io.undertow.security.api.AuthenticationMechanism for GSSAPI / SPNEGO based authentication.

GSSAPI authentication is associated with the HTTP connection, as long as a connection is being re-used allow the authentication state to be re-used.

TODO - May consider an option to allow it to also be associated with the underlying session but that has it's own risks so would need to come with a warning.

Nested and Inner Type Summary

Modifier and Type	Class and Description
private class	GSSAPIAuthenticationMechanism.AcceptSecurityContext
private static class	GSSAPIAuthenticationMechanism.NegotiationContext

Field Summary

Modifier and Type	Field and Description
private static final Oid[]	DEFAULT_MECHANISMS
public static final ExclusivityChecker	EXCLUSIVITY_CHECKER
private final IdentityManager	identityManager
private final Oid[]	mechanisms
private static final String	name
private static final String	NEGOTIATE_PREFIX
private static final String	NEGOTIATION_PLAIN
private final GSSAPIServerSubjectFactory	subjectFactory

Access	Constructor and Description
public	GSSAPIAuthenticationMechanism(final GSSAPIServerSubjectFactory subjectFactory, IdentityManager identityManager, Oid... supportedMechanisms)
public	GSSAPIAuthenticationMechanism(final GSSAPIServerSubjectFactory subjectFactory, Oid... supportedMechanisms)
public	GSSAPIAuthenticationMechanism(final GSSAPIServerSubjectFactory subjectFactory)

Method Summary

Modifier and Type	Method and Description
public AuthenticationMechanism.AuthenticationMechanismOutcome	authenticate(final HttpServerExchange The exchange exchange, final SecurityContext securityContext) Implements io.undertow.security.api.AuthenticationMechanism.authenticate. Perform authentication of the request.
private String	getHostName(final HttpServerExchange exchange)
private IdentityManager	getIdentityManager(SecurityContext securityContext)
public AuthenticationMechanism.AuthenticationMechanismOutcome	runGSSAPI(final HttpServerExchange exchange, final ByteBuffer challenge, final SecurityContext securityContext)
public AuthenticationMechanism.ChallengeResult	sendChallenge(final HttpServerExchange The exchange exchange, final SecurityContext The security context securityContext) Implements io.undertow.security.api.AuthenticationMechanism.sendChallenge. Send an authentication challenge to the remote client.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

DEFAULT_MECHANISMS	back to summary
private static final Oid[] DEFAULT_MECHANISMS

EXCLUSIVITY_CHECKER	back to summary
public static final ExclusivityChecker EXCLUSIVITY_CHECKER

identityManager	back to summary
private final IdentityManager identityManager

mechanisms	back to summary
private final Oid[] mechanisms

name	back to summary
private static final String name

NEGOTIATE_PREFIX	back to summary
private static final String NEGOTIATE_PREFIX

NEGOTIATION_PLAIN	back to summary
private static final String NEGOTIATION_PLAIN

subjectFactory	back to summary
private final GSSAPIServerSubjectFactory subjectFactory

GSSAPIAuthenticationMechanism	back to summary
public GSSAPIAuthenticationMechanism(final GSSAPIServerSubjectFactory subjectFactory, IdentityManager identityManager, Oid... supportedMechanisms)

GSSAPIAuthenticationMechanism	back to summary
public GSSAPIAuthenticationMechanism(final GSSAPIServerSubjectFactory subjectFactory, Oid... supportedMechanisms)

GSSAPIAuthenticationMechanism	back to summary
public GSSAPIAuthenticationMechanism(final GSSAPIServerSubjectFactory subjectFactory)

Method Detail

authenticate	back to summary
public AuthenticationMechanism.AuthenticationMechanismOutcome authenticate(final HttpServerExchange exchange, final SecurityContext securityContext) Implements io.undertow.security.api.AuthenticationMechanism.authenticate. Doc from io.undertow.security.api.AuthenticationMechanism.authenticate. Perform authentication of the request. Any potentially blocking work should be performed in the handoff executor provided Parameters exchange:HttpServerExchange The exchange Annotations @Override

authenticate

back to summary

public AuthenticationMechanism.AuthenticationMechanismOutcome authenticate(final HttpServerExchange exchange, final SecurityContext securityContext)

Implements io.undertow.security.api.AuthenticationMechanism.authenticate.

Doc from io.undertow.security.api.AuthenticationMechanism.authenticate.

Perform authentication of the request. Any potentially blocking work should be performed in the handoff executor provided

Parameters

exchange:HttpServerExchange: The exchange

Annotations

@Override

getHostName	back to summary
private String getHostName(final HttpServerExchange exchange)

getIdentityManager	back to summary
private IdentityManager getIdentityManager(SecurityContext securityContext) Annotations @SuppressWarnings:deprecation

runGSSAPI	back to summary
public AuthenticationMechanism.AuthenticationMechanismOutcome runGSSAPI(final HttpServerExchange exchange, final ByteBuffer challenge, final SecurityContext securityContext)

sendChallenge back to summary

sendChallenge	back to summary
public AuthenticationMechanism.ChallengeResult sendChallenge(final HttpServerExchange exchange, final SecurityContext securityContext) Implements io.undertow.security.api.AuthenticationMechanism.sendChallenge. Doc from io.undertow.security.api.AuthenticationMechanism.sendChallenge. Send an authentication challenge to the remote client. The individual mechanisms should update the response headers and body of the message as appropriate however they should not set the response code, instead that should be indicated in the `ChallengeResult` and the most appropriate overall response code will be selected. This method should not return `null`. Parameters exchange:HttpServerExchange The exchange securityContext:SecurityContext The security context Returns:AuthenticationMechanism.ChallengeResult A `ChallengeResult` indicating if a challenge was sent and the desired response code.

public AuthenticationMechanism.ChallengeResult sendChallenge(final HttpServerExchange exchange, final SecurityContext securityContext)

Implements io.undertow.security.api.AuthenticationMechanism.sendChallenge.

