Java KerberosTicket.getServer方法代码示例

import javax.security.auth.kerberos.KerberosTicket; //导入方法依赖的package包/类
/**
 * Creates an instance of KerberosClientKeyExchange consisting of the
 * Kerberos service ticket, authenticator and encrypted premaster secret.
 * Called by client handshaker.
 *
 * @param serverName name of server with which to do handshake;
 *             this is used to get the Kerberos service ticket
 * @param protocolVersion Maximum version supported by client (i.e,
 *          version it requested in client hello)
 * @param rand random number generator to use for generating pre-master
 *          secret
 */
@Override
public void init(String serverName,
    AccessControlContext acc, ProtocolVersion protocolVersion,
    SecureRandom rand) throws IOException {

     // Get service ticket
     KerberosTicket ticket = getServiceTicket(serverName, acc);
     encodedTicket = ticket.getEncoded();

     // Record the Kerberos principals
     peerPrincipal = ticket.getServer();
     localPrincipal = ticket.getClient();

     // Optional authenticator, encrypted using session key,
     // currently ignored

     // Generate premaster secret and encrypt it using session key
     EncryptionKey sessionKey = new EncryptionKey(
                                    ticket.getSessionKeyType(),
                                    ticket.getSessionKey().getEncoded());

     preMaster = new KerberosPreMasterSecret(protocolVersion,
         rand, sessionKey);
}
 

import javax.security.auth.kerberos.KerberosTicket; //导入方法依赖的package包/类
ExchangerImpl(String serverName, AccessControlContext acc,
        ProtocolVersion protocolVersion, SecureRandom rand) throws IOException {

    // Get service ticket
    KerberosTicket ticket = getServiceTicket(serverName, acc);
    encodedTicket = ticket.getEncoded();

    // Record the Kerberos principals
    peerPrincipal = ticket.getServer();
    localPrincipal = ticket.getClient();

    // Optional authenticator, encrypted using session key,
    // currently ignored

    // Generate premaster secret and encrypt it using session key
    EncryptionKey sessionKey = new EncryptionKey(
            ticket.getSessionKeyType(),
            ticket.getSessionKey().getEncoded());

    preMaster = new KerberosPreMasterSecret(protocolVersion,
            rand, sessionKey);
}
 

import javax.security.auth.kerberos.KerberosTicket; //导入方法依赖的package包/类
/**
 * Get the Kerberos TGT
 * @return the user's TGT or null if none was found
 */
private synchronized KerberosTicket getTGT() {
  Set<KerberosTicket> tickets = 
    subject.getPrivateCredentials(KerberosTicket.class);
  for(KerberosTicket ticket: tickets) {
    KerberosPrincipal server = ticket.getServer();
    if (server.getName().equals("krbtgt/" + server.getRealm() + 
                                "@" + server.getRealm())) {
      if (LOG.isDebugEnabled()) {
        LOG.debug("Found tgt " + ticket);
      }
      return ticket;
    }
  }
  return null;
}
 

import javax.security.auth.kerberos.KerberosTicket; //导入方法依赖的package包/类
/**
 * Creates an instance of KerberosClientKeyExchange consisting of the
 * Kerberos service ticket, authenticator and encrypted premaster secret.
 * Called by client handshaker.
 *
 * @param serverName name of server with which to do handshake;
 *             this is used to get the Kerberos service ticket
 * @param protocolVersion Maximum version supported by client (i.e,
 *          version it requested in client hello)
 * @param rand random number generator to use for generating pre-master
 *          secret
 */
@Override
public void init(String serverName, boolean isLoopback,
    AccessControlContext acc, ProtocolVersion protocolVersion,
    SecureRandom rand) throws IOException {

     // Get service ticket
     KerberosTicket ticket = getServiceTicket(serverName, isLoopback, acc);
     encodedTicket = ticket.getEncoded();

     // Record the Kerberos principals
     peerPrincipal = ticket.getServer();
     localPrincipal = ticket.getClient();

     // Optional authenticator, encrypted using session key,
     // currently ignored

