APIdia Launch Partner
Top Description Fields Constructors Methods
javax.security.auth.kerberos

public Class KerberosTicket

extends Object
implements Destroyable, Refreshable, Serializable
Class Inheritance
All Implemented Interfaces
java.io.Serializable, javax.security.auth.Refreshable, javax.security.auth.Destroyable
Known Direct Subclasses
sun.security.jgss.krb5.Krb5InitCredential
Imports
java.io.*, java.util.Date, .Arrays, .Objects, java.net.InetAddress, javax.crypto.SecretKey, javax.security.auth.Refreshable, .Destroyable, .RefreshFailedException, .DestroyFailedException, sun.security.krb5.KrbException, sun.security.util.HexDumpEncoder
This class encapsulates a Kerberos ticket and associated information as viewed from the client's point of view. It captures all information that the Key Distribution Center (KDC) sends to the client in the reply message KDC-REP defined in the Kerberos Protocol Specification (RFC 4120).

All Kerberos JAAS login modules that authenticate a user to a KDC should use this class. Where available, the login module might even read this information from a ticket cache in the operating system instead of directly communicating with the KDC. During the commit phase of the JAAS authentication process, the JAAS login module should instantiate this class and store the instance in the private credential set of a Subject.

Note that this class is applicable to both ticket granting tickets and other regular service tickets. A ticket granting ticket is just a special case of a more generalized service ticket.

Implementation Note

The JAAS login module in the JDK reference implementation destroys all tickets after logout.

Author
Mayank Upadhyay
Since
1.4
See Also
javax.security.auth.Subject, javax.security.auth.login.LoginContext, org.ietf.jgss.GSSCredential, org.ietf.jgss.GSSManager

Field Summary

Modifier and TypeField and Description
private byte[]
asn1Encoding

ASN.1 DER Encoding of the Ticket as defined in the Kerberos Protocol Specification RFC4120.

private Date
authTime

Time of initial authentication

private KerberosPrincipal
client

Client that owns the service ticket

private InetAddress[]
clientAddresses

The addresses from where the ticket may be used by the client.

pack-priv transient KerberosPrincipal
clientAlias

private transient boolean
destroyed

private Date
endTime

Time after which the ticket will not be honored.

private boolean[]
flags

Ticket Flags as defined in the Kerberos Protocol Specification RFC4120.

private static final int
FORWARDABLE_TICKET_FLAG

private static final int
FORWARDED_TICKET_FLAG

private static final int
INITIAL_TICKET_FLAG

private static final int
NUM_FLAGS

private static final int
POSTDATED_TICKET_FLAG

private static final int
PROXIABLE_TICKET_FLAG

pack-priv KerberosTicket
proxy

private static final int
PROXY_TICKET_FLAG

private static final int
RENEWABLE_TICKET_FLAG

private Date
renewTill

For renewable Tickets it indicates the maximum endtime that may be included in a renewal.

private static final long
serialVersionUID

private KerberosPrincipal
server

The service for which the ticket was issued.

pack-priv transient KerberosPrincipal
serverAlias

private KeyImpl
sessionKey

KeyImpl is serialized by writing out the ASN1 Encoded bytes of the encryption key.

private Date
startTime

Time after which the ticket is valid.

Constructor Summary

AccessConstructor and Description
public
KerberosTicket(byte[]
the ASN.1 encoding of the ticket as defined by the Kerberos protocol specification.
asn1Encoding, KerberosPrincipal
the client that owns this service ticket
client, KerberosPrincipal
the service that this ticket is for
server, byte[]
the raw bytes for the session key that must be used to encrypt the authenticator that will be sent to the server
sessionKey, int
the key type for the session key as defined by the Kerberos protocol specification.
keyType, boolean[]
the ticket flags. Each element in this array indicates the value for the corresponding bit in the ASN.1 BitString that represents the ticket flags. If the number of elements in this array is less than the number of flags used by the Kerberos protocol, then the missing flags will be filled in with false.
flags, Date
the time of initial authentication for the client
authTime, Date
the time after which the ticket will be valid. This may be null in which case the value of authTime is treated as the startTime.
startTime, Date
the time after which the ticket will no longer be valid
endTime, Date
an absolute expiration time for the ticket, including all renewal that might be possible. This field may be null for tickets that are not renewable.
renewTill, InetAddress[]
the addresses from where the ticket may be used by the client. This field may be null when the ticket is usable from any address.
clientAddresses)

Constructs a KerberosTicket using credentials information that a client either receives from a KDC or reads from a cache.

Method Summary

Modifier and TypeMethod and Description
public void
destroy()

Overrides default javax.security.auth.Destroyable.destroy.

Destroys the ticket and destroys any sensitive information stored in it.

public boolean

Returns:

true if the specified object is equal to this KerberosTicket, false otherwise.
equals(Object
the object to compare to
other)

Overrides java.lang.Object.equals.

Compares the specified object with this KerberosTicket for equality.

public final Date

Returns:

the time that the client was authenticated or null if the field is not set or this ticket is destroyed.
getAuthTime()

Returns the time that the client was authenticated.

public final KerberosPrincipal

Returns:

the client principal, or null if destroyed.
getClient()

Returns the client principal associated with this ticket.

public final InetAddress[]

Returns:

the list of addresses, or null if the field was not provided or this ticket is destroyed.
getClientAddresses()

Returns a list of addresses from where the ticket can be used.

public final byte[]

Returns:

an ASN.1 encoding of the entire ticket. A new byte array is returned each time this method is called.
getEncoded()

Returns an ASN.1 encoding of the entire ticket.

public final Date

Returns:

the expiration time for this ticket's validity period, or null if destroyed.
getEndTime()

Returns the expiration time for this ticket's validity period.

public final boolean[]

Returns:

the flags associated with this ticket, or null if destroyed.
getFlags()

Returns the flags associated with this ticket.

public final Date

Returns:

the latest expiration time for this ticket, or null if destroyed.
getRenewTill()

Returns the latest expiration time for this ticket, including all renewals.

public final KerberosPrincipal

Returns:

the service principal, or null if destroyed.
getServer()

Returns the service principal associated with this ticket.

public final SecretKey

Returns:

the session key.
getSessionKey()

Returns the session key associated with this ticket.

public final int

Returns:

the key type of the session key associated with this ticket.
getSessionKeyType()

Returns the key type of the session key associated with this ticket as defined by the Kerberos Protocol Specification.

public final Date

Returns:

the start time for this ticket's validity period or null if the field is not set or this ticket is destroyed.
getStartTime()

Returns the start time for this ticket's validity period.

public int

Returns:

a hash code for this KerberosTicket
hashCode()

Overrides java.lang.Object.hashCode.

Returns a hash code for this KerberosTicket.

private void
init(byte[] asn1Encoding, KerberosPrincipal client, KerberosPrincipal server, byte[] sessionKey, int keyType, boolean[] flags, Date authTime, Date startTime, Date endTime, Date renewTill, InetAddress[] clientAddresses)

private void
init(byte[] asn1Encoding, KerberosPrincipal client, KerberosPrincipal server, KeyImpl sessionKey, boolean[] flags, Date authTime, Date startTime, Date endTime, Date renewTill, InetAddress[] clientAddresses)

public boolean

Returns:

true if this ticket is still current, or false if not current or destroyed.
isCurrent()

Implements javax.security.auth.Refreshable.isCurrent.

Determines if this ticket is still current.

public boolean
isDestroyed()

Overrides default javax.security.auth.Destroyable.isDestroyed.

Determines if this ticket has been destroyed.

public final boolean

Returns:

true if this ticket is forwardable, or false if not forwardable or destroyed.
isForwardable()

Determines if this ticket is forwardable.

public final boolean

Returns:

true if this ticket had been forwarded or was issued based on authentication involving a forwarded ticket-granting ticket, or false otherwise or destroyed.
isForwarded()

Determines if this ticket had been forwarded or was issued based on authentication involving a forwarded ticket-granting ticket.

public final boolean

Returns:

true if this ticket was issued using the Kerberos AS-Exchange protocol, or false if not issued this way or destroyed.
isInitial()

Determines if this ticket was issued using the Kerberos AS-Exchange protocol, and not issued based on some ticket-granting ticket.