Doc from io.undertow.security.api.AuthenticationMechanism.sendChallenge.

Send an authentication challenge to the remote client.

The individual mechanisms should update the response headers and body of the message as appropriate however they should not set the response code, instead that should be indicated in the ChallengeResult and the most appropriate overall response code will be selected. This method should not return null.

Parameters

exchange:HttpServerExchange: The exchange
securityContext:SecurityContext: The security context

Returns:AuthenticationMechanism.ChallengeResult

A ChallengeResult indicating if a challenge was sent and the desired response code.

io.undertow.security.impl back to summary

private Class GSSAPIAuthenticationMechanism.AcceptSecurityContext

Class Inheritance

extends Object
implements PrivilegedExceptionAction<AuthenticationMechanism.AuthenticationMechanismOutcome>

java.lang.Object
io.undertow.security.impl.GSSAPIAuthenticationMechanism.AcceptSecurityContext

All Implemented Interfaces

java.security.PrivilegedExceptionAction

Field Summary

Modifier and Type	Field and Description
private final ByteBuffer	challenge
private final HttpServerExchange	exchange
private final SecurityContext	securityContext

Constructor Summary

Access	Constructor and Description
private	AcceptSecurityContext(final HttpServerExchange exchange, final ByteBuffer challenge, final SecurityContext securityContext)

Method Summary

Modifier and Type	Method and Description
public AuthenticationMechanism.AuthenticationMechanismOutcome	run() Implements java.security.PrivilegedExceptionAction.run. Performs the computation.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

challenge	back to summary
private final ByteBuffer challenge

exchange	back to summary
private final HttpServerExchange exchange

securityContext	back to summary
private final SecurityContext securityContext

Constructor Detail

AcceptSecurityContext	back to summary
private AcceptSecurityContext(final HttpServerExchange exchange, final ByteBuffer challenge, final SecurityContext securityContext)

Method Detail

run back to summary

run	back to summary
public AuthenticationMechanism.AuthenticationMechanismOutcome run() throws GSSException Implements java.security.PrivilegedExceptionAction.run. Doc from java.security.PrivilegedExceptionAction.run. Performs the computation. This method will be called by `AccessController.doPrivileged` after enabling privileges. Returns:AuthenticationMechanism.AuthenticationMechanismOutcome a class-dependent value that may represent the results of the computation. Each class that implements `PrivilegedExceptionAction` should document what (if anything) this value represents.

public AuthenticationMechanism.AuthenticationMechanismOutcome run() throws GSSException

Implements java.security.PrivilegedExceptionAction.run.

Doc from java.security.PrivilegedExceptionAction.run.

Performs the computation. This method will be called by AccessController.doPrivileged after enabling privileges.

Returns:AuthenticationMechanism.AuthenticationMechanismOutcome: a class-dependent value that may represent the results of the computation. Each class that implements PrivilegedExceptionAction should document what (if anything) this value represents.

io.undertow.security.impl back to summary

private Class GSSAPIAuthenticationMechanism.NegotiationContext

Class Inheritance

extends Object

java.lang.Object
io.undertow.security.impl.GSSAPIAuthenticationMechanism.NegotiationContext

Field Summary

Modifier and Type	Field and Description
pack-priv static final AttachmentKey<GSSAPIAuthenticationMechanism.NegotiationContext>	ATTACHMENT_KEY
private GSSContext	gssContext
private Principal	principal
private byte[]	responseToken

Constructor Summary

Access	Constructor and Description
private	NegotiationContext()

Method Summary

Modifier and Type	Method and Description
pack-priv GSSContext	getGssContext()
pack-priv Principal	getPrincipal()
pack-priv boolean	isEstablished()
pack-priv void	setGssContext(GSSContext gssContext)
pack-priv void	setResponseToken(byte[] responseToken)
pack-priv byte[]	useResponseToken()

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

ATTACHMENT_KEY	back to summary
pack-priv static final AttachmentKey<GSSAPIAuthenticationMechanism.NegotiationContext> ATTACHMENT_KEY

gssContext	back to summary
private GSSContext gssContext

principal	back to summary
private Principal principal

responseToken	back to summary
private byte[] responseToken

Constructor Detail

NegotiationContext	back to summary
private NegotiationContext()

Method Detail

getGssContext	back to summary
pack-priv GSSContext getGssContext()

getPrincipal	back to summary
pack-priv Principal getPrincipal()

isEstablished	back to summary
pack-priv boolean isEstablished()

setGssContext	back to summary
pack-priv void setGssContext(GSSContext gssContext)

setResponseToken	back to summary
pack-priv void setResponseToken(byte[] responseToken)

useResponseToken	back to summary
pack-priv byte[] useResponseToken()

public Class GSSAPIAuthenticationMechanism

Nested and Inner Type Summary

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

private Class GSSAPIAuthenticationMechanism.AcceptSecurityContext

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

private Class GSSAPIAuthenticationMechanism.NegotiationContext

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail