com.sun.security.auth.module.Krb5LoginModule Java Examples

/**
 * Logins with username/keytab as a new subject,
 */
public static Context fromUserKtab(Subject s,
        String user, String ktab, boolean storeKey) throws Exception {
    Context out = new Context();
    out.name = user;
    out.s = s;
    Krb5LoginModule krb5 = new Krb5LoginModule();
    Map<String, String> map = new HashMap<>();

    map.put("isInitiator", "false");
    map.put("doNotPrompt", "true");
    map.put("useTicketCache", "false");
    map.put("useKeyTab", "true");
    map.put("keyTab", ktab);
    map.put("principal", user);
    if (storeKey) {
        map.put("storeKey", "true");
    }

    krb5.initialize(out.s, null, null, map);
    krb5.login();
    krb5.commit();
    return out;
}
 

static void login(CallbackHandler callback, Object... options)
        throws Exception {
    Krb5LoginModule krb5 = new Krb5LoginModule();
    Subject subject = new Subject();
    Map<String, String> map = new HashMap<>();
    Map<String, Object> shared = new HashMap<>();

    int count = options.length / 2;
    for (int i = 0; i < count; i++) {
        String key = (String) options[2 * i];
        Object value = options[2 * i + 1];
        if (key.startsWith("javax")) {
            shared.put(key, value);
        } else {
            map.put(key, (String) value);
        }
    }
    krb5.initialize(subject, callback, shared, map);
    krb5.login();
    krb5.commit();
    if (!subject.getPrincipals().iterator().next()
            .getName().startsWith(OneKDC.USER)) {
        throw new Exception("The authenticated is not " + OneKDC.USER);
    }
}
 

/**
 * Logins with username/keytab as a new subject,
 */
public static Context fromUserKtab(Subject s,
        String user, String ktab, boolean storeKey) throws Exception {
    Context out = new Context();
    out.name = user;
    out.s = s;
    Krb5LoginModule krb5 = new Krb5LoginModule();
    Map<String, String> map = new HashMap<>();

    map.put("isInitiator", "false");
    map.put("doNotPrompt", "true");
    map.put("useTicketCache", "false");
    map.put("useKeyTab", "true");
    map.put("keyTab", ktab);
    map.put("principal", user);
    if (storeKey) {
        map.put("storeKey", "true");
    }

    krb5.initialize(out.s, null, null, map);
    krb5.login();
    krb5.commit();
    return out;
}
 

/**
 * Logins with username/keytab as a new subject,
 */
public static Context fromUserKtab(Subject s,
        String user, String ktab, boolean storeKey) throws Exception {
    Context out = new Context();
    out.name = user;
    out.s = s;
    Krb5LoginModule krb5 = new Krb5LoginModule();
    Map<String, String> map = new HashMap<>();

    map.put("isInitiator", "false");
    map.put("doNotPrompt", "true");
    map.put("useTicketCache", "false");
    map.put("useKeyTab", "true");
    map.put("keyTab", ktab);
    map.put("principal", user);
    if (storeKey) {
        map.put("storeKey", "true");
    }

    krb5.initialize(out.s, null, null, map);
    krb5.login();
    krb5.commit();
    return out;
}
 

/**
 * Logins with username/keytab as a new subject,
 */
public static Context fromUserKtab(Subject s,
        String user, String ktab, boolean storeKey) throws Exception {
    Context out = new Context();
    out.name = user;
    out.s = s;
    Krb5LoginModule krb5 = new Krb5LoginModule();
    Map<String, String> map = new HashMap<>();

    map.put("isInitiator", "false");
    map.put("doNotPrompt", "true");
    map.put("useTicketCache", "false");
    map.put("useKeyTab", "true");
    map.put("keyTab", ktab);
    map.put("principal", user);
    if (storeKey) {
        map.put("storeKey", "true");
    }

    krb5.initialize(out.s, null, null, map);
    krb5.login();
    krb5.commit();
    return out;
}
 

