sun.security.jgss.GSSUtil Java Examples

The following examples show how to use sun.security.jgss.GSSUtil. You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.

Example #1

Source File: LoginNoPass.java From dragonwell8_jdk with GNU General Public License v2.0

6 votes

public static void main(String[] args) throws Exception {

        new OneKDC(null) {
            protected byte[] processAsReq(byte[] in) throws Exception {
                kdcTouched = true;
                return super.processAsReq(in);
            }
        }.writeJAASConf();
        Security.setProperty("auth.login.defaultCallbackHandler",
                "LoginNoPass$CallbackForClient");
        System.setProperty("javax.security.auth.useSubjectCredsOnly", "false");

        try {
            Context c;
            c = Context.fromJAAS("client");
            c.startAsClient(OneKDC.SERVER, GSSUtil.GSS_KRB5_MECH_OID);
            c.take(new byte[0]);
        } catch (Exception e) {
            e.printStackTrace(System.out);
            // OK
        }
        if (kdcTouched) {
            throw new Exception("Failed");
        }
    }

Example #2

Source File: Krb5Util.java From hottub with GNU General Public License v2.0

6 votes

/**
 * Retrieves the ServiceCreds for the specified server principal from
 * the Subject in the specified AccessControlContext. If not found, and if
 * useSubjectCredsOnly is false, then obtain from a LoginContext.
 *
 * NOTE: This method is also used by JSSE Kerberos Cipher Suites
 */
public static ServiceCreds getServiceCreds(GSSCaller caller,
    String serverPrincipal, AccessControlContext acc)
            throws LoginException {

    Subject accSubj = Subject.getSubject(acc);
    ServiceCreds sc = null;
    if (accSubj != null) {
        sc = ServiceCreds.getInstance(accSubj, serverPrincipal);
    }
    if (sc == null && !GSSUtil.useSubjectCredsOnly(caller)) {
        Subject subject = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
        sc = ServiceCreds.getInstance(subject, serverPrincipal);
    }
    return sc;
}

Example #3

Source File: GSSUnbound.java From openjdk-8-source with GNU General Public License v2.0

6 votes

public static void main(String[] args) throws Exception {

        new OneKDC(null);

        Context c, s;
        c = Context.fromUserPass(OneKDC.USER, OneKDC.PASS, false);
        s = Context.fromThinAir();

        // This is the only setting needed for JGSS without JAAS. The default
        // JAAS config entries are already created by OneKDC.
        System.setProperty("javax.security.auth.useSubjectCredsOnly", "false");

        c.startAsClient(OneKDC.BACKEND, GSSUtil.GSS_KRB5_MECH_OID);
        s.startAsServer(GSSUtil.GSS_KRB5_MECH_OID);

        Context.handshake(c, s);

        Context.transmit("i say high --", c, s);
        Context.transmit("   you say low", s, c);

        s.dispose();
        c.dispose();
    }

Example #4

Source File: NativeGSSContext.java From dragonwell8_jdk with GNU General Public License v2.0

6 votes

NativeGSSContext(GSSNameElement peer, GSSCredElement myCred,
                 int time, GSSLibStub stub) throws GSSException {
    if (peer == null) {
        throw new GSSException(GSSException.FAILURE, 1, "null peer");
    }
    cStub = stub;
    cred = myCred;
    targetName = peer;
    isInitiator = true;
    lifetime = time;

    if (GSSUtil.isKerberosMech(cStub.getMech())) {
        doServicePermCheck();
        if (cred == null) {
            cred = new GSSCredElement(null, lifetime,
                                      GSSCredential.INITIATE_ONLY, cStub);
        }
        srcName = cred.getName();
    }
}

Example #5

Source File: NativeGSSContext.java From hottub with GNU General Public License v2.0

6 votes

NativeGSSContext(GSSNameElement peer, GSSCredElement myCred,
                 int time, GSSLibStub stub) throws GSSException {
    if (peer == null) {
        throw new GSSException(GSSException.FAILURE, 1, "null peer");
    }
    cStub = stub;
    cred = myCred;
    targetName = peer;
    isInitiator = true;
    lifetime = time;

    if (GSSUtil.isKerberosMech(cStub.getMech())) {
        doServicePermCheck();
        if (cred == null) {
            cred = new GSSCredElement(null, lifetime,
                                      GSSCredential.INITIATE_ONLY, cStub);
        }
        srcName = cred.getName();
    }
}

