Java GSSException.NO_CRED屬性代碼示例

public static void main(String[] args) throws Exception {

        // msoid.txt is a NegTokenInit packet sent from Internet Explorer to
        // IIS server on a test machine. No sensitive info included.
        byte[] header = Files.readAllBytes(
                Paths.get(System.getProperty("test.src"), "msoid.txt"));
        byte[] token = Base64.getMimeDecoder().decode(
                Arrays.copyOfRange(header, 10, header.length));

        GSSCredential cred = null;
        GSSContext ctx = GSSManager.getInstance().createContext(cred);

        try {
            ctx.acceptSecContext(token, 0, token.length);
            // Before the fix, GSS_KRB5_MECH_OID_MS is not recognized
            // and acceptor chooses another mech and goes on
            throw new Exception("Should fail");
        } catch (GSSException gsse) {
            // After the fix, GSS_KRB5_MECH_OID_MS is recognized but the token
            // cannot be accepted because we don't have any krb5 credential.
            gsse.printStackTrace();
            if (gsse.getMajor() != GSSException.NO_CRED) {
                throw gsse;
            }
            for (StackTraceElement st: gsse.getStackTrace()) {
                if (st.getClassName().startsWith("sun.security.jgss.krb5.")) {
                    // Good, it is already in krb5 mech's hand.
                    return;
                }
            }
            throw gsse;
        }
    }
 

@Override
public Header authenticate(
                            final Credentials credentials,
                            final HttpRequest request,
                            final HttpContext context ) throws AuthenticationException {

    if (request == null) {
        throw new IllegalArgumentException("HTTP request may not be null");
    }
    switch (state) {
        case UNINITIATED:
            throw new AuthenticationException(getSchemeName() + " authentication has not been initiated");
        case FAILED:
            throw new AuthenticationException(getSchemeName() + " authentication has failed");
        case CHALLENGE_RECEIVED:
            try {
                token = generateToken(token);
                state = State.TOKEN_GENERATED;
            } catch (GSSException gsse) {
                state = State.FAILED;
                if (gsse.getMajor() == GSSException.DEFECTIVE_CREDENTIAL
                    || gsse.getMajor() == GSSException.CREDENTIALS_EXPIRED)
                    throw new InvalidCredentialsException(gsse.getMessage(), gsse);
                if (gsse.getMajor() == GSSException.NO_CRED)
                    throw new InvalidCredentialsException(gsse.getMessage(), gsse);
                if (gsse.getMajor() == GSSException.DEFECTIVE_TOKEN
                    || gsse.getMajor() == GSSException.DUPLICATE_TOKEN
                    || gsse.getMajor() == GSSException.OLD_TOKEN)
                    throw new AuthenticationException(gsse.getMessage(), gsse);
                // other error
                throw new AuthenticationException(gsse.getMessage());
            }
            // continue to next case block
        case TOKEN_GENERATED:
            String tokenstr = new String(base64codec.encode(token));
            if (log.isDebugEnabled()) {
                log.debug("Sending response '" + tokenstr + "' back to the auth server");
            }
            return new BasicHeader("Authorization", "Negotiate " + tokenstr);
        default:
            throw new IllegalStateException("Illegal state: " + state);
    }
}
 

@Override
public Header authenticate(
        final Credentials credentials,
        final HttpRequest request,
        final HttpContext context) throws AuthenticationException {
    if (request == null) {
        throw new IllegalArgumentException("HTTP request may not be null");
    }
    switch (state) {
    case UNINITIATED:
        throw new AuthenticationException(getSchemeName() + " authentication has not been initiated");
    case FAILED:
        throw new AuthenticationException(getSchemeName() + " authentication has failed");
    case CHALLENGE_RECEIVED:
        try {
            String key = null;
            if (isProxy()) {
                key = ExecutionContext.HTTP_PROXY_HOST;
            } else {
                key = ExecutionContext.HTTP_TARGET_HOST;
            }
            HttpHost host = (HttpHost) context.getAttribute(key);
            if (host == null) {
                throw new AuthenticationException("Authentication host is not set " +
                        "in the execution context");
            }
            String authServer;
            if (!this.stripPort && host.getPort() > 0) {
                authServer = host.toHostString();
            } else {
                authServer = host.getHostName();
            }

            if (log.isDebugEnabled()) {
                log.debug("init " + authServer);
            }
            token = generateToken(token, authServer);
            state = State.TOKEN_GENERATED;
        } catch (GSSException gsse) {
            state = State.FAILED;
            if (gsse.getMajor() == GSSException.DEFECTIVE_CREDENTIAL
                    || gsse.getMajor() == GSSException.CREDENTIALS_EXPIRED)
                throw new InvalidCredentialsException(gsse.getMessage(), gsse);
            if (gsse.getMajor() == GSSException.NO_CRED )
                throw new InvalidCredentialsException(gsse.getMessage(), gsse);
            if (gsse.getMajor() == GSSException.DEFECTIVE_TOKEN
                    || gsse.getMajor() == GSSException.DUPLICATE_TOKEN
                    || gsse.getMajor() == GSSException.OLD_TOKEN)
                throw new AuthenticationException(gsse.getMessage(), gsse);
            // other error
            throw new AuthenticationException(gsse.getMessage());
        }
    case TOKEN_GENERATED:
        String tokenstr = new String(base64codec.encode(token));
        if (log.isDebugEnabled()) {
            log.debug("Sending response '" + tokenstr + "' back to the auth server");
        }
        return new BasicHeader("Authorization", "Negotiate " + tokenstr);
    default:
        throw new IllegalStateException("Illegal state: " + state);
    }
}
 

