9
Source File: Krb5Util.java    From openjdk-8-source with GNU General Public License v2.0 4 votes vote down vote up 
/**
 * Retrieve the service ticket for serverPrincipal from caller's Subject
 * or from Subject obtained by logging in, or if not found, via the
 * Ticket Granting Service using the TGT obtained from the Subject.
 *
 * Caller must have permission to:
 *    - access and update Subject's private credentials
 *    - create LoginContext
 *    - read the auth.login.defaultCallbackHandler security property
 *
 * NOTE: This method is used by JSSE Kerberos Cipher Suites
 */
public static KerberosTicket getTicketFromSubjectAndTgs(GSSCaller caller,
    String clientPrincipal, String serverPrincipal, String tgsPrincipal,
    AccessControlContext acc)
    throws LoginException, KrbException, IOException {

    // 1. Try to find service ticket in acc subject
    Subject accSubj = Subject.getSubject(acc);
    KerberosTicket ticket = SubjectComber.find(accSubj,
        serverPrincipal, clientPrincipal, KerberosTicket.class);

    if (ticket != null) {
        return ticket;  // found it
    }

    Subject loginSubj = null;
    if (!GSSUtil.useSubjectCredsOnly(caller)) {
        // 2. Try to get ticket from login
        try {
            loginSubj = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
            ticket = SubjectComber.find(loginSubj,
                serverPrincipal, clientPrincipal, KerberosTicket.class);
            if (ticket != null) {
                return ticket; // found it
            }
        } catch (LoginException e) {
            // No login entry to use
            // ignore and continue
        }
    }

    // Service ticket not found in subject or login
    // Try to get TGT to acquire service ticket

    // 3. Try to get TGT from acc subject
    KerberosTicket tgt = SubjectComber.find(accSubj,
        tgsPrincipal, clientPrincipal, KerberosTicket.class);

    boolean fromAcc;
    if (tgt == null && loginSubj != null) {
        // 4. Try to get TGT from login subject
        tgt = SubjectComber.find(loginSubj,
            tgsPrincipal, clientPrincipal, KerberosTicket.class);
        fromAcc = false;
    } else {
        fromAcc = true;
    }

    // 5. Try to get service ticket using TGT
    if (tgt != null) {
        Credentials tgtCreds = ticketToCreds(tgt);
        Credentials serviceCreds = Credentials.acquireServiceCreds(
                    serverPrincipal, tgtCreds);
        if (serviceCreds != null) {
            ticket = credsToTicket(serviceCreds);

            // Store service ticket in acc's Subject
            if (fromAcc && accSubj != null && !accSubj.isReadOnly()) {
                accSubj.getPrivateCredentials().add(ticket);
            }
        }
    }
    return ticket;
}
Example 10
Source File: Krb5Util.java    From openjdk-8 with GNU General Public License v2.0 4 votes vote down vote up 
/**
 * Retrieve the service ticket for serverPrincipal from caller's Subject
 * or from Subject obtained by logging in, or if not found, via the
 * Ticket Granting Service using the TGT obtained from the Subject.
 *
 * Caller must have permission to:
 *    - access and update Subject's private credentials
 *    - create LoginContext
 *    - read the auth.login.defaultCallbackHandler security property
 *
 * NOTE: This method is used by JSSE Kerberos Cipher Suites
 */
public static KerberosTicket getTicketFromSubjectAndTgs(GSSCaller caller,
    String clientPrincipal, String serverPrincipal, String tgsPrincipal,
    AccessControlContext acc)
    throws LoginException, KrbException, IOException {

    // 1. Try to find service ticket in acc subject
    Subject accSubj = Subject.getSubject(acc);
    KerberosTicket ticket = SubjectComber.find(accSubj,
        serverPrincipal, clientPrincipal, KerberosTicket.class);

    if (ticket != null) {
        return ticket;  // found it
    }

    Subject loginSubj = null;
    if (!GSSUtil.useSubjectCredsOnly(caller)) {
        // 2. Try to get ticket from login
        try {
            loginSubj = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
            ticket = SubjectComber.find(loginSubj,
                serverPrincipal, clientPrincipal, KerberosTicket.class);
            if (ticket != null) {
                return ticket; // found it
            }
        } catch (LoginException e) {
            // No login entry to use
            // ignore and continue
        }
    }

    // Service ticket not found in subject or login
    // Try to get TGT to acquire service ticket

