@Test(expectedExceptions = SpnegoEngineException.class) public void testSpnegoGenerateTokenWithUsernamePasswordFail() throws Exception { SpnegoEngine spnegoEngine = new SpnegoEngine("alice", "wrong password", "bob", "service.ws.apache.org", false, null, "alice", null); spnegoEngine.generateToken("localhost"); }
public String generateToken(String host) throws SpnegoEngineException { GSSContext gssContext = null; byte[] token = null; Oid negotiationOid; try { negotiationOid = new Oid(SPNEGO_OID); boolean tryKerberos = false; String spn = getCompleteServicePrincipalName(host); try { GSSManager manager = GSSManager.getInstance(); GSSName serverName = manager.createName(spn, GSSName.NT_HOSTBASED_SERVICE); GSSCredential myCred = null; if (username != null || loginContextName != null || (customLoginConfig != null && !customLoginConfig.isEmpty())) { String contextName = loginContextName; if (contextName == null) { contextName = ""; } LoginContext loginContext = new LoginContext(contextName, null, getUsernamePasswordHandler(), getLoginConfiguration()); loginContext.login(); final Oid negotiationOidFinal = negotiationOid; final PrivilegedExceptionAction<GSSCredential> action = () -> manager.createCredential(null, GSSCredential.INDEFINITE_LIFETIME, negotiationOidFinal, GSSCredential.INITIATE_AND_ACCEPT); myCred = Subject.doAs(loginContext.getSubject(), action); } gssContext = manager.createContext(useCanonicalHostname ? serverName.canonicalize(negotiationOid) : serverName, negotiationOid, myCred, GSSContext.DEFAULT_LIFETIME); gssContext.requestMutualAuth(true); gssContext.requestCredDeleg(true); } catch (GSSException ex) { log.error("generateToken", ex); if (ex.getMajor() == GSSException.BAD_MECH) { log.debug("GSSException BAD_MECH, retry with Kerberos MECH"); tryKerberos = true; } else { throw ex; } } if (tryKerberos) { log.debug("Using Kerberos MECH {}", KERBEROS_OID); negotiationOid = new Oid(KERBEROS_OID); GSSManager manager = GSSManager.getInstance(); GSSName serverName = manager.createName(spn, GSSName.NT_HOSTBASED_SERVICE); gssContext = manager.createContext(serverName.canonicalize(negotiationOid), negotiationOid, null, GSSContext.DEFAULT_LIFETIME); gssContext.requestMutualAuth(true); gssContext.requestCredDeleg(true); } if (token == null) { token = new byte[0]; } token = gssContext.initSecContext(token, 0, token.length); if (token == null) { throw new SpnegoEngineException("GSS security context initialization failed"); } if (spnegoGenerator != null && negotiationOid.toString().equals(KERBEROS_OID)) { token = spnegoGenerator.generateSpnegoDERObject(token); } gssContext.dispose(); String tokenstr = Base64.getEncoder().encodeToString(token); log.debug("Sending response '{}' back to the server", tokenstr); return tokenstr; } catch (GSSException gsse) { log.error("generateToken", gsse); if (gsse.getMajor() == GSSException.DEFECTIVE_CREDENTIAL || gsse.getMajor() == GSSException.CREDENTIALS_EXPIRED) throw new SpnegoEngineException(gsse.getMessage(), gsse); if (gsse.getMajor() == GSSException.NO_CRED) throw new SpnegoEngineException(gsse.getMessage(), gsse); if (gsse.getMajor() == GSSException.DEFECTIVE_TOKEN || gsse.getMajor() == GSSException.DUPLICATE_TOKEN || gsse.getMajor() == GSSException.OLD_TOKEN) throw new SpnegoEngineException(gsse.getMessage(), gsse); throw new SpnegoEngineException(gsse.getMessage()); } catch (IOException | LoginException | PrivilegedActionException ex) { throw new SpnegoEngineException(ex.getMessage()); } }