public final boolean

Returns:

true if this ticket is post-dated, or false if not post-dated or destroyed.
isPostdated()

Determines is this ticket is post-dated.

public final boolean

Returns:

true if this ticket is proxiable, or false if not proxiable or destroyed.
isProxiable()

Determines if this ticket is proxiable.

public final boolean

Returns:

true if this ticket is a proxy-ticket, or false if not a proxy-ticket or destroyed.
isProxy()

Determines is this ticket is a proxy-ticket.

public final boolean

Returns:

true if this ticket is renewable, or false if not renewable or destroyed.
isRenewable()

Determines is this ticket is renewable.

private void
readObject(ObjectInputStream
the ObjectInputStream from which data is read
s)

Restores the state of this object from the stream.

public void
refresh()

Implements javax.security.auth.Refreshable.refresh.

Extends the validity period of this ticket.

public String

Returns:

an informative textual representation of this KerberosTicket.
toString()

Overrides java.lang.Object.toString.

Returns an informative textual representation of this KerberosTicket.

Inherited from java.lang.Object:
clonefinalizegetClassnotifynotifyAllwaitwaitwait

Field Detail

asn1Encodingback to summary
private byte[] asn1Encoding

ASN.1 DER Encoding of the Ticket as defined in the Kerberos Protocol Specification RFC4120.

authTimeback to summary
private Date authTime

Time of initial authentication

clientback to summary
private KerberosPrincipal client

Client that owns the service ticket

clientAddressesback to summary
private InetAddress[] clientAddresses

The addresses from where the ticket may be used by the client. This field may be null when the ticket is usable from any address.

clientAliasback to summary
pack-priv transient KerberosPrincipal clientAlias
destroyedback to summary
private transient boolean destroyed
endTimeback to summary
private Date endTime

Time after which the ticket will not be honored. (its expiration time).

flagsback to summary
private boolean[] flags

Ticket Flags as defined in the Kerberos Protocol Specification RFC4120.

FORWARDABLE_TICKET_FLAGback to summary
private static final int FORWARDABLE_TICKET_FLAG
FORWARDED_TICKET_FLAGback to summary
private static final int FORWARDED_TICKET_FLAG
INITIAL_TICKET_FLAGback to summary
private static final int INITIAL_TICKET_FLAG
NUM_FLAGSback to summary
private static final int NUM_FLAGS
POSTDATED_TICKET_FLAGback to summary
private static final int POSTDATED_TICKET_FLAG
PROXIABLE_TICKET_FLAGback to summary
private static final int PROXIABLE_TICKET_FLAG
proxyback to summary
pack-priv KerberosTicket proxy
PROXY_TICKET_FLAGback to summary
private static final int PROXY_TICKET_FLAG
RENEWABLE_TICKET_FLAGback to summary
private static final int RENEWABLE_TICKET_FLAG
renewTillback to summary
private Date renewTill

For renewable Tickets it indicates the maximum endtime that may be included in a renewal. It can be thought of as the absolute expiration time for the ticket, including all renewals. This field may be null for tickets that are not renewable.

serialVersionUIDback to summary
private static final long serialVersionUID
Annotations
@Serial
serverback to summary
private KerberosPrincipal server

The service for which the ticket was issued.

serverAliasback to summary
pack-priv transient KerberosPrincipal serverAlias
sessionKeyback to summary
private KeyImpl sessionKey

KeyImpl is serialized by writing out the ASN1 Encoded bytes of the encryption key. The ASN1 encoding is defined in RFC4120 and as follows: 

EncryptionKey   ::= SEQUENCE {
         keytype    [0] Int32 -- actually encryption type --,
         keyvalue   [1] OCTET STRING
}
startTimeback to summary
private Date startTime

Time after which the ticket is valid.

Constructor Detail

KerberosTicketback to summary
public KerberosTicket(byte[] asn1Encoding, KerberosPrincipal client, KerberosPrincipal server, byte[] sessionKey, int keyType, boolean[] flags, Date authTime, Date startTime, Date endTime, Date renewTill, InetAddress[] clientAddresses)

Constructs a KerberosTicket using credentials information that a client either receives from a KDC or reads from a cache.