    // 3. Try to get TGT from acc subject
    KerberosTicket tgt = SubjectComber.find(accSubj,
        tgsPrincipal, clientPrincipal, KerberosTicket.class);

    boolean fromAcc;
    if (tgt == null && loginSubj != null) {
        // 4. Try to get TGT from login subject
        tgt = SubjectComber.find(loginSubj,
            tgsPrincipal, clientPrincipal, KerberosTicket.class);
        fromAcc = false;
    } else {
        fromAcc = true;
    }

    // 5. Try to get service ticket using TGT
    if (tgt != null) {
        Credentials tgtCreds = ticketToCreds(tgt);
        Credentials serviceCreds = Credentials.acquireServiceCreds(
                    serverPrincipal, tgtCreds);
        if (serviceCreds != null) {
            ticket = credsToTicket(serviceCreds);

            // Store service ticket in acc's Subject
            if (fromAcc && accSubj != null && !accSubj.isReadOnly()) {
                accSubj.getPrivateCredentials().add(ticket);
            }
        }
    }
    return ticket;
}
Example 11
Source File: Krb5Util.java    From jdk8u_jdk with GNU General Public License v2.0 4 votes vote down vote up 
/**
 * Retrieve the service ticket for serverPrincipal from caller's Subject
 * or from Subject obtained by logging in, or if not found, via the
 * Ticket Granting Service using the TGT obtained from the Subject.
 *
 * Caller must have permission to:
 *    - access and update Subject's private credentials
 *    - create LoginContext
 *    - read the auth.login.defaultCallbackHandler security property
 *
 * NOTE: This method is used by JSSE Kerberos Cipher Suites
 */
public static KerberosTicket getTicketFromSubjectAndTgs(GSSCaller caller,
    String clientPrincipal, String serverPrincipal, String tgsPrincipal,
    AccessControlContext acc)
    throws LoginException, KrbException, IOException {

    // 1. Try to find service ticket in acc subject
    Subject accSubj = Subject.getSubject(acc);
    KerberosTicket ticket = SubjectComber.find(accSubj,
        serverPrincipal, clientPrincipal, KerberosTicket.class);

    if (ticket != null) {
        return ticket;  // found it
    }

    Subject loginSubj = null;
    if (!GSSUtil.useSubjectCredsOnly(caller)) {
        // 2. Try to get ticket from login
        try {
            loginSubj = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
            ticket = SubjectComber.find(loginSubj,
                serverPrincipal, clientPrincipal, KerberosTicket.class);
            if (ticket != null) {
                return ticket; // found it
            }
        } catch (LoginException e) {
            // No login entry to use
            // ignore and continue
        }
    }

    // Service ticket not found in subject or login
    // Try to get TGT to acquire service ticket

    // 3. Try to get TGT from acc subject
    KerberosTicket tgt = SubjectComber.find(accSubj,
        tgsPrincipal, clientPrincipal, KerberosTicket.class);

    boolean fromAcc;
    if (tgt == null && loginSubj != null) {
        // 4. Try to get TGT from login subject
        tgt = SubjectComber.find(loginSubj,
            tgsPrincipal, clientPrincipal, KerberosTicket.class);
        fromAcc = false;
    } else {
        fromAcc = true;
    }

    // 5. Try to get service ticket using TGT
    if (tgt != null) {
        Credentials tgtCreds = ticketToCreds(tgt);
        Credentials serviceCreds = Credentials.acquireServiceCreds(
                    serverPrincipal, tgtCreds);
        if (serviceCreds != null) {
            ticket = credsToTicket(serviceCreds);

            // Store service ticket in acc's Subject
            if (fromAcc && accSubj != null && !accSubj.isReadOnly()) {
                accSubj.getPrivateCredentials().add(ticket);
            }
        }
    }
    return ticket;
}
Example 12
Source File: Krb5Util.java    From jdk8u-jdk with GNU General Public License v2.0 4 votes vote down vote up 
/**
 * Retrieve the service ticket for serverPrincipal from caller's Subject
 * or from Subject obtained by logging in, or if not found, via the
 * Ticket Granting Service using the TGT obtained from the Subject.
 *
 * Caller must have permission to:
 *    - access and update Subject's private credentials
 *    - create LoginContext
 *    - read the auth.login.defaultCallbackHandler security property
 *
 * NOTE: This method is used by JSSE Kerberos Cipher Suites
 */
public static KerberosTicket getTicketFromSubjectAndTgs(GSSCaller caller,
    String clientPrincipal, String serverPrincipal, String tgsPrincipal,
    AccessControlContext acc)
    throws LoginException, KrbException, IOException {