     // Generate premaster secret and encrypt it using session key
     EncryptionKey sessionKey = new EncryptionKey(
                                    ticket.getSessionKeyType(),
                                    ticket.getSessionKey().getEncoded());

     preMaster = new KerberosPreMasterSecret(protocolVersion,
         rand, sessionKey);
}
 

import javax.security.auth.kerberos.KerberosTicket; //导入方法依赖的package包/类
private synchronized KerberosTicket getTGT() {
    Set<KerberosTicket> tickets = subject.getPrivateCredentials(KerberosTicket.class);
    for(KerberosTicket ticket: tickets) {
        KerberosPrincipal server = ticket.getServer();
        if (server.getName().equals("krbtgt/" + server.getRealm() + "@" + server.getRealm())) {
            LOG.debug("Client principal is \"" + ticket.getClient().getName() + "\".");
            LOG.debug("Server principal is \"" + ticket.getServer().getName() + "\".");
            return ticket;
        }
    }
    return null;
}
 

import javax.security.auth.kerberos.KerberosTicket; //导入方法依赖的package包/类
private synchronized KerberosTicket getTGT() {
    Set<KerberosTicket> tickets = subject.getPrivateCredentials(KerberosTicket.class);
    for (KerberosTicket ticket : tickets) {
        KerberosPrincipal server = ticket.getServer();
        if (server.getName().equals("krbtgt/" + server.getRealm() + "@" + server.getRealm())) {
            log.debug("Found TGT with client principal '{}' and server principal '{}'.", ticket.getClient().getName(),
                    ticket.getServer().getName());
            return ticket;
        }
    }
    return null;
}
 

import javax.security.auth.kerberos.KerberosTicket; //导入方法依赖的package包/类
static Krb5InitCredential getInstance(GSSCaller caller, Krb5NameElement name,
                               int initLifetime)
    throws GSSException {

    KerberosTicket tgt = getTgt(caller, name, initLifetime);
    if (tgt == null)
        throw new GSSException(GSSException.NO_CRED, -1,
                               "Failed to find any Kerberos tgt");

    if (name == null) {
        String fullName = tgt.getClient().getName();
        name = Krb5NameElement.getInstance(fullName,
                                   Krb5MechFactory.NT_GSS_KRB5_PRINCIPAL);
    }

    return new Krb5InitCredential(name,
                                  tgt.getEncoded(),
                                  tgt.getClient(),
                                  tgt.getServer(),
                                  tgt.getSessionKey().getEncoded(),
                                  tgt.getSessionKeyType(),
                                  tgt.getFlags(),
                                  tgt.getAuthTime(),
                                  tgt.getStartTime(),
                                  tgt.getEndTime(),
                                  tgt.getRenewTill(),
                                  tgt.getClientAddresses());
}
 

import javax.security.auth.kerberos.KerberosTicket; //导入方法依赖的package包/类
private synchronized KerberosTicket getTGT() {
    Set<KerberosTicket> tickets = subject.getPrivateCredentials(KerberosTicket.class);
    for (KerberosTicket ticket : tickets) {
        KerberosPrincipal server = ticket.getServer();
        if (server.getName().equals("krbtgt/" + server.getRealm() + "@" + server.getRealm())) {
            log.debug("Found TGT {}.", ticket);
            return ticket;
        }
    }
    return null;
}
 

import javax.security.auth.kerberos.KerberosTicket; //导入方法依赖的package包/类
private synchronized KerberosTicket getTGT() {
    Set<KerberosTicket> tickets = subject.getPrivateCredentials(KerberosTicket.class);
    for(KerberosTicket ticket: tickets) {
        KerberosPrincipal server = ticket.getServer();
        if (server.getName().equals("krbtgt/" + server.getRealm() + "@" + server.getRealm())) {
            LOG.debug("Found tgt " + ticket + ".");
            return ticket;
        }
    }
    return null;
}
 

import javax.security.auth.kerberos.KerberosTicket; //导入方法依赖的package包/类
private KerberosTicket getTGT() {
    Set<KerberosTicket> tickets = loginContext.getSubject().getPrivateCredentials(KerberosTicket.class);
    for (KerberosTicket ticket : tickets) {
        KerberosPrincipal server = ticket.getServer();
        if (server.getName().equals("krbtgt/" + server.getRealm() + "@" + server.getRealm())) {
            log.debug("Found TGT with client principal '{}' and server principal '{}'.", ticket.getClient().getName(),
                    ticket.getServer().getName());
            return ticket;
        }
    }
    return null;
}
 

import javax.security.auth.kerberos.KerberosTicket; //导入方法依赖的package包/类
boolean isTargetPrincipal(KerberosTicket ticket, String remoteSvcPrincipal) {
    if (ticket == null) {
        return false;
    }

