APIdia Launch Partner
Top Description Fields Constructors Methods
com.sun.security.sasl.gsskerb

pack-priv final Class GssKrb5Client

extends GssKrb5Base
implements SaslClient
Class Inheritance
All Implemented Interfaces
javax.security.sasl.SaslClient
Imports
java.util.Map, java.util.logging.Level, javax.security.sasl.*, javax.security.auth.callback.CallbackHandler, sun.security.jgss.krb5.internal.TlsChannelBindingImpl, org.ietf.jgss.*
Implements the GSSAPI SASL client mechanism for Kerberos V5. (RFC 2222, draft-ietf-cat-sasl-gssapi-04.txt). It uses the Java Bindings for GSSAPI (RFC 2853) for getting GSSAPI/Kerberos V5 support. The client/server interactions are: C0: bind (GSSAPI, initial response) S0: sasl-bind-in-progress, challenge 1 (output of accept_sec_context or []) C1: bind (GSSAPI, response 1 (output of init_sec_context or [])) S1: sasl-bind-in-progress challenge 2 (security layer, server max recv size) C2: bind (GSSAPI, response 2 (security layer, client max recv size, authzid)) S2: bind success response Expects the client's credentials to be supplied from the javax.security.sasl.credentials property or from the thread's Subject. Otherwise the underlying KRB5 mech will attempt to acquire Kerberos creds by logging into Kerberos (via default TextCallbackHandler). These creds will be used for exchange with server. Required callbacks: none. Environment properties that affect behavior of implementation: javax.security.sasl.qop - quality of protection; list of auth, auth-int, auth-conf; default is "auth" javax.security.sasl.maxbuf - max receive buffer size; default is 65536 javax.security.sasl.sendmaxbuffer - max send buffer size; default is 65536; (min with server max recv size) javax.security.sasl.server.authentication - "true" means require mutual authentication; default is "false" javax.security.sasl.credentials - an org.ietf.jgss.GSSCredential used for delegated authentication.
Author
Rosanna Lee

Field Summary

Modifier and TypeField and Description
private byte[]
authzID

private boolean
finalHandshake

private static final String
MY_CLASS_NAME

Inherited from com.sun.security.sasl.gsskerb.GssKrb5Base:
EMPTYJGSS_QOPKRB5_OIDsecCtx

Constructor Summary

AccessConstructor and Description
pack-priv
GssKrb5Client(String authzID, String protocol, String serverName, Map<String, ?> props, CallbackHandler cbh)

Creates a SASL mechanism with client credentials that it needs to participate in GSS-API/Kerberos v5 authentication exchange with the server.

Method Summary

Modifier and TypeMethod and Description
private byte[]
doFinalHandshake(byte[] challengeData)

public byte[]

Returns:

A non-null byte array containing the response to be sent to the server.
evaluateChallenge(byte[]
A non-null byte array containing the challenge data from the server.
challengeData)

Implements javax.security.sasl.SaslClient.evaluateChallenge.

Processes the challenge data.

public boolean
hasInitialResponse()

Implements javax.security.sasl.SaslClient.hasInitialResponse.

Determines whether this mechanism has an optional initial response.

Inherited from com.sun.security.sasl.gsskerb.GssKrb5Base:
checkMessagePropdisposefinalizegetMechanismNamegetNegotiatedPropertyunwrapwrap

Field Detail

authzIDback to summary
private byte[] authzID
finalHandshakeback to summary
private boolean finalHandshake
MY_CLASS_NAMEback to summary
private static final String MY_CLASS_NAME

Constructor Detail

GssKrb5Clientback to summary
pack-priv GssKrb5Client(String authzID, String protocol, String serverName, Map<String, ?> props, CallbackHandler cbh) throws SaslException

Creates a SASL mechanism with client credentials that it needs to participate in GSS-API/Kerberos v5 authentication exchange with the server.

Method Detail

doFinalHandshakeback to summary
private byte[] doFinalHandshake(byte[] challengeData) throws SaslException
evaluateChallengeback to summary
public byte[] evaluateChallenge(byte[] challengeData) throws SaslException

Implements javax.security.sasl.SaslClient.evaluateChallenge.

Processes the challenge data. The server sends a challenge data using which the client must process using GSS_Init_sec_context. As per RFC 2222, when GSS_S_COMPLETE is returned, we do an extra handshake to determine the negotiated security protection and buffer sizes.

Parameters
challengeData:byte[]

A non-null byte array containing the challenge data from the server.

Returns:byte[]

A non-null byte array containing the response to be sent to the server.

Exceptions
SaslException:

Doc from javax.security.sasl.SaslClient.evaluateChallenge.

If an error occurred while processing the challenge or generating a response.

hasInitialResponseback to summary
public boolean hasInitialResponse()

Implements javax.security.sasl.SaslClient.hasInitialResponse.

Doc from javax.security.sasl.SaslClient.hasInitialResponse.

Determines whether this mechanism has an optional initial response. If true, caller should call evaluateChallenge() with an empty array to get the initial response.