001: package org.jacorb.security.sas;
002:
003: /*
004: * JacORB - a free Java ORB
005: *
006: * Copyright (C) 2002-2004 Gerald Brose
007: *
008: * This library is free software; you can redistribute it and/or
009: * modify it under the terms of the GNU Library General Public
010: * License as published by the Free Software Foundation; either
011: * version 2 of the License, or (at your option) any later version.
012: *
013: * This library is distributed in the hope that it will be useful,
014: * but WITHOUT ANY WARRANTY; without even the implied warranty of
015: * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
016: * Library General Public License for more details.
017: *
018: * You should have received a copy of the GNU Library General Public
019: * License along with this library; if not, write to the Free
020: * Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
021: */
022:
023: import org.apache.avalon.framework.configuration.Configuration;
024: import org.apache.avalon.framework.configuration.ConfigurationException;
025: import org.apache.avalon.framework.logger.Logger;
026: import org.ietf.jgss.GSSContext;
027: import org.ietf.jgss.GSSCredential;
028: import org.ietf.jgss.GSSException;
029: import org.ietf.jgss.GSSManager;
030: import org.ietf.jgss.GSSName;
031: import org.ietf.jgss.Oid;
032: import org.omg.CORBA.ORB;
033: import org.omg.CSI.KRB5MechOID;
034: import org.omg.CSIIOP.CompoundSecMechList;
035: import org.omg.IOP.Codec;
036:
037: public class KerberosContext implements ISASContext {
038: /** the logger used by the naming service implementation */
039: private Logger logger;
040:
041: //private GSSManager gssManager = GSSManager.getInstance();
042: private GSSContext validatedContext = null;
043: private GSSCredential targetCreds = null;
044: private GSSCredential clientCreds = null;
045:
046: public void configure(Configuration configuration)
047: throws ConfigurationException {
048: logger = ((org.jacorb.config.Configuration) configuration)
049: .getNamedLogger("jacorb.security.sas.Kerberos");
050: }
051:
052: public void initClient() {
053: String principal = "";
054: try {
055: Oid krb5Oid = new Oid(KRB5MechOID.value.substring(4));
056: GSSManager gssManager = GSSManager.getInstance();
057: clientCreds = gssManager.createCredential(null,
058: GSSCredential.INDEFINITE_LIFETIME, krb5Oid,
059: GSSCredential.INITIATE_ONLY);
060: } catch (Exception e) {
061: logger.warn("Error getting created principal: " + e);
062: }
063: }
064:
065: public String getMechOID() {
066: return KRB5MechOID.value.substring(4);
067: }
068:
069: public byte[] createClientContext(ORB orb, Codec codec,
070: CompoundSecMechList csmList) {
071: // see if context supported
072: //if ((csmList.mechanism_list[0].as_context_mech.target_supports & EstablishTrustInClient.value) == 0) {
073: // // SAS context not supported
074: // return new byte[0];
075: //}
076:
077: // check for acceptable security mech
078: //try {
079: // byte[] mechOid = csmList.mechanism_list[0].as_context_mech.client_authentication_mech;
080: // Oid krb5Oid = new Oid(KRB5MechOID.value.substring(4));
081: // if (!mechOid.equals(krb5Oid.getDER())) {
082: // logger.warn("Kerberos mechanism not supported");
083: // return new byte[0];
084: // }
085: //} catch (GSSException e) {
086: // logger.warn("Error getting Client Context: "+e);
087: // return new byte[0];
088: //}
089:
090: // generate context
091: byte[] contextToken = new byte[0];
092: try {
093: byte[] target = csmList.mechanism_list[0].as_context_mech.target_name;
094:
095: Oid krb5Oid = new Oid(KRB5MechOID.value.substring(4));
096: GSSManager gssManager = GSSManager.getInstance();
097: GSSName myPeer = gssManager.createName(target, null,
098: krb5Oid);
099: if (clientCreds == null)
100: clientCreds = gssManager.createCredential(null,
101: GSSCredential.INDEFINITE_LIFETIME, krb5Oid,
102: GSSCredential.INITIATE_ONLY);
103: GSSContext myContext = gssManager.createContext(myPeer,
104: krb5Oid, clientCreds,
105: GSSContext.INDEFINITE_LIFETIME);
106: contextToken = myContext.initSecContext(contextToken, 0,
107: contextToken.length);
108: } catch (Exception e) {
109: logger.error("Error creating Kerberos context: " + e);
110: }
111: return contextToken;
112: }
113:
114: public String getClientPrincipal() {
115: String principal = "";
116: try {
117: Oid krb5Oid = new Oid(KRB5MechOID.value.substring(4));
118: GSSManager gssManager = GSSManager.getInstance();
119: if (clientCreds == null)
120: clientCreds = gssManager.createCredential(null,
121: GSSCredential.INDEFINITE_LIFETIME, krb5Oid,
122: GSSCredential.INITIATE_ONLY);
123: principal = clientCreds.getName().toString();
124: } catch (Exception e) {
125: logger.error("Error getting created principal: " + e);
126: }
127: return principal;
128: }
129:
130: public void initTarget() {
131: try {
132: Oid krb5Oid = new Oid(KRB5MechOID.value.substring(4));
133: GSSManager gssManager = GSSManager.getInstance();
134: if (targetCreds == null)
135: targetCreds = gssManager.createCredential(null,
136: GSSCredential.INDEFINITE_LIFETIME, krb5Oid,
137: GSSCredential.ACCEPT_ONLY);
138: } catch (GSSException e) {
139: logger.warn("Error accepting Kerberos context: " + e);
140: }
141: }
142:
143: public boolean validateContext(ORB orb, Codec codec,
144: byte[] contextToken) {
145: byte[] token = null;
146:
147: try {
148: Oid krb5Oid = new Oid(KRB5MechOID.value.substring(4));
149: GSSManager gssManager = GSSManager.getInstance();
150: if (targetCreds == null)
151: targetCreds = gssManager.createCredential(null,
152: GSSCredential.INDEFINITE_LIFETIME, krb5Oid,
153: GSSCredential.ACCEPT_ONLY);
154: validatedContext = gssManager.createContext(targetCreds);
155: token = validatedContext.acceptSecContext(contextToken, 0,
156: contextToken.length);
157: } catch (GSSException e) {
158: logger.error("Error accepting Kerberos context: " + e);
159: }
160: if (token == null) {
161: logger.warn("Could not accept token");
162: return false;
163: }
164:
165: return true;
166: }
167:
168: public String getValidatedPrincipal() {
169: if (validatedContext == null)
170: return null;
171: try {
172: return validatedContext.getSrcName().toString();
173: } catch (GSSException e) {
174: logger.error("Error getting name: " + e);
175: }
176: return null;
177: }
178: }
|