Java Code Examples for javax.security.auth.Subject#isReadOnly()

The following examples show how to use javax.security.auth.Subject#isReadOnly() . You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example 1
Source File: SubjectDelegator.java    From jdk1.8-source-analysis with Apache License 2.0 5 votes vote down vote up 
/**
 * Retrieves the {@linkplain Subject} principals
 * @param subject The subject
 * @return If the {@code Subject} is immutable it will return the principals directly.
 *         If the {@code Subject} is mutable it will create an unmodifiable copy.
 */
private static Collection<Principal> getSubjectPrincipals(Subject subject) {
    if (subject.isReadOnly()) {
        return subject.getPrincipals();
    }

    List<Principal> principals = Arrays.asList(subject.getPrincipals().toArray(new Principal[0]));
    return Collections.unmodifiableList(principals);
}
Example 2
Source File: SubjectDelegator.java    From dragonwell8_jdk with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * Retrieves the {@linkplain Subject} principals
 * @param subject The subject
 * @return If the {@code Subject} is immutable it will return the principals directly.
 *         If the {@code Subject} is mutable it will create an unmodifiable copy.
 */
private static Collection<Principal> getSubjectPrincipals(Subject subject) {
    if (subject.isReadOnly()) {
        return subject.getPrincipals();
    }

    List<Principal> principals = Arrays.asList(subject.getPrincipals().toArray(new Principal[0]));
    return Collections.unmodifiableList(principals);
}
Example 3
Source File: SubjectDelegator.java    From jdk8u_jdk with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * Retrieves the {@linkplain Subject} principals
 * @param subject The subject
 * @return If the {@code Subject} is immutable it will return the principals directly.
 *         If the {@code Subject} is mutable it will create an unmodifiable copy.
 */
private static Collection<Principal> getSubjectPrincipals(Subject subject) {
    if (subject.isReadOnly()) {
        return subject.getPrincipals();
    }

    List<Principal> principals = Arrays.asList(subject.getPrincipals().toArray(new Principal[0]));
    return Collections.unmodifiableList(principals);
}
Example 4
Source File: SubjectDelegator.java    From hottub with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * Retrieves the {@linkplain Subject} principals
 * @param subject The subject
 * @return If the {@code Subject} is immutable it will return the principals directly.
 *         If the {@code Subject} is mutable it will create an unmodifiable copy.
 */
private static Collection<Principal> getSubjectPrincipals(Subject subject) {
    if (subject.isReadOnly()) {
        return subject.getPrincipals();
    }

    List<Principal> principals = Arrays.asList(subject.getPrincipals().toArray(new Principal[0]));
    return Collections.unmodifiableList(principals);
}
Example 5
Source File: SubjectDelegator.java    From jdk8u60 with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * Retrieves the {@linkplain Subject} principals
 * @param subject The subject
 * @return If the {@code Subject} is immutable it will return the principals directly.
 *         If the {@code Subject} is mutable it will create an unmodifiable copy.
 */
private static Collection<Principal> getSubjectPrincipals(Subject subject) {
    if (subject.isReadOnly()) {
        return subject.getPrincipals();
    }

    List<Principal> principals = Arrays.asList(subject.getPrincipals().toArray(new Principal[0]));
    return Collections.unmodifiableList(principals);
}
Example 6
Source File: SubjectDelegator.java    From JDKSourceCode1.8 with MIT License 5 votes vote down vote up 
/**
 * Retrieves the {@linkplain Subject} principals
 * @param subject The subject
 * @return If the {@code Subject} is immutable it will return the principals directly.
 *         If the {@code Subject} is mutable it will create an unmodifiable copy.
 */
private static Collection<Principal> getSubjectPrincipals(Subject subject) {
    if (subject.isReadOnly()) {
        return subject.getPrincipals();
    }

    List<Principal> principals = Arrays.asList(subject.getPrincipals().toArray(new Principal[0]));
    return Collections.unmodifiableList(principals);
}
Example 7
Source File: SubjectDelegator.java    From jdk8u-dev-jdk with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * Retrieves the {@linkplain Subject} principals
 * @param subject The subject
 * @return If the {@code Subject} is immutable it will return the principals directly.
 *         If the {@code Subject} is mutable it will create an unmodifiable copy.
 */
private static Collection<Principal> getSubjectPrincipals(Subject subject) {
    if (subject.isReadOnly()) {
        return subject.getPrincipals();
    }