SpnegoEngine { public String generateToken(String host) throws SpnegoEngineException { GSSContext gssContext = null; byte[] token = null; Oid negotiationOid; try { negotiationOid = new Oid(SPNEGO_OID); boolean tryKerberos = false; String spn = getCompleteServicePrincipalName(host); try { GSSManager manager = GSSManager.getInstance(); GSSName serverName = manager.createName(spn, GSSName.NT_HOSTBASED_SERVICE); GSSCredential myCred = null; if (username != null || loginContextName != null || (customLoginConfig != null && !customLoginConfig.isEmpty())) { String contextName = loginContextName; if (contextName == null) { contextName = ""; } LoginContext loginContext = new LoginContext(contextName, null, getUsernamePasswordHandler(), getLoginConfiguration()); loginContext.login(); final Oid negotiationOidFinal = negotiationOid; final PrivilegedExceptionAction<GSSCredential> action = () -> manager.createCredential(null, GSSCredential.INDEFINITE_LIFETIME, negotiationOidFinal, GSSCredential.INITIATE_AND_ACCEPT); myCred = Subject.doAs(loginContext.getSubject(), action); } gssContext = manager.createContext(useCanonicalHostname ? serverName.canonicalize(negotiationOid) : serverName, negotiationOid, myCred, GSSContext.DEFAULT_LIFETIME); gssContext.requestMutualAuth(true); gssContext.requestCredDeleg(true); } catch (GSSException ex) { log.error("generateToken", ex); if (ex.getMajor() == GSSException.BAD_MECH) { log.debug("GSSException BAD_MECH, retry with Kerberos MECH"); tryKerberos = true; } else { throw ex; } } if (tryKerberos) { log.debug("Using Kerberos MECH {}", KERBEROS_OID); negotiationOid = new Oid(KERBEROS_OID); GSSManager manager = GSSManager.getInstance(); GSSName serverName = manager.createName(spn, GSSName.NT_HOSTBASED_SERVICE); gssContext = manager.createContext(serverName.canonicalize(negotiationOid), negotiationOid, null, GSSContext.DEFAULT_LIFETIME); gssContext.requestMutualAuth(true); gssContext.requestCredDeleg(true); } if (token == null) { token = new byte[0]; } token = gssContext.initSecContext(token, 0, token.length); if (token == null) { throw new SpnegoEngineException("GSS security context initialization failed"); } if (spnegoGenerator != null && negotiationOid.toString().equals(KERBEROS_OID)) { token = spnegoGenerator.generateSpnegoDERObject(token); } gssContext.dispose(); String tokenstr = Base64.getEncoder().encodeToString(token); log.debug("Sending response '{}' back to the server", tokenstr); return tokenstr; } catch (GSSException gsse) { log.error("generateToken", gsse); if (gsse.getMajor() == GSSException.DEFECTIVE_CREDENTIAL || gsse.getMajor() == GSSException.CREDENTIALS_EXPIRED) throw new SpnegoEngineException(gsse.getMessage(), gsse); if (gsse.getMajor() == GSSException.NO_CRED) throw new SpnegoEngineException(gsse.getMessage(), gsse); if (gsse.getMajor() == GSSException.DEFECTIVE_TOKEN || gsse.getMajor() == GSSException.DUPLICATE_TOKEN || gsse.getMajor() == GSSException.OLD_TOKEN) throw new SpnegoEngineException(gsse.getMessage(), gsse); throw new SpnegoEngineException(gsse.getMessage()); } catch (IOException | LoginException | PrivilegedActionException ex) { throw new SpnegoEngineException(ex.getMessage()); } } }
SpnegoEngine { public String generateToken(String host) throws SpnegoEngineException { GSSContext gssContext = null; byte[] token = null; Oid negotiationOid; try { negotiationOid = new Oid(SPNEGO_OID); boolean tryKerberos = false; String spn = getCompleteServicePrincipalName(host); try { GSSManager manager = GSSManager.getInstance(); GSSName serverName = manager.createName(spn, GSSName.NT_HOSTBASED_SERVICE); GSSCredential myCred = null; if (username != null || loginContextName != null || (customLoginConfig != null && !customLoginConfig.isEmpty())) { String contextName = loginContextName; if (contextName == null) { contextName = ""; } LoginContext loginContext = new LoginContext(contextName, null, getUsernamePasswordHandler(), getLoginConfiguration()); loginContext.login(); final Oid