Example #6

Source File: NativeGSSContext.java From TencentKona-8 with GNU General Public License v2.0

6 votes

NativeGSSContext(long pCtxt, GSSLibStub stub) throws GSSException {
    assert(pContext != 0);
    pContext = pCtxt;
    cStub = stub;

    // Set everything except cred, cb, delegatedCred
    long[] info = cStub.inquireContext(pContext);
    if (info.length != NUM_OF_INQUIRE_VALUES) {
        throw new RuntimeException("Bug w/ GSSLibStub.inquireContext()");
    }
    srcName = new GSSNameElement(info[0], cStub);
    targetName = new GSSNameElement(info[1], cStub);
    isInitiator = (info[2] != 0);
    isEstablished = (info[3] != 0);
    flags = (int) info[4];
    lifetime = (int) info[5];

    // Do Service Permission check when importing SPNEGO context
    // just to be safe
    Oid mech = cStub.getMech();
    if (GSSUtil.isSpNegoMech(mech) || GSSUtil.isKerberosMech(mech)) {
        doServicePermCheck();
    }
}

Example #7

Source File: CrossRealm.java From openjdk-8-source with GNU General Public License v2.0

6 votes

static void xRealmAuth() throws Exception {
    Security.setProperty("auth.login.defaultCallbackHandler", "CrossRealm");
    System.setProperty("java.security.auth.login.config", "jaas-localkdc.conf");
    System.setProperty("javax.security.auth.useSubjectCredsOnly", "false");
    FileOutputStream fos = new FileOutputStream("jaas-localkdc.conf");
    fos.write(("com.sun.security.jgss.krb5.initiate {\n" +
            "    com.sun.security.auth.module.Krb5LoginModule\n" +
            "    required\n" +
            "    principal=dummy\n" +
            "    doNotPrompt=false\n" +
            "    useTicketCache=false\n" +
            "    ;\n" +
            "};").getBytes());
    fos.close();

    GSSManager m = GSSManager.getInstance();
    m.createContext(
            m.createName("[email protected]", GSSName.NT_HOSTBASED_SERVICE),
            GSSUtil.GSS_KRB5_MECH_OID,
            null,
            GSSContext.DEFAULT_LIFETIME).initSecContext(new byte[0], 0, 0);
}

Example #8

Source File: NewSalt.java From openjdk-8 with GNU General Public License v2.0

6 votes

public static void main(String[] args)
        throws Exception {

    // Create and start the KDC
    KDC kdc = new OneKDC(null);
    if (System.getProperty("onlyonepreauth") != null) {
        KDC.saveConfig(OneKDC.KRB5_CONF, kdc,
                "default_tgs_enctypes=des3-cbc-sha1");
        Config.refresh();
        kdc.setOption(KDC.Option.ONLY_ONE_PREAUTH, true);
    }
    if (System.getProperty("nopreauth") != null) {
        kdc.setOption(KDC.Option.PREAUTH_REQUIRED, false);
    }

    // Use a different case of name. KDC will return correct salt
    Context c1 = Context.fromUserPass(OneKDC.USER.toUpperCase(),
            OneKDC.PASS, true);
    Context c2 = Context.fromUserPass(OneKDC.USER2.toUpperCase(),
            OneKDC.PASS2, true);

    c1.startAsClient(OneKDC.USER2, GSSUtil.GSS_KRB5_MECH_OID);
    c2.startAsServer(GSSUtil.GSS_KRB5_MECH_OID);

    Context.handshake(c1, c2);
}

Example #9

Source File: NativeGSSContext.java From openjdk-8-source with GNU General Public License v2.0

6 votes

private void doServicePermCheck() throws GSSException {
    if (System.getSecurityManager() != null) {
        String action = (isInitiator? "initiate" : "accept");
        // Need to check Service permission for accessing
        // initiator cred for SPNEGO during context establishment
        if (GSSUtil.isSpNegoMech(cStub.getMech()) && isInitiator
            && !isEstablished) {
            if (srcName == null) {
                // Check by creating default initiator KRB5 cred
                GSSCredElement tempCred =
                    new GSSCredElement(null, lifetime,
                                       GSSCredential.INITIATE_ONLY,
                                       GSSLibStub.getInstance(GSSUtil.GSS_KRB5_MECH_OID));
                tempCred.dispose();
            } else {
                String tgsName = Krb5Util.getTGSName(srcName);
                Krb5Util.checkServicePermission(tgsName, action);
            }
        }
        String targetStr = targetName.getKrbName();
        Krb5Util.checkServicePermission(targetStr, action);
        skipServicePermCheck = true;
    }
}

Example #10

Source File: PrincipalNameEquals.java From openjdk-jdk8u-backup with GNU General Public License v2.0

6 votes

public static void main(String[] args) throws Exception {

        OneKDC kdc = new OneKDC(null);
        kdc.writeJAASConf();
        kdc.setOption(KDC.Option.RESP_NT, PrincipalName.KRB_NT_PRINCIPAL);

        Context c, s;
        c = Context.fromJAAS("client");
        s = Context.fromJAAS("server");

        c.startAsClient(OneKDC.SERVER, GSSUtil.GSS_KRB5_MECH_OID);
        s.startAsServer(GSSUtil.GSS_KRB5_MECH_OID);

        Context.handshake(c, s);

        Context.transmit("i say high --", c, s);
        Context.transmit("   you say low", s, c);

        s.dispose();
        c.dispose();
    }

Example #11

Source File: NewSalt.java From openjdk-jdk9 with GNU General Public License v2.0

6 votes

public static void main(String[] args)
        throws Exception {

    // Create and start the KDC
    KDC kdc = new OneKDC(null);
    if (System.getProperty("onlyonepreauth") != null) {
        KDC.saveConfig(OneKDC.KRB5_CONF, kdc,
                "default_tgs_enctypes=des3-cbc-sha1");
        Config.refresh();
        kdc.setOption(KDC.Option.ONLY_ONE_PREAUTH, true);
    }
    if (System.getProperty("nopreauth") != null) {
        kdc.setOption(KDC.Option.PREAUTH_REQUIRED, false);
    }

    // Use a different case of name. KDC will return correct salt
    Context c1 = Context.fromUserPass(OneKDC.USER.toUpperCase(Locale.US),
            OneKDC.PASS, true);
    Context c2 = Context.fromUserPass(OneKDC.USER2.toUpperCase(Locale.US),
            OneKDC.PASS2, true);

    c1.startAsClient(OneKDC.USER2, GSSUtil.GSS_KRB5_MECH_OID);
    c2.startAsServer(GSSUtil.GSS_KRB5_MECH_OID);

    Context.handshake(c1, c2);
}

Example #12

Source File: Krb5Util.java From jdk8u60 with GNU General Public License v2.0

6 votes

/**
 * Retrieves the ServiceCreds for the specified server principal from
 * the Subject in the specified AccessControlContext. If not found, and if
 * useSubjectCredsOnly is false, then obtain from a LoginContext.
 *
 * NOTE: This method is also used by JSSE Kerberos Cipher Suites
 */
public static ServiceCreds getServiceCreds(GSSCaller caller,
    String serverPrincipal, AccessControlContext acc)
            throws LoginException {

    Subject accSubj = Subject.getSubject(acc);
    ServiceCreds sc = null;
    if (accSubj != null) {
        sc = ServiceCreds.getInstance(accSubj, serverPrincipal);
    }
    if (sc == null && !GSSUtil.useSubjectCredsOnly(caller)) {
        Subject subject = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
        sc = ServiceCreds.getInstance(subject, serverPrincipal);
    }
    return sc;
}

Example #13

Source File: NativeGSSContext.java From openjdk-8-source with GNU General Public License v2.0

6 votes

NativeGSSContext(long pCtxt, GSSLibStub stub) throws GSSException {
    assert(pContext != 0);
    pContext = pCtxt;
    cStub = stub;

    // Set everything except cred, cb, delegatedCred
    long[] info = cStub.inquireContext(pContext);
    if (info.length != NUM_OF_INQUIRE_VALUES) {
        throw new RuntimeException("Bug w/ GSSLibStub.inquireContext()");
    }
    srcName = new GSSNameElement(info[0], cStub);
    targetName = new GSSNameElement(info[1], cStub);
    isInitiator = (info[2] != 0);
    isEstablished = (info[3] != 0);
    flags = (int) info[4];
    lifetime = (int) info[5];

    // Do Service Permission check when importing SPNEGO context
    // just to be safe
    Oid mech = cStub.getMech();
    if (GSSUtil.isSpNegoMech(mech) || GSSUtil.isKerberosMech(mech)) {
        doServicePermCheck();
    }
}

Example #14

Source File: PrincipalNameEquals.java From hottub with GNU General Public License v2.0