    KerberosPrincipal principal = ticket.getServer();
    if (LOG.isDebugEnabled()) {
        LOG.debug("KerberosAuthority:isTargetPrincipal: our princ=" + servicePrincipal + " ticket princ=" + principal.getName());
    }

    if (principal.getName().equals(remoteSvcPrincipal)) {
        return true;
    }
    return false;
}
 

import javax.security.auth.kerberos.KerberosTicket; //导入方法依赖的package包/类
private static KerberosTicket getTGT(Subject subject) {
    Set<KerberosTicket> tickets = subject.getPrivateCredentials(KerberosTicket.class);
    for (KerberosTicket ticket : tickets) {
        KerberosPrincipal server = ticket.getServer();
        if (server.getName().equals("krbtgt/" + server.getRealm() + "@" + server.getRealm())) {
            tickets = null;
            return ticket;
        }
    }
    tickets = null;
    return null;
}
 

import javax.security.auth.kerberos.KerberosTicket; //导入方法依赖的package包/类
private synchronized KerberosTicket getTGT() {
  Set<KerberosTicket> tickets = subject.getPrivateCredentials(KerberosTicket.class);
  for (KerberosTicket ticket : tickets) {
    KerberosPrincipal server = ticket.getServer();
    if (server.getName().equals("krbtgt/" + server.getRealm() + "@" + server.getRealm())) {
      log.debug("Found TGT with client principal '{}' and server principal '{}'.", ticket.getClient().getName(),
          ticket.getServer().getName());
      return ticket;
    }
  }
  return null;
}
 

import javax.security.auth.kerberos.KerberosTicket; //导入方法依赖的package包/类
/**
 * Get the Kerberos TGT, it purges old expired tickets from Subject
 * @return the user's TGT or null if none was found
 */
@VisibleForTesting
synchronized KerberosTicket getKerberosTicket() {
  KerberosTicket found = null;
  Set<KerberosTicket> expiredTickets = new HashSet<>();
  SortedSet<KerberosTicket> tickets = new TreeSet<>(new Comparator<KerberosTicket>() {
    @Override
    public int compare(KerberosTicket ticket1, KerberosTicket ticket2) {
      return Long.compare(ticket1.getEndTime().getTime(), ticket2.getEndTime().getTime());
    }
  });
  for (KerberosTicket ticket : getSubject().getPrivateCredentials(KerberosTicket.class)) {
    KerberosPrincipal principal = ticket.getServer();
    String principalName = Utils.format("krbtgt/{}@{}", principal.getRealm(), principal.getRealm());
    if (principalName.equals(principal.getName())) {
      if (ticket.getEndTime().getTime() < getTimeNow()) {
        // the ticket in question expired, we should remove it from the subject as it is useless
        expiredTickets.add(ticket);
        LOG.debug("Found expired Kerberos ticket '{}', will remove it", ticket.getServer().getName());
      }
      tickets.add(ticket);
    }
  }
  if (!tickets.isEmpty()) {
    // lets get the most recent ticket
    found = tickets.last();
    // take out the last ticket from expired tickets as we don' want to purge it as we want to renew that one
    // this should not really happen as we renew before the expire
    if (expiredTickets.contains(found)) {
      LOG.warn("Last Kerberos ticket '{}' already expired", found.getServer().getName());
      found = null;
    }
  }
  if (!expiredTickets.isEmpty()) {
    // removing expired tickets from subject
    getSubject().getPrivateCredentials().removeAll(expiredTickets);
    LOG.debug("Removed '{}' expired Kerberos tickets from SDC subject", expiredTickets.size());
  }
  return found;
}
 

import javax.security.auth.kerberos.KerberosTicket; //导入方法依赖的package包/类
private synchronized void initLoginContext() {
    if (loggedIn) {
        return;
    }

    try {
        LoginCallbackHandler callback = new LoginCallbackHandler(config.getSsoJaasPrincipalPassword());
        loginContext = new LoginContext(config.getSsoJaasConfigName(), callback);
        loginContext.login();

        loggedIn = true;

        Subject serviceSubject = loginContext.getSubject();

        for (KerberosTicket ticket : serviceSubject.getPrivateCredentials(KerberosTicket.class)) {
            log.info("AuthTime: " + ticket.getAuthTime());
            log.info("StartTime: " + ticket.getStartTime());
            log.info("EndTime: " + ticket.getEndTime());
            log.info("RenewTill: " + ticket.getRenewTill());

            KerberosPrincipal client = ticket.getClient();
            log.info("Client: name=" + client.getName() + ", realm=" + client.getRealm());

            KerberosPrincipal server = ticket.getServer();
            log.info("Server: name=" + server.getName() + ", realm=" + server.getRealm());
        }

    } catch (LoginException ex) {
        log.error(ex.getMessage(), ex);
    }
}