/**
 * Logins with username/keytab as a new subject,
 */
public static Context fromUserKtab(Subject s,
        String user, String ktab, boolean storeKey) throws Exception {
    Context out = new Context();
    out.name = user;
    out.s = s;
    Krb5LoginModule krb5 = new Krb5LoginModule();
    Map<String, String> map = new HashMap<>();

    map.put("isInitiator", "false");
    map.put("doNotPrompt", "true");
    map.put("useTicketCache", "false");
    map.put("useKeyTab", "true");
    map.put("keyTab", ktab);
    map.put("principal", user);
    if (storeKey) {
        map.put("storeKey", "true");
    }

    krb5.initialize(out.s, null, null, map);
    krb5.login();
    krb5.commit();
    return out;
}
 

/**
 * Logins with username/keytab as a new subject,
 */
public static Context fromUserKtab(Subject s,
        String user, String ktab, boolean storeKey) throws Exception {
    Context out = new Context();
    out.name = user;
    out.s = s;
    Krb5LoginModule krb5 = new Krb5LoginModule();
    Map<String, String> map = new HashMap<>();

    map.put("isInitiator", "false");
    map.put("doNotPrompt", "true");
    map.put("useTicketCache", "false");
    map.put("useKeyTab", "true");
    map.put("keyTab", ktab);
    map.put("principal", user);
    if (storeKey) {
        map.put("storeKey", "true");
    }

    krb5.initialize(out.s, null, null, map);
    krb5.login();
    krb5.commit();
    return out;
}
 

static void login(CallbackHandler callback, Object... options)
        throws Exception {
    Krb5LoginModule krb5 = new Krb5LoginModule();
    Subject subject = new Subject();
    Map<String, String> map = new HashMap<>();
    Map<String, Object> shared = new HashMap<>();

    int count = options.length / 2;
    for (int i = 0; i < count; i++) {
        String key = (String) options[2 * i];
        Object value = options[2 * i + 1];
        if (key.startsWith("javax")) {
            shared.put(key, value);
        } else {
            map.put(key, (String) value);
        }
    }
    krb5.initialize(subject, callback, shared, map);
    krb5.login();
    krb5.commit();
    if (!subject.getPrincipals().iterator().next()
            .getName().startsWith(OneKDC.USER)) {
        throw new Exception("The authenticated is not " + OneKDC.USER);
    }
}
 

/**
 * Logins with username/keytab as a new subject,
 */
public static Context fromUserKtab(Subject s,
        String user, String ktab, boolean storeKey) throws Exception {
    Context out = new Context();
    out.name = user;
    out.s = s;
    Krb5LoginModule krb5 = new Krb5LoginModule();
    Map<String, String> map = new HashMap<>();

    map.put("isInitiator", "false");
    map.put("doNotPrompt", "true");
    map.put("useTicketCache", "false");
    map.put("useKeyTab", "true");
    map.put("keyTab", ktab);
    map.put("principal", user);
    if (storeKey) {
        map.put("storeKey", "true");
    }

    krb5.initialize(out.s, null, null, map);
    krb5.login();
    krb5.commit();
    return out;
}
 

static void login(CallbackHandler callback, Object... options)
        throws Exception {
    Krb5LoginModule krb5 = new Krb5LoginModule();
    Subject subject = new Subject();
    Map<String, String> map = new HashMap<>();
    Map<String, Object> shared = new HashMap<>();

    int count = options.length / 2;
    for (int i = 0; i < count; i++) {
        String key = (String) options[2 * i];
        Object value = options[2 * i + 1];
        if (key.startsWith("javax")) {
            shared.put(key, value);
        } else {
            map.put(key, (String) value);
        }
    }
    krb5.initialize(subject, callback, shared, map);
    krb5.login();
    krb5.commit();
    if (!subject.getPrincipals().iterator().next()
            .getName().startsWith(OneKDC.USER)) {
        throw new Exception("The authenticated is not " + OneKDC.USER);
    }
}
 

