OpenJDK 27 · com.sun.security.auth.module.KeyStoreLoginModule

Provides a JAAS login module that prompts for a key store alias and populates the subject with the alias's principal and credentials. Stores an X500Principal for the subject distinguished name of the first certificate in the alias's credentials in the subject's principals, the alias's certificate path in the subject's public credentials, and a X500PrivateCredential whose certificate is the first certificate in the alias's certificate path and whose private key is the alias's private key in the subject's private credentials.

Recognizes the following options in the configuration file:

keyStoreURL: A URL that specifies the location of the key store. Defaults to a URL pointing to the .keystore file in the directory specified by the user.home system property. The input stream from this URL is passed to the KeyStore.load method. "NONE" may be specified if a null stream must be passed to the KeyStore.load method. "NONE" should be specified if the KeyStore resides on a hardware token device, for example.
keyStoreType: The key store type. If not specified, defaults to the result of calling KeyStore.getDefaultType(). If the type is "PKCS11", then keyStoreURL must be "NONE" and privateKeyPasswordURL must not be specified.
keyStoreProvider: The key store provider. If not specified, uses the standard search order to find the provider.
keyStoreAlias: The alias in the key store to login as. Required when no callback handler is provided. No default value.
keyStorePasswordURL: A URL that specifies the location of the key store password. Required when no callback handler is provided and protected is false. No default value.
privateKeyPasswordURL: A URL that specifies the location of the specific private key password needed to access the private key for this alias. The keystore password is used if this value is needed and not specified.
protected: This value should be set to "true" if the KeyStore has a separate, protected authentication path (for example, a dedicated PIN-pad attached to a smart card). Defaults to "false". If "true" keyStorePasswordURL and privateKeyPasswordURL must not be specified.

Field Summary

Modifier and Type	Field and Description
private static final int	AUTHENTICATED
private static final TextOutputCallback	bannerCallback
private CallbackHandler	callbackHandler
private CertPath	certP
private final ConfirmationCallback	confirmationCallback
private boolean	debug
private Certificate[]	fromKeyStore
private static final int	INITIALIZED
private KeyStore	keyStore
private String	keyStoreAlias
private char[]	keyStorePassword
private String	keyStorePasswordURL
private String	keyStoreProvider
private String	keyStoreType
private String	keyStoreURL
private static final int	LOGGED_IN
private static final String	NONE
private static final int	NORMAL
private boolean	nullStream
private Map<String, ?>	options
private static final String	P11KEYSTORE
private X500Principal	principal
private X500PrivateCredential	privateCredential
private char[]	privateKeyPassword
private String	privateKeyPasswordURL
private static final int	PROTECTED_PATH
private boolean	protectedPath
private Map<String, Object>	sharedState
private int	status
private Subject	subject
private static final int	TOKEN
private boolean	token
private static final int	UNINITIALIZED

Constructor Summary

Access	Constructor and Description
public	KeyStoreLoginModule() Creates a `KeyStoreLoginModule`.

Method Summary

Modifier and Type	Method and Description
public boolean	Returns: false if this LoginModule's own login and/or commit attempts failed, and true otherwise. abort() Implements javax.security.auth.spi.LoginModule.abort. This method is called if the LoginContext's overall authentication failed.
private void	checkAlias()
private void	checkKeyPass()
private void	checkStorePass()
public boolean	Returns: true if this LoginModule's own login and commit attempts succeeded, or false otherwise. commit() Implements javax.security.auth.spi.LoginModule.commit. Abstract method to commit the authentication process (phase 2).
private boolean	commitInternal()
private void	debugPrint(String message)
private void	getAliasAndPasswords(int env) Get the alias and passwords to use for looking up in the KeyStore.
private void	getKeyStoreInfo() Get the credentials from the KeyStore.
public void	initialize(Subject the `Subject` to be authenticated. subject, CallbackHandler a `CallbackHandler` for communicating with the end user (prompting for usernames and passwords, for example), which may be `null`. callbackHandler, Map<String, ?> shared `LoginModule` state. sharedState, Map<String, ?> options specified in the login `Configuration` for this particular `LoginModule`. options) Implements javax.security.auth.spi.LoginModule.initialize. Initialize this `LoginModule`.
public boolean	Returns: true in all cases (this `LoginModule` should not be ignored). login() Implements javax.security.auth.spi.LoginModule.login. Authenticate the user.
public boolean	Returns: true in all cases since this `LoginModule` should not be ignored. logout() Implements javax.security.auth.spi.LoginModule.logout. Logout a user.
private void	logoutInternal()
private static URL	newURL(String spec)
private void	processOptions()
private void	prompt(NameCallback aliasCallback, PasswordCallback storePassCallback, PasswordCallback keyPassCallback)
private void	saveAlias(NameCallback cb)
private void	saveKeyPass(PasswordCallback c)
private void	saveStorePass(PasswordCallback c)