    List<Principal> principals = Arrays.asList(subject.getPrincipals().toArray(new Principal[0]));
    return Collections.unmodifiableList(principals);
}
Example 8
Source File: SubjectDelegator.java    From openjdk-jdk8u with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * Retrieves the {@linkplain Subject} principals
 * @param subject The subject
 * @return If the {@code Subject} is immutable it will return the principals directly.
 *         If the {@code Subject} is mutable it will create an unmodifiable copy.
 */
private static Collection<Principal> getSubjectPrincipals(Subject subject) {
    if (subject.isReadOnly()) {
        return subject.getPrincipals();
    }

    List<Principal> principals = Arrays.asList(subject.getPrincipals().toArray(new Principal[0]));
    return Collections.unmodifiableList(principals);
}
Example 9
Source File: SubjectDelegator.java    From jdk8u-jdk with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * Retrieves the {@linkplain Subject} principals
 * @param subject The subject
 * @return If the {@code Subject} is immutable it will return the principals directly.
 *         If the {@code Subject} is mutable it will create an unmodifiable copy.
 */
private static Collection<Principal> getSubjectPrincipals(Subject subject) {
    if (subject.isReadOnly()) {
        return subject.getPrincipals();
    }

    List<Principal> principals = Arrays.asList(subject.getPrincipals().toArray(new Principal[0]));
    return Collections.unmodifiableList(principals);
}
Example 10
Source File: SubjectDelegator.java    From openjdk-jdk8u-backup with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * Retrieves the {@linkplain Subject} principals
 * @param subject The subject
 * @return If the {@code Subject} is immutable it will return the principals directly.
 *         If the {@code Subject} is mutable it will create an unmodifiable copy.
 */
private static Collection<Principal> getSubjectPrincipals(Subject subject) {
    if (subject.isReadOnly()) {
        return subject.getPrincipals();
    }

    List<Principal> principals = Arrays.asList(subject.getPrincipals().toArray(new Principal[0]));
    return Collections.unmodifiableList(principals);
}
Example 11
Source File: SubjectDelegator.java    From jdk8u-jdk with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * Retrieves the {@linkplain Subject} principals
 * @param subject The subject
 * @return If the {@code Subject} is immutable it will return the principals directly.
 *         If the {@code Subject} is mutable it will create an unmodifiable copy.
 */
private static Collection<Principal> getSubjectPrincipals(Subject subject) {
    if (subject.isReadOnly()) {
        return subject.getPrincipals();
    }

    List<Principal> principals = Arrays.asList(subject.getPrincipals().toArray(new Principal[0]));
    return Collections.unmodifiableList(principals);
}
Example 12
Source File: SubjectDelegator.java    From openjdk-jdk9 with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * Retrieves the {@linkplain Subject} principals
 * @param subject The subject
 * @return If the {@code Subject} is immutable it will return the principals directly.
 *         If the {@code Subject} is mutable it will create an unmodifiable copy.
 */
private static Collection<Principal> getSubjectPrincipals(Subject subject) {
    if (subject.isReadOnly()) {
        return subject.getPrincipals();
    }

    List<Principal> principals = Arrays.asList(subject.getPrincipals().toArray(new Principal[0]));
    return Collections.unmodifiableList(principals);
}
Example 13
Source File: Krb5Util.java    From openjdk-8 with GNU General Public License v2.0 4 votes vote down vote up 
/**
 * Retrieve the service ticket for serverPrincipal from caller's Subject
 * or from Subject obtained by logging in, or if not found, via the
 * Ticket Granting Service using the TGT obtained from the Subject.
 *
 * Caller must have permission to:
 *    - access and update Subject's private credentials
 *    - create LoginContext
 *    - read the auth.login.defaultCallbackHandler security property
 *
 * NOTE: This method is used by JSSE Kerberos Cipher Suites
 */
public static KerberosTicket getTicketFromSubjectAndTgs(GSSCaller caller,
    String clientPrincipal, String serverPrincipal, String tgsPrincipal,
    AccessControlContext acc)
    throws LoginException, KrbException, IOException {