/**
 * Logins with username/keytab as a new subject,
 */
public static Context fromUserKtab(Subject s,
        String user, String ktab, boolean storeKey) throws Exception {
    Context out = new Context();
    out.name = user;
    out.s = s;
    Krb5LoginModule krb5 = new Krb5LoginModule();
    Map<String, String> map = new HashMap<>();

    map.put("isInitiator", "false");
    map.put("doNotPrompt", "true");
    map.put("useTicketCache", "false");
    map.put("useKeyTab", "true");
    map.put("keyTab", ktab);
    map.put("principal", user);
    if (storeKey) {
        map.put("storeKey", "true");
    }

    krb5.initialize(out.s, null, null, map);
    krb5.login();
    krb5.commit();
    return out;
}
 

static void login(CallbackHandler callback, Object... options)
        throws Exception {
    Krb5LoginModule krb5 = new Krb5LoginModule();
    Subject subject = new Subject();
    Map<String, String> map = new HashMap<>();
    Map<String, Object> shared = new HashMap<>();

    int count = options.length / 2;
    for (int i = 0; i < count; i++) {
        String key = (String) options[2 * i];
        Object value = options[2 * i + 1];
        if (key.startsWith("javax")) {
            shared.put(key, value);
        } else {
            map.put(key, (String) value);
        }
    }
    krb5.initialize(subject, callback, shared, map);
    krb5.login();
    krb5.commit();
    if (!subject.getPrincipals().iterator().next()
            .getName().startsWith(OneKDC.USER)) {
        throw new Exception("The authenticated is not " + OneKDC.USER);
    }
}
 

/**
 * Log in the given principal and return the subject.
 */
public Subject login(String principal) {
    Path keytab = getKeytabPath(principal);

    // Set login options
    final Map<String, String> options = new HashMap<>();
    options.put("keyTab", keytab.toString());
    options.put("principal", principal);
    options.put("doNotPrompt", "true");
    options.put("isInitiator", "true");
    options.put("refreshKrb5Config", "true");
    options.put("storeKey", "true");
    options.put("useKeyTab", "true");

    // Execute the login
    Subject subject = new Subject();
    Krb5LoginModule krb5LoginModule = new Krb5LoginModule();
    krb5LoginModule.initialize(subject, null, new HashMap<String, String>(), options);
    try {
        krb5LoginModule.login();
        krb5LoginModule.commit();
    } catch (LoginException e) {
        throw new RuntimeException(e);
    }
    return subject;
}
 

static void login(CallbackHandler callback, Object... options)
        throws Exception {
    Krb5LoginModule krb5 = new Krb5LoginModule();
    Subject subject = new Subject();
    Map<String, String> map = new HashMap<>();
    Map<String, Object> shared = new HashMap<>();

    int count = options.length / 2;
    for (int i = 0; i < count; i++) {
        String key = (String) options[2 * i];
        Object value = options[2 * i + 1];
        if (key.startsWith("javax")) {
            shared.put(key, value);
        } else {
            map.put(key, (String) value);
        }
    }
    krb5.initialize(subject, callback, shared, map);
    krb5.login();
    krb5.commit();
    if (!subject.getPrincipals().iterator().next()
            .getName().startsWith(OneKDC.USER)) {
        throw new Exception("The authenticated is not " + OneKDC.USER);
    }
}
 

static void login(CallbackHandler callback, Object... options)
        throws Exception {
    Krb5LoginModule krb5 = new Krb5LoginModule();
    Subject subject = new Subject();
    Map<String, String> map = new HashMap<>();
    Map<String, Object> shared = new HashMap<>();

    int count = options.length / 2;
    for (int i = 0; i < count; i++) {
        String key = (String) options[2 * i];
        Object value = options[2 * i + 1];
        if (key.startsWith("javax")) {
            shared.put(key, value);
        } else {
            map.put(key, (String) value);
        }
    }
    krb5.initialize(subject, callback, shared, map);
    krb5.login();
    krb5.commit();
    if (!subject.getPrincipals().iterator().next()
            .getName().startsWith(OneKDC.USER)) {
        throw new Exception("The authenticated is not " + OneKDC.USER);
    }
}
 

