236 lines
7.8 KiB
Java
236 lines
7.8 KiB
Java
/*
|
|
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
|
*
|
|
* This code is free software; you can redistribute it and/or modify it
|
|
* under the terms of the GNU General Public License version 2 only, as
|
|
* published by the Free Software Foundation. Oracle designates this
|
|
* particular file as subject to the "Classpath" exception as provided
|
|
* by Oracle in the LICENSE file that accompanied this code.
|
|
*
|
|
* This code is distributed in the hope that it will be useful, but WITHOUT
|
|
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
|
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
* version 2 for more details (a copy is included in the LICENSE file that
|
|
* accompanied this code).
|
|
*
|
|
* You should have received a copy of the GNU General Public License version
|
|
* 2 along with this work; if not, write to the Free Software Foundation,
|
|
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
*
|
|
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
|
* or visit www.oracle.com if you need additional information or have any
|
|
* questions.
|
|
*/
|
|
|
|
/*
|
|
*
|
|
* (C) Copyright IBM Corp. 1999 All Rights Reserved.
|
|
* Copyright 1997 The Open Group Research Institute. All rights reserved.
|
|
*/
|
|
|
|
package sun.security.krb5.internal.ccache;
|
|
|
|
import sun.security.krb5.*;
|
|
import sun.security.krb5.internal.*;
|
|
|
|
public class Credentials {
|
|
|
|
PrincipalName cname;
|
|
PrincipalName sname;
|
|
EncryptionKey key;
|
|
KerberosTime authtime;
|
|
KerberosTime starttime;//optional
|
|
KerberosTime endtime;
|
|
KerberosTime renewTill; //optional
|
|
HostAddresses caddr; //optional; for proxied tickets only
|
|
AuthorizationData authorizationData; //optional, not being actually used
|
|
public boolean isEncInSKey; // true if ticket is encrypted in another ticket's skey
|
|
TicketFlags flags;
|
|
Ticket ticket;
|
|
Ticket secondTicket; //optional
|
|
private boolean DEBUG = Krb5.DEBUG;
|
|
|
|
public Credentials(
|
|
PrincipalName new_cname,
|
|
PrincipalName new_sname,
|
|
EncryptionKey new_key,
|
|
KerberosTime new_authtime,
|
|
KerberosTime new_starttime,
|
|
KerberosTime new_endtime,
|
|
KerberosTime new_renewTill,
|
|
boolean new_isEncInSKey,
|
|
TicketFlags new_flags,
|
|
HostAddresses new_caddr,
|
|
AuthorizationData new_authData,
|
|
Ticket new_ticket,
|
|
Ticket new_secondTicket) {
|
|
cname = (PrincipalName) new_cname.clone();
|
|
sname = (PrincipalName) new_sname.clone();
|
|
key = (EncryptionKey) new_key.clone();
|
|
|
|
authtime = new_authtime;
|
|
starttime = new_starttime;
|
|
endtime = new_endtime;
|
|
renewTill = new_renewTill;
|
|
|
|
if (new_caddr != null) {
|
|
caddr = (HostAddresses) new_caddr.clone();
|
|
}
|
|
if (new_authData != null) {
|
|
authorizationData = (AuthorizationData) new_authData.clone();
|
|
}
|
|
|
|
isEncInSKey = new_isEncInSKey;
|
|
flags = (TicketFlags) new_flags.clone();
|
|
ticket = (Ticket) (new_ticket.clone());
|
|
if (new_secondTicket != null) {
|
|
secondTicket = (Ticket) new_secondTicket.clone();
|
|
}
|
|
}
|
|
|
|
public Credentials(
|
|
KDCRep kdcRep,
|
|
Ticket new_secondTicket,
|
|
AuthorizationData new_authorizationData,
|
|
boolean new_isEncInSKey) {
|
|
if (kdcRep.encKDCRepPart == null) //can't store while encrypted
|
|
{
|
|
return;
|
|
}
|
|
cname = (PrincipalName) kdcRep.cname.clone();
|
|
ticket = (Ticket) kdcRep.ticket.clone();
|
|
key = (EncryptionKey) kdcRep.encKDCRepPart.key.clone();
|
|
flags = (TicketFlags) kdcRep.encKDCRepPart.flags.clone();
|
|
authtime = kdcRep.encKDCRepPart.authtime;
|
|
starttime = kdcRep.encKDCRepPart.starttime;
|
|
endtime = kdcRep.encKDCRepPart.endtime;
|
|
renewTill = kdcRep.encKDCRepPart.renewTill;
|
|
|
|
sname = (PrincipalName) kdcRep.encKDCRepPart.sname.clone();
|
|
caddr = (HostAddresses) kdcRep.encKDCRepPart.caddr.clone();
|
|
secondTicket = (Ticket) new_secondTicket.clone();
|
|
authorizationData =
|
|
(AuthorizationData) new_authorizationData.clone();
|
|
isEncInSKey = new_isEncInSKey;
|
|
}
|
|
|
|
public Credentials(KDCRep kdcRep) {
|
|
this(kdcRep, null);
|
|
}
|
|
|
|
public Credentials(KDCRep kdcRep, Ticket new_ticket) {
|
|
sname = (PrincipalName) kdcRep.encKDCRepPart.sname.clone();
|
|
cname = (PrincipalName) kdcRep.cname.clone();
|
|
key = (EncryptionKey) kdcRep.encKDCRepPart.key.clone();
|
|
authtime = kdcRep.encKDCRepPart.authtime;
|
|
starttime = kdcRep.encKDCRepPart.starttime;
|
|
endtime = kdcRep.encKDCRepPart.endtime;
|
|
renewTill = kdcRep.encKDCRepPart.renewTill;
|
|
// if (kdcRep.msgType == Krb5.KRB_AS_REP) {
|
|
// isEncInSKey = false;
|
|
// secondTicket = null;
|
|
// }
|
|
flags = kdcRep.encKDCRepPart.flags;
|
|
if (kdcRep.encKDCRepPart.caddr != null) {
|
|
caddr = (HostAddresses) kdcRep.encKDCRepPart.caddr.clone();
|
|
} else {
|
|
caddr = null;
|
|
}
|
|
ticket = (Ticket) kdcRep.ticket.clone();
|
|
if (new_ticket != null) {
|
|
secondTicket = (Ticket) new_ticket.clone();
|
|
isEncInSKey = true;
|
|
} else {
|
|
secondTicket = null;
|
|
isEncInSKey = false;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Checks if this credential is expired
|
|
*/
|
|
public boolean isValid() {
|
|
boolean valid = true;
|
|
if (endtime.getTime() < System.currentTimeMillis()) {
|
|
valid = false;
|
|
} else if (starttime != null) {
|
|
if (starttime.getTime() > System.currentTimeMillis()) {
|
|
valid = false;
|
|
}
|
|
} else {
|
|
if (authtime.getTime() > System.currentTimeMillis()) {
|
|
valid = false;
|
|
}
|
|
}
|
|
return valid;
|
|
}
|
|
|
|
public PrincipalName getServicePrincipal() throws RealmException {
|
|
return sname;
|
|
}
|
|
|
|
public Ticket getTicket() throws RealmException {
|
|
return ticket;
|
|
}
|
|
|
|
public PrincipalName getServicePrincipal2() throws RealmException {
|
|
return secondTicket == null ? null : secondTicket.sname;
|
|
}
|
|
|
|
public PrincipalName getClientPrincipal() throws RealmException {
|
|
return cname;
|
|
}
|
|
|
|
public sun.security.krb5.Credentials setKrbCreds() {
|
|
// Note: We will not pass authorizationData to s.s.k.Credentials. The
|
|
// field in that class will be passed to Krb5Context as the return
|
|
// value of ExtendedGSSContext.inquireSecContext(KRB5_GET_AUTHZ_DATA),
|
|
// which is documented as the authData in the service ticket. That
|
|
// is on the acceptor side.
|
|
//
|
|
// This class is for the initiator side. Also, authdata inside a ccache
|
|
// is most likely to be the one in Authenticator in PA-TGS-REQ encoded
|
|
// in TGS-REQ, therefore only stored with a service ticket. Currently
|
|
// in Java, we only reads TGTs.
|
|
return new sun.security.krb5.Credentials(ticket, cname, null, sname,
|
|
null, key, flags, authtime, starttime, endtime, renewTill,
|
|
caddr);
|
|
}
|
|
|
|
public KerberosTime getStartTime() {
|
|
return starttime;
|
|
}
|
|
|
|
public KerberosTime getAuthTime() {
|
|
return authtime;
|
|
}
|
|
|
|
public KerberosTime getEndTime() {
|
|
return endtime;
|
|
}
|
|
|
|
public KerberosTime getRenewTill() {
|
|
return renewTill;
|
|
}
|
|
|
|
public TicketFlags getTicketFlags() {
|
|
return flags;
|
|
}
|
|
|
|
public int getEType() {
|
|
return key.getEType();
|
|
}
|
|
|
|
public EncryptionKey getKey() {
|
|
return key;
|
|
}
|
|
|
|
public int getTktEType() {
|
|
return ticket.encPart.getEType();
|
|
}
|
|
|
|
public int getTktEType2() {
|
|
return (secondTicket == null) ? 0 : secondTicket.encPart.getEType();
|
|
}
|
|
}
|