202 lines
7.7 KiB
Java
202 lines
7.7 KiB
Java
/*
|
|
* Copyright (c) 1999, 2011, Oracle and/or its affiliates. All rights reserved.
|
|
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
|
*
|
|
* This code is free software; you can redistribute it and/or modify it
|
|
* under the terms of the GNU General Public License version 2 only, as
|
|
* published by the Free Software Foundation. Oracle designates this
|
|
* particular file as subject to the "Classpath" exception as provided
|
|
* by Oracle in the LICENSE file that accompanied this code.
|
|
*
|
|
* This code is distributed in the hope that it will be useful, but WITHOUT
|
|
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
|
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
* version 2 for more details (a copy is included in the LICENSE file that
|
|
* accompanied this code).
|
|
*
|
|
* You should have received a copy of the GNU General Public License version
|
|
* 2 along with this work; if not, write to the Free Software Foundation,
|
|
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
*
|
|
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
|
* or visit www.oracle.com if you need additional information or have any
|
|
* questions.
|
|
*/
|
|
|
|
package com.sun.jndi.ldap.sasl;
|
|
|
|
import java.io.*;
|
|
import java.util.Vector;
|
|
import java.util.Hashtable;
|
|
import java.util.StringTokenizer;
|
|
|
|
import javax.naming.AuthenticationException;
|
|
import javax.naming.AuthenticationNotSupportedException;
|
|
import javax.naming.NamingException;
|
|
|
|
import javax.naming.ldap.Control;
|
|
|
|
import javax.security.auth.callback.CallbackHandler;
|
|
import javax.security.sasl.*;
|
|
import com.sun.jndi.ldap.Connection;
|
|
import com.sun.jndi.ldap.LdapClient;
|
|
import com.sun.jndi.ldap.LdapResult;
|
|
|
|
/**
|
|
* Handles SASL support.
|
|
*
|
|
* @author Vincent Ryan
|
|
* @author Rosanna Lee
|
|
*/
|
|
|
|
final public class LdapSasl {
|
|
// SASL stuff
|
|
private static final String SASL_CALLBACK = "java.naming.security.sasl.callback";
|
|
private static final String SASL_AUTHZ_ID =
|
|
"java.naming.security.sasl.authorizationId";
|
|
private static final String SASL_REALM =
|
|
"java.naming.security.sasl.realm";
|
|
|
|
private static final int LDAP_SUCCESS = 0;
|
|
private static final int LDAP_SASL_BIND_IN_PROGRESS = 14; // LDAPv3
|
|
|
|
private LdapSasl() {
|
|
}
|
|
|
|
/**
|
|
* Performs SASL bind.
|
|
* Creates a SaslClient by using a default CallbackHandler
|
|
* that uses the Context.SECURITY_PRINCIPAL and Context.SECURITY_CREDENTIALS
|
|
* properties to satisfy the callbacks, and by using the
|
|
* SASL_AUTHZ_ID property as the authorization id. If the SASL_AUTHZ_ID
|
|
* property has not been set, Context.SECURITY_PRINCIPAL is used.
|
|
* If SASL_CALLBACK has been set, use that instead of the default
|
|
* CallbackHandler.
|
|
*<p>
|
|
* If bind is successful and the selected SASL mechanism has a security
|
|
* layer, set inStream and outStream to be filter streams that use
|
|
* the security layer. These will be used for subsequent communication
|
|
* with the server.
|
|
*<p>
|
|
* @param conn The non-null connection to use for sending an LDAP BIND
|
|
* @param server Non-null string name of host to connect to
|
|
* @param dn Non-null DN to bind as; also used as authentication ID
|
|
* @param pw Possibly null password; can be byte[], char[] or String
|
|
* @param authMech A non-null space-separated list of SASL authentication
|
|
* mechanisms.
