LdapSasl.java revision 0
694N/A/*
694N/A * Copyright 1999-2003 Sun Microsystems, Inc. All Rights Reserved.
694N/A * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
694N/A *
694N/A * This code is free software; you can redistribute it and/or modify it
694N/A * under the terms of the GNU General Public License version 2 only, as
694N/A * published by the Free Software Foundation. Sun designates this
694N/A * particular file as subject to the "Classpath" exception as provided
694N/A * by Sun in the LICENSE file that accompanied this code.
694N/A *
694N/A * This code is distributed in the hope that it will be useful, but WITHOUT
694N/A * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
694N/A * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
694N/A * version 2 for more details (a copy is included in the LICENSE file that
694N/A * accompanied this code).
694N/A *
694N/A * You should have received a copy of the GNU General Public License version
694N/A * 2 along with this work; if not, write to the Free Software Foundation,
694N/A * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
694N/A *
694N/A * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara,
694N/A * CA 95054 USA or visit www.sun.com if you need additional information or
694N/A * have any questions.
694N/A */
694N/A
695N/Apackage com.sun.jndi.ldap.sasl;
694N/A
694N/Aimport java.io.*;
694N/Aimport java.util.Vector;
694N/Aimport java.util.Hashtable;
694N/Aimport java.util.StringTokenizer;
694N/A
694N/Aimport javax.naming.AuthenticationException;
694N/Aimport javax.naming.AuthenticationNotSupportedException;
694N/Aimport javax.naming.NamingException;
694N/A
694N/Aimport javax.naming.ldap.Control;
694N/A
694N/Aimport javax.security.auth.callback.CallbackHandler;
694N/Aimport javax.security.sasl.*;
694N/Aimport com.sun.jndi.ldap.Connection;
694N/Aimport com.sun.jndi.ldap.LdapClient;
694N/Aimport com.sun.jndi.ldap.LdapResult;
694N/A
694N/A/**
694N/A * Handles SASL support.
694N/A *
694N/A * @author Vincent Ryan
694N/A * @author Rosanna Lee
694N/A */
694N/A
694N/Afinal public class LdapSasl {
694N/A // SASL stuff
694N/A private static final String SASL_CALLBACK = "java.naming.security.sasl.callback";
694N/A private static final String SASL_AUTHZ_ID =
694N/A "java.naming.security.sasl.authorizationId";
694N/A private static final String SASL_REALM =
694N/A "java.naming.security.sasl.realm";
694N/A
694N/A private static final int LDAP_SUCCESS = 0;
694N/A private static final int LDAP_SASL_BIND_IN_PROGRESS = 14; // LDAPv3
694N/A
694N/A private LdapSasl() {
694N/A }
694N/A
694N/A /**
694N/A * Performs SASL bind.
694N/A * Creates a SaslClient by using a default CallbackHandler
694N/A * that uses the Context.SECURITY_PRINCIPAL and Context.SECURITY_CREDENTIALS
694N/A * properties to satisfy the callbacks, and by using the
694N/A * SASL_AUTHZ_ID property as the authorization id. If the SASL_AUTHZ_ID
694N/A * property has not been set, Context.SECURITY_PRINCIPAL is used.
695N/A * If SASL_CALLBACK has been set, use that instead of the default
694N/A * CallbackHandler.
694N/A *<p>
694N/A * If bind is successful and the selected SASL mechanism has a security
694N/A * layer, set inStream and outStream to be filter streams that use
694N/A * the security layer. These will be used for subsequent communication
694N/A * with the server.
694N/A *<p>
694N/A * @param conn The non-null connection to use for sending an LDAP BIND
694N/A * @param server Non-null string name of host to connect to
694N/A * @param dn Non-null DN to bind as; also used as authentication ID
694N/A * @param pw Possibly null password; can be byte[], char[] or String
695N/A * @param authMech A non-null space-separated list of SASL authentication
694N/A * mechanisms.
694N/A * @param env The possibly null environment of the context, possibly containing
694N/A * properties for used by SASL mechanisms
694N/A * @param bindCtls The possibly null controls to accompany the bind
694N/A * @return LdapResult containing status of the bind
694N/A */
694N/A public static LdapResult saslBind(LdapClient clnt, Connection conn,
694N/A String server, String dn, Object pw,
694N/A String authMech, Hashtable env, Control[] bindCtls)
694N/A throws IOException, NamingException {
694N/A
694N/A SaslClient saslClnt = null;
694N/A boolean cleanupHandler = false;
694N/A
694N/A // Use supplied callback handler or create default
694N/A CallbackHandler cbh =
694N/A (env != null) ? (CallbackHandler)env.get(SASL_CALLBACK) : null;
694N/A if (cbh == null) {
694N/A cbh = new DefaultCallbackHandler(dn, pw, (String)env.get(SASL_REALM));
694N/A cleanupHandler = true;
694N/A }
694N/A
694N/A // Prepare parameters for creating SASL client
694N/A String authzId = (env != null) ? (String)env.get(SASL_AUTHZ_ID) : null;
694N/A String[] mechs = getSaslMechanismNames(authMech);
694N/A
694N/A try {
694N/A // Create SASL client to use using SASL package
694N/A saslClnt = Sasl.createSaslClient(
694N/A mechs, authzId, "ldap", server, env, cbh);
694N/A
694N/A if (saslClnt == null) {
694N/A throw new AuthenticationNotSupportedException(authMech);
694N/A }
694N/A
694N/A LdapResult res;
694N/A String mechName = saslClnt.getMechanismName();
694N/A byte[] response = saslClnt.hasInitialResponse() ?
694N/A saslClnt.evaluateChallenge(NO_BYTES) : null;
694N/A
694N/A res = clnt.ldapBind(null, response, bindCtls, mechName, true);
694N/A
694N/A while (!saslClnt.isComplete() &&
694N/A (res.status == LDAP_SASL_BIND_IN_PROGRESS ||
694N/A res.status == LDAP_SUCCESS)) {
694N/A
694N/A response = saslClnt.evaluateChallenge(
694N/A res.serverCreds != null? res.serverCreds : NO_BYTES);
694N/A if (res.status == LDAP_SUCCESS) {
694N/A if (response != null) {
694N/A throw new AuthenticationException(
694N/A "SASL client generated response after success");
694N/A }
694N/A break;
694N/A }
694N/A res = clnt.ldapBind(null, response, bindCtls, mechName, true);
694N/A }
694N/A
694N/A if (res.status == LDAP_SUCCESS) {
694N/A if (!saslClnt.isComplete()) {
694N/A throw new AuthenticationException(
694N/A "SASL authentication not complete despite server claims");
694N/A }
694N/A
694N/A String qop = (String) saslClnt.getNegotiatedProperty(Sasl.QOP);
694N/A
694N/A // If negotiated integrity or privacy,
694N/A if (qop != null && (qop.equalsIgnoreCase("auth-int")
694N/A || qop.equalsIgnoreCase("auth-conf"))) {
694N/A
694N/A InputStream newIn = new SaslInputStream(saslClnt,
694N/A conn.inStream);
694N/A OutputStream newOut = new SaslOutputStream(saslClnt,
694N/A conn.outStream);
694N/A
694N/A conn.replaceStreams(newIn, newOut);
694N/A } else {
694N/A saslClnt.dispose();
694N/A }
694N/A }
694N/A return res;
694N/A } catch (SaslException e) {
694N/A NamingException ne = new AuthenticationException(
694N/A authMech);
694N/A ne.setRootCause(e);
694N/A throw ne;
694N/A } finally {
694N/A if (cleanupHandler) {
694N/A ((DefaultCallbackHandler)cbh).clearPassword();
694N/A }
694N/A }
694N/A }
694N/A
694N/A /**
694N/A * Returns an array of SASL mechanisms given a string of space
694N/A * separated SASL mechanism names.
694N/A * @param The non-null string containing the mechanism names
694N/A * @return A non-null array of String; each element of the array
694N/A * contains a single mechanism name.
694N/A */
694N/A private static String[] getSaslMechanismNames(String str) {
694N/A StringTokenizer parser = new StringTokenizer(str);
694N/A Vector mechs = new Vector(10);
694N/A while (parser.hasMoreTokens()) {
694N/A mechs.addElement(parser.nextToken());
694N/A }
694N/A String[] mechNames = new String[mechs.size()];
694N/A for (int i = 0; i < mechs.size(); i++) {
694N/A mechNames[i] = (String)mechs.elementAt(i);
694N/A }
694N/A return mechNames;
694N/A }
694N/A
694N/A private static final byte[] NO_BYTES = new byte[0];
694N/A}
694N/A