6 votes

public static void main(String[] args) throws Exception {

        OneKDC kdc = new OneKDC(null);
        kdc.writeJAASConf();
        kdc.setOption(KDC.Option.RESP_NT, PrincipalName.KRB_NT_PRINCIPAL);

        Context c, s;
        c = Context.fromJAAS("client");
        s = Context.fromJAAS("server");

        c.startAsClient(OneKDC.SERVER, GSSUtil.GSS_KRB5_MECH_OID);
        s.startAsServer(GSSUtil.GSS_KRB5_MECH_OID);

        Context.handshake(c, s);

        Context.transmit("i say high --", c, s);
        Context.transmit("   you say low", s, c);

        s.dispose();
        c.dispose();
    }

Example #15

Source File: PrincipalNameEquals.java From jdk8u60 with GNU General Public License v2.0

6 votes

public static void main(String[] args) throws Exception {

        OneKDC kdc = new OneKDC(null);
        kdc.writeJAASConf();
        kdc.setOption(KDC.Option.RESP_NT, PrincipalName.KRB_NT_PRINCIPAL);

        Context c, s;
        c = Context.fromJAAS("client");
        s = Context.fromJAAS("server");

        c.startAsClient(OneKDC.SERVER, GSSUtil.GSS_KRB5_MECH_OID);
        s.startAsServer(GSSUtil.GSS_KRB5_MECH_OID);

        Context.handshake(c, s);

        Context.transmit("i say high --", c, s);
        Context.transmit("   you say low", s, c);

        s.dispose();
        c.dispose();
    }

Example #16

Source File: NativeGSSContext.java From openjdk-8 with GNU General Public License v2.0

6 votes

NativeGSSContext(GSSCredElement myCred, GSSLibStub stub)
    throws GSSException {
    cStub = stub;
    cred = myCred;

    if (cred != null) targetName = cred.getName();

    isInitiator = false;
    // Defer Service permission check for default acceptor cred
    // to acceptSecContext()
    if (GSSUtil.isKerberosMech(cStub.getMech()) && targetName != null) {
        doServicePermCheck();
    }

    // srcName and potentially targetName (when myCred is null)
    // will be set in GSSLibStub.acceptContext(...)
}

Example #17

Source File: GSS.java From openjdk-jdk8u with GNU General Public License v2.0

6 votes

public static void main(String[] args) throws Exception {

        new OneKDC(null).writeJAASConf();

        Context c, s;
        c = Context.fromThinAir();
        s = Context.fromThinAir();

        // This is the only setting needed for JGSS without JAAS. The default
        // JAAS config entries are already created by OneKDC.
        System.setProperty("javax.security.auth.useSubjectCredsOnly", "false");

        c.startAsClient(OneKDC.SERVER, GSSUtil.GSS_KRB5_MECH_OID);
        s.startAsServer(GSSUtil.GSS_KRB5_MECH_OID);

        Context.handshake(c, s);

        Context.transmit("i say high --", c, s);
        Context.transmit("   you say low", s, c);

        s.dispose();
        c.dispose();
    }

Example #18

Source File: GSS.java From jdk8u-jdk with GNU General Public License v2.0

6 votes

public static void main(String[] args) throws Exception {

        new OneKDC(null).writeJAASConf();

        Context c, s;
        c = Context.fromThinAir();
        s = Context.fromThinAir();

        // This is the only setting needed for JGSS without JAAS. The default
        // JAAS config entries are already created by OneKDC.
        System.setProperty("javax.security.auth.useSubjectCredsOnly", "false");

        c.startAsClient(OneKDC.SERVER, GSSUtil.GSS_KRB5_MECH_OID);
        s.startAsServer(GSSUtil.GSS_KRB5_MECH_OID);

        Context.handshake(c, s);

        Context.transmit("i say high --", c, s);
        Context.transmit("   you say low", s, c);

        s.dispose();
        c.dispose();
    }

Example #19

Source File: NativeGSSFactory.java From openjdk-8-source with GNU General Public License v2.0

6 votes

private GSSCredElement getCredFromSubject(GSSNameElement name,
                                          boolean initiate)
    throws GSSException {
    Oid mech = cStub.getMech();
    Vector<GSSCredElement> creds = GSSUtil.searchSubject
        (name, mech, initiate, GSSCredElement.class);

