OpenJDK 27 · com.sun.security.jgss.ExtendedGSSContext

Modifier and Type	Method and Description
public boolean	Returns: the delegation policy response getDelegPolicyState() Returns the delegation policy response.
public Object	Returns: the attribute, see the method documentation for details. inquireSecContext(InquireType the type of the attribute requested type) Return the mechanism-specific attribute associated with `type`.
public void	requestDelegPolicy(boolean true if the policy should be respected state) Requests that the delegation policy be respected.

Method Detail

getDelegPolicyState back to summary

getDelegPolicyState	back to summary
public boolean getDelegPolicyState() Returns the delegation policy response. Called after a security context is established. This method can be only called on the initiator's side. See `ExtendedGSSContext#requestDelegPolicy`. Returns:boolean the delegation policy response

public boolean getDelegPolicyState()

Returns the delegation policy response. Called after a security context is established. This method can be only called on the initiator's side. See ExtendedGSSContext#requestDelegPolicy.

Returns:boolean: the delegation policy response

inquireSecContext back to summary

inquireSecContext	back to summary
public Object inquireSecContext(InquireType type) throws GSSException Return the mechanism-specific attribute associated with `type`. Example: GSSContext ctxt = m.createContext(...) // Establishing the context if (ctxt instanceof ExtendedGSSContext) { ExtendedGSSContext ex = (ExtendedGSSContext)ctxt; try { Key key = (key)ex.inquireSecContext( InquireType.KRB5_GET_SESSION_KEY); // read key info } catch (GSSException gsse) { // deal with exception } } Parameters type:InquireType the type of the attribute requested Returns:Object the attribute, see the method documentation for details. Exceptions GSSException: containing the following major error codes: `GSSException.BAD_MECH` if the mechanism does not support this method, `GSSException.UNAVAILABLE` if the type specified is not supported, `GSSException.NO_CONTEXT` if the security context is invalid, `GSSException.FAILURE` for other unspecified failures. See Also `InquireType`

public Object inquireSecContext(InquireType type) throws GSSException

Return the mechanism-specific attribute associated with type.

Example:

     GSSContext ctxt = m.createContext(...)
     // Establishing the context
     if (ctxt instanceof ExtendedGSSContext) {
         ExtendedGSSContext ex = (ExtendedGSSContext)ctxt;
         try {
             Key key = (key)ex.inquireSecContext(
                     InquireType.KRB5_GET_SESSION_KEY);
             // read key info
         } catch (GSSException gsse) {
             // deal with exception
         }
     }

Parameters

type:InquireType: the type of the attribute requested

Returns:Object

the attribute, see the method documentation for details.

Exceptions

GSSException:: containing the following major error codes: GSSException.BAD_MECH if the mechanism does not support this method, GSSException.UNAVAILABLE if the type specified is not supported, GSSException.NO_CONTEXT if the security context is invalid, GSSException.FAILURE for other unspecified failures.

See Also

InquireType

requestDelegPolicy back to summary

requestDelegPolicy	back to summary
public void requestDelegPolicy(boolean state) throws GSSException Requests that the delegation policy be respected. When a true value is requested, the underlying context would use the delegation policy defined by the environment as a hint to determine whether credentials delegation should be performed. This request can only be made on the context initiator's side and it has to be done prior to the first call to `initSecContext`. When this flag is false, delegation will only be tried when the `credentials delegation flag` is true. When this flag is true but the `credentials delegation flag` is false, delegation will be only tried if the delegation policy permits delegation. When both this flag and the `credentials delegation flag` are true, delegation will be always tried. However, if the delegation policy does not permit delegation, the value of `getDelegPolicyState` will be false, even if delegation is performed successfully. In any case, if the delegation is not successful, the value returned by `GSSContext#getCredDelegState()` is false, and the value returned by `getDelegPolicyState()` is also false. Not all mechanisms support delegation policy. Therefore, the application should check to see if the request was honored with the `getDelegPolicyState` method. When delegation policy is not supported, `requestDelegPolicy` should return silently without throwing an exception. Note for the Kerberos 5 mechanism, the delegation policy is expressed through the OK-AS-DELEGATE flag in the service ticket. When it's true, the KDC permits delegation to the target server. In a cross-realm environment, in order for delegation be permitted, all cross-realm TGTs on the authentication path must also have the OK-AS-DELAGATE flags set. Parameters state:boolean true if the policy should be respected Exceptions GSSException: containing the following major error codes: `GSSException.FAILURE`

public void requestDelegPolicy(boolean state) throws GSSException

Requests that the delegation policy be respected. When a true value is requested, the underlying context would use the delegation policy defined by the environment as a hint to determine whether credentials delegation should be performed. This request can only be made on the context initiator's side and it has to be done prior to the first call to initSecContext.

When this flag is false, delegation will only be tried when the credentials delegation flag is true.

When this flag is true but the credentials delegation flag is false, delegation will be only tried if the delegation policy permits delegation.

When both this flag and the credentials delegation flag are true, delegation will be always tried. However, if the delegation policy does not permit delegation, the value of getDelegPolicyState will be false, even if delegation is performed successfully.

In any case, if the delegation is not successful, the value returned by GSSContext#getCredDelegState() is false, and the value returned by getDelegPolicyState() is also false.

Not all mechanisms support delegation policy. Therefore, the application should check to see if the request was honored with the getDelegPolicyState method. When delegation policy is not supported, requestDelegPolicy should return silently without throwing an exception.

Note

for the Kerberos 5 mechanism, the delegation policy is expressed through the OK-AS-DELEGATE flag in the service ticket. When it's true, the KDC permits delegation to the target server. In a cross-realm environment, in order for delegation be permitted, all cross-realm TGTs on the authentication path must also have the OK-AS-DELAGATE flags set.

Parameters

state:boolean: true if the policy should be respected

Exceptions

GSSException:: containing the following major error codes: GSSException.FAILURE

public Interface ExtendedGSSContext

Field Summary

Method Summary

Method Detail