APIdia Launch Partner
Top Description Fields Constructors Methods
com.sun.security.sasl.gsskerb

pack-priv final Class GssKrb5Server

extends GssKrb5Base
implements SaslServer
Class Inheritance
All Implemented Interfaces
javax.security.sasl.SaslServer
Imports
javax.security.sasl.*, java.io.*, java.util.Map, java.util.logging.Level, javax.security.auth.callback.*, org.ietf.jgss.*
Implements the GSSAPI SASL server mechanism for Kerberos V5. (RFC 2222, draft-ietf-cat-sasl-gssapi-00.txt). Expects thread's Subject to contain server's Kerberos credentials - If not, underlying KRB5 mech will attempt to acquire Kerberos creds by logging into Kerberos (via default TextCallbackHandler). - These creds will be used for exchange with client. Required callbacks: - AuthorizeCallback handler must verify that authid/authzids are allowed and set authorized ID to be the canonicalized authzid (if applicable). Environment properties that affect behavior of implementation: javax.security.sasl.qop - quality of protection; list of auth, auth-int, auth-conf; default is "auth" javax.security.sasl.maxbuf - max receive buffer size; default is 65536 javax.security.sasl.sendmaxbuffer - max send buffer size; default is 65536; (min with client max recv size)
Author
Rosanna Lee

Field Summary

Modifier and TypeField and Description
private String
authzid

private CallbackHandler
cbh

private int
handshakeStage

private String
me

private static final String
MY_CLASS_NAME

private String
peer

private final String
protocolSaved

Inherited from com.sun.security.sasl.gsskerb.GssKrb5Base:
EMPTYJGSS_QOPKRB5_OIDsecCtx

Constructor Summary

AccessConstructor and Description
pack-priv
GssKrb5Server(String protocol, String serverName, Map<String, ?> props, CallbackHandler cbh)

Creates a SASL mechanism with server credentials that it needs to participate in GSS-API/Kerberos v5 authentication exchange with the client.

Method Summary

Modifier and TypeMethod and Description
private byte[]
doHandshake1(byte[] responseData)

private byte[]
doHandshake2(byte[] responseData)

public byte[]

Returns:

A non-null byte array containing the challenge to be sent to the client, or null when no more data is to be sent.
evaluateResponse(byte[]
A non-null but possible empty byte array containing the response data from the client.
responseData)

Implements javax.security.sasl.SaslServer.evaluateResponse.

Processes the response data.

public String
getAuthorizationID()

Implements javax.security.sasl.SaslServer.getAuthorizationID.

Reports the authorization ID in effect for the client of this session.

public Object
getNegotiatedProperty(String propName)

Overrides com.sun.security.sasl.gsskerb.GssKrb5Base.getNegotiatedProperty.

Implements javax.security.sasl.SaslServer.getNegotiatedProperty.

Retrieves the negotiated property.

Inherited from com.sun.security.sasl.gsskerb.GssKrb5Base:
checkMessagePropdisposefinalizegetMechanismNameunwrapwrap

Field Detail

authzidback to summary
private String authzid
cbhback to summary
private CallbackHandler cbh
handshakeStageback to summary
private int handshakeStage
meback to summary
private String me
MY_CLASS_NAMEback to summary
private static final String MY_CLASS_NAME
peerback to summary
private String peer
protocolSavedback to summary
private final String protocolSaved

Constructor Detail

GssKrb5Serverback to summary
pack-priv GssKrb5Server(String protocol, String serverName, Map<String, ?> props, CallbackHandler cbh) throws SaslException

Creates a SASL mechanism with server credentials that it needs to participate in GSS-API/Kerberos v5 authentication exchange with the client.

Method Detail

doHandshake1back to summary
private byte[] doHandshake1(byte[] responseData) throws SaslException
doHandshake2back to summary
private byte[] doHandshake2(byte[] responseData) throws SaslException
evaluateResponseback to summary
public byte[] evaluateResponse(byte[] responseData) throws SaslException

Implements javax.security.sasl.SaslServer.evaluateResponse.

Processes the response data. The client sends response data to which the server must process using GSS_accept_sec_context. As per RFC 2222, the GSS authentication completes (GSS_S_COMPLETE) we do an extra hand shake to determine the negotiated security protection and buffer sizes.

Parameters
responseData:byte[]

A non-null but possible empty byte array containing the response data from the client.

Returns:byte[]

A non-null byte array containing the challenge to be sent to the client, or null when no more data is to be sent.

Exceptions
SaslException:

Doc from javax.security.sasl.SaslServer.evaluateResponse.

If an error occurred while processing the response or generating a challenge.

getAuthorizationIDback to summary
public String getAuthorizationID()

Implements javax.security.sasl.SaslServer.getAuthorizationID.

Doc from javax.security.sasl.SaslServer.getAuthorizationID.

Reports the authorization ID in effect for the client of this session. This method can only be called if isComplete() returns true.

getNegotiatedPropertyback to summary
public Object getNegotiatedProperty(String propName)

Overrides com.sun.security.sasl.gsskerb.GssKrb5Base.getNegotiatedProperty.

Implements javax.security.sasl.SaslServer.getNegotiatedProperty.

Doc from javax.security.sasl.SaslServer.getNegotiatedProperty.

Retrieves the negotiated property. This method can be called only after the authentication exchange has completed (i.e., when isComplete() returns true); otherwise, an IllegalStateException is thrown.

The Sasl class includes several well-known property names (For example, Sasl#QOP). A SASL provider can support other properties which are specific to the vendor and/or a mechanism.