negotiationOidFinal = negotiationOid; final PrivilegedExceptionAction<GSSCredential> action = () -> manager.createCredential(null, GSSCredential.INDEFINITE_LIFETIME, negotiationOidFinal, GSSCredential.INITIATE_AND_ACCEPT); myCred = Subject.doAs(loginContext.getSubject(), action); } gssContext = manager.createContext(useCanonicalHostname ? serverName.canonicalize(negotiationOid) : serverName, negotiationOid, myCred, GSSContext.DEFAULT_LIFETIME); gssContext.requestMutualAuth(true); gssContext.requestCredDeleg(true); } catch (GSSException ex) { log.error("generateToken", ex); if (ex.getMajor() == GSSException.BAD_MECH) { log.debug("GSSException BAD_MECH, retry with Kerberos MECH"); tryKerberos = true; } else { throw ex; } } if (tryKerberos) { log.debug("Using Kerberos MECH {}", KERBEROS_OID); negotiationOid = new Oid(KERBEROS_OID); GSSManager manager = GSSManager.getInstance(); GSSName serverName = manager.createName(spn, GSSName.NT_HOSTBASED_SERVICE); gssContext = manager.createContext(serverName.canonicalize(negotiationOid), negotiationOid, null, GSSContext.DEFAULT_LIFETIME); gssContext.requestMutualAuth(true); gssContext.requestCredDeleg(true); } if (token == null) { token = new byte[0]; } token = gssContext.initSecContext(token, 0, token.length); if (token == null) { throw new SpnegoEngineException("GSS security context initialization failed"); } if (spnegoGenerator != null && negotiationOid.toString().equals(KERBEROS_OID)) { token = spnegoGenerator.generateSpnegoDERObject(token); } gssContext.dispose(); String tokenstr = Base64.getEncoder().encodeToString(token); log.debug("Sending response '{}' back to the server", tokenstr); return tokenstr; } catch (GSSException gsse) { log.error("generateToken", gsse); if (gsse.getMajor() == GSSException.DEFECTIVE_CREDENTIAL || gsse.getMajor() == GSSException.CREDENTIALS_EXPIRED) throw new SpnegoEngineException(gsse.getMessage(), gsse); if (gsse.getMajor() == GSSException.NO_CRED) throw new SpnegoEngineException(gsse.getMessage(), gsse); if (gsse.getMajor() == GSSException.DEFECTIVE_TOKEN || gsse.getMajor() == GSSException.DUPLICATE_TOKEN || gsse.getMajor() == GSSException.OLD_TOKEN) throw new SpnegoEngineException(gsse.getMessage(), gsse); throw new SpnegoEngineException(gsse.getMessage()); } catch (IOException | LoginException | PrivilegedActionException ex) { throw new SpnegoEngineException(ex.getMessage()); } } SpnegoEngine(final String username,
                      final String password,
                      final String servicePrincipalName,
                      final String realmName,
                      final boolean useCanonicalHostname,
                      final Map<String, String> customLoginConfig,
                      final String loginContextName,
                      final SpnegoTokenGenerator spnegoGenerator);  SpnegoEngine(); }
SpnegoEngine { public String generateToken(String host) throws SpnegoEngineException { GSSContext gssContext = null; byte[] token = null; Oid negotiationOid; try { negotiationOid = new Oid(SPNEGO_OID); boolean tryKerberos = false; String spn = getCompleteServicePrincipalName(host); try { GSSManager manager = GSSManager.getInstance(); GSSName serverName = manager.createName(spn, GSSName.NT_HOSTBASED_SERVICE); GSSCredential myCred = null; if (username != null || loginContextName != null || (customLoginConfig != null && !customLoginConfig.isEmpty())) { String contextName = loginContextName; if (contextName == null) { contextName = ""; } LoginContext loginContext = new LoginContext(contextName, null, getUsernamePasswordHandler(), getLoginConfiguration()); loginContext.login(); final Oid negotiationOidFinal = negotiationOid; final PrivilegedExceptionAction<GSSCredential> action = () -> manager.createCredential(null, GSSCredential.INDEFINITE_LIFETIME, negotiationOidFinal, GSSCredential.INITIATE_AND_ACCEPT); myCred = Subject.doAs(loginContext.getSubject(), action); } gssContext = manager.createContext(useCanonicalHostname ? serverName.canonicalize(negotiationOid) : serverName, negotiationOid, myCred, GSSContext.DEFAULT_LIFETIME); gssContext.requestMutualAuth(true); gssContext.requestCredDeleg(true); } catch (GSSException ex) { log.error("generateToken", ex); if (ex.getMajor() == GSSException.BAD_MECH) { log.debug("GSSException BAD_MECH, retry with Kerberos MECH"); tryKerberos = true; } else { throw ex; } } if (tryKerberos) { log.debug("Using Kerberos MECH {}", KERBEROS_OID); negotiationOid = new Oid(KERBEROS_OID); GSSManager manager = GSSManager.getInstance(); GSSName serverName = manager.createName(spn, GSSName.NT_HOSTBASED_SERVICE); gssContext = manager.createContext(serverName.canonicalize(negotiationOid), negotiationOid, null, GSSContext.DEFAULT_LIFETIME); gssContext.requestMutualAuth(true); gssContext.requestCredDeleg(true); } if (token == null) { token = new byte[0]; } token = gssContext.initSecContext(token, 0, token.length); if (token == null) { throw new SpnegoEngineException("GSS security context initialization failed"); } if (spnegoGenerator != null && negotiationOid.toString().equals(KERBEROS_OID)) { token = spnegoGenerator.generateSpnegoDERObject(token); } gssContext.dispose(); String tokenstr = Base64.getEncoder().encodeToString(token); log.debug("Sending response '{}' back to the server", tokenstr); return tokenstr; } catch (GSSException gsse) { log.error("generateToken", gsse); if (gsse.getMajor() == GSSException.DEFECTIVE_CREDENTIAL || gsse.getMajor() == GSSException.CREDENTIALS_EXPIRED) throw new SpnegoEngineException(gsse.getMessage(), gsse); if (gsse.getMajor() == GSSException.NO_CRED) throw new SpnegoEngineException(gsse.getMessage(), gsse); if (gsse.getMajor() == GSSException.DEFECTIVE_TOKEN || gsse.getMajor() == GSSException.DUPLICATE_TOKEN || gsse.getMajor() == GSSException.OLD_TOKEN) throw new SpnegoEngineException(gsse.getMessage(), gsse); throw new SpnegoEngineException(gsse.getMessage()); } catch (IOException | LoginException | PrivilegedActionException ex) { throw new SpnegoEngineException(ex.getMessage()); } } SpnegoEngine(final String username,
                      final String password,
                      final String servicePrincipalName,
                      final String realmName,
                      final boolean useCanonicalHostname,
                      final Map<String, String> customLoginConfig,
                      final String loginContextName,
                      final SpnegoTokenGenerator spnegoGenerator);  SpnegoEngine(); static SpnegoEngine instance(final String username,
                                      final String password,
                                      final String servicePrincipalName,
                                      final String realmName,
                                      final boolean useCanonicalHostname,
                                      final Map<String, String> customLoginConfig,
                                      final String loginContextName); String generateToken(String host); Configuration getLoginConfiguration(); }
SpnegoEngine { public String generateToken(String host) throws SpnegoEngineException { GSSContext gssContext = null; byte[] token = null; Oid negotiationOid; try { negotiationOid = new Oid(SPNEGO_OID); boolean tryKerberos = false; String spn = getCompleteServicePrincipalName(host); try { GSSManager manager = GSSManager.getInstance(); GSSName serverName = manager.createName(spn, GSSName.NT_HOSTBASED_SERVICE); GSSCredential myCred = null; if (username != null || loginContextName != null || (customLoginConfig != null && !customLoginConfig.isEmpty())) { String contextName = loginContextName; if (contextName == null) { contextName = ""; } LoginContext loginContext = new LoginContext(contextName, null, getUsernamePasswordHandler(), getLoginConfiguration()); loginContext.login(); final Oid negotiationOidFinal = negotiationOid; final PrivilegedExceptionAction<GSSCredential> action = () -> manager.createCredential(null, GSSCredential.INDEFINITE_LIFETIME, negotiationOidFinal, GSSCredential.INITIATE_AND_ACCEPT); myCred = Subject.doAs(loginContext.getSubject(), action); } gssContext = manager.createContext(useCanonicalHostname ? serverName.canonicalize(negotiationOid) : serverName, negotiationOid, myCred, GSSContext.DEFAULT_LIFETIME); gssContext.requestMutualAuth(true); gssContext.requestCredDeleg(true); } catch (GSSException ex) { log.error("generateToken", ex); if (ex.getMajor() == GSSException.BAD_MECH) { log.debug("GSSException BAD_MECH, retry with Kerberos MECH"); tryKerberos = true; } else { throw ex; } } if (tryKerberos) { log.debug("Using Kerberos MECH {}", KERBEROS_OID); negotiationOid = new Oid(KERBEROS_OID); GSSManager manager = GSSManager.getInstance(); GSSName serverName = manager.createName(spn, GSSName.NT_HOSTBASED_SERVICE); gssContext = manager.createContext(serverName.canonicalize(negotiationOid), negotiationOid, null, GSSContext.DEFAULT_LIFETIME); gssContext.requestMutualAuth(true); gssContext.requestCredDeleg(true); } if (token == null) { token = new byte[0]; } token = gssContext.initSecContext(token, 0, token.length); if (token == null) { throw new SpnegoEngineException("GSS security context initialization failed"); } if (spnegoGenerator != null && negotiationOid.toString().equals(KERBEROS_OID)) { token = spnegoGenerator.generateSpnegoDERObject(token); } gssContext.dispose(); String tokenstr = Base64.getEncoder().encodeToString(token); log.debug("Sending response '{}' back to the server", tokenstr); return tokenstr; } catch (GSSException gsse) { log.error("generateToken", gsse); if (gsse.getMajor() == GSSException.DEFECTIVE_CREDENTIAL || gsse.getMajor() == GSSException.CREDENTIALS_EXPIRED) throw new SpnegoEngineException(gsse.getMessage(), gsse); if (gsse.getMajor() == GSSException.NO_CRED) throw new SpnegoEngineException(gsse.getMessage(), gsse); if (gsse.getMajor() == GSSException.DEFECTIVE_TOKEN || gsse.getMajor() == GSSException.DUPLICATE_TOKEN || gsse.getMajor() == GSSException.OLD_TOKEN) throw new SpnegoEngineException(gsse.getMessage(), gsse); throw new SpnegoEngineException(gsse.getMessage()); } catch (IOException | LoginException | PrivilegedActionException ex) { throw new SpnegoEngineException(ex.getMessage()); } } SpnegoEngine(final String username,
                      final String password,
                      final String servicePrincipalName,
                      final String realmName,
                      final boolean useCanonicalHostname,
                      final Map<String, String> customLoginConfig,
                      final String loginContextName,
                      final SpnegoTokenGenerator spnegoGenerator);  SpnegoEngine(); static SpnegoEngine instance(final String username,
                                      final String password,
                                      final String servicePrincipalName,
                                      final String realmName,
                                      final boolean useCanonicalHostname,
                                      final Map<String, String> customLoginConfig,
                                      final String loginContextName); String generateToken(String host); Configuration getLoginConfiguration();  }