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

AUTHENTICATED	back to summary
private static final int AUTHENTICATED

bannerCallback	back to summary
private static final TextOutputCallback bannerCallback

callbackHandler	back to summary
private CallbackHandler callbackHandler

certP	back to summary
private CertPath certP

confirmationCallback	back to summary
private final ConfirmationCallback confirmationCallback

debug	back to summary
private boolean debug

fromKeyStore	back to summary
private Certificate[] fromKeyStore

INITIALIZED	back to summary
private static final int INITIALIZED

keyStore	back to summary
private KeyStore keyStore

keyStoreAlias	back to summary
private String keyStoreAlias

keyStorePassword	back to summary
private char[] keyStorePassword

keyStorePasswordURL	back to summary
private String keyStorePasswordURL

keyStoreProvider	back to summary
private String keyStoreProvider

keyStoreType	back to summary
private String keyStoreType

keyStoreURL	back to summary
private String keyStoreURL

LOGGED_IN	back to summary
private static final int LOGGED_IN

NONE	back to summary
private static final String NONE

NORMAL	back to summary
private static final int NORMAL

nullStream	back to summary
private boolean nullStream

options	back to summary
private Map<String, ?> options

P11KEYSTORE	back to summary
private static final String P11KEYSTORE

principal	back to summary
private X500Principal principal

privateCredential	back to summary
private X500PrivateCredential privateCredential

privateKeyPassword	back to summary
private char[] privateKeyPassword

privateKeyPasswordURL	back to summary
private String privateKeyPasswordURL

PROTECTED_PATH	back to summary
private static final int PROTECTED_PATH

protectedPath	back to summary
private boolean protectedPath

sharedState	back to summary
private Map<String, Object> sharedState

status	back to summary
private int status

subject	back to summary
private Subject subject

TOKEN	back to summary
private static final int TOKEN

token	back to summary
private boolean token

UNINITIALIZED	back to summary
private static final int UNINITIALIZED

Constructor Detail

KeyStoreLoginModule	back to summary
public KeyStoreLoginModule() Creates a `KeyStoreLoginModule`.

Method Detail

abort back to summary

abort	back to summary
public boolean abort() throws LoginException Implements javax.security.auth.spi.LoginModule.abort. This method is called if the LoginContext's overall authentication failed. (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules did not succeed). If this LoginModule's own authentication attempt succeeded (checked by retrieving the private state saved by the `login` and `commit` methods), then this method cleans up any state that was originally saved. If the loaded KeyStore's provider extends `java.security.AuthProvider`, then the provider's `logout` method is invoked. Returns:boolean false if this LoginModule's own login and/or commit attempts failed, and true otherwise. Exceptions LoginException: if the abort fails.

public boolean abort() throws LoginException

Implements javax.security.auth.spi.LoginModule.abort.

This method is called if the LoginContext's overall authentication failed. (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules did not succeed).

If this LoginModule's own authentication attempt succeeded (checked by retrieving the private state saved by the login and commit methods), then this method cleans up any state that was originally saved.

If the loaded KeyStore's provider extends java.security.AuthProvider, then the provider's logout method is invoked.

Returns:boolean

false if this LoginModule's own login and/or commit attempts failed, and true otherwise.

Exceptions

LoginException:: if the abort fails.

checkAlias	back to summary
private void checkAlias() throws LoginException

checkKeyPass	back to summary
private void checkKeyPass() throws LoginException

checkStorePass	back to summary
private void checkStorePass() throws LoginException

commit back to summary

commit	back to summary
public boolean commit() throws LoginException Implements javax.security.auth.spi.LoginModule.commit. Abstract method to commit the authentication process (phase 2). This method is called if the LoginContext's overall authentication succeeded (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules succeeded). If this LoginModule's own authentication attempt succeeded (checked by retrieving the private state saved by the `login` method), then this method associates a `X500Principal` for the subject distinguished name of the first certificate in the alias's credentials in the subject's principals, the alias's certificate path in the subject's public credentials, and a `X500PrivateCredential` whose certificate is the first certificate in the alias's certificate path and whose private key is the alias's private key in the subject's private credentials. If this LoginModule's own authentication attempted failed, then this method removes any state that was originally saved. Returns:boolean true if this LoginModule's own login and commit attempts succeeded, or false otherwise. Exceptions LoginException: if the commit fails

public boolean commit() throws LoginException

Implements javax.security.auth.spi.LoginModule.commit.

Abstract method to commit the authentication process (phase 2).

This method is called if the LoginContext's overall authentication succeeded (the relevant REQUIRED, REQUISITE, SUFFICIENT and OPTIONAL LoginModules succeeded).