/**
 * Logins with username/keytab as a new subject,
 */
public static Context fromUserKtab(Subject s,
        String user, String ktab, boolean storeKey) throws Exception {
    Context out = new Context();
    out.name = user;
    out.s = s;
    Krb5LoginModule krb5 = new Krb5LoginModule();
    Map<String, String> map = new HashMap<>();

    map.put("isInitiator", "false");
    map.put("doNotPrompt", "true");
    map.put("useTicketCache", "false");
    map.put("useKeyTab", "true");
    map.put("keyTab", ktab);
    map.put("principal", user);
    if (storeKey) {
        map.put("storeKey", "true");
    }

    krb5.initialize(out.s, null, null, map);
    krb5.login();
    krb5.commit();
    return out;
}
 

static void login(CallbackHandler callback, Object... options)
        throws Exception {
    Krb5LoginModule krb5 = new Krb5LoginModule();
    Subject subject = new Subject();
    Map<String, String> map = new HashMap<>();
    Map<String, Object> shared = new HashMap<>();

    int count = options.length / 2;
    for (int i = 0; i < count; i++) {
        String key = (String) options[2 * i];
        Object value = options[2 * i + 1];
        if (key.startsWith("javax")) {
            shared.put(key, value);
        } else {
            map.put(key, (String) value);
        }
    }
    krb5.initialize(subject, callback, shared, map);
    krb5.login();
    krb5.commit();
    if (!subject.getPrincipals().iterator().next()
            .getName().startsWith(OneKDC.USER)) {
        throw new Exception("The authenticated is not " + OneKDC.USER);
    }
}
 

static void login(CallbackHandler callback, Object... options)
        throws Exception {
    Krb5LoginModule krb5 = new Krb5LoginModule();
    Subject subject = new Subject();
    Map<String, String> map = new HashMap<>();
    Map<String, Object> shared = new HashMap<>();

    int count = options.length / 2;
    for (int i = 0; i < count; i++) {
        String key = (String) options[2 * i];
        Object value = options[2 * i + 1];
        if (key.startsWith("javax")) {
            shared.put(key, value);
        } else {
            map.put(key, (String) value);
        }
    }
    krb5.initialize(subject, callback, shared, map);
    krb5.login();
    krb5.commit();
    if (!subject.getPrincipals().iterator().next()
            .getName().startsWith(OneKDC.USER)) {
        throw new Exception("The authenticated is not " + OneKDC.USER);
    }
}
 

/**
 * Logins with username/keytab as a new subject,
 */
public static Context fromUserKtab(Subject s,
        String user, String ktab, boolean storeKey) throws Exception {
    Context out = new Context();
    out.name = user;
    out.s = s;
    Krb5LoginModule krb5 = new Krb5LoginModule();
    Map<String, String> map = new HashMap<>();

    map.put("isInitiator", "false");
    map.put("doNotPrompt", "true");
    map.put("useTicketCache", "false");
    map.put("useKeyTab", "true");
    map.put("keyTab", ktab);
    map.put("principal", user);
    if (storeKey) {
        map.put("storeKey", "true");
    }

    krb5.initialize(out.s, null, null, map);
    krb5.login();
    krb5.commit();
    return out;
}
 

static void login(CallbackHandler callback, Object... options)
        throws Exception {
    Krb5LoginModule krb5 = new Krb5LoginModule();
    Subject subject = new Subject();
    Map<String, String> map = new HashMap<>();
    Map<String, Object> shared = new HashMap<>();

    int count = options.length / 2;
    for (int i = 0; i < count; i++) {
        String key = (String) options[2 * i];
        Object value = options[2 * i + 1];
        if (key.startsWith("javax")) {
            shared.put(key, value);
        } else {
            map.put(key, (String) value);
        }
    }
    krb5.initialize(subject, callback, shared, map);
    krb5.login();
    krb5.commit();
    if (!subject.getPrincipals().iterator().next()
            .getName().startsWith(OneKDC.USER)) {
        throw new Exception("The authenticated is not " + OneKDC.USER);
    }
}
 

static void login(CallbackHandler callback, Object... options)
        throws Exception {
    Krb5LoginModule krb5 = new Krb5LoginModule();
    Subject subject = new Subject();
    Map<String, String> map = new HashMap<>();
    Map<String, Object> shared = new HashMap<>();

    int count = options.length / 2;
    for (int i = 0; i < count; i++) {
        String key = (String) options[2 * i];
        Object value = options[2 * i + 1];
        if (key.startsWith("javax")) {
            shared.put(key, value);
        } else {
            map.put(key, (String) value);
        }
    }
    krb5.initialize(subject, callback, shared, map);
    krb5.login();
    krb5.commit();
    if (!subject.getPrincipals().iterator().next()
            .getName().startsWith(OneKDC.USER)) {
        throw new Exception("The authenticated is not " + OneKDC.USER);
    }
}
 