Parameters
asn1Encoding:byte[]

the ASN.1 encoding of the ticket as defined by the Kerberos protocol specification.

client:KerberosPrincipal

the client that owns this service ticket

server:KerberosPrincipal

the service that this ticket is for

sessionKey:byte[]

the raw bytes for the session key that must be used to encrypt the authenticator that will be sent to the server

keyType:int

the key type for the session key as defined by the Kerberos protocol specification.

flags:boolean[]

the ticket flags. Each element in this array indicates the value for the corresponding bit in the ASN.1 BitString that represents the ticket flags. If the number of elements in this array is less than the number of flags used by the Kerberos protocol, then the missing flags will be filled in with false.

authTime:Date

the time of initial authentication for the client

startTime:Date

the time after which the ticket will be valid. This may be null in which case the value of authTime is treated as the startTime.

endTime:Date

the time after which the ticket will no longer be valid

renewTill:Date

an absolute expiration time for the ticket, including all renewal that might be possible. This field may be null for tickets that are not renewable.

clientAddresses:InetAddress[]

the addresses from where the ticket may be used by the client. This field may be null when the ticket is usable from any address.

Method Detail

destroyback to summary
public void destroy() throws DestroyFailedException

Overrides default javax.security.auth.Destroyable.destroy.

Destroys the ticket and destroys any sensitive information stored in it.

Exceptions
DestroyFailedException:

Doc from javax.security.auth.Destroyable.destroy.

if the destroy operation fails.

equalsback to summary
public boolean equals(Object other)

Overrides java.lang.Object.equals.

Compares the specified object with this KerberosTicket for equality. Returns true if the given object is also a KerberosTicket and the two KerberosTicket instances are equivalent. A destroyed KerberosTicket object is only equal to itself.

Parameters
other:Object

the object to compare to

Returns:boolean

true if the specified object is equal to this KerberosTicket, false otherwise.

Annotations
@Override
Since
1.6
getAuthTimeback to summary
public final Date getAuthTime()

Returns the time that the client was authenticated.

Returns:Date

the time that the client was authenticated or null if the field is not set or this ticket is destroyed.

getClientback to summary
public final KerberosPrincipal getClient()

Returns the client principal associated with this ticket.

Returns:KerberosPrincipal

the client principal, or null if destroyed.

getClientAddressesback to summary
public final InetAddress[] getClientAddresses()

Returns a list of addresses from where the ticket can be used.

Returns:InetAddress[]

the list of addresses, or null if the field was not provided or this ticket is destroyed.

getEncodedback to summary
public final byte[] getEncoded()

Returns an ASN.1 encoding of the entire ticket.

Returns:byte[]

an ASN.1 encoding of the entire ticket. A new byte array is returned each time this method is called.

Exceptions
IllegalStateException:
if this ticket is destroyed
getEndTimeback to summary
public final Date getEndTime()

Returns the expiration time for this ticket's validity period.

Returns:Date

the expiration time for this ticket's validity period, or null if destroyed.

getFlagsback to summary
public final boolean[] getFlags()

Returns the flags associated with this ticket. Each element in the returned array indicates the value for the corresponding bit in the ASN.1 BitString that represents the ticket flags.

Returns:boolean[]

the flags associated with this ticket, or null if destroyed.

getRenewTillback to summary
public final Date getRenewTill()

Returns the latest expiration time for this ticket, including all renewals. This will return a null value for non-renewable tickets.

Returns:Date

the latest expiration time for this ticket, or null if destroyed.

getServerback to summary
public final KerberosPrincipal getServer()

Returns the service principal associated with this ticket.

Returns:KerberosPrincipal

the service principal, or null if destroyed.

getSessionKeyback to summary
public final SecretKey getSessionKey()

Returns the session key associated with this ticket. The return value is always a EncryptionKey object.

Returns:SecretKey

the session key.

Exceptions
IllegalStateException:
if this ticket is destroyed
getSessionKeyTypeback to summary
public final int getSessionKeyType()

Returns the key type of the session key associated with this ticket as defined by the Kerberos Protocol Specification.

Returns:int

the key type of the session key associated with this ticket.

Exceptions
IllegalStateException:
if this ticket is destroyed
See Also
getSessionKey()
getStartTimeback to summary
public final Date getStartTime()

Returns the start time for this ticket's validity period.