If this LoginModule's own authentication attempt succeeded (checked by retrieving the private state saved by the login method), then this method associates a X500Principal for the subject distinguished name of the first certificate in the alias's credentials in the subject's principals, the alias's certificate path in the subject's public credentials, and a X500PrivateCredential whose certificate is the first certificate in the alias's certificate path and whose private key is the alias's private key in the subject's private credentials. If this LoginModule's own authentication attempted failed, then this method removes any state that was originally saved.

Returns:boolean

true if this LoginModule's own login and commit attempts succeeded, or false otherwise.

Exceptions

LoginException:: if the commit fails

commitInternal	back to summary
private boolean commitInternal() throws LoginException

debugPrint	back to summary
private void debugPrint(String message)

getAliasAndPasswords	back to summary
private void getAliasAndPasswords(int env) throws LoginException Get the alias and passwords to use for looking up in the KeyStore. Annotations @SuppressWarnings:fallthrough

getAliasAndPasswords

back to summary

private void getAliasAndPasswords(int env) throws LoginException

Get the alias and passwords to use for looking up in the KeyStore.

Annotations

@SuppressWarnings:fallthrough

getKeyStoreInfo	back to summary
private void getKeyStoreInfo() throws LoginException Get the credentials from the KeyStore.

initialize back to summary

initialize	back to summary
public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String, ?> sharedState, Map<String, ?> options) Implements javax.security.auth.spi.LoginModule.initialize. Initialize this `LoginModule`. Parameters subject:Subject the `Subject` to be authenticated. callbackHandler:CallbackHandler a `CallbackHandler` for communicating with the end user (prompting for usernames and passwords, for example), which may be `null`. sharedState:Map<String, ?> shared `LoginModule` state. options:Map<String, ?> options specified in the login `Configuration` for this particular `LoginModule`. Annotations @SuppressWarnings:unchecked

public void initialize(Subject subject, CallbackHandler callbackHandler, Map<String, ?> sharedState, Map<String, ?> options)

Implements javax.security.auth.spi.LoginModule.initialize.

Initialize this LoginModule.

Parameters

subject:Subject: the Subject to be authenticated.
callbackHandler:CallbackHandler: a CallbackHandler for communicating with the end user (prompting for usernames and passwords, for example), which may be null.
sharedState:Map<String, ?>: shared LoginModule state.
options:Map<String, ?>: options specified in the login Configuration for this particular LoginModule.

Annotations

@SuppressWarnings:unchecked

login	back to summary
public boolean login() throws LoginException Implements javax.security.auth.spi.LoginModule.login. Authenticate the user. Get the Keystore alias and relevant passwords. Retrieve the alias's principal and credentials from the Keystore. Returns:boolean true in all cases (this `LoginModule` should not be ignored). Exceptions LoginException: Doc from javax.security.auth.spi.LoginModule.login. if the authentication fails FailedLoginException: if the authentication fails.

public boolean login() throws LoginException

Implements javax.security.auth.spi.LoginModule.login.

Authenticate the user.

Get the Keystore alias and relevant passwords. Retrieve the alias's principal and credentials from the Keystore.

Returns:boolean

true in all cases (this LoginModule should not be ignored).

Exceptions

LoginException:

Doc from javax.security.auth.spi.LoginModule.login.

if the authentication fails

FailedLoginException:

if the authentication fails.

logout back to summary

logout	back to summary
public boolean logout() throws LoginException Implements javax.security.auth.spi.LoginModule.logout. Logout a user. This method removes the Principals, public credentials and the private credentials that were added by the `commit` method. If the loaded KeyStore's provider extends `java.security.AuthProvider`, then the provider's `logout` method is invoked. Returns:boolean true in all cases since this `LoginModule` should not be ignored. Exceptions LoginException: if the logout fails.

public boolean logout() throws LoginException

Implements javax.security.auth.spi.LoginModule.logout.

Logout a user.

This method removes the Principals, public credentials and the private credentials that were added by the commit method.

If the loaded KeyStore's provider extends java.security.AuthProvider, then the provider's logout method is invoked.

Returns:boolean

true in all cases since this LoginModule should not be ignored.

Exceptions

LoginException:: if the logout fails.

logoutInternal	back to summary
private void logoutInternal() throws LoginException

newURL	back to summary
private static URL newURL(String spec) throws MalformedURLException Annotations @SuppressWarnings:deprecation

processOptions	back to summary
private void processOptions()

prompt	back to summary
private void prompt(NameCallback aliasCallback, PasswordCallback storePassCallback, PasswordCallback keyPassCallback) throws LoginException

saveAlias	back to summary
private void saveAlias(NameCallback cb)

saveKeyPass	back to summary
private void saveKeyPass(PasswordCallback c)

saveStorePass	back to summary
private void saveStorePass(PasswordCallback c)

public Class KeyStoreLoginModule

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail