Java AuthorizationData类代码示例

import sun.security.krb5.internal.AuthorizationData; //导入依赖的package包/类
@Override
public Object inquireSecContext(InquireType type) throws GSSException {
    SecurityManager security = System.getSecurityManager();
    if (security != null) {
        security.checkPermission(
                new InquireSecContextPermission(type.toString()));
    }
    Object output = super.inquireSecContext(type.name());
    if (output != null) {
        if (type == InquireType.KRB5_GET_AUTHZ_DATA) {
            AuthorizationData ad = (AuthorizationData) output;
            AuthorizationDataEntry[] authzData =
                    new AuthorizationDataEntry[ad.count()];
            for (int i = 0; i < ad.count(); i++) {
                authzData[i] = new AuthorizationDataEntry(
                        ad.item(i).adType, ad.item(i).adData);
            }
            output = authzData;
        }
    }
    return output;
}
 

import sun.security.krb5.internal.AuthorizationData; //导入依赖的package包/类
private Map<String, Object> decodeAuthorizationData(AuthorizationData authorizationData) throws Exception{
	Map<String, Object> clientDetailsFromPac = new HashMap<String, Object>();
	//Iterate through the authorizationData and find adData with adType = AD-IF-RELEVANT (1) - see RFC 4210 section 7.5.4
	for( int i = 0; i < authorizationData.count(); i++) {
		if (authorizationData.item(i).adType == 1){
			DerInputStream adDataStream = new DerInputStream(authorizationData.item(i).adData);
			DerValue[] values = adDataStream.getSet(authorizationData.item(i).adData.length, true);
			//values[0] contains authorizationData entry with adType = AD-WIN2k-PAC (128) - see RFC 4210 section 7.5.4
			DerValue pacDerValue = values[0];
			AuthorizationDataEntry pacAuthorizationDataEntry = new AuthorizationDataEntry(pacDerValue);
			if (pacAuthorizationDataEntry.adType != 128){
				throw new IOException("PAC not found within authorization data as expected. Was expecting adType=128 (AD-WIN2K-PAC) within AD-IF-RELEVANT");
			}
			Pac pac = new Pac(pacAuthorizationDataEntry.adData, this.serverPrivateKey);
			clientDetailsFromPac.put("pac", pac);
			clientDetailsFromPac.put("fullName", pac.getFullName());
			clientDetailsFromPac.put("groupMemberships", pac.getGroupMemberships());
			clientDetailsFromPac.put("homeDirectory", pac.getHomeDirectory());
			clientDetailsFromPac.put("groupCount", pac.getiGroupCount());
			clientDetailsFromPac.put("kdc", pac.getKdc());
			clientDetailsFromPac.put("logonCount", pac.getLogonCount());
			clientDetailsFromPac.put("logonDomainName", pac.getLogonDomainName());
			clientDetailsFromPac.put("passwordExpiryDateTime", pac.getPasswordExpiresDateTime());
			clientDetailsFromPac.put("passwordSetDateTime", pac.getPasswordSetDateTime());
			clientDetailsFromPac.put("primaryGroup", pac.getPrimaryGroup());
			clientDetailsFromPac.put("profilePath", pac.getProfilePath());
		}
	}
	return clientDetailsFromPac;
}
 

import sun.security.krb5.internal.AuthorizationData; //导入依赖的package包/类
/**
 * For the context acceptor to call. It reads the bytes out of an
 * InputStream and constructs an InitSecContextToken with them.
 */
InitSecContextToken(Krb5Context context, Krb5AcceptCredential cred,
                           InputStream is)
    throws IOException, GSSException, KrbException  {

    int tokenId = ((is.read()<<8) | is.read());

    if (tokenId != Krb5Token.AP_REQ_ID)
        throw new GSSException(GSSException.DEFECTIVE_TOKEN, -1,
                               "AP_REQ token id does not match!");

    // XXX Modify KrbApReq cons to take an InputStream
    byte[] apReqBytes =
        new sun.security.util.DerValue(is).toByteArray();
    //debug("=====ApReqBytes: [" + getHexBytes(apReqBytes) + "]\n");

    InetAddress addr = null;
    if (context.getChannelBinding() != null) {
        addr = context.getChannelBinding().getInitiatorAddress();
    }
    apReq = new KrbApReq(apReqBytes, cred, addr);
    //debug("\nReceived AP-REQ and authenticated it.\n");

    EncryptionKey sessionKey = apReq.getCreds().getSessionKey();

    /*
      System.out.println("\n\nSession key from service ticket is: " +
      getHexBytes(sessionKey.getBytes()));
    */

    EncryptionKey subKey = apReq.getSubKey();
    if (subKey != null) {
        context.setKey(Krb5Context.INITIATOR_SUBKEY, subKey);
        /*
          System.out.println("Sub-Session key from authenticator is: " +
          getHexBytes(subKey.getBytes()) + "\n");
        */
    } else {
        context.setKey(Krb5Context.SESSION_KEY, sessionKey);
        //System.out.println("Sub-Session Key Missing in Authenticator.\n");
    }

    OverloadedChecksum gssChecksum = new OverloadedChecksum(
            context, apReq.getChecksum(), sessionKey, subKey);
    gssChecksum.setContextFlags(context);
    Credentials delegCred = gssChecksum.getDelegatedCreds();
    if (delegCred != null) {
        Krb5CredElement credElement =
            Krb5InitCredential.getInstance(
                               (Krb5NameElement)context.getSrcName(),
                               delegCred);
        context.setDelegCred(credElement);
    }

    Integer apReqSeqNumber = apReq.getSeqNumber();
    int peerSeqNumber = (apReqSeqNumber != null ?
                         apReqSeqNumber.intValue() :
                         0);
    context.resetPeerSequenceNumber(peerSeqNumber);
    if (!context.getMutualAuthState())
        // Use the same sequence number as the peer
        // (Behaviour exhibited by the Windows SSPI server)
        context.resetMySequenceNumber(peerSeqNumber);
    context.setAuthTime(
            new KerberosTime(apReq.getCreds().getAuthTime()).toString());
    context.setTktFlags(apReq.getCreds().getFlags());
    AuthorizationData ad = apReq.getCreds().getAuthzData();
    context.setAuthzData(ad);
}
 

import sun.security.krb5.internal.AuthorizationData; //导入依赖的package包/类
public void setAuthzData(AuthorizationData authzData) {
    this.authzData = authzData;
}