Spring/spring-security-kerberos
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fixed JAAS ticket validator.

Browse Source
This commit is contained in:
Bogdan Mustiata
2017-03-23 14:13:00 +01:00
parent e7113fd2b8
commit 005320c594
1 changed files with 17 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

53
spring-security-kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/sun/SunJaasKerberosTicketValidator.java
View File

@@ -15,19 +15,6 @@
*/
package org.springframework.security.kerberos.authentication.sun;
import java.security.Principal;
import java.security.PrivilegedActionException;
import java.security.PrivilegedExceptionAction;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Set;
import javax.security.auth.Subject;
import javax.security.auth.kerberos.KerberosPrincipal;
import javax.security.auth.login.AppConfigurationEntry;
import javax.security.auth.login.Configuration;
import javax.security.auth.login.LoginContext;
import com.sun.security.jgss.GSSUtil;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
@@ -41,11 +28,22 @@ import org.springframework.core.io.ClassPathResource;
import org.springframework.core.io.Resource;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.kerberos.authentication.JaasSubjectHolder;
import org.springframework.security.kerberos.authentication.KerberosMultiTier;
import org.springframework.security.kerberos.authentication.KerberosTicketValidation;
import org.springframework.security.kerberos.authentication.KerberosTicketValidator;
import org.springframework.util.Assert;
import javax.security.auth.Subject;
import javax.security.auth.kerberos.KerberosPrincipal;
import javax.security.auth.login.AppConfigurationEntry;
import javax.security.auth.login.Configuration;
import javax.security.auth.login.LoginContext;
import java.security.Principal;
import java.security.PrivilegedActionException;
import java.security.PrivilegedExceptionAction;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Set;
/**
* Implementation of {@link KerberosTicketValidator} which uses the SUN JAAS
* login module, which is included in the SUN JRE, it will not work with an IBM JRE.
@@ -200,30 +198,13 @@ public class SunJaasKerberosTicketValidator implements KerberosTicketValidator,
byte[] responseToken = new byte[0];
GSSManager manager = GSSManager.getInstance();
GSSName serverName =
manager.createName(servicePrincipal,
GSSName.NT_USER_NAME);
GSSContext context = manager.createContext((GSSCredential) null);
GSSCredential serverCreds =
manager.createCredential(serverName,
GSSCredential.INDEFINITE_LIFETIME,
KerberosMultiTier.KERBEROS_OID,
GSSCredential.INITIATE_AND_ACCEPT);
byte[] patchedToken = tweakJdkRegression(kerberosTicket);
GSSContext context = manager.createContext(serverCreds);
boolean first = true;
while (!context.isEstablished()) {
if (first) {
kerberosTicket = tweakJdkRegression(kerberosTicket);
}
responseToken = context.acceptSecContext(kerberosTicket, 0, kerberosTicket.length);
serverName = context.getSrcName();
if (serverName == null) {
throw new BadCredentialsException("GSSContext name of the context initiator is null");
}
first = false;
}
while (!context.isEstablished()) {
context.acceptSecContext(patchedToken, 0, patchedToken.length);
}
Subject subject = GSSUtil.createSubject(
context.getSrcName(),