Java Credentials类代码示例

import sun.security.krb5.internal.ccache.Credentials; //导入依赖的package包/类
/**
 * Put TGS credentials ticket in cache file to persist credentials.
 *
 * @param tgsCredentials TGS credentials
 * @throws KrbException 
 * @throws IOException 
 */
public static void putInCache(sun.security.krb5.Credentials tgsCredentials)
    throws KrbException, IOException {

  CredentialsCache cache = CredentialsCache.getInstance();
  Credentials ccreds = new sun.security.krb5.internal.ccache.Credentials(
      tgsCredentials.getClient(),
      tgsCredentials.getServer(),
      tgsCredentials.getSessionKey(),
      new KerberosTime(tgsCredentials.getAuthTime()),
      /*new KerberosTime(tgsCredentials.getStartTime())*/ null,
      new KerberosTime(tgsCredentials.getEndTime()),
      /*new KerberosTime(receivedCredentials.getRenewTill())*/ null,
      false,
      tgsCredentials.getTicketFlags(),
      /*new HostAddresses(receivedCredentials.getClientAddresses())*/ null,
      null,
      tgsCredentials.getTicket(),
      null);
  cache.update(ccreds);
  cache.save();

}
 

import sun.security.krb5.internal.ccache.Credentials; //导入依赖的package包/类
public static void main(String[] args) throws Exception {
    System.setProperty("sun.security.krb5.debug", "true");  // test code changes in DEBUG
    CCacheInputStream cis = new CCacheInputStream(new ByteArrayInputStream(ccache));
    cis.readVersion();
    cis.readTag();
    cis.readPrincipal(0x504);
    Method m = CCacheInputStream.class.getDeclaredMethod("readCred", Integer.TYPE);
    m.setAccessible(true);
    Credentials c = (Credentials) m.invoke(cis, new Integer(0x504));
    sun.security.krb5.Credentials cc = c.setKrbCreds();

    // 1. Make sure starttime is still null
    if (cc.getStartTime() != null) {
        throw new Exception("Fail, starttime should be zero here");
    }

    // 2. Make sure renewTill is still null
    if (cc.getRenewTill() != null) {
        throw new Exception("Fail, renewTill should be zero here");
    }

    // 3. Make sure isValid works
    c.isValid();
}
 

import sun.security.krb5.internal.ccache.Credentials; //导入依赖的package包/类
public static void main(String[] args) {
  try {
    String userNamePrincipal = "[email protected]";
    Credentials tgtCredentials = getTGT("/etc/bob.keytab", userNamePrincipal);
    putInCache(userNamePrincipal, tgtCredentials);
    sun.security.krb5.Credentials tgsCredentials = getTGS(
        "host/[email protected]"
    );
    putInCache(tgsCredentials);
    cleanCache();
  } catch (Exception e) {
    e.printStackTrace();
  }
}
 

import sun.security.krb5.internal.ccache.Credentials; //导入依赖的package包/类
/**
 * Get a Ticket Granting Ticket (TGT) from Authentication Server (AS) with required keytab file.
 *
 * 1. Create and send AS-REQ
 * 2. Receive KRB ERROR (PRE-AUTH is mandatory in Kerberos v5)
 * 3. Re-send AS-REQ
 * 4. Receive AS-REP
 * 5. Return TGT credentials ticket in Java object
 *
 * @param keytabFileName Path file name to keytab (required already on disk storage, for instance
 *                       /etc/bob.keytab)
 * @param userName user name principal (UPN) (ex: [email protected])
 * @param realm Kerberos domain of the Authentication Server (ex: EXAMPLE.COM)
 * @return TGT credentials
 * @throws KrbException
 * @throws IOException
 *
 * Note: 
 * - For system administrator it is like the command: kinit -kt keytab upn 
 * - [WARNING] dependencies with internal proprietary API and may be removed in a future release
 */
public static Credentials getTGT(String keytabFileName, String userName, String realm)
    throws KrbException, IOException {

  KrbAsReqBuilder builder = null;
  try {

    PrincipalName userPrincipalName = new PrincipalName(userName);
    KeyTab keyTab = KeyTab.getInstance(new File(keytabFileName));
    builder = new KrbAsReqBuilder(userPrincipalName, keyTab);

    PrincipalName tgsPrincipalName = PrincipalName.tgsService(realm, realm);
    builder.setTarget(tgsPrincipalName);

    // see http://hg.openjdk.java.net/jdk8/jdk8/jdk/file/default/src/share/classes/sun/security/krb5/KdcComm.java#l145
    // for default parameters (timeout, max retries ...)
    builder.action();