    // 1. Try to find service ticket in acc subject
    Subject accSubj = Subject.getSubject(acc);
    KerberosTicket ticket = SubjectComber.find(accSubj,
        serverPrincipal, clientPrincipal, KerberosTicket.class);

    if (ticket != null) {
        return ticket;  // found it
    }

    Subject loginSubj = null;
    if (!GSSUtil.useSubjectCredsOnly(caller)) {
        // 2. Try to get ticket from login
        try {
            loginSubj = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
            ticket = SubjectComber.find(loginSubj,
                serverPrincipal, clientPrincipal, KerberosTicket.class);
            if (ticket != null) {
                return ticket; // found it
            }
        } catch (LoginException e) {
            // No login entry to use
            // ignore and continue
        }
    }

    // Service ticket not found in subject or login
    // Try to get TGT to acquire service ticket

    // 3. Try to get TGT from acc subject
    KerberosTicket tgt = SubjectComber.find(accSubj,
        tgsPrincipal, clientPrincipal, KerberosTicket.class);

    boolean fromAcc;
    if (tgt == null && loginSubj != null) {
        // 4. Try to get TGT from login subject
        tgt = SubjectComber.find(loginSubj,
            tgsPrincipal, clientPrincipal, KerberosTicket.class);
        fromAcc = false;
    } else {
        fromAcc = true;
    }

    // 5. Try to get service ticket using TGT
    if (tgt != null) {
        Credentials tgtCreds = ticketToCreds(tgt);
        Credentials serviceCreds = Credentials.acquireServiceCreds(
                    serverPrincipal, tgtCreds);
        if (serviceCreds != null) {
            ticket = credsToTicket(serviceCreds);

            // Store service ticket in acc's Subject
            if (fromAcc && accSubj != null && !accSubj.isReadOnly()) {
                accSubj.getPrivateCredentials().add(ticket);
            }
        }
    }
    return ticket;
}
Example 13
Source File: Krb5Util.java    From jdk8u-dev-jdk with GNU General Public License v2.0 4 votes vote down vote up 
/**
 * Retrieve the service ticket for serverPrincipal from caller's Subject
 * or from Subject obtained by logging in, or if not found, via the
 * Ticket Granting Service using the TGT obtained from the Subject.
 *
 * Caller must have permission to:
 *    - access and update Subject's private credentials
 *    - create LoginContext
 *    - read the auth.login.defaultCallbackHandler security property
 *
 * NOTE: This method is used by JSSE Kerberos Cipher Suites
 */
public static KerberosTicket getTicketFromSubjectAndTgs(GSSCaller caller,
    String clientPrincipal, String serverPrincipal, String tgsPrincipal,
    AccessControlContext acc)
    throws LoginException, KrbException, IOException {

    // 1. Try to find service ticket in acc subject
    Subject accSubj = Subject.getSubject(acc);
    KerberosTicket ticket = SubjectComber.find(accSubj,
        serverPrincipal, clientPrincipal, KerberosTicket.class);

    if (ticket != null) {
        return ticket;  // found it
    }

    Subject loginSubj = null;
    if (!GSSUtil.useSubjectCredsOnly(caller)) {
        // 2. Try to get ticket from login
        try {
            loginSubj = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
            ticket = SubjectComber.find(loginSubj,
                serverPrincipal, clientPrincipal, KerberosTicket.class);
            if (ticket != null) {
                return ticket; // found it
            }
        } catch (LoginException e) {
            // No login entry to use
            // ignore and continue
        }
    }

    // Service ticket not found in subject or login
    // Try to get TGT to acquire service ticket

    // 3. Try to get TGT from acc subject
    KerberosTicket tgt = SubjectComber.find(accSubj,
        tgsPrincipal, clientPrincipal, KerberosTicket.class);

    boolean fromAcc;
    if (tgt == null && loginSubj != null) {
        // 4. Try to get TGT from login subject
        tgt = SubjectComber.find(loginSubj,
            tgsPrincipal, clientPrincipal, KerberosTicket.class);
        fromAcc = false;
    } else {
        fromAcc = true;
    }

    // 5. Try to get service ticket using TGT
    if (tgt != null) {
        Credentials tgtCreds = ticketToCreds(tgt);
        Credentials serviceCreds = Credentials.acquireServiceCreds(
                    serverPrincipal, tgtCreds);
        if (serviceCreds != null) {
            ticket = credsToTicket(serviceCreds);

            // Store service ticket in acc's Subject
            if (fromAcc && accSubj != null && !accSubj.isReadOnly()) {
                accSubj.getPrivateCredentials().add(ticket);
            }
        }
    }
    return ticket;
}