/**
 * Produces Negotiate authorization string based on token created by 
 * processChallenge.
 * 
 * @param credentials Never used be the Negotiate scheme but must be provided to 
 * satisfy common-httpclient API. Credentials from JAAS will be used insted.
 * @param method The method being authenticated
 * 
 * @throws AuthenticationException if authorization string cannot 
 *   be generated due to an authentication failure
 * 
 * @return an Negotiate authorization string
 * 
 * @since 3.0
 */
public String authenticate(
    Credentials credentials, 
    HttpMethod method
) throws AuthenticationException {
    LOG.debug("enter NegotiateScheme.authenticate(Credentials, HttpMethod)");

    if (state == UNINITIATED) {
        throw new IllegalStateException(
           "Negotiation authentication process has not been initiated");
    }

    try {
        try {                
            if(context==null) {
                LOG.info("host: " + method.getURI().getHost());
                init( method.getURI().getHost() );
            }
        } catch (org.apache.commons.httpclient.URIException urie) {
            LOG.error(urie.getMessage());
            state = FAILED;
            throw new AuthenticationException(urie.getMessage());
        }
    
        // HTTP 1.1 issue:
        // Mutual auth will never complete do to 200 insted of 401 in 
        // return from server. "state" will never reach ESTABLISHED
        // but it works anyway
        token = context.initSecContext(token, 0, token.length);
        LOG.info("got token, sending " + token.length + " to server");
    } catch (GSSException gsse) {
        LOG.fatal(gsse.getMessage());
        state = FAILED;
        if( gsse.getMajor() == GSSException.DEFECTIVE_CREDENTIAL
                || gsse.getMajor() == GSSException.CREDENTIALS_EXPIRED )
            throw new InvalidCredentialsException(gsse.getMessage(),gsse);
        if( gsse.getMajor() == GSSException.NO_CRED )
            throw new CredentialsNotAvailableException(gsse.getMessage(),gsse);
        if( gsse.getMajor() == GSSException.DEFECTIVE_TOKEN
                || gsse.getMajor() == GSSException.DUPLICATE_TOKEN
                || gsse.getMajor() == GSSException.OLD_TOKEN )
            throw new AuthChallengeException(gsse.getMessage(),gsse);
        // other error
        throw new AuthenticationException(gsse.getMessage());
    }
    return "Negotiate " + new String(new Base64().encode(token));
}
 

@Override
public Header authenticate(
        final Credentials credentials,
        final HttpRequest request,
        final HttpContext context) throws AuthenticationException {
    Args.notNull(request, "HTTP request");
    switch (state) {
    case UNINITIATED:
        throw new AuthenticationException(getSchemeName() + " authentication has not been initiated");
    case FAILED:
        throw new AuthenticationException(getSchemeName() + " authentication has failed");
    case CHALLENGE_RECEIVED:
        try {
            final HttpRoute route = (HttpRoute) context.getAttribute(HttpClientContext.HTTP_ROUTE);
            if (route == null) {
                throw new AuthenticationException("Connection route is not available");
            }
            HttpHost host;
            if (isProxy()) {
                host = route.getProxyHost();
                if (host == null) {
                    host = route.getTargetHost();
                }
            } else {
                host = route.getTargetHost();
            }
            final String authServer;
            if (!this.stripPort && host.getPort() > 0) {
                authServer = host.toHostString();
            } else {
                authServer = host.getHostName();
            }

            if (log.isDebugEnabled()) {
                log.debug("init " + authServer);
            }
            token = generateToken(token, authServer);
            state = State.TOKEN_GENERATED;
        } catch (final GSSException gsse) {
            state = State.FAILED;
            if (gsse.getMajor() == GSSException.DEFECTIVE_CREDENTIAL
                    || gsse.getMajor() == GSSException.CREDENTIALS_EXPIRED) {
                throw new InvalidCredentialsException(gsse.getMessage(), gsse);
            }
            if (gsse.getMajor() == GSSException.NO_CRED ) {
                throw new InvalidCredentialsException(gsse.getMessage(), gsse);
            }
            if (gsse.getMajor() == GSSException.DEFECTIVE_TOKEN
                    || gsse.getMajor() == GSSException.DUPLICATE_TOKEN
                    || gsse.getMajor() == GSSException.OLD_TOKEN) {
                throw new AuthenticationException(gsse.getMessage(), gsse);
            }
            // other error
            throw new AuthenticationException(gsse.getMessage());
        }
    case TOKEN_GENERATED:
        final String tokenstr = new String(base64codec.encode(token));
        if (log.isDebugEnabled()) {
            log.debug("Sending response '" + tokenstr + "' back to the auth server");
        }
        final CharArrayBuffer buffer = new CharArrayBuffer(32);
        if (isProxy()) {
            buffer.append(AUTH.PROXY_AUTH_RESP);
        } else {
            buffer.append(AUTH.WWW_AUTH_RESP);
        }
        buffer.append(": Negotiate ");
        buffer.append(tokenstr);
        return new BufferedHeader(buffer);
    default:
        throw new IllegalStateException("Illegal state: " + state);
    }
}