    Credentials tgtCredentials = builder.getCCreds();
    if (DEBUG) {
      System.out.println(">>>TGT credentials : " +
          ReflectionToStringBuilder.toString(tgtCredentials));
    }
    return tgtCredentials;

  } finally {

    if (builder != null) {
      builder.destroy();
    }

  }

}
 

import sun.security.krb5.internal.ccache.Credentials; //导入依赖的package包/类
@Test
public void test01getTGT() {
  try {
    Credentials tgtCredentials = getTGT("/etc/bob.keytab", "[email protected]");
    assertEquals(
        "krbtgt/[email protected]",
        tgtCredentials.getServicePrincipal().toString()
    );
    KerberosTicketManager.putInCache("[email protected]", tgtCredentials);
  } catch (KrbException | IOException e) {
    e.printStackTrace();
  }
}
 

import sun.security.krb5.internal.ccache.Credentials; //导入依赖的package包/类
@Test
public void test02getTGS() {
  try {
    sun.security.krb5.Credentials tgsCredentials = getTGS(
        "host/[email protected]");
    assertEquals(
        "host/[email protected]",
        tgsCredentials.getServer().toString()
    );
    KerberosTicketManager.putInCache(tgsCredentials);
  } catch (KrbException | IOException e) {
    e.printStackTrace();
  }
}
 

import sun.security.krb5.internal.ccache.Credentials; //导入依赖的package包/类
@Test
public void test03checkCache() {
  try {
    CredentialsCache cache = KerberosTicketManager.getCache();
    Credentials[] credentials = cache.getCredsList();
    assertEquals(2, credentials.length);
    assertEquals("krbtgt/[email protected]",
        credentials[0].getServicePrincipal().toString());
    assertEquals("host/[email protected]",
        credentials[1].getServicePrincipal().toString());
  } catch (RealmException e) {
    e.printStackTrace();
  }
}
 

import sun.security.krb5.internal.ccache.Credentials; //导入依赖的package包/类
static void checkKinit(
        String s1,      // ticket_lifetime in krb5.conf, null if none
        String s2,      // renew_lifetime in krb5.conf, null if none
        String c1,      // -l on kinit, null if none
        String c2,      // -r on kinit, null if none
        int t1, int t2  // expected lifetimes, -1 of unexpected
            ) throws Exception {
    KDC.saveConfig(OneKDC.KRB5_CONF, kdc,
            s1 != null ? ("ticket_lifetime = " + s1) : "",
            s2 != null ? ("renew_lifetime = " + s2) : "");
    Proc p = Proc.create(clazz);
    if (c1 != null) {
        p.args("-l", c1);
    }
    if (c2 != null) {
        p.args("-r", c2);
    }
    count++;
    p.args(OneKDC.USER, new String(OneKDC.PASS))
            .inheritIO()
            .prop("jdk.net.hosts.file", hostsFileName)
            .prop("java.security.krb5.conf", OneKDC.KRB5_CONF)
            .env("KRB5CCNAME", "ccache" + count)
            .start();
    if (p.waitFor() != 0) {
        throw new Exception();
    }
    FileCredentialsCache fcc =
            FileCredentialsCache.acquireInstance(null, "ccache" + count);
    Credentials cred = fcc.getDefaultCreds();
    checkRough(cred.getEndTime().toDate(), t1);
    if (cred.getRenewTill() == null) {
        checkRough(null, t2);
    } else {
        checkRough(cred.getRenewTill().toDate(), t2);
    }
}
 

