APIdia Launch Partner
Top Description Fields Constructors Methods
com.sun.security.sasl.digest

pack-priv final Class DigestMD5Server

extends DigestMD5Base
implements SaslServer
Class Inheritance
All Implemented Interfaces
javax.security.sasl.SaslServer
Imports
java.io.ByteArrayOutputStream, .IOException, java.security.NoSuchAlgorithmException, java.util.StringTokenizer, .ArrayList, .List, .Map, .Arrays, java.util.logging.Level, javax.security.sasl.*, javax.security.auth.callback.*
An implementation of the DIGEST-MD5 server SASL mechanism. (RFC 2831)

The DIGEST-MD5 SASL mechanism specifies two modes of authentication.

Required callbacks: - RealmCallback used as key by handler to fetch password - NameCallback used as key by handler to fetch password - PasswordCallback handler must enter password for username/realm supplied - AuthorizeCallback handler must verify that authid/authzids are allowed and set authorized ID to be the canonicalized authzid (if applicable). Environment properties that affect the implementation: javax.security.sasl.qop: specifies list of qops; default is "auth"; typically, caller should set this to "auth, auth-int, auth-conf". javax.security.sasl.strength specifies low/medium/high strength of encryption; default is all available ciphers [high,medium,low]; high means des3 or rc4 (128); medium des or rc4-56; low is rc4-40. javax.security.sasl.maxbuf specifies max receive buf size; default is 65536 javax.security.sasl.sendmaxbuffer specifies max send buf size; default is 65536 (min of this and client's max recv size) com.sun.security.sasl.digest.utf8: "true" means to use UTF-8 charset; "false" to use ISO-8859-1 encoding; default is "true". com.sun.security.sasl.digest.realm: space-separated list of realms; default is server name (fqdn parameter)
Author
Rosanna Lee

Field Summary

Modifier and TypeField and Description
private static final String
ALGORITHM_DIRECTIVE

private static final int
AUTH_PARAM

private static final int
AUTHZID

private static final int
CHARSET

private static final int
CIPHER

private static final int
CNONCE

private static final int
DIGEST_URI

private static final String[]
DIRECTIVE_KEY

private static final int
MAXBUF

private static final String
MY_CLASS_NAME

private byte[]
myCiphers

private static final int
NONCE

private static final int
NONCE_COUNT

private static final int
NONCE_COUNT_VALUE

private static final int
QOP

private static final int
REALM

private static final String
REALM_PROPERTY

private static final int
RESPONSE

private List<String>
serverRealms

private String
specifiedQops

private static final int
USERNAME

private static final String
UTF8_DIRECTIVE

private static final String
UTF8_PROPERTY

Inherited from com.sun.security.sasl.digest.DigestMD5Base:
authzidcbhCIPHER_MASKSCIPHER_TOKENSDEFAULT_MAXBUFDESDES3DES_3_STRENGTHDES_STRENGTHdigestUriEMPTY_BYTE_ARRAYencodingH_A1MAX_CHALLENGE_LENGTHMAX_RESPONSE_LENGTHnegotiatedCiphernegotiatedQopnegotiatedRealmnegotiatedStrengthnonceRC4RC4_40RC4_40_STRENGTHRC4_56RC4_56_STRENGTHRC4_STRENGTHsecCtxstepUNSETuseUTF8

Constructor Summary

AccessConstructor and Description
pack-priv
DigestMD5Server(String protocol, String serverName, Map<String, ?> props, CallbackHandler cbh)

Method Summary

Modifier and TypeMethod and Description
public byte[]
evaluateResponse(byte[] response)

Implements javax.security.sasl.SaslServer.evaluateResponse.

Evaluates the response data and generates a challenge.

private byte[]
generateChallenge(List<String> realms, String qopStr, String cipherStr)

Generates challenge to be sent to client.

private byte[]
generateResponseAuth(String username, char[] passwd, byte[] cnonce, int nonceCount, byte[] authzidBytes)

Server sends a message formatted as follows: response-auth = "rspauth" "=" response-value where response-value is calculated as above, using the values sent in step two, except that if qop is "auth", then A2 is A2 = { ":", digest-uri-value } And if qop is "auth-int" or "auth-conf" then A2 is A2 = { ":", digest-uri-value, ":00000000000000000000000000000000" } Clears password afterwards.

public String
getAuthorizationID()

Implements javax.security.sasl.SaslServer.getAuthorizationID.

Reports the authorization ID in effect for the client of this session.

private static boolean
uriMatches(String thisUri, String incomingUri)

private byte[]

Returns:

response-value ('rspauth') for client to validate
validateClientResponse(byte[][] responseVal)

Validates client's response.