|
|
* @param env The possibly null environment of the context, possibly containing
|
|
* properties for used by SASL mechanisms
|
|
* @param bindCtls The possibly null controls to accompany the bind
|
|
* @return LdapResult containing status of the bind
|
|
*/
|
|
@SuppressWarnings("unchecked")
|
|
public static LdapResult saslBind(LdapClient clnt, Connection conn,
|
|
String server, String dn, Object pw,
|
|
String authMech, Hashtable<?,?> env, Control[] bindCtls)
|
|
throws IOException, NamingException {
|
|
|
|
SaslClient saslClnt = null;
|
|
boolean cleanupHandler = false;
|
|
|
|
// Use supplied callback handler or create default
|
|
CallbackHandler cbh =
|
|
(env != null) ? (CallbackHandler)env.get(SASL_CALLBACK) : null;
|
|
if (cbh == null) {
|
|
cbh = new DefaultCallbackHandler(dn, pw, (String)env.get(SASL_REALM));
|
|
cleanupHandler = true;
|
|
}
|
|
|
|
// Prepare parameters for creating SASL client
|
|
String authzId = (env != null) ? (String)env.get(SASL_AUTHZ_ID) : null;
|
|
String[] mechs = getSaslMechanismNames(authMech);
|
|
|
|
try {
|
|
// Create SASL client to use using SASL package
|
|
saslClnt = Sasl.createSaslClient(
|
|
mechs, authzId, "ldap", server, (Hashtable<String, ?>)env, cbh);
|
|
|
|
if (saslClnt == null) {
|
|
throw new AuthenticationNotSupportedException(authMech);
|
|
}
|
|
|
|
LdapResult res;
|
|
String mechName = saslClnt.getMechanismName();
|
|
byte[] response = saslClnt.hasInitialResponse() ?
|
|
saslClnt.evaluateChallenge(NO_BYTES) : null;
|
|
|
|
res = clnt.ldapBind(null, response, bindCtls, mechName, true);
|
|
|
|
while (!saslClnt.isComplete() &&
|
|
(res.status == LDAP_SASL_BIND_IN_PROGRESS ||
|
|
res.status == LDAP_SUCCESS)) {
|
|
|
|
response = saslClnt.evaluateChallenge(
|
|
res.serverCreds != null? res.serverCreds : NO_BYTES);
|
|
if (res.status == LDAP_SUCCESS) {
|
|
if (response != null) {
|
|
throw new AuthenticationException(
|
|
"SASL client generated response after success");
|
|
}
|
|
break;
|
|
}
|
|
res = clnt.ldapBind(null, response, bindCtls, mechName, true);
|
|
}
|
|
|
|
if (res.status == LDAP_SUCCESS) {
|
|
if (!saslClnt.isComplete()) {
|
|
throw new AuthenticationException(
|
|
"SASL authentication not complete despite server claims");
|
|
}
|
|
|
|
String qop = (String) saslClnt.getNegotiatedProperty(Sasl.QOP);
|
|
|
|
// If negotiated integrity or privacy,
|
|
if (qop != null && (qop.equalsIgnoreCase("auth-int")
|
|
|| qop.equalsIgnoreCase("auth-conf"))) {
|
|
|
|
InputStream newIn = new SaslInputStream(saslClnt,
|
|
conn.inStream);
|
|
OutputStream newOut = new SaslOutputStream(saslClnt,
|
|
conn.outStream);
|
|
|
|
conn.replaceStreams(newIn, newOut);
|
|
} else {
|
|
saslClnt.dispose();
|
|
}
|
|
}
|
|
return res;
|
|
} catch (SaslException e) {
|
|
NamingException ne = new AuthenticationException(
|
|
authMech);
|
|
ne.setRootCause(e);
|
|
throw ne;
|
|
} finally {
|
|
if (cleanupHandler) {
|
|
((DefaultCallbackHandler)cbh).clearPassword();
|
|
}
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Returns an array of SASL mechanisms given a string of space
|
|
* separated SASL mechanism names.
|
|
* @param The non-null string containing the mechanism names
|
|
* @return A non-null array of String; each element of the array
|
|
* contains a single mechanism name.
|
|
*/
|
|
private static String[] getSaslMechanismNames(String str) {
|
|
StringTokenizer parser = new StringTokenizer(str);
|
|
Vector<String> mechs = new Vector<>(10);
|
|
while (parser.hasMoreTokens()) {
|
|
mechs.addElement(parser.nextToken());
|
|
}
|
|
String[] mechNames = new String[mechs.size()];
|
|
for (int i = 0; i < mechs.size(); i++) {
|
|
mechNames[i] = mechs.elementAt(i);
|
|
}
|
|
return mechNames;
|
|
}
|
|
|
|
private static final byte[] NO_BYTES = new byte[0];
|
|
}
|