[java-identity-provider COMMIT] /trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernamePas...

[noreply at shibboleth.net]

Author: scantor
Date: Sat May  2 20:20:31 2015
New Revision: 7491

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7491&view=rev
Log:
IDP-114 - rewrite of Kerberos action on top of JAAS module and GSS exchange

Modified:
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstKerberos.java

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstKerberos.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstKerberos.java?rev=7491&r1=7490&r2=7491&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstKerberos.java	(original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/impl/ValidateUsernamePasswordAgainstKerberos.java	Sat May  2 20:20:31 2015
@@ -17,38 +17,45 @@
 
 package net.shibboleth.idp.authn.impl;
 
-import java.io.File;
-import java.io.IOException;
+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
+import java.util.HashMap;
+import java.util.Map;
 
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 import javax.security.auth.Subject;
-import javax.security.auth.kerberos.KerberosPrincipal;
+import javax.security.auth.callback.Callback;
+import javax.security.auth.callback.CallbackHandler;
+import javax.security.auth.callback.NameCallback;
+import javax.security.auth.callback.PasswordCallback;
+import javax.security.auth.callback.UnsupportedCallbackException;
+import javax.security.auth.login.LoginException;
+import javax.security.auth.spi.LoginModule;
 
 import net.shibboleth.idp.authn.AbstractValidationAction;
 import net.shibboleth.idp.authn.AuthnEventIds;
 import net.shibboleth.idp.authn.context.AuthenticationContext;
 import net.shibboleth.idp.authn.context.UsernamePasswordContext;
 import net.shibboleth.idp.authn.principal.UsernamePrincipal;
+import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
 import net.shibboleth.utilities.java.support.component.ComponentInitializationException;
 import net.shibboleth.utilities.java.support.component.ComponentSupport;
+import net.shibboleth.utilities.java.support.logic.Constraint;
 import net.shibboleth.utilities.java.support.primitive.StringSupport;
 
+import org.ietf.jgss.GSSContext;
+import org.ietf.jgss.GSSCredential;
+import org.ietf.jgss.GSSException;
+import org.ietf.jgss.GSSManager;
+import org.ietf.jgss.GSSName;
+import org.ietf.jgss.Oid;
 import org.opensaml.profile.action.ActionSupport;
 import org.opensaml.profile.action.EventIds;
 import org.opensaml.profile.context.ProfileRequestContext;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
-
-import sun.security.jgss.krb5.Krb5Util;
-import sun.security.krb5.Config;
-import sun.security.krb5.Credentials;
-import sun.security.krb5.internal.ktab.KeyTab;
-import sun.security.krb5.EncryptionKey;
-import sun.security.krb5.KrbApReq;
-import sun.security.krb5.KrbAsReqBuilder;
-import sun.security.krb5.KrbException;
-import sun.security.krb5.PrincipalName;
 
 /**
  * An action that checks for a {@link UsernamePasswordContext} and directly produces an
@@ -66,10 +73,13 @@
  * ProfileRequestContext, AuthenticationContext, Exception, String)} method is called.
  */
 public class ValidateUsernamePasswordAgainstKerberos extends AbstractValidationAction {
-
+    
     /** Class logger. */
     @Nonnull private final Logger log = LoggerFactory.getLogger(ValidateUsernamePasswordAgainstKerberos.class);
 
+    /** Class name of JAAS LoginModule to acquire Kerberos credentials. */
+    @NonnullAfterInit @NotEmpty private String loginModuleClassName;
+    
     /** Refresh the Kerberos config before running? */
     private boolean refreshKrb5Config;
     
@@ -81,12 +91,32 @@
     
     /** Path to keytab for service principal. */
     private String keytabPath;
-    
+
+    /** JAAS options for client login. */
+    @NonnullAfterInit private Map<String,String> clientOptions;
+
+    /** JAAS options for server login. */
+    @NonnullAfterInit private Map<String,String> serverOptions;
+
     /** UsernamePasswordContext containing the credentials to validate. */
     @Nullable private UsernamePasswordContext upContext;
     
-    /** Result of authentication. */
-    @Nullable private Credentials krbCreds;
+    /** Constructor. */
+    public ValidateUsernamePasswordAgainstKerberos() {
+        loginModuleClassName = "com.sun.security.auth.module.Krb5LoginModule";
+    }
+    
+    /**
+     * Set the name of the JAAS LoginModule to use to acquire Kerberos credentials.
+     * 
+     * @param name  name of login module class
+     */
+    public void setLoginModuleClassName(@Nonnull final String name) {
+        ComponentSupport.ifInitializedThrowUnmodifiabledComponentException(this);
+        

[... 232 lines stripped ...]