    // 1. Try to find service ticket in acc subject
    Subject accSubj = Subject.getSubject(acc);
    KerberosTicket ticket = SubjectComber.find(accSubj,
        serverPrincipal, clientPrincipal, KerberosTicket.class);

    if (ticket != null) {
        return ticket;  // found it
    }

    Subject loginSubj = null;
    if (!GSSUtil.useSubjectCredsOnly(caller)) {
        // 2. Try to get ticket from login
        try {
            loginSubj = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
            ticket = SubjectComber.find(loginSubj,
                serverPrincipal, clientPrincipal, KerberosTicket.class);
            if (ticket != null) {
                return ticket; // found it
            }
        } catch (LoginException e) {
            // No login entry to use
            // ignore and continue
        }
    }

    // Service ticket not found in subject or login
    // Try to get TGT to acquire service ticket

    // 3. Try to get TGT from acc subject
    KerberosTicket tgt = SubjectComber.find(accSubj,
        tgsPrincipal, clientPrincipal, KerberosTicket.class);

    boolean fromAcc;
    if (tgt == null && loginSubj != null) {
        // 4. Try to get TGT from login subject
        tgt = SubjectComber.find(loginSubj,
            tgsPrincipal, clientPrincipal, KerberosTicket.class);
        fromAcc = false;
    } else {
        fromAcc = true;
    }

    // 5. Try to get service ticket using TGT
    if (tgt != null) {
        Credentials tgtCreds = ticketToCreds(tgt);
        Credentials serviceCreds = Credentials.acquireServiceCreds(
                    serverPrincipal, tgtCreds);
        if (serviceCreds != null) {
            ticket = credsToTicket(serviceCreds);

            // Store service ticket in acc's Subject
            if (fromAcc && accSubj != null && !accSubj.isReadOnly()) {
                accSubj.getPrivateCredentials().add(ticket);
            }
        }
    }
    return ticket;
}
Example 14
Source File: Krb5Util.java    From hottub with GNU General Public License v2.0 4 votes vote down vote up 
/**
 * Retrieve the service ticket for serverPrincipal from caller's Subject
 * or from Subject obtained by logging in, or if not found, via the
 * Ticket Granting Service using the TGT obtained from the Subject.
 *
 * Caller must have permission to:
 *    - access and update Subject's private credentials
 *    - create LoginContext
 *    - read the auth.login.defaultCallbackHandler security property
 *
 * NOTE: This method is used by JSSE Kerberos Cipher Suites
 */
public static KerberosTicket getTicketFromSubjectAndTgs(GSSCaller caller,
    String clientPrincipal, String serverPrincipal, String tgsPrincipal,
    AccessControlContext acc)
    throws LoginException, KrbException, IOException {

    // 1. Try to find service ticket in acc subject
    Subject accSubj = Subject.getSubject(acc);
    KerberosTicket ticket = SubjectComber.find(accSubj,
        serverPrincipal, clientPrincipal, KerberosTicket.class);

    if (ticket != null) {
        return ticket;  // found it
    }

    Subject loginSubj = null;
    if (!GSSUtil.useSubjectCredsOnly(caller)) {
        // 2. Try to get ticket from login
        try {
            loginSubj = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
            ticket = SubjectComber.find(loginSubj,
                serverPrincipal, clientPrincipal, KerberosTicket.class);
            if (ticket != null) {
                return ticket; // found it
            }
        } catch (LoginException e) {
            // No login entry to use
            // ignore and continue
        }
    }

    // Service ticket not found in subject or login
    // Try to get TGT to acquire service ticket

    // 3. Try to get TGT from acc subject
    KerberosTicket tgt = SubjectComber.find(accSubj,
        tgsPrincipal, clientPrincipal, KerberosTicket.class);

    boolean fromAcc;
    if (tgt == null && loginSubj != null) {
        // 4. Try to get TGT from login subject
        tgt = SubjectComber.find(loginSubj,
            tgsPrincipal, clientPrincipal, KerberosTicket.class);
        fromAcc = false;
    } else {
        fromAcc = true;
    }