import sun.security.krb5.internal.ccache.Credentials; //导入依赖的package包/类
public static void main(String[] args) throws Exception {
    // A trivial cache file, with startdate and renewTill being zero.
    // The endtime is set to sometime in year 2022, so that isValid()
    // will always check starttime.
    byte[] ccache = new byte[]{
        5, 4, 0, 12, 0, 1, 0, 8, -1, -1, -1, 19, -1, -2, 89, 51,
        0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 10, 77, 65, 88, 73,
        46, 76, 79, 67, 65, 76, 0, 0, 0, 5, 100, 117, 109, 109, 121, 0,
        0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 10, 77, 65, 88, 73, 46,
        76, 79, 67, 65, 76, 0, 0, 0, 5, 100, 117, 109, 109, 121, 0, 0,
        0, 0, 0, 0, 0, 2, 0, 0, 0, 10, 77, 65, 88, 73, 46, 76,
        79, 67, 65, 76, 0, 0, 0, 6, 107, 114, 98, 116, 103, 116, 0, 0,
        0, 10, 77, 65, 88, 73, 46, 76, 79, 67, 65, 76, 0, 17, 0, 0,
        0, 16, -78, -85, -90, -50, -68, 115, 68, 8, -39, -109, 91, 61, -17, -27,
        -122, -120, 71, 69, 16, -121, 0, 0, 0, 0, 98, 69, 16, -121, 0, 0,
        0, 0, 0, 64, -32, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
        0, 1, 0, 97, -127, -3, 48, -127, -6, -96, 3, 2, 1, 5, -95, 12,
        27, 10, 77, 65, 88, 73, 46, 76, 79, 67, 65, 76, -94, 31, 48, 29,
        -96, 3, 2, 1, 0, -95, 22, 48, 20, 27, 6, 107, 114, 98, 116, 103,
        116, 27, 10, 77, 65, 88, 73, 46, 76, 79, 67, 65, 76, -93, -127, -61,
        48, -127, -64, -96, 3, 2, 1, 17, -95, 3, 2, 1, 1, -94, -127, -77,
        4, -127, -80, 43, 65, -66, 34, 21, -34, 37, 35, 32, 50, -14, 122, 77,
        -3, -29, 37, 99, 50, 125, -43, -96, -78, 85, 23, 41, -80, 68, 2, -109,
        -27, 38, -41, -72, -32, 127, 63, -76, -22, 81, 33, -114, -30, 104, 125, -81,
        -29, 70, -25, 23, 100, -75, -25, 62, -120, -78, -61, -100, -74, 50, -117, -127,
        -16, 79, -106, 62, -39, 91, 100, -10, 23, -88, -18, -47, 51, -19, 113, 18,
        98, -101, 31, 98, 22, -81, 11, -41, -42, 67, 87, 92, -2, 42, -54, 79,
        49, -90, 43, -37, 90, -102, 125, 62, -88, -77, 100, 102, 23, -57, -51, 38,
        68, -44, -57, -102, 103, -6, 85, -58, 74, -117, -87, 67, -103, -36, 110, -122,
        115, 12, 118, -106, -114, -51, 79, 68, 32, -91, -53, -5, -51, 89, 72, 70,
        123, -12, -95, 9, 40, -30, -117, 74, 77, 38, 91, 126, -82, 17, 98, 98,
        -49, 78, 36, 36, 103, -76, -100, -23, 118, -92, -8, 80, 103, -23, -98, 56,
        21, 65, -77, 0, 0, 0, 0
    };
    System.setProperty("sun.security.krb5.debug", "true");  // test code changes in DEBUG
    CCacheInputStream cis = new CCacheInputStream(new ByteArrayInputStream(ccache));
    cis.readVersion();
    cis.readTag();
    cis.readPrincipal(0x504);
    Method m = CCacheInputStream.class.getDeclaredMethod("readCred", Integer.TYPE);
    m.setAccessible(true);
    Credentials c = (Credentials) m.invoke(cis, new Integer(0x504));
    sun.security.krb5.Credentials cc = c.setKrbCreds();

    // 1. Make sure starttime is still null
    if (cc.getStartTime() != null) {
        throw new Exception("Fail, starttime should be zero here");
    }

    // 2. Make sure renewTill is still null
    if (cc.getRenewTill() != null) {
        throw new Exception("Fail, renewTill should be zero here");
    }

    // 3. Make sure isValid works
    c.isValid();
}
 

import sun.security.krb5.internal.ccache.Credentials; //导入依赖的package包/类
/**
 * Get a Ticket Granting Service (TGS) from Ticket Granting Server (TGS) required TGT.
 * 
 * 1. Create and send TGS-REQ
 * 2. Receive TGS-REP
 * 3. Return TGS credentials ticket in Java object
 * 
 * @param serviceName service name principal (SPN) (ex: host/[email protected])
 * @return TGS credentials
 * @throws KrbException
 * @throws IOException
 * 
 * Note: 
 * - For system administrator it is like the command: kvno spn
 */
public static sun.security.krb5.Credentials getTGS(String serviceName)
    throws KrbException, IOException {

  PrincipalName servicePrincipalName = new PrincipalName(serviceName);
  sun.security.krb5.Credentials credentials = sun.security.krb5.Credentials.acquireDefaultCreds();
  KrbTgsReq tgsReq = new KrbTgsReq(credentials, servicePrincipalName);
  sun.security.krb5.Credentials tgsCredentials = tgsReq.sendAndGetCreds();
  if (DEBUG) {
    System.out.println(">>>TGS credentials : " +
        ReflectionToStringBuilder.toString(tgsCredentials));
  }
  return tgsCredentials;
}