Returns:Date

the start time for this ticket's validity period or null if the field is not set or this ticket is destroyed.

hashCodeback to summary
public int hashCode()

Overrides java.lang.Object.hashCode.

Returns a hash code for this KerberosTicket.

Returns:int

a hash code for this KerberosTicket

Annotations
@Override
Since
1.6
initback to summary
private void init(byte[] asn1Encoding, KerberosPrincipal client, KerberosPrincipal server, byte[] sessionKey, int keyType, boolean[] flags, Date authTime, Date startTime, Date endTime, Date renewTill, InetAddress[] clientAddresses)
initback to summary
private void init(byte[] asn1Encoding, KerberosPrincipal client, KerberosPrincipal server, KeyImpl sessionKey, boolean[] flags, Date authTime, Date startTime, Date endTime, Date renewTill, InetAddress[] clientAddresses)
isCurrentback to summary
public boolean isCurrent()

Implements javax.security.auth.Refreshable.isCurrent.

Determines if this ticket is still current.

Returns:boolean

true if this ticket is still current, or false if not current or destroyed.

isDestroyedback to summary
public boolean isDestroyed()

Overrides default javax.security.auth.Destroyable.isDestroyed.

Determines if this ticket has been destroyed.

isForwardableback to summary
public final boolean isForwardable()

Determines if this ticket is forwardable.

Returns:boolean

true if this ticket is forwardable, or false if not forwardable or destroyed.

isForwardedback to summary
public final boolean isForwarded()

Determines if this ticket had been forwarded or was issued based on authentication involving a forwarded ticket-granting ticket.

Returns:boolean

true if this ticket had been forwarded or was issued based on authentication involving a forwarded ticket-granting ticket, or false otherwise or destroyed.

isInitialback to summary
public final boolean isInitial()

Determines if this ticket was issued using the Kerberos AS-Exchange protocol, and not issued based on some ticket-granting ticket.

Returns:boolean

true if this ticket was issued using the Kerberos AS-Exchange protocol, or false if not issued this way or destroyed.

isPostdatedback to summary
public final boolean isPostdated()

Determines is this ticket is post-dated.

Returns:boolean

true if this ticket is post-dated, or false if not post-dated or destroyed.

isProxiableback to summary
public final boolean isProxiable()

Determines if this ticket is proxiable.

Returns:boolean

true if this ticket is proxiable, or false if not proxiable or destroyed.

isProxyback to summary
public final boolean isProxy()

Determines is this ticket is a proxy-ticket.

Returns:boolean

true if this ticket is a proxy-ticket, or false if not a proxy-ticket or destroyed.

isRenewableback to summary
public final boolean isRenewable()

Determines is this ticket is renewable. If so, the refresh method can be called, assuming the validity period for renewing is not already over.

Returns:boolean

true if this ticket is renewable, or false if not renewable or destroyed.

readObjectback to summary
private void readObject(ObjectInputStream s) throws IOException, ClassNotFoundException

Restores the state of this object from the stream.

Parameters
s:ObjectInputStream

the ObjectInputStream from which data is read

Annotations
@Serial
Exceptions
IOException:
if an I/O error occurs
ClassNotFoundException:
if a serialized class cannot be loaded
refreshback to summary
public void refresh() throws RefreshFailedException

Implements javax.security.auth.Refreshable.refresh.

Extends the validity period of this ticket. The ticket will contain a new session key if the refresh operation succeeds. The refresh operation will fail if the ticket is not renewable or the latest allowable renew time has passed. Any other error returned by the KDC will also cause this method to fail.

Note

This method is not synchronized with the accessor methods of this object. Hence callers need to be aware of multiple threads that might access this and try to renew it at the same time.

Exceptions
RefreshFailedException:
if the ticket is not renewable, or the latest allowable renew time has passed, or the KDC returns some error.
IllegalStateException:
if this ticket is destroyed
See Also
isRenewable(), getRenewTill()
toStringback to summary
public String toString()

Overrides java.lang.Object.toString.

Returns an informative textual representation of this KerberosTicket.

Returns:String

an informative textual representation of this KerberosTicket.