Credentials are instantiated using one of the
createCredential methods in the GSSManager class. GSS-API credential creation is not
intended to provide a "login to the network" function, as such a
function would involve the creation of new credentials rather than
merely acquiring a handle to existing credentials. The
section on credential
acquisition in the package level description describes
how existing credentials are acquired in the Java platform. GSS-API
implementations must impose a local access-control policy on callers to
prevent unauthorized callers from acquiring credentials to which they
are not entitled.
Applications will create a credential object passing the desired
parameters. The application can then use the query methods to obtain
specific information about the instantiated credential object.
When the credential is no longer needed, the application should call
the dispose method to release any resources held by
the credential object and to destroy any cryptographically sensitive
information.
This example code demonstrates the creation of a GSSCredential implementation for a specific entity, querying of its fields, and its release when it is no longer needed:
GSSManager manager = GSSManager.getInstance();
// start by creating a name object for the entity
GSSName name = manager.createName("myusername", GSSName.NT_USER_NAME);
// now acquire credentials for the entity
GSSCredential cred = manager.createCredential(name,
GSSCredential.ACCEPT_ONLY);
// display credential information - name, remaining lifetime,
// and the mechanisms it has been acquired over
System.out.println(cred.getName().toString());
System.out.println(cred.getRemainingLifetime());
Oid [] mechs = cred.getMechs();
if (mechs != null) {
for (int i = 0; i< mechs.length; i++)
System.out.println(mechs[i].toString());
}
// release system resources held by the credential
cred.dispose();
GSSManager#createCredential(int), GSSManager#createCredential(GSSName, int, Oid, int), GSSManager#createCredential(GSSName, int, Oid[], int), dispose()
| Modifier and Type | Field and Description |
|---|---|
| public static final int | ACCEPT_ONLY
Credential usage flag requesting that it be usable for context acceptance only. |
| public static final int | DEFAULT_LIFETIME
A lifetime constant representing the default credential lifetime. |
| public static final int | INDEFINITE_LIFETIME
A lifetime constant representing indefinite credential lifetime. |
| public static final int | INITIATE_AND_ACCEPT
Credential usage flag requesting that it be usable for both context initiation and acceptance. |
| public static final int | INITIATE_ONLY
Credential usage flag requesting that it be usable for context initiation only. |
| Modifier and Type | Method and Description |
|---|---|
| public void | add(GSSName
the name of the principal for whom this credential is to
be acquired. Use name, int null to specify the default
principal.the number of seconds that the credential element
should remain valid for initiating of security contexts. Use initLifetime, int GSSCredential.
to request that the credentials have the maximum permitted lifetime
for this. Use GSSCredential. to request default credential lifetime
for this.the number of seconds that the credential
element should remain valid for accepting security contexts. Use acceptLifetime, Oid GSSCredential.
to request that the credentials have the maximum permitted lifetime
for this. Use GSSCredential. to request default credential lifetime
for this.the mechanism over which the credential is to be acquired. mech, int the usage mode that this credential
element should add to the credential. The value
of this parameter must be one of:
usage)INITIATE_AND_ACCEPT,
ACCEPT_ONLY, and
INITIATE_ONLY.Adds a mechanism specific credential-element to an existing credential. |
| public void | |
| public boolean | |
| public Oid[] | Returns: an array of Oid's corresponding to the supported mechanisms.Returns a list of mechanisms supported by this credential. |
| public GSSName | Returns: a GSSName representing the entityRetrieves the name of the entity that the credential asserts. |
| public GSSName | |
| public int | Returns: the number of seconds remaining in the life of this credential element. A return value ofINDEFINITE_LIFETIME indicates that the credential element does not
expire. A return value of 0 indicates that the credential element is
already expired.the Oid of the mechanism whose acceptor credential element
should be queried. mech)Returns the lifetime in seconds for the credential to remain capable of accepting security contexts using the specified mechanism. |
| public int | Returns: the number of seconds remaining in the life of this credential element. A return value ofINDEFINITE_LIFETIME indicates that the credential element does not
expire. A return value of 0 indicates that the credential element is
already expired.the Oid of the mechanism whose initiator credential element
should be queried. mech)Returns the lifetime in seconds for the credential to remain capable of initiating security contexts using the specified mechanism. |
| public int | Returns: the minimum remaining lifetime in seconds for this credential. A return value ofINDEFINITE_LIFETIME indicates that the credential does
not expire. A return value of 0 indicates that the credential is
already expired.Returns the remaining lifetime in seconds for a credential. |
| public int | |
| public int | |
| public int | Returns: a hashcode value for this GSSCredentialReturns a hashcode value for this GSSCredential. |
| ACCEPT_ONLY | back to summary |
|---|---|
| public static final int ACCEPT_ONLY Credential usage flag requesting that it be usable for context acceptance only. | |
| DEFAULT_LIFETIME | back to summary |
|---|---|
| public static final int DEFAULT_LIFETIME A lifetime constant representing the default credential lifetime. This value it set to 0. | |
| INDEFINITE_LIFETIME | back to summary |
|---|---|
| public static final int INDEFINITE_LIFETIME A lifetime constant representing indefinite credential lifetime.
This value must is set to the maximum integer value in Java -
| |
| INITIATE_AND_ACCEPT | back to summary |
|---|---|
| public static final int INITIATE_AND_ACCEPT Credential usage flag requesting that it be usable for both context initiation and acceptance. | |
| INITIATE_ONLY | back to summary |
|---|---|
| public static final int INITIATE_ONLY Credential usage flag requesting that it be usable for context initiation only. | |
| add | back to summary |
|---|---|
| public void add(GSSName name, int initLifetime, int acceptLifetime, Oid mech, int usage) throws GSSException Adds a mechanism specific credential-element to an existing credential. This method allows the construction of credentials, one mechanism at a time. This routine is envisioned to be used mainly by context acceptors during the creation of acceptor credentials which are to be used with a variety of clients using different security mechanisms.
This routine adds the new credential element "in-place". To add the
element in a new credential, first call
As always, GSS-API implementations must impose a local access-control
policy on callers to prevent unauthorized callers from acquiring
credentials to which they are not entitled.
Non-default values for initLifetime and acceptLifetime cannot always
be honored by the underlying mechanisms, thus callers should be
prepared to call
| |
| dispose | back to summary |
|---|---|
| public void dispose() throws GSSException Releases any sensitive information that the GSSCredential object may be containing. Applications should call this method as soon as the credential is no longer needed to minimize the time any sensitive information is maintained.
| |
| equals | back to summary |
|---|---|
| public boolean equals(Object another) Tests if this GSSCredential asserts the same entity as the supplied object. The two credentials must be acquired over the same mechanisms and must refer to the same principal. | |
| getMechs | back to summary |
|---|---|
| public Oid[] getMechs() throws GSSException Returns a list of mechanisms supported by this credential. It does
not tell us which ones can be used to initiate
contexts and which ones can be used to accept contexts. The
application must call the
| |
| getName | back to summary |
|---|---|
| public GSSName getName() throws GSSException Retrieves the name of the entity that the credential asserts.
| |
| getName | back to summary |
|---|---|
| public GSSName getName(Oid mech) throws GSSException Retrieves a Mechanism Name of the entity that the credential
asserts. This is equivalent to calling
| |
| getRemainingAcceptLifetime | back to summary |
|---|---|
| public int getRemainingAcceptLifetime(Oid mech) throws GSSException Returns the lifetime in seconds for the credential to remain capable of accepting security contexts using the specified mechanism. This method queries the acceptor credential element that belongs to the specified mechanism.
| |
| getRemainingInitLifetime | back to summary |
|---|---|
| public int getRemainingInitLifetime(Oid mech) throws GSSException Returns the lifetime in seconds for the credential to remain capable of initiating security contexts using the specified mechanism. This method queries the initiator credential element that belongs to the specified mechanism.
| |
| getRemainingLifetime | back to summary |
|---|---|
| public int getRemainingLifetime() throws GSSException Returns the remaining lifetime in seconds for a credential. The remaining lifetime is the minimum lifetime amongst all the underlying mechanism specific credential elements.
| |
| getUsage | back to summary |
|---|---|
| public int getUsage() throws GSSException Returns the credential usage mode. In other words, it tells us if this credential can be used for initiating or accepting security contexts. It does not tell us which mechanism(s) has to be used in order to do so. It is expected that an application will allow the GSS-API to pick a default mechanism after calling this method.
| |
| getUsage | back to summary |
|---|---|
| public int getUsage(Oid mech) throws GSSException Returns the credential usage mode for a specific mechanism. In other words, it tells us if this credential can be used for initiating or accepting security contexts with a given underlying mechanism.
| |
| hashCode | back to summary |
|---|---|
| public int hashCode() Returns a hashcode value for this GSSCredential.
| |