151b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski/* 251b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved. 351b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 451b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * 551b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * This code is free software; you can redistribute it and/or modify it 651b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * under the terms of the GNU General Public License version 2 only, as 751b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * published by the Free Software Foundation. Oracle designates this 851b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * particular file as subject to the "Classpath" exception as provided 951b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * by Oracle in the LICENSE file that accompanied this code. 1051b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * 1151b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * This code is distributed in the hope that it will be useful, but WITHOUT 1251b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 1351b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 1451b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * version 2 for more details (a copy is included in the LICENSE file that 1551b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * accompanied this code). 1651b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * 1751b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * You should have received a copy of the GNU General Public License version 1851b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * 2 along with this work; if not, write to the Free Software Foundation, 1951b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. 2051b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * 2151b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA 2251b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * or visit www.oracle.com if you need additional information or have any 2351b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * questions. 2451b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski */ 2551b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski 2651b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebskipackage sun.security.ssl; 2751b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski 2851b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebskiimport java.security.AccessControlContext; 2951b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebskiimport java.security.AccessController; 3051b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebskiimport java.security.Permission; 3151b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebskiimport java.security.Principal; 3251b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebskiimport java.security.PrivilegedAction; 3351b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebskiimport javax.crypto.SecretKey; 3451b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebskiimport javax.security.auth.Subject; 3551b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebskiimport javax.security.auth.login.LoginException; 3651b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski 3751b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski/** 3851b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * A helper class for Kerberos APIs. 3951b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski */ 4051b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebskipublic final class Krb5Helper { 4151b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski 4251b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski private Krb5Helper() { } 4351b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski 4451b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski // loads Krb5Proxy implementation class if available 4551b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski private static final String IMPL_CLASS = 4651b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski "sun.security.ssl.krb5.Krb5ProxyImpl"; 4751b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski 4851b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski private static final Krb5Proxy proxy = 4951b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski AccessController.doPrivileged(new PrivilegedAction<Krb5Proxy>() { 5051b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski public Krb5Proxy run() { 5151b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski try { 5251b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski Class<?> c = Class.forName(IMPL_CLASS, true, null); 5351b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski return (Krb5Proxy)c.newInstance(); 5451b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski } catch (ClassNotFoundException cnf) { 5551b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski return null; 5651b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski } catch (InstantiationException e) { 5751b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski throw new AssertionError(e); 5851b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski } catch (IllegalAccessException e) { 5951b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski throw new AssertionError(e); 6051b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski } 6151b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski }}); 6251b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski 6351b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski /** 6451b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * Returns true if Kerberos is available. 6551b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski */ 6651b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski public static boolean isAvailable() { 6751b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski return proxy != null; 6851b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski } 6951b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski 7051b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski private static void ensureAvailable() { 7151b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski if (proxy == null) 7251b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski throw new AssertionError("Kerberos should have been available"); 7351b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski } 7451b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski 7551b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski /** 7651b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * Returns the Subject associated with client-side of the SSL socket. 7751b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski */ 7851b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski public static Subject getClientSubject(AccessControlContext acc) 7951b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski throws LoginException { 8051b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski ensureAvailable(); 8151b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski return proxy.getClientSubject(acc); 8251b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski } 8351b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski 8451b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski /** 8551b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * Returns the Subject associated with server-side of the SSL socket. 8651b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski */ 8751b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski public static Subject getServerSubject(AccessControlContext acc) 8851b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski throws LoginException { 8951b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski ensureAvailable(); 9051b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski return proxy.getServerSubject(acc); 9151b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski } 9251b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski 9351b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski /** 9451b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * Returns the KerberosKeys for the default server-side principal. 9551b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski */ 9651b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski public static SecretKey[] getServerKeys(AccessControlContext acc) 9751b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski throws LoginException { 9851b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski ensureAvailable(); 9951b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski return proxy.getServerKeys(acc); 10051b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski } 10151b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski 10251b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski /** 10351b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * Returns the server-side principal name associated with the KerberosKey. 10451b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski */ 10551b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski public static String getServerPrincipalName(SecretKey kerberosKey) { 10651b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski ensureAvailable(); 10751b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski return proxy.getServerPrincipalName(kerberosKey); 10851b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski } 10951b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski 11051b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski /** 11151b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * Returns the hostname embedded in the principal name. 11251b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski */ 11351b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski public static String getPrincipalHostName(Principal principal) { 11451b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski ensureAvailable(); 11551b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski return proxy.getPrincipalHostName(principal); 11651b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski } 11751b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski 11851b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski /** 11951b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * Returns a ServicePermission for the principal name and action. 12051b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski */ 12151b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski public static Permission getServicePermission(String principalName, 12251b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski String action) { 12351b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski ensureAvailable(); 12451b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski return proxy.getServicePermission(principalName, action); 12551b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski } 12651b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski} 127