    // 5. Try to get service ticket using TGT
    if (tgt != null) {
        Credentials tgtCreds = ticketToCreds(tgt);
        Credentials serviceCreds = Credentials.acquireServiceCreds(
                    serverPrincipal, tgtCreds);
        if (serviceCreds != null) {
            ticket = credsToTicket(serviceCreds);

            // Store service ticket in acc's Subject
            if (fromAcc && accSubj != null && !accSubj.isReadOnly()) {
                accSubj.getPrivateCredentials().add(ticket);
            }
        }
    }
    return ticket;
}
Example 15
Source File: Krb5Util.java    From jdk8u-jdk with GNU General Public License v2.0 4 votes vote down vote up 
/**
 * Retrieve the service ticket for serverPrincipal from caller's Subject
 * or from Subject obtained by logging in, or if not found, via the
 * Ticket Granting Service using the TGT obtained from the Subject.
 *
 * Caller must have permission to:
 *    - access and update Subject's private credentials
 *    - create LoginContext
 *    - read the auth.login.defaultCallbackHandler security property
 *
 * NOTE: This method is used by JSSE Kerberos Cipher Suites
 */
public static KerberosTicket getTicketFromSubjectAndTgs(GSSCaller caller,
    String clientPrincipal, String serverPrincipal, String tgsPrincipal,
    AccessControlContext acc)
    throws LoginException, KrbException, IOException {

    // 1. Try to find service ticket in acc subject
    Subject accSubj = Subject.getSubject(acc);
    KerberosTicket ticket = SubjectComber.find(accSubj,
        serverPrincipal, clientPrincipal, KerberosTicket.class);

    if (ticket != null) {
        return ticket;  // found it
    }

    Subject loginSubj = null;
    if (!GSSUtil.useSubjectCredsOnly(caller)) {
        // 2. Try to get ticket from login
        try {
            loginSubj = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
            ticket = SubjectComber.find(loginSubj,
                serverPrincipal, clientPrincipal, KerberosTicket.class);
            if (ticket != null) {
                return ticket; // found it
            }
        } catch (LoginException e) {
            // No login entry to use
            // ignore and continue
        }
    }

    // Service ticket not found in subject or login
    // Try to get TGT to acquire service ticket

    // 3. Try to get TGT from acc subject
    KerberosTicket tgt = SubjectComber.find(accSubj,
        tgsPrincipal, clientPrincipal, KerberosTicket.class);

    boolean fromAcc;
    if (tgt == null && loginSubj != null) {
        // 4. Try to get TGT from login subject
        tgt = SubjectComber.find(loginSubj,
            tgsPrincipal, clientPrincipal, KerberosTicket.class);
        fromAcc = false;
    } else {
        fromAcc = true;
    }

    // 5. Try to get service ticket using TGT
    if (tgt != null) {
        Credentials tgtCreds = ticketToCreds(tgt);
        Credentials serviceCreds = Credentials.acquireServiceCreds(
                    serverPrincipal, tgtCreds);
        if (serviceCreds != null) {
            ticket = credsToTicket(serviceCreds);

            // Store service ticket in acc's Subject
            if (fromAcc && accSubj != null && !accSubj.isReadOnly()) {
                accSubj.getPrivateCredentials().add(ticket);
            }
        }
    }
    return ticket;
}
Example 16
Source File: Krb5Util.java    From openjdk-jdk9 with GNU General Public License v2.0 4 votes vote down vote up 
/**
 * Retrieve the service ticket for serverPrincipal from caller's Subject
 * or from Subject obtained by logging in, or if not found, via the
 * Ticket Granting Service using the TGT obtained from the Subject.
 *
 * Caller must have permission to:
 *    - access and update Subject's private credentials
 *    - create LoginContext
 *    - read the auth.login.defaultCallbackHandler security property
 *
 * NOTE: This method is used by JSSE Kerberos Cipher Suites
 */
public static KerberosTicket getTicketFromSubjectAndTgs(GSSCaller caller,
    String clientPrincipal, String serverPrincipal, String tgsPrincipal,
    AccessControlContext acc)
    throws LoginException, KrbException, IOException {

