4102N/A/*
4102N/A * Copyright (c) 2011, Oracle and/or its affiliates. All rights reserved.
4102N/A * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4102N/A *
4102N/A * This code is free software; you can redistribute it and/or modify it
4102N/A * under the terms of the GNU General Public License version 2 only, as
4102N/A * published by the Free Software Foundation.
4102N/A *
4102N/A * This code is distributed in the hope that it will be useful, but WITHOUT
4102N/A * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
4102N/A * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
4102N/A * version 2 for more details (a copy is included in the LICENSE file that
4102N/A * accompanied this code).
4102N/A *
4102N/A * You should have received a copy of the GNU General Public License version
4102N/A * 2 along with this work; if not, write to the Free Software Foundation,
4102N/A * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
4102N/A *
4102N/A * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
4102N/A * or visit www.oracle.com if you need additional information or have any
4102N/A * questions.
4102N/A */
4102N/A
4102N/A/*
4102N/A * @test
4102N/A * @bug 6894072
4102N/A * @compile -XDignore.symbol.file TwoPrinces.java
4102N/A * @run main/othervm TwoPrinces
4102N/A * @summary always refresh keytab
4102N/A */
4102N/A
4102N/Aimport java.io.File;
4102N/Aimport java.io.FileOutputStream;
4102N/Aimport sun.security.jgss.GSSUtil;
4102N/Aimport sun.security.krb5.Config;
4102N/A
4102N/Apublic class TwoPrinces {
4102N/A
4102N/A public static void main(String[] args)
4102N/A throws Exception {
4102N/A
4102N/A KDC k1 = KDC.create("R1");
4102N/A k1.addPrincipal("u1", "hello".toCharArray());
4102N/A k1.addPrincipalRandKey("krbtgt/R1");
4102N/A k1.addPrincipalRandKey("host/same.host");
4102N/A
4102N/A KDC k2 = KDC.create("R2");
4102N/A k2.addPrincipal("u2", "hello".toCharArray());
4102N/A k2.addPrincipalRandKey("krbtgt/R2");
4102N/A k2.addPrincipalRandKey("host/same.host");
4102N/A
4102N/A System.setProperty("java.security.krb5.conf", "krb5.conf");
4102N/A
4102N/A // R1 is the default realm now
4102N/A KDC.saveConfig("krb5.conf", k1, k2);
4102N/A Config.refresh();
4102N/A
4102N/A k1.writeKtab("ktab1");
4102N/A k2.writeKtab("ktab2");
4102N/A
4102N/A // A JAAS config file with 2 Krb5LoginModules, after commit, the
4102N/A // subject with have principals and keytabs from both sides
4102N/A System.setProperty("java.security.auth.login.config", "jaas.conf");
4102N/A File f = new File("jaas.conf");
4102N/A FileOutputStream fos = new FileOutputStream(f);
4102N/A fos.write((
4102N/A "me {\n"
4102N/A + " com.sun.security.auth.module.Krb5LoginModule required"
4102N/A + " isInitiator=true principal=\"host/same.host@R1\""
4102N/A + " useKeyTab=true keyTab=ktab1 storeKey=true;\n"
4102N/A + " com.sun.security.auth.module.Krb5LoginModule required"
4102N/A + " isInitiator=true principal=\"host/same.host@R2\""
4102N/A + " useKeyTab=true keyTab=ktab2 storeKey=true;\n"
4102N/A + "};\n"
4102N/A ).getBytes());
4102N/A fos.close();
4102N/A
4102N/A /*
4102N/A * This server side context will be able to act as services in both
4102N/A * realms. Please note that we still don't support a single instance
4102N/A * of server to accept connections from two realms at the same time.
4102N/A * Therefore, we must call startAsServer in a given realm to start
4102N/A * working there. The same Subject never changes anyway.
4102N/A */
4102N/A Context s = Context.fromJAAS("me");
4102N/A
4102N/A // Default realm still R1
4102N/A s.startAsServer("host@same.host", GSSUtil.GSS_KRB5_MECH_OID);
4102N/A Context c1 = Context.fromUserPass("u1", "hello".toCharArray(), false);
4102N/A c1.startAsClient("host@same.host", GSSUtil.GSS_KRB5_MECH_OID);
4102N/A Context.handshake(c1, s);
4102N/A
4102N/A KDC.saveConfig("krb5.conf", k2, k1);
4102N/A Config.refresh();
4102N/A
4102N/A // Default realm now R2
4102N/A s.startAsServer("host@same.host", GSSUtil.GSS_KRB5_MECH_OID);
4102N/A Context c2 = Context.fromUserPass("u2", "hello".toCharArray(), false);
4102N/A c2.startAsClient("host@same.host", GSSUtil.GSS_KRB5_MECH_OID);
4102N/A Context.handshake(c2, s);
4102N/A }
4102N/A}