Inherited from com.sun.security.sasl.digest.DigestMD5Base:
binaryToHexdisposegenerateNoncegenerateResponseValuegetMechanismNamegetNegotiatedPropertygetPlatformCiphersnonceCountToHexparseDirectivesquotedStringValuestringToByte_8859_1unwrapwrapwriteQuotedStringValue

Field Detail

ALGORITHM_DIRECTIVEback to summary
private static final String ALGORITHM_DIRECTIVE
AUTH_PARAMback to summary
private static final int AUTH_PARAM
AUTHZIDback to summary
private static final int AUTHZID
CHARSETback to summary
private static final int CHARSET
CIPHERback to summary
private static final int CIPHER
CNONCEback to summary
private static final int CNONCE
DIGEST_URIback to summary
private static final int DIGEST_URI
DIRECTIVE_KEYback to summary
private static final String[] DIRECTIVE_KEY
MAXBUFback to summary
private static final int MAXBUF
MY_CLASS_NAMEback to summary
private static final String MY_CLASS_NAME
myCiphersback to summary
private byte[] myCiphers
NONCEback to summary
private static final int NONCE
NONCE_COUNTback to summary
private static final int NONCE_COUNT
NONCE_COUNT_VALUEback to summary
private static final int NONCE_COUNT_VALUE
QOPback to summary
private static final int QOP
REALMback to summary
private static final int REALM
REALM_PROPERTYback to summary
private static final String REALM_PROPERTY
RESPONSEback to summary
private static final int RESPONSE
serverRealmsback to summary
private List<String> serverRealms
specifiedQopsback to summary
private String specifiedQops
USERNAMEback to summary
private static final int USERNAME
UTF8_DIRECTIVEback to summary
private static final String UTF8_DIRECTIVE
UTF8_PROPERTYback to summary
private static final String UTF8_PROPERTY

Constructor Detail

DigestMD5Serverback to summary
pack-priv DigestMD5Server(String protocol, String serverName, Map<String, ?> props, CallbackHandler cbh) throws SaslException

Method Detail

evaluateResponseback to summary
public byte[] evaluateResponse(byte[] response) throws SaslException

Implements javax.security.sasl.SaslServer.evaluateResponse.

Doc from javax.security.sasl.SaslServer.evaluateResponse.

Evaluates the response data and generates a challenge. If a response is received from the client during the authentication process, this method is called to prepare an appropriate next challenge to submit to the client. The challenge is null if the authentication has succeeded and no more challenge data is to be sent to the client. It is non-null if the authentication must be continued by sending a challenge to the client, or if the authentication has succeeded but challenge data needs to be processed by the client. isComplete() should be called after each call to evaluateResponse(), to determine if any further response is needed from the client.

Exceptions
SaslException:
If an error occurred while processing the response or generating a challenge.
generateChallengeback to summary
private byte[] generateChallenge(List<String> realms, String qopStr, String cipherStr) throws IOException

Generates challenge to be sent to client. digest-challenge = 1#( realm | nonce | qop-options | stale | maxbuf | charset algorithm | cipher-opts | auth-param ) realm = "realm" "=" <"> realm-value <"> realm-value = qdstr-val nonce = "nonce" "=" <"> nonce-value <"> nonce-value = qdstr-val qop-options = "qop" "=" <"> qop-list <"> qop-list = 1#qop-value qop-value = "auth" | "auth-int" | "auth-conf" | token stale = "stale" "=" "true" maxbuf = "maxbuf" "=" maxbuf-value maxbuf-value = 1*DIGIT charset = "charset" "=" "utf-8" algorithm = "algorithm" "=" "md5-sess" cipher-opts = "cipher" "=" <"> 1#cipher-value <"> cipher-value = "3des" | "des" | "rc4-40" | "rc4" | "rc4-56" | token auth-param = token "=" ( token | quoted-string )

generateResponseAuthback to summary
private byte[] generateResponseAuth(String username, char[] passwd, byte[] cnonce, int nonceCount, byte[] authzidBytes) throws SaslException

Server sends a message formatted as follows: response-auth = "rspauth" "=" response-value where response-value is calculated as above, using the values sent in step two, except that if qop is "auth", then A2 is A2 = { ":", digest-uri-value } And if qop is "auth-int" or "auth-conf" then A2 is A2 = { ":", digest-uri-value, ":00000000000000000000000000000000" } Clears password afterwards.

getAuthorizationIDback to summary
public String getAuthorizationID()

Implements javax.security.sasl.SaslServer.getAuthorizationID.

Doc from javax.security.sasl.SaslServer.getAuthorizationID.

Reports the authorization ID in effect for the client of this session. This method can only be called if isComplete() returns true.

uriMatchesback to summary
private static boolean uriMatches(String thisUri, String incomingUri)
validateClientResponseback to summary
private byte[] validateClientResponse(byte[][] responseVal) throws SaslException

Validates client's response. digest-response = 1#( username | realm | nonce | cnonce | nonce-count | qop | digest-uri | response | maxbuf | charset | cipher | authzid | auth-param ) username = "username" "=" <"> username-value <"> username-value = qdstr-val cnonce = "cnonce" "=" <"> cnonce-value <"> cnonce-value = qdstr-val nonce-count = "nc" "=" nc-value nc-value = 8LHEX qop = "qop" "=" qop-value digest-uri = "digest-uri" "=" <"> digest-uri-value <"> digest-uri-value = serv-type "/" host [ "/" serv-name ] serv-type = 1*ALPHA host = 1*( ALPHA | DIGIT | "-" | "." ) serv-name = host response = "response" "=" response-value response-value = 32LHEX LHEX = "0" | "1" | "2" | "3" | "4" | "5" | "6" | "7" | "8" | "9" | "a" | "b" | "c" | "d" | "e" | "f" cipher = "cipher" "=" cipher-value authzid = "authzid" "=" <"> authzid-value <"> authzid-value = qdstr-val sets: negotiatedQop negotiatedCipher negotiatedRealm negotiatedStrength digestUri (checked and set to clients to account for case diffs) sendMaxBufSize authzid (gotten from callback)

Returns:byte[]

response-value ('rspauth') for client to validate