    // 1. Try to find service ticket in acc subject
    Subject accSubj = Subject.getSubject(acc);
    KerberosTicket ticket = SubjectComber.find(accSubj,
        serverPrincipal, clientPrincipal, KerberosTicket.class);

    if (ticket != null) {
        return ticket;  // found it
    }

    Subject loginSubj = null;
    if (!GSSUtil.useSubjectCredsOnly(caller)) {
        // 2. Try to get ticket from login
        try {
            loginSubj = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
            ticket = SubjectComber.find(loginSubj,
                serverPrincipal, clientPrincipal, KerberosTicket.class);
            if (ticket != null) {
                return ticket; // found it
            }
        } catch (LoginException e) {
            // No login entry to use
            // ignore and continue
        }
    }

    // Service ticket not found in subject or login
    // Try to get TGT to acquire service ticket

    // 3. Try to get TGT from acc subject
    KerberosTicket tgt = SubjectComber.find(accSubj,
        tgsPrincipal, clientPrincipal, KerberosTicket.class);

    boolean fromAcc;
    if (tgt == null && loginSubj != null) {
        // 4. Try to get TGT from login subject
        tgt = SubjectComber.find(loginSubj,
            tgsPrincipal, clientPrincipal, KerberosTicket.class);
        fromAcc = false;
    } else {
        fromAcc = true;
    }

    // 5. Try to get service ticket using TGT
    if (tgt != null) {
        Credentials tgtCreds = ticketToCreds(tgt);
        Credentials serviceCreds = Credentials.acquireServiceCreds(
                    serverPrincipal, tgtCreds);
        if (serviceCreds != null) {
            ticket = credsToTicket(serviceCreds);

            // Store service ticket in acc's Subject
            if (fromAcc && accSubj != null && !accSubj.isReadOnly()) {
                accSubj.getPrivateCredentials().add(ticket);
            }
        }
    }
    return ticket;
}
Example 17
Source File: Krb5Util.java    From jdk8u60 with GNU General Public License v2.0 4 votes vote down vote up 
/**
 * Retrieve the service ticket for serverPrincipal from caller's Subject
 * or from Subject obtained by logging in, or if not found, via the
 * Ticket Granting Service using the TGT obtained from the Subject.
 *
 * Caller must have permission to:
 *    - access and update Subject's private credentials
 *    - create LoginContext
 *    - read the auth.login.defaultCallbackHandler security property
 *
 * NOTE: This method is used by JSSE Kerberos Cipher Suites
 */
public static KerberosTicket getTicketFromSubjectAndTgs(GSSCaller caller,
    String clientPrincipal, String serverPrincipal, String tgsPrincipal,
    AccessControlContext acc)
    throws LoginException, KrbException, IOException {

    // 1. Try to find service ticket in acc subject
    Subject accSubj = Subject.getSubject(acc);
    KerberosTicket ticket = SubjectComber.find(accSubj,
        serverPrincipal, clientPrincipal, KerberosTicket.class);

    if (ticket != null) {
        return ticket;  // found it
    }

    Subject loginSubj = null;
    if (!GSSUtil.useSubjectCredsOnly(caller)) {
        // 2. Try to get ticket from login
        try {
            loginSubj = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
            ticket = SubjectComber.find(loginSubj,
                serverPrincipal, clientPrincipal, KerberosTicket.class);
            if (ticket != null) {
                return ticket; // found it
            }
        } catch (LoginException e) {
            // No login entry to use
            // ignore and continue
        }
    }

    // Service ticket not found in subject or login
    // Try to get TGT to acquire service ticket

    // 3. Try to get TGT from acc subject
    KerberosTicket tgt = SubjectComber.find(accSubj,
        tgsPrincipal, clientPrincipal, KerberosTicket.class);

    boolean fromAcc;
    if (tgt == null && loginSubj != null) {
        // 4. Try to get TGT from login subject
        tgt = SubjectComber.find(loginSubj,
            tgsPrincipal, clientPrincipal, KerberosTicket.class);
        fromAcc = false;
    } else {
        fromAcc = true;
    }

    // 5. Try to get service ticket using TGT
    if (tgt != null) {
        Credentials tgtCreds = ticketToCreds(tgt);
        Credentials serviceCreds = Credentials.acquireServiceCreds(
                    serverPrincipal, tgtCreds);
        if (serviceCreds != null) {
            ticket = credsToTicket(serviceCreds);

            // Store service ticket in acc's Subject
            if (fromAcc && accSubj != null && !accSubj.isReadOnly()) {
                accSubj.getPrivateCredentials().add(ticket);
            }
        }
    }
    return ticket;
}
Example 18
Source File: Krb5Util.java    From jdk8u-dev-jdk with GNU General Public License v2.0 4 votes vote down vote up 
/**
 * Retrieve the service ticket for serverPrincipal from caller's Subject
 * or from Subject obtained by logging in, or if not found, via the
 * Ticket Granting Service using the TGT obtained from the Subject.
 *
 * Caller must have permission to:
 *    - access and update Subject's private credentials
 *    - create LoginContext
 *    - read the auth.login.defaultCallbackHandler security property
 *
 * NOTE: This method is used by JSSE Kerberos Cipher Suites
 */
public static KerberosTicket getTicketFromSubjectAndTgs(GSSCaller caller,
    String clientPrincipal, String serverPrincipal, String tgsPrincipal,
    AccessControlContext acc)
    throws LoginException, KrbException, IOException {

    // 1. Try to find service ticket in acc subject
    Subject accSubj = Subject.getSubject(acc);
    KerberosTicket ticket = SubjectComber.find(accSubj,
        serverPrincipal, clientPrincipal, KerberosTicket.class);

    if (ticket != null) {
        return ticket;  // found it
    }

    Subject loginSubj = null;
    if (!GSSUtil.useSubjectCredsOnly(caller)) {
        // 2. Try to get ticket from login
        try {
            loginSubj = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
            ticket = SubjectComber.find(loginSubj,
                serverPrincipal, clientPrincipal, KerberosTicket.class);
            if (ticket != null) {
                return ticket; // found it
            }
        } catch (LoginException e) {
            // No login entry to use
            // ignore and continue
        }
    }

    // Service ticket not found in subject or login
    // Try to get TGT to acquire service ticket

    // 3. Try to get TGT from acc subject
    KerberosTicket tgt = SubjectComber.find(accSubj,
        tgsPrincipal, clientPrincipal, KerberosTicket.class);

    boolean fromAcc;
    if (tgt == null && loginSubj != null) {
        // 4. Try to get TGT from login subject
        tgt = SubjectComber.find(loginSubj,
            tgsPrincipal, clientPrincipal, KerberosTicket.class);
        fromAcc = false;
    } else {
        fromAcc = true;
    }

    // 5. Try to get service ticket using TGT
    if (tgt != null) {
        Credentials tgtCreds = ticketToCreds(tgt);
        Credentials serviceCreds = Credentials.acquireServiceCreds(
                    serverPrincipal, tgtCreds);
        if (serviceCreds != null) {
            ticket = credsToTicket(serviceCreds);

            // Store service ticket in acc's Subject
            if (fromAcc && accSubj != null && !accSubj.isReadOnly()) {
                accSubj.getPrivateCredentials().add(ticket);
            }
        }
    }
    return ticket;
}
Example 19
Source File: Krb5Util.java    From TencentKona-8 with GNU General Public License v2.0 4 votes vote down vote up 
/**
 * Retrieve the service ticket for serverPrincipal from caller's Subject
 * or from Subject obtained by logging in, or if not found, via the
 * Ticket Granting Service using the TGT obtained from the Subject.
 *
 * Caller must have permission to:
 *    - access and update Subject's private credentials
 *    - create LoginContext
 *    - read the auth.login.defaultCallbackHandler security property
 *
 * NOTE: This method is used by JSSE Kerberos Cipher Suites
 */
public static KerberosTicket getTicketFromSubjectAndTgs(GSSCaller caller,
    String clientPrincipal, String serverPrincipal, String tgsPrincipal,
    AccessControlContext acc)
    throws LoginException, KrbException, IOException {

    // 1. Try to find service ticket in acc subject
    Subject accSubj = Subject.getSubject(acc);
    KerberosTicket ticket = SubjectComber.find(accSubj,
        serverPrincipal, clientPrincipal, KerberosTicket.class);

    if (ticket != null) {
        return ticket;  // found it
    }

    Subject loginSubj = null;
    if (!GSSUtil.useSubjectCredsOnly(caller)) {
        // 2. Try to get ticket from login
        try {
            loginSubj = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
            ticket = SubjectComber.find(loginSubj,
                serverPrincipal, clientPrincipal, KerberosTicket.class);
            if (ticket != null) {
                return ticket; // found it
            }
        } catch (LoginException e) {
            // No login entry to use
            // ignore and continue
        }
    }