    // If Subject is present but no native creds available
    if (creds != null && creds.isEmpty()) {
        if (GSSUtil.useSubjectCredsOnly(caller)) {
            throw new GSSException(GSSException.NO_CRED);
        }
    }

    GSSCredElement result = ((creds == null || creds.isEmpty()) ?
                             null : creds.firstElement());
    // Force permission check before returning the cred to caller
    if (result != null) {
        result.doServicePermCheck();
    }
    return result;
}

Example #20

Source File: Krb5Util.java From openjdk-jdk8u with GNU General Public License v2.0

6 votes

/**
 * Retrieves the ServiceCreds for the specified server principal from
 * the Subject in the specified AccessControlContext. If not found, and if
 * useSubjectCredsOnly is false, then obtain from a LoginContext.
 *
 * NOTE: This method is also used by JSSE Kerberos Cipher Suites
 */
public static ServiceCreds getServiceCreds(GSSCaller caller,
    String serverPrincipal, AccessControlContext acc)
            throws LoginException {

    Subject accSubj = Subject.getSubject(acc);
    ServiceCreds sc = null;
    if (accSubj != null) {
        sc = ServiceCreds.getInstance(accSubj, serverPrincipal);
    }
    if (sc == null && !GSSUtil.useSubjectCredsOnly(caller)) {
        Subject subject = GSSUtil.login(caller, GSSUtil.GSS_KRB5_MECH_OID);
        sc = ServiceCreds.getInstance(subject, serverPrincipal);
    }
    return sc;
}

Example #21

Source File: TicketSName.java From TencentKona-8 with GNU General Public License v2.0

6 votes

public static void main(String[] args) throws Exception {

        new OneKDC(null).writeJAASConf();

        Context c, s;
        c = Context.fromJAAS("client");
        s = Context.fromJAAS("server");

        c.startAsClient(OneKDC.SERVER, GSSUtil.GSS_KRB5_MECH_OID);
        s.startAsServer(GSSUtil.GSS_KRB5_MECH_OID);

        Context.handshake(c, s);

        String expected = OneKDC.SERVER + "@" + OneKDC.REALM;
        if (!c.s().getPrivateCredentials(KerberosTicket.class)
                .stream()
                .anyMatch(t -> t.getServer().toString().equals(expected))) {
            c.status();
            throw new Exception("no " + expected);
        }
    }

Example #22

Source File: CrossRealm.java From jdk8u_jdk with GNU General Public License v2.0

6 votes

static void xRealmAuth() throws Exception {
    Security.setProperty("auth.login.defaultCallbackHandler", "CrossRealm");
    System.setProperty("java.security.auth.login.config", "jaas-localkdc.conf");
    System.setProperty("javax.security.auth.useSubjectCredsOnly", "false");
    FileOutputStream fos = new FileOutputStream("jaas-localkdc.conf");
    fos.write(("com.sun.security.jgss.krb5.initiate {\n" +
            "    com.sun.security.auth.module.Krb5LoginModule\n" +
            "    required\n" +
            "    principal=dummy\n" +
            "    doNotPrompt=false\n" +
            "    useTicketCache=false\n" +
            "    ;\n" +
            "};").getBytes());
    fos.close();

    GSSManager m = GSSManager.getInstance();
    m.createContext(
            m.createName("[email protected]", GSSName.NT_HOSTBASED_SERVICE),
            GSSUtil.GSS_KRB5_MECH_OID,
            null,
            GSSContext.DEFAULT_LIFETIME).initSecContext(new byte[0], 0, 0);
}

Example #23

Source File: Basic.java From openjdk-jdk9 with GNU General Public License v2.0

5 votes

public static void main(String[] args) throws Exception {

        new OneKDC(null).writeJAASConf();

        Context c, s, s2, b;
        c = Context.fromJAAS("client");
        s = Context.fromJAAS("server");
        b = Context.fromJAAS("backend");

        c.startAsClient(OneKDC.SERVER, GSSUtil.GSS_KRB5_MECH_OID);
        c.x().requestCredDeleg(true);
        s.startAsServer(GSSUtil.GSS_KRB5_MECH_OID);

        Context.handshake(c, s);

        Context.transmit("i say high --", c, s);
        Context.transmit("   you say low", s, c);

        s2 = s.delegated();
        s.dispose();
        c.dispose();

        s2.startAsClient(OneKDC.BACKEND, GSSUtil.GSS_KRB5_MECH_OID);
        b.startAsServer(GSSUtil.GSS_KRB5_MECH_OID);

        Context.handshake(s2, b);
    }

Example #24

Source File: GSSNameElement.java From openjdk-jdk8u with GNU General Public License v2.0

5 votes

private static Oid getNativeNameType(Oid nameType, GSSLibStub stub) {
    if (GSSUtil.NT_GSS_KRB5_PRINCIPAL.equals(nameType)) {
        Oid[] supportedNTs = null;
        try {
            supportedNTs = stub.inquireNamesForMech();
        } catch (GSSException ge) {
            if (ge.getMajor() == GSSException.BAD_MECH &&
                GSSUtil.isSpNegoMech(stub.getMech())) {
                // Workaround known Heimdal issue and retry with KRB5
                try {
                    stub = GSSLibStub.getInstance
                        (GSSUtil.GSS_KRB5_MECH_OID);
                    supportedNTs = stub.inquireNamesForMech();
                } catch (GSSException ge2) {
                    // Should never happen
                    SunNativeProvider.debug("Name type list unavailable: " +
                        ge2.getMajorString());
                }
            } else {
                SunNativeProvider.debug("Name type list unavailable: " +
                    ge.getMajorString());
            }
        }
        if (supportedNTs != null) {
            for (int i = 0; i < supportedNTs.length; i++) {
                if (supportedNTs[i].equals(nameType)) return nameType;
            }
            // Special handling the specified name type
            SunNativeProvider.debug("Override " + nameType +
                " with mechanism default(null)");
            return null; // Use mechanism specific default
        }
    }
    return nameType;
}

Example #25

Source File: S4U2selfGSS.java From hottub with GNU General Public License v2.0

5 votes

public static void main(String[] args) throws Exception {
    Oid mech;
    if (args[0].equals("spnego")) {
        mech = GSSUtil.GSS_SPNEGO_MECH_OID;
    } else if (args[0].contains("krb5")) {
        mech = GSSUtil.GSS_KRB5_MECH_OID;
    } else {
        throw new Exception("Unknown mech");
    }

    OneKDC kdc = new OneKDC(null);
    kdc.writeJAASConf();
    kdc.setOption(KDC.Option.ALLOW_S4U2SELF, Arrays.asList(
            new String[]{OneKDC.USER + "@" + OneKDC.REALM}));
    Map<String,List<String>> map = new HashMap<>();
    map.put(OneKDC.USER + "@" + OneKDC.REALM, Arrays.asList(
            new String[]{OneKDC.SERVER + "@" + OneKDC.REALM}));
    kdc.setOption(KDC.Option.ALLOW_S4U2PROXY, map);

    Context c, s;
    System.setProperty("javax.security.auth.useSubjectCredsOnly", "false");
    c = Context.fromThinAir();
    s = Context.fromThinAir();

    c = c.impersonate(OneKDC.USER2);

    c.startAsClient(OneKDC.SERVER, mech);
    s.startAsServer(mech);

    Context.handshake(c, s);

    String n1 = c.x().getSrcName().toString().split("@")[0];
    String n2 = s.x().getSrcName().toString().split("@")[0];
    if (!n1.equals(OneKDC.USER2) || !n2.equals(OneKDC.USER2)) {
        throw new Exception("Impersonate failed");
    }

    s.dispose();
    c.dispose();
}

Example #26

Source File: S4U2selfGSS.java From TencentKona-8 with GNU General Public License v2.0

5 votes

public static void main(String[] args) throws Exception {
    Oid mech;
    if (args[0].equals("spnego")) {
        mech = GSSUtil.GSS_SPNEGO_MECH_OID;
    } else if (args[0].contains("krb5")) {
        mech = GSSUtil.GSS_KRB5_MECH_OID;
    } else {
        throw new Exception("Unknown mech");
    }

    OneKDC kdc = new OneKDC(null);
    kdc.writeJAASConf();
    kdc.setOption(KDC.Option.ALLOW_S4U2SELF, Arrays.asList(
            new String[]{OneKDC.USER + "@" + OneKDC.REALM}));
    Map<String,List<String>> map = new HashMap<>();
    map.put(OneKDC.USER + "@" + OneKDC.REALM, Arrays.asList(
            new String[]{OneKDC.SERVER + "@" + OneKDC.REALM}));
    kdc.setOption(KDC.Option.ALLOW_S4U2PROXY, map);

