OkAsDelegate.java revision 2362
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw/*
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * Copyright (c) 2009, Oracle and/or its affiliates. All rights reserved.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * This code is free software; you can redistribute it and/or modify it
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * under the terms of the GNU General Public License version 2 only, as
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * published by the Free Software Foundation.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * This code is distributed in the hope that it will be useful, but WITHOUT
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * version 2 for more details (a copy is included in the LICENSE file that
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * accompanied this code).
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * You should have received a copy of the GNU General Public License version
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * 2 along with this work; if not, write to the Free Software Foundation,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * or visit www.oracle.com if you need additional information or have any
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright * questions.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw */
c586600796766c83eb9485c446886fd9ed2359a9Keyur Desai
68b2bbf26c7040fea4281dcb58b81e7627e46f34Gordon Rossimport com.sun.security.jgss.ExtendedGSSContext;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwimport org.ietf.jgss.GSSCredential;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwimport org.ietf.jgss.GSSException;
bbf6f00c25b6a2bed23c35eac6d62998ecdb338cJordan Brownimport org.ietf.jgss.Oid;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwimport sun.security.jgss.GSSUtil;
3db3f65c6274eb042354801a308c8e9bc4994553amwimport sun.security.krb5.Config;
bbf6f00c25b6a2bed23c35eac6d62998ecdb338cJordan Brown
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwpublic class OkAsDelegate {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
a90cf9f29973990687fa61de9f1f6ea22e924e40Gordon Ross public static void main(String[] args)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw throws Exception {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw OkAsDelegate ok = new OkAsDelegate();
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ok.go(
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw Boolean.valueOf(args[0]), // FORWARDABLE in krb5.conf on?
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw Boolean.valueOf(args[1]), // requestDelegState
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw Boolean.valueOf(args[2]), // requestDelegPolicyState
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw Boolean.valueOf(args[3]), // DelegState in response
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw Boolean.valueOf(args[4]), // DelegPolicyState in response
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw Boolean.valueOf(args[5]) // getDelegCred OK?
b1352070d318187b41b088da3533692976f3f225Alan Wright );
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw void go(
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw boolean forwardable,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw boolean requestDelegState,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw boolean requestDelegPolicyState,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw boolean delegState,
9fb67ea305c66b6a297583b9b0db6796b0dfe497afshin salek ardakani - Sun Microsystems - Irvine United States boolean delegPolicyState,
9fb67ea305c66b6a297583b9b0db6796b0dfe497afshin salek ardakani - Sun Microsystems - Irvine United States boolean delegated
9fb67ea305c66b6a297583b9b0db6796b0dfe497afshin salek ardakani - Sun Microsystems - Irvine United States ) throws Exception {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw OneKDC kdc = new OneKDC(null);
7b59d02d2a384be9a08087b14defadd214b3c1ddjb kdc.setPolicy("ok-as-delegate",
faa1795a28a5c712eed6d0a3f84d98c368a316c6jb System.getProperty("test.kdc.policy.ok-as-delegate"));
faa1795a28a5c712eed6d0a3f84d98c368a316c6jb kdc.writeJAASConf();
faa1795a28a5c712eed6d0a3f84d98c368a316c6jb if (!forwardable) {
faa1795a28a5c712eed6d0a3f84d98c368a316c6jb // The default OneKDC always includes "forwardable = true"
faa1795a28a5c712eed6d0a3f84d98c368a316c6jb // in krb5.conf, override it.
faa1795a28a5c712eed6d0a3f84d98c368a316c6jb KDC.saveConfig(OneKDC.KRB5_CONF, kdc,
faa1795a28a5c712eed6d0a3f84d98c368a316c6jb "default_keytab_name = " + OneKDC.KTAB);
faa1795a28a5c712eed6d0a3f84d98c368a316c6jb Config.refresh();
faa1795a28a5c712eed6d0a3f84d98c368a316c6jb }
faa1795a28a5c712eed6d0a3f84d98c368a316c6jb
faa1795a28a5c712eed6d0a3f84d98c368a316c6jb Context c, s;
faa1795a28a5c712eed6d0a3f84d98c368a316c6jb c = Context.fromJAAS("client");
faa1795a28a5c712eed6d0a3f84d98c368a316c6jb s = Context.fromJAAS("server");
faa1795a28a5c712eed6d0a3f84d98c368a316c6jb
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw Oid mech = GSSUtil.GSS_KRB5_MECH_OID;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (System.getProperty("test.spnego") != null) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw mech = GSSUtil.GSS_SPNEGO_MECH_OID;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw c.startAsClient(OneKDC.SERVER, mech);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ExtendedGSSContext cx = (ExtendedGSSContext)c.x();
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw cx.requestCredDeleg(requestDelegState);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw cx.requestDelegPolicy(requestDelegPolicyState);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw s.startAsServer(mech);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ExtendedGSSContext sx = (ExtendedGSSContext)s.x();
a90cf9f29973990687fa61de9f1f6ea22e924e40Gordon Ross
a90cf9f29973990687fa61de9f1f6ea22e924e40Gordon Ross Context.handshake(c, s);
a90cf9f29973990687fa61de9f1f6ea22e924e40Gordon Ross
a90cf9f29973990687fa61de9f1f6ea22e924e40Gordon Ross if (cx.getCredDelegState() != delegState) {
a90cf9f29973990687fa61de9f1f6ea22e924e40Gordon Ross throw new Exception("Initiator cred state error");
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (sx.getCredDelegState() != delegState) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw throw new Exception("Acceptor cred state error");
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
7b59d02d2a384be9a08087b14defadd214b3c1ddjb if (cx.getDelegPolicyState() != delegPolicyState) {
faa1795a28a5c712eed6d0a3f84d98c368a316c6jb throw new Exception("Initiator cred policy state error");
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw GSSCredential cred = null;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw try {
dc20a3024900c47dd2ee44b9707e6df38f7d62a5as cred = s.x().getDelegCred();
faa1795a28a5c712eed6d0a3f84d98c368a316c6jb } catch (GSSException e) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw // leave cred as null
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (delegated != (cred != null)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw throw new Exception("get cred error");
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw}
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw