[java-identity-provider COMMIT] in /trunk/idp-authn-impl/src: main/java/net/shibboleth/idp/authn/spnego/impl/SPNEGOAu...

[noreply at shibboleth.net]

Author: scantor
Date: Fri Nov  6 14:26:54 2015
New Revision: 7956

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=7956&view=rev
Log:
Add a null check to compensate for a GSS-API misbehavior.

Modified:
    trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/spnego/impl/SPNEGOAuthnController.java
    trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/spnego/impl/SPNEGOAuthnControllerTest.java

Modified: trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/spnego/impl/SPNEGOAuthnController.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/spnego/impl/SPNEGOAuthnController.java?rev=7956&r1=7955&r2=7956&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/spnego/impl/SPNEGOAuthnController.java	(original)
+++ trunk/idp-authn-impl/src/main/java/net/shibboleth/idp/authn/spnego/impl/SPNEGOAuthnController.java	Fri Nov  6 14:26:54 2015
@@ -175,6 +175,14 @@
             log.debug("GSS security context is complete");
             try {
                 final GSSName clientGSSName = acceptor.getContext().getSrcName();
+                if (clientGSSName == null) {
+                    // This case should never happen, but we observed it. Handle it as authentication failure.
+                    log.error("Error extracting principal name from security context");
+                    acceptor.logout();
+                    finishWithException(conversationKey, httpRequest, httpResponse,
+                            new ExternalAuthenticationException(SPNEGO_NOT_AVAILABLE));
+                    return null;
+                }
                 final KerberosPrincipal kerberosPrincipal = new KerberosPrincipal(clientGSSName.toString());
 
                 log.info("SPNEGO/Kerberos authentication succeeded for principal: {}", clientGSSName.toString());

Modified: trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/spnego/impl/SPNEGOAuthnControllerTest.java
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/spnego/impl/SPNEGOAuthnControllerTest.java?rev=7956&r1=7955&r2=7956&view=diff
==============================================================================
--- trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/spnego/impl/SPNEGOAuthnControllerTest.java	(original)
+++ trunk/idp-authn-impl/src/test/java/net/shibboleth/idp/authn/spnego/impl/SPNEGOAuthnControllerTest.java	Fri Nov  6 14:26:54 2015
@@ -395,6 +395,23 @@
         Assert.assertTrue(s.getPrincipals(UsernamePrincipal.class).contains(new UsernamePrincipal("testname at realm")));
     }
 
+    @Test
+    public void givenGSSContextEstablishedButNoGSSNameIsNull_continueSPNEGO_shouldSetAuthenticationSubjectAttribute()
+            throws LoginException, GSSException, PrivilegedActionException, ExternalAuthenticationException,
+            IOException, Exception {
+        GSSContext mockGSSContext = mock(GSSContext.class);
+        when(mockGSSContextAcceptor.acceptSecContext(Matchers.<byte[]> any(), anyInt(), anyInt())).thenReturn(
+                "tokenBytes".getBytes());
+        when(mockGSSContextAcceptor.getContext()).thenReturn(mockGSSContext);
+        when(mockGSSContext.isEstablished()).thenReturn(true);
+        when(mockGSSContext.getSrcName()).thenReturn(null);
+        MockHttpServletRequest req = buildSPNEGOHttpServletRequest(NEGOTIATE_HEADER_DATA);
+        ModelAndView mv = mockedGSSController.continueSPNEGO(TEST_CONVERSATION_KEY, "Negotiate " + NEGOTIATE_HEADER_DATA, req, null);
+        Assert.assertNull(mv);
+        Assert.assertEquals(((ExternalAuthenticationException) req
+                .getAttribute(ExternalAuthentication.AUTHENTICATION_EXCEPTION_KEY)).getClass(),ExternalAuthenticationException.class);
+    }
+
     private MockHttpServletRequest buildSPNEGOHttpServletRequest(String negotiateHeaderData) {
         MockHttpServletRequest req = buildKerberosContextHttpServletRequest();
         req.addHeader(HttpHeaders.AUTHORIZATION, "Negotiate " + negotiateHeaderData);