    // Service ticket not found in subject or login
    // Try to get TGT to acquire service ticket

    // 3. Try to get TGT from acc subject
    KerberosTicket tgt = SubjectComber.find(accSubj,
        tgsPrincipal, clientPrincipal, KerberosTicket.class);

    boolean fromAcc;
    if (tgt == null && loginSubj != null) {
        // 4. Try to get TGT from login subject
        tgt = SubjectComber.find(loginSubj,
            tgsPrincipal, clientPrincipal, KerberosTicket.class);
        fromAcc = false;
    } else {
        fromAcc = true;
    }

    // 5. Try to get service ticket using TGT
    if (tgt != null) {
        Credentials tgtCreds = ticketToCreds(tgt);
        Credentials serviceCreds = Credentials.acquireServiceCreds(
                    serverPrincipal, tgtCreds);
        if (serviceCreds != null) {
            ticket = credsToTicket(serviceCreds);

            // Store service ticket in acc's Subject
            if (fromAcc && accSubj != null && !accSubj.isReadOnly()) {
                accSubj.getPrivateCredentials().add(ticket);
            }
        }
    }
    return ticket;
}
Example 20
Source File: Krb5Util.java    From dragonwell8_jdk with GNU General Public License v2.0 4 votes vote down vote up 
/**
 * Retrieve the service ticket for serverPrincipal from caller's Subject
 * or from Subject obtained by logging in, or if not found, via the
 * Ticket Granting Service using the TGT obtained from the Subject.
 *
 * Caller must have permission to:
 *    - access and update Subject's private credentials
 *    - create LoginContext
 *    - read the auth.login.defaultCallbackHandler security property
 *
 * NOTE: This method is used by JSSE Kerberos Cipher Suites
 */
public static KerberosTicket getTicketFromSubjectAndTgs(GSSCaller caller,
    String clientPrincipal, String serverPrincipal, String tgsPrincipal,
    AccessControlContext acc)
    throws LoginException, KrbException, IOException {

    // 1. Try to find service ticket in acc subject
    Subject accSubj = Subject.getSubject(acc);
    KerberosTicket ticket = SubjectComber.find(accSubj,
        serverPrincipal, clientPrincipal, KerberosTicket.class);

    if (ticket != null) {
        return ticket;  // found it
    }

    Subject loginSubj = null;
    if (!GSSUtil.useSubjectCredsOnly(caller)) {
        // 2. Try to get ticket from login
        try {
            loginSubj = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
            ticket = SubjectComber.find(loginSubj,
                serverPrincipal, clientPrincipal, KerberosTicket.class);
            if (ticket != null) {
                return ticket; // found it
            }
        } catch (LoginException e) {
            // No login entry to use
            // ignore and continue
        }
    }

    // Service ticket not found in subject or login
    // Try to get TGT to acquire service ticket

    // 3. Try to get TGT from acc subject
    KerberosTicket tgt = SubjectComber.find(accSubj,
        tgsPrincipal, clientPrincipal, KerberosTicket.class);

    boolean fromAcc;
    if (tgt == null && loginSubj != null) {
        // 4. Try to get TGT from login subject
        tgt = SubjectComber.find(loginSubj,
            tgsPrincipal, clientPrincipal, KerberosTicket.class);
        fromAcc = false;
    } else {
        fromAcc = true;
    }

    // 5. Try to get service ticket using TGT
    if (tgt != null) {
        Credentials tgtCreds = ticketToCreds(tgt);
        Credentials serviceCreds = Credentials.acquireServiceCreds(
                    serverPrincipal, tgtCreds);
        if (serviceCreds != null) {
            ticket = credsToTicket(serviceCreds);

            // Store service ticket in acc's Subject
            if (fromAcc && accSubj != null && !accSubj.isReadOnly()) {
                accSubj.getPrivateCredentials().add(ticket);
            }
        }
    }
    return ticket;
}