[java-identity-provider COMMIT] in /trunk: idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernam...

[noreply at shibboleth.net]

Author: scantor
Date: Sun Jul  6 21:49:28 2014
New Revision: 6234

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=6234&view=rev
Log:
Rudimentary Kerberos validation action, based on Sun's JAAS module.

Added:
    trunk/idp-conf/src/main/resources/conf/authn/krb5-authn-config.xml   (with props)
Modified:
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstKerberos.java
    trunk/idp-conf/src/main/resources/conf/authn/password-authn-config.xml
    trunk/idp-conf/src/main/resources/system/flows/authn/password-authn-beans.xml

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstKerberos.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstKerberos.java?rev=6234&r1=6233&r2=6234&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstKerberos.java (original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstKerberos.java Sun Jul  6 21:49:28 2014
@@ -17,21 +17,32 @@
 
 package net.shibboleth.idp.authn.impl;
 
+import java.io.IOException;
+
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 import javax.security.auth.Subject;
+import javax.security.auth.kerberos.KerberosPrincipal;
 
 import net.shibboleth.idp.authn.AbstractValidationAction;
 import net.shibboleth.idp.authn.AuthnEventIds;
 import net.shibboleth.idp.authn.context.AuthenticationContext;
 import net.shibboleth.idp.authn.context.UsernamePasswordContext;
 import net.shibboleth.idp.authn.principal.UsernamePrincipal;
+import net.shibboleth.utilities.java.support.component.ComponentSupport;
 
 import org.opensaml.profile.action.ActionSupport;
 import org.opensaml.profile.action.EventIds;
 import org.opensaml.profile.context.ProfileRequestContext;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+
+import sun.security.jgss.krb5.Krb5Util;
+import sun.security.krb5.Config;
+import sun.security.krb5.Credentials;
+import sun.security.krb5.KrbAsReqBuilder;
+import sun.security.krb5.KrbException;
+import sun.security.krb5.PrincipalName;
 
 /**
  * An action that checks for a {@link UsernamePasswordContext} and directly produces an
@@ -53,9 +64,40 @@
     /** Class logger. */
     @Nonnull private final Logger log = LoggerFactory.getLogger(ValidateUsernamePasswordAgainstKerberos.class);
 
+    /** Refresh the Kerberos config before running? */
+    private boolean refreshKrb5Config;
+    
+    /** Save the TGT in the resulting Subject? */
+    private boolean preserveTicket;
+    
     /** UsernamePasswordContext containing the credentials to validate. */
     @Nullable private UsernamePasswordContext upContext;
+    
+    /** Result of authentication. */
+    @Nullable private Credentials krbCreds;
+    
+    /**
+     * Set whether to refresh the Kerberos configuration before running.
+     * 
+     * @param flag  flag to set
+     */
+    public void setRefreshKrb5Config(final boolean flag) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        
+        refreshKrb5Config = flag;
+    }
 
+    /**
+     * Set whether to save the TGT in the Subject.
+     * 
+     * @param flag  flag to set
+     */
+    public void setPreserveTicket(final boolean flag) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        
+        preserveTicket = flag;
+    }
+    
     /** {@inheritDoc} */
     @Override
     protected boolean doPreExecute(@Nonnull final ProfileRequestContext profileRequestContext,
@@ -86,13 +128,39 @@
     @Override
     protected void doExecute(@Nonnull final ProfileRequestContext profileRequestContext,
             @Nonnull final AuthenticationContext authenticationContext) {
-        // TODO Auto-generated method stub
+        
+        try {
+            if (refreshKrb5Config) {
+                Config.refresh();
+            }
+            
+            // Build principal name to authenticate.
+            final PrincipalName pname = new PrincipalName(upContext.getUsername(), PrincipalName.KRB_NT_PRINCIPAL);
+            final KrbAsReqBuilder reqBuilder = new KrbAsReqBuilder(pname, upContext.getPassword().toCharArray());
+            
+            // Do the exchange.
+            krbCreds = reqBuilder.action().getCreds();
+            reqBuilder.destroy();
+            
+            log.info("{} Login by '{}' succeeded", getLogPrefix(), pname.getName());
+            
+            buildAuthenticationResult(profileRequestContext, authenticationContext);
+        } catch (final KrbException | IOException e) {
+            log.warn(getLogPrefix() + " Login by '" + upContext.getUsername() + "' produced exception", e);
+            handleError(profileRequestContext, authenticationContext, e, AuthnEventIds.AUTHN_EXCEPTION);
+        }
     }
 
     /** {@inheritDoc} */

[... 48 lines stripped ...]