Java GSSUtil.isSpNegoMech方法代码示例

import sun.security.jgss.GSSUtil; //导入方法依赖的package包/类
private void doServicePermCheck() throws GSSException {
    if (System.getSecurityManager() != null) {
        String action = (isInitiator? "initiate" : "accept");
        // Need to check Service permission for accessing
        // initiator cred for SPNEGO during context establishment
        if (GSSUtil.isSpNegoMech(cStub.getMech()) && isInitiator
            && !isEstablished) {
            if (srcName == null) {
                // Check by creating default initiator KRB5 cred
                GSSCredElement tempCred =
                    new GSSCredElement(null, lifetime,
                                       GSSCredential.INITIATE_ONLY,
                                       GSSLibStub.getInstance(GSSUtil.GSS_KRB5_MECH_OID));
                tempCred.dispose();
            } else {
                String tgsName = Krb5Util.getTGSName(srcName);
                Krb5Util.checkServicePermission(tgsName, action);
            }
        }
        String targetStr = targetName.getKrbName();
        Krb5Util.checkServicePermission(targetStr, action);
        skipServicePermCheck = true;
    }
}
 

import sun.security.jgss.GSSUtil; //导入方法依赖的package包/类
NativeGSSContext(long pCtxt, GSSLibStub stub) throws GSSException {
    assert(pContext != 0);
    pContext = pCtxt;
    cStub = stub;

    // Set everything except cred, cb, delegatedCred
    long[] info = cStub.inquireContext(pContext);
    if (info.length != NUM_OF_INQUIRE_VALUES) {
        throw new RuntimeException("Bug w/ GSSLibStub.inquireContext()");
    }
    srcName = new GSSNameElement(info[0], cStub);
    targetName = new GSSNameElement(info[1], cStub);
    isInitiator = (info[2] != 0);
    isEstablished = (info[3] != 0);
    flags = (int) info[4];
    lifetime = (int) info[5];

    // Do Service Permission check when importing SPNEGO context
    // just to be safe
    Oid mech = cStub.getMech();
    if (GSSUtil.isSpNegoMech(mech) || GSSUtil.isKerberosMech(mech)) {
        doServicePermCheck();
    }
}
 

import sun.security.jgss.GSSUtil; //导入方法依赖的package包/类
private static Oid getNativeNameType(Oid nameType, GSSLibStub stub) {
    if (GSSUtil.NT_GSS_KRB5_PRINCIPAL.equals(nameType)) {
        Oid[] supportedNTs = null;
        try {
            supportedNTs = stub.inquireNamesForMech();
        } catch (GSSException ge) {
            if (ge.getMajor() == GSSException.BAD_MECH &&
                GSSUtil.isSpNegoMech(stub.getMech())) {
                // Workaround known Heimdal issue and retry with KRB5
                try {
                    stub = GSSLibStub.getInstance
                        (GSSUtil.GSS_KRB5_MECH_OID);
                    supportedNTs = stub.inquireNamesForMech();
                } catch (GSSException ge2) {
                    // Should never happen
                    SunNativeProvider.debug("Name type list unavailable: " +
                        ge2.getMajorString());
                }
            } else {
                SunNativeProvider.debug("Name type list unavailable: " +
                    ge.getMajorString());
            }
        }
        if (supportedNTs != null) {
            for (int i = 0; i < supportedNTs.length; i++) {
                if (supportedNTs[i].equals(nameType)) return nameType;
            }
            // Special handling the specified name type
            SunNativeProvider.debug("Override " + nameType +
                " with mechanism default(null)");
            return null; // Use mechanism specific default
        }
    }
    return nameType;
}
 

import sun.security.jgss.GSSUtil; //导入方法依赖的package包/类
public byte[] acceptSecContext(InputStream is, int mechTokenLen)
    throws GSSException {
    byte[] outToken = null;
    if ((!isEstablished) && (!isInitiator)) {
        byte[] inToken = retrieveToken(is, mechTokenLen);
        SunNativeProvider.debug("acceptSecContext=> inToken len=" +
                                inToken.length);
        long pCred = (cred == null? 0 : cred.pCred);
        outToken = cStub.acceptContext(pCred, cb, inToken, this);
        SunNativeProvider.debug("acceptSecContext=> outToken len=" +
                                (outToken == null? 0 : outToken.length));

        if (targetName == null) {
            targetName = new GSSNameElement
                (cStub.getContextName(pContext, false), cStub);
            // Replace the current default acceptor cred now that
            // the context acceptor name is available
            if (cred != null) cred.dispose();
            cred = new GSSCredElement(targetName, lifetime,
                                      GSSCredential.ACCEPT_ONLY, cStub);
        }

        // Only inspect token when the permission check has not
        // been performed
        if (GSSUtil.isSpNegoMech(cStub.getMech()) &&
            (outToken != null) && !skipServicePermCheck) {
            if (GSSUtil.isKerberosMech(getMechFromSpNegoToken
                                       (outToken, false))) {
                doServicePermCheck();
            }
        }
    }
    return outToken;
}
 

import sun.security.jgss.GSSUtil; //导入方法依赖的package包/类
public byte[] initSecContext(InputStream is, int mechTokenLen)
    throws GSSException {
    byte[] outToken = null;
    if ((!isEstablished) && (isInitiator)) {
        byte[] inToken = null;
        // Ignore the specified input stream on the first call
        if (pContext != 0) {
            inToken = retrieveToken(is, mechTokenLen);
            SunNativeProvider.debug("initSecContext=> inToken len=" +
                inToken.length);
        }

        if (!getCredDelegState()) skipDelegPermCheck = true;

        if (GSSUtil.isKerberosMech(cStub.getMech()) && !skipDelegPermCheck) {
            doDelegPermCheck();
        }

        long pCred = (cred == null? 0 : cred.pCred);
        outToken = cStub.initContext(pCred, targetName.pName,
                                     cb, inToken, this);
        SunNativeProvider.debug("initSecContext=> outToken len=" +
            (outToken == null ? 0 : outToken.length));

        // Only inspect the token when the permission check
        // has not been performed
        if (GSSUtil.isSpNegoMech(cStub.getMech()) && outToken != null) {
            // WORKAROUND for SEAM bug#6287358
            actualMech = getMechFromSpNegoToken(outToken, true);

            if (GSSUtil.isKerberosMech(actualMech)) {
                if (!skipServicePermCheck) doServicePermCheck();
                if (!skipDelegPermCheck) doDelegPermCheck();
            }
        }

        if (isEstablished) {
            if (srcName == null) {
                srcName = new GSSNameElement
                    (cStub.getContextName(pContext, true), cStub);
            }
            if (cred == null) {
                cred = new GSSCredElement(srcName, lifetime,
                                          GSSCredential.INITIATE_ONLY,
                                          cStub);
            }
        }
    }
    return outToken;
}