    Context c, s;
    System.setProperty("javax.security.auth.useSubjectCredsOnly", "false");
    c = Context.fromThinAir();
    s = Context.fromThinAir();

    c = c.impersonate(OneKDC.USER2);

    c.startAsClient(OneKDC.SERVER, mech);
    s.startAsServer(mech);

    Context.handshake(c, s);

    String n1 = c.x().getSrcName().toString().split("@")[0];
    String n2 = s.x().getSrcName().toString().split("@")[0];
    if (!n1.equals(OneKDC.USER2) || !n2.equals(OneKDC.USER2)) {
        throw new Exception("Impersonate failed");
    }

    s.dispose();
    c.dispose();
}

Example #27

Source File: GSSNameElement.java From openjdk-jdk8u-backup with GNU General Public License v2.0

5 votes

public String getKrbName() throws GSSException {
    long mName = 0;
    GSSLibStub stub = cStub;
    if (!GSSUtil.isKerberosMech(cStub.getMech())) {
        stub = GSSLibStub.getInstance(GSSUtil.GSS_KRB5_MECH_OID);
    }
    mName = stub.canonicalizeName(pName);
    Object[] printables2 = stub.displayName(mName);
    stub.releaseName(mName);
    SunNativeProvider.debug("Got kerberized name: " + printables2[0]);
    return (String) printables2[0];
}

Example #28

Source File: KPEquals.java From openjdk-8 with GNU General Public License v2.0

5 votes

public static void main(String[] args) throws Exception {
    new OneKDC(null).writeJAASConf();
    Context c = Context.fromJAAS("client");
    Context s = Context.fromThinAir();
    KerberosPrincipal kp = new KerberosPrincipal(
            OneKDC.SERVER + "@" + OneKDC.REALM,
            KerberosPrincipal.KRB_NT_SRV_INST);
    s.s().getPrincipals().add(kp);
    for (KerberosKey k: KeyTab.getInstance(kp).getKeys(kp)) {
        s.s().getPrivateCredentials().add(k);
    }
    c.startAsClient(OneKDC.SERVER, GSSUtil.GSS_KRB5_MECH_OID);
    s.startAsServer(OneKDC.SERVER, GSSUtil.GSS_KRB5_MECH_OID);
    Context.handshake(c, s);
}

Example #29

Source File: KvnoNA.java From jdk8u60 with GNU General Public License v2.0

5 votes

public static void main(String[] args)
        throws Exception {

    OneKDC kdc = new OneKDC(null);
    kdc.writeJAASConf();

    // In KDC, it's 2
    char[] pass = "pass2".toCharArray();
    kdc.addPrincipal(OneKDC.SERVER, pass);

    // In ktab, kvno is 1 or 3, 3 has the same password
    KeyTab ktab = KeyTab.create(OneKDC.KTAB);
    PrincipalName p = new PrincipalName(
        OneKDC.SERVER+"@"+OneKDC.REALM, PrincipalName.KRB_NT_SRV_HST);
    ktab.addEntry(p, "pass1".toCharArray(), 1, true);
    ktab.addEntry(p, "pass2".toCharArray(), 3, true);
    ktab.save();

    Context c, s;

    c = Context.fromUserPass("dummy", "bogus".toCharArray(), false);
    s = Context.fromJAAS("server");

    c.startAsClient(OneKDC.SERVER, GSSUtil.GSS_KRB5_MECH_OID);
    s.startAsServer(GSSUtil.GSS_KRB5_MECH_OID);

    Context.handshake(c, s);

    s.dispose();
    c.dispose();
}

Example #30

Source File: KPEquals.java From jdk8u-jdk with GNU General Public License v2.0

5 votes

public static void main(String[] args) throws Exception {
    new OneKDC(null).writeJAASConf();
    Context c = Context.fromJAAS("client");
    Context s = Context.fromThinAir();
    KerberosPrincipal kp = new KerberosPrincipal(
            OneKDC.SERVER + "@" + OneKDC.REALM,
            KerberosPrincipal.KRB_NT_SRV_INST);
    s.s().getPrincipals().add(kp);
    for (KerberosKey k: KeyTab.getInstance(kp).getKeys(kp)) {
        s.s().getPrivateCredentials().add(k);
    }
    c.startAsClient(OneKDC.SERVER, GSSUtil.GSS_KRB5_MECH_OID);
    s.startAsServer(OneKDC.SERVER, GSSUtil.GSS_KRB5_MECH_OID);
    Context.handshake(c, s);
}