/**
 * Logins with username/keytab as a new subject,
 */
public static Context fromUserKtab(Subject s,
        String user, String ktab, boolean storeKey) throws Exception {
    Context out = new Context();
    out.name = user;
    out.s = s;
    Krb5LoginModule krb5 = new Krb5LoginModule();
    Map<String, String> map = new HashMap<>();

    map.put("isInitiator", "false");
    map.put("doNotPrompt", "true");
    map.put("useTicketCache", "false");
    map.put("useKeyTab", "true");
    map.put("keyTab", ktab);
    map.put("principal", user);
    if (storeKey) {
        map.put("storeKey", "true");
    }

    krb5.initialize(out.s, null, null, map);
    krb5.login();
    krb5.commit();
    return out;
}
 

/**
 * Logins with username/keytab as a new subject,
 */
public static Context fromUserKtab(Subject s,
        String user, String ktab, boolean storeKey) throws Exception {
    Context out = new Context();
    out.name = user;
    out.s = s;
    Krb5LoginModule krb5 = new Krb5LoginModule();
    Map<String, String> map = new HashMap<>();

    map.put("isInitiator", "false");
    map.put("doNotPrompt", "true");
    map.put("useTicketCache", "false");
    map.put("useKeyTab", "true");
    map.put("keyTab", ktab);
    map.put("principal", user);
    if (storeKey) {
        map.put("storeKey", "true");
    }

    krb5.initialize(out.s, null, null, map);
    krb5.login();
    krb5.commit();
    return out;
}
 

static void login(CallbackHandler callback, Object... options)
        throws Exception {
    Krb5LoginModule krb5 = new Krb5LoginModule();
    Subject subject = new Subject();
    Map<String, String> map = new HashMap<>();
    Map<String, Object> shared = new HashMap<>();

    int count = options.length / 2;
    for (int i = 0; i < count; i++) {
        String key = (String) options[2 * i];
        Object value = options[2 * i + 1];
        if (key.startsWith("javax")) {
            shared.put(key, value);
        } else {
            map.put(key, (String) value);
        }
    }
    krb5.initialize(subject, callback, shared, map);
    krb5.login();
    krb5.commit();
    if (!subject.getPrincipals().iterator().next()
            .getName().startsWith(OneKDC.USER)) {
        throw new Exception("The authenticated is not " + OneKDC.USER);
    }
}
 

static void login(CallbackHandler callback, Object... options)
        throws Exception {
    Krb5LoginModule krb5 = new Krb5LoginModule();
    Subject subject = new Subject();
    Map<String, String> map = new HashMap<>();
    Map<String, Object> shared = new HashMap<>();

    int count = options.length / 2;
    for (int i = 0; i < count; i++) {
        String key = (String) options[2 * i];
        Object value = options[2 * i + 1];
        if (key.startsWith("javax")) {
            shared.put(key, value);
        } else {
            map.put(key, (String) value);
        }
    }
    krb5.initialize(subject, callback, shared, map);
    krb5.login();
    krb5.commit();
    if (!subject.getPrincipals().iterator().next()
            .getName().startsWith(OneKDC.USER)) {
        throw new Exception("The authenticated is not " + OneKDC.USER);
    }
}
 

/**
 * Logins with username/keytab as a new subject,
 */
public static Context fromUserKtab(Subject s,
        String user, String ktab, boolean storeKey) throws Exception {
    Context out = new Context();
    out.name = user;
    out.s = s;
    Krb5LoginModule krb5 = new Krb5LoginModule();
    Map<String, String> map = new HashMap<>();

    map.put("isInitiator", "false");
    map.put("doNotPrompt", "true");
    map.put("useTicketCache", "false");
    map.put("useKeyTab", "true");
    map.put("keyTab", ktab);
    map.put("principal", user);
    if (storeKey) {
        map.put("storeKey", "true");
    }

    krb5.initialize(out.s, null, null, map);
    krb5.login();
    krb5.commit();
    return out;
}
 

