0N/A/*
2362N/A * Copyright (c) 2005, 2009, Oracle and/or its affiliates. All rights reserved.
0N/A * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
0N/A *
0N/A * This code is free software; you can redistribute it and/or modify it
0N/A * under the terms of the GNU General Public License version 2 only, as
2362N/A * published by the Free Software Foundation. Oracle designates this
0N/A * particular file as subject to the "Classpath" exception as provided
2362N/A * by Oracle in the LICENSE file that accompanied this code.
0N/A *
0N/A * This code is distributed in the hope that it will be useful, but WITHOUT
0N/A * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
0N/A * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
0N/A * version 2 for more details (a copy is included in the LICENSE file that
0N/A * accompanied this code).
0N/A *
0N/A * You should have received a copy of the GNU General Public License version
0N/A * 2 along with this work; if not, write to the Free Software Foundation,
0N/A * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
0N/A *
2362N/A * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
2362N/A * or visit www.oracle.com if you need additional information or have any
2362N/A * questions.
0N/A */
0N/A
0N/Apackage sun.security.jgss;
0N/A
0N/Aimport java.util.HashMap;
0N/Aimport javax.security.auth.login.AppConfigurationEntry;
0N/Aimport javax.security.auth.login.Configuration;
0N/Aimport org.ietf.jgss.Oid;
0N/A
0N/A/**
0N/A * A Configuration implementation especially designed for JGSS.
0N/A *
0N/A * @author weijun.wang
0N/A * @since 1.6
0N/A */
0N/Apublic class LoginConfigImpl extends Configuration {
0N/A
0N/A private final Configuration config;
1266N/A private final GSSCaller caller;
0N/A private final String mechName;
0N/A private static final sun.security.util.Debug debug =
0N/A sun.security.util.Debug.getInstance("gssloginconfig", "\t[GSS LoginConfigImpl]");
0N/A
0N/A /**
0N/A * A new instance of LoginConfigImpl must be created for each login request
0N/A * since it's only used by a single (caller, mech) pair
0N/A * @param caller defined in GSSUtil as CALLER_XXX final fields
0N/A * @param oid defined in GSSUtil as XXX_MECH_OID final fields
0N/A */
1266N/A public LoginConfigImpl(GSSCaller caller, Oid mech) {
0N/A
0N/A this.caller = caller;
0N/A
0N/A if (mech.equals(GSSUtil.GSS_KRB5_MECH_OID)) {
0N/A mechName = "krb5";
0N/A } else {
0N/A throw new IllegalArgumentException(mech.toString() + " not supported");
0N/A }
0N/A config = java.security.AccessController.doPrivileged
0N/A (new java.security.PrivilegedAction <Configuration> () {
0N/A public Configuration run() {
0N/A return Configuration.getConfiguration();
0N/A }
0N/A });
0N/A }
0N/A
0N/A /**
0N/A * @param name Almost useless, since the (caller, mech) is already passed
0N/A * into constructor. The only use will be detecting OTHER which
0N/A * is called in LoginContext
0N/A */
0N/A public AppConfigurationEntry[] getAppConfigurationEntry(String name) {
0N/A
0N/A AppConfigurationEntry[] entries = null;
0N/A
0N/A // This is the second call from LoginContext, which we will just ignore
0N/A if ("OTHER".equalsIgnoreCase(name)) {
0N/A return null;
0N/A }
0N/A
0N/A String[] alts = null;
0N/A
0N/A // Compatibility:
0N/A // For the 4 old callers, old entry names will be used if the new
0N/A // entry name is not provided.
0N/A
0N/A if ("krb5".equals(mechName)) {
1266N/A if (caller == GSSCaller.CALLER_INITIATE) {
0N/A alts = new String[] {
0N/A "com.sun.security.jgss.krb5.initiate",
0N/A "com.sun.security.jgss.initiate",
0N/A };
1266N/A } else if (caller == GSSCaller.CALLER_ACCEPT) {
0N/A alts = new String[] {
0N/A "com.sun.security.jgss.krb5.accept",
0N/A "com.sun.security.jgss.accept",
0N/A };
1266N/A } else if (caller == GSSCaller.CALLER_SSL_CLIENT) {
0N/A alts = new String[] {
0N/A "com.sun.security.jgss.krb5.initiate",
0N/A "com.sun.net.ssl.client",
0N/A };
1266N/A } else if (caller == GSSCaller.CALLER_SSL_SERVER) {
0N/A alts = new String[] {
0N/A "com.sun.security.jgss.krb5.accept",
0N/A "com.sun.net.ssl.server",
0N/A };
1266N/A } else if (caller instanceof HttpCaller) {
0N/A alts = new String[] {
0N/A "com.sun.security.jgss.krb5.initiate",
0N/A };
1266N/A } else if (caller == GSSCaller.CALLER_UNKNOWN) {
0N/A throw new AssertionError("caller not defined");
0N/A }
0N/A } else {
0N/A throw new IllegalArgumentException(mechName + " not supported");
0N/A // No other mech at the moment, maybe --
0N/A /*
0N/A switch (caller) {
0N/A case GSSUtil.CALLER_INITIATE:
0N/A case GSSUtil.CALLER_SSL_CLIENT:
0N/A case GSSUtil.CALLER_HTTP_NEGOTIATE:
0N/A alts = new String[] {
0N/A "com.sun.security.jgss." + mechName + ".initiate",
0N/A };
0N/A break;
0N/A case GSSUtil.CALLER_ACCEPT:
0N/A case GSSUtil.CALLER_SSL_SERVER:
0N/A alts = new String[] {
0N/A "com.sun.security.jgss." + mechName + ".accept",
0N/A };
0N/A break;
0N/A case GSSUtil.CALLER_UNKNOWN:
0N/A // should never use
0N/A throw new AssertionError("caller cannot be unknown");
0N/A default:
0N/A throw new AssertionError("caller not defined");
0N/A }
0N/A */
0N/A }
0N/A for (String alt: alts) {
0N/A entries = config.getAppConfigurationEntry(alt);
0N/A if (debug != null) {
0N/A debug.println("Trying " + alt +
0N/A ((entries == null)?": does not exist.":": Found!"));
0N/A }
0N/A if (entries != null) {
0N/A break;
0N/A }
0N/A }
0N/A
0N/A if (entries == null) {
0N/A if (debug != null) {
0N/A debug.println("Cannot read JGSS entry, use default values instead.");
0N/A }
0N/A entries = getDefaultConfigurationEntry();
0N/A }
0N/A return entries;
0N/A }
0N/A
0N/A /**
0N/A * Default value for a caller-mech pair when no entry is defined in
0N/A * the system-wide Configuration object.
0N/A */
0N/A private AppConfigurationEntry[] getDefaultConfigurationEntry() {
0N/A HashMap <String, String> options = new HashMap <String, String> (2);
0N/A
0N/A if (mechName == null || mechName.equals("krb5")) {
0N/A if (isServerSide(caller)) {
0N/A // Assuming the keytab file can be found through
0N/A // krb5 config file or under user home directory
0N/A options.put("useKeyTab", "true");
0N/A options.put("storeKey", "true");
0N/A options.put("doNotPrompt", "true");
0N/A options.put("isInitiator", "false");
0N/A } else {
0N/A options.put("useTicketCache", "true");
0N/A options.put("doNotPrompt", "false");
0N/A }
0N/A return new AppConfigurationEntry[] {
0N/A new AppConfigurationEntry(
0N/A "com.sun.security.auth.module.Krb5LoginModule",
0N/A AppConfigurationEntry.LoginModuleControlFlag.REQUIRED,
0N/A options)
0N/A };
0N/A }
0N/A return null;
0N/A }
0N/A
1266N/A private static boolean isServerSide (GSSCaller caller) {
1266N/A return GSSCaller.CALLER_ACCEPT == caller ||
1266N/A GSSCaller.CALLER_SSL_SERVER == caller;
0N/A }
0N/A}