static void login(CallbackHandler callback, Object... options)
        throws Exception {
    Krb5LoginModule krb5 = new Krb5LoginModule();
    Subject subject = new Subject();
    Map<String, String> map = new HashMap<>();
    Map<String, Object> shared = new HashMap<>();

    int count = options.length / 2;
    for (int i = 0; i < count; i++) {
        String key = (String) options[2 * i];
        Object value = options[2 * i + 1];
        if (key.startsWith("javax")) {
            shared.put(key, value);
        } else {
            map.put(key, (String) value);
        }
    }
    krb5.initialize(subject, callback, shared, map);
    krb5.login();
    krb5.commit();
    if (!subject.getPrincipals().iterator().next()
            .getName().startsWith(OneKDC.USER)) {
        throw new Exception("The authenticated is not " + OneKDC.USER);
    }
}
 

/**
 * Logins with username/password as an existing Subject. The
 * same subject can be used multiple times to simulate multiple logins.
 * @param s existing subject
 */
public static Context fromUserPass(Subject s,
        String user, char[] pass, boolean storeKey) throws Exception {
    Context out = new Context();
    out.name = user;
    out.s = s;
    Krb5LoginModule krb5 = new Krb5LoginModule();
    Map<String, String> map = new HashMap<>();
    Map<String, Object> shared = new HashMap<>();

    if (pass != null) {
        map.put("useFirstPass", "true");
        shared.put("javax.security.auth.login.name", user);
        shared.put("javax.security.auth.login.password", pass);
    } else {
        map.put("doNotPrompt", "true");
        map.put("useTicketCache", "true");
        if (user != null) {
            map.put("principal", user);
        }
    }
    if (storeKey) {
        map.put("storeKey", "true");
    }

    krb5.initialize(out.s, null, shared, map);
    krb5.login();
    krb5.commit();
    return out;
}
 

void go() throws Exception {
    Krb5LoginModule krb5 = new Krb5LoginModule();

    final String name = OneKDC.USER;
    final char[] password = OneKDC.PASS;
    char[] badpassword = "hellokitty".toCharArray();

    Map<String,String> map = new HashMap<>();
    map.put("useTicketCache", "false");
    map.put("doNotPrompt", "false");
    map.put("tryFirstPass", "true");
    Map<String,Object> shared = new HashMap<>();
    shared.put("javax.security.auth.login.name", name);
    shared.put("javax.security.auth.login.password", badpassword);

    krb5.initialize(new Subject(), new CallbackHandler() {
        @Override
        public void handle(Callback[] callbacks) {
            for(Callback callback: callbacks) {
                if (callback instanceof NameCallback) {
                    ((NameCallback)callback).setName(name);
                }
                if (callback instanceof PasswordCallback) {
                    ((PasswordCallback)callback).setPassword(password);
                }
            }
        }
    }, shared, map);
    krb5.login();
}
 

public MyServerAuthenticator(boolean proxy, String scheme,
        String principal, String ktab) throws Exception {

    this.scheme = scheme;
    if (proxy) {
        reqHdr = "Proxy-Authenticate";
        respHdr = "Proxy-Authorization";
        err = HttpURLConnection.HTTP_PROXY_AUTH;
    }

    Krb5LoginModule krb5 = new Krb5LoginModule();
    Map<String, String> map = new HashMap<>();
    Map<String, Object> shared = new HashMap<>();

    map.put("storeKey", "true");
    map.put("isInitiator", "false");
    map.put("useKeyTab", "true");
    map.put("keyTab", ktab);
    map.put("principal", principal);
    krb5.initialize(s, null, shared, map);
    krb5.login();
    krb5.commit();
    m = GSSManager.getInstance();
    cred = Subject.doAs(s, new PrivilegedExceptionAction<GSSCredential>() {
        @Override
        public GSSCredential run() throws Exception {
            System.err.println("Creating GSSCredential");
            return m.createCredential(
                    null,
                    GSSCredential.INDEFINITE_LIFETIME,
                    MyServerAuthenticator.this.scheme.equalsIgnoreCase("Negotiate")?
                            GSSUtil.GSS_SPNEGO_MECH_OID:
                            GSSUtil.GSS_KRB5_MECH_OID,
                    GSSCredential.ACCEPT_ONLY);
        }
    });
}