Top Description Fields Constructors Methods
org.apache.sshd.server.auth.gss

public Class GSSAuthenticator

extends Object
Class Inheritance
Imports
java.net.InetAddress, .UnknownHostException, javax.security.auth.login.LoginException, org.apache.sshd.server.session.ServerSession, org.ietf.jgss.GSSCredential, .GSSException, .GSSManager
Class providing basic GSS authentication services. Can be used as-is, but is often extended to provide environment specific implementations.
Author
Richard Evans

Field Summary

Modifier and TypeField and Description
private String
keytabFile

private String
servicePrincipalName

Constructor Summary

AccessConstructor and Description
public
GSSAuthenticator()

Method Summary

Modifier and TypeMethod and Description
public GSSCredential

Returns:

The credential; if the result is null gssapi authentication fails immediately
getGSSCredential(GSSManager
The GSS manager
mgr)

Overridable method to get GSS accept credential suitable for the current environment.

public GSSManager

Returns:

A new manager
getGSSManager()

Overridable method to get GSS manager suitable for current environment.

public void
setKeytabFile(String
The location of the keytab
keytabFile)

Set the location of the Kerberos keytab.

public void
setServicePrincipalName(String
The principal name
servicePrincipalName)

Set the service principal name to be used.

public boolean

Returns:

true if the identity is valid, false if invalid
validateIdentity(ServerSession
The current session
session, String
The identity from the GSS context
identity)

Validate the source identity obtained from the context after negotiation is complete.

public boolean

Returns:

true if the user is valid, false if invalid
validateInitialUser(ServerSession
The current session
session, String
The user name from the initial request
user)

Validate the user name passed in the initial SSH_MSG_USERAUTH_REQUEST message.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

keytabFileback to summary
private String keytabFile
servicePrincipalNameback to summary
private String servicePrincipalName

Constructor Detail

GSSAuthenticatorback to summary
public GSSAuthenticator()

Method Detail

getGSSCredentialback to summary
public GSSCredential getGSSCredential(GSSManager mgr) throws UnknownHostException, LoginException, GSSException

Overridable method to get GSS accept credential suitable for the current environment. The default implementation uses a Kerberos key table.

Parameters
mgr:GSSManager

The GSS manager

Returns:GSSCredential

The credential; if the result is null gssapi authentication fails immediately

Exceptions
UnknownHostException:
If the local host name could not be determined
LoginException:
If the subject could not be found
GSSException:
If the credential could not be obtained
getGSSManagerback to summary
public GSSManager getGSSManager()

Overridable method to get GSS manager suitable for current environment.

Returns:GSSManager

A new manager

setKeytabFileback to summary
public void setKeytabFile(String keytabFile)

Set the location of the Kerberos keytab. The default is defined by the JRE.

Parameters
keytabFile:String

The location of the keytab

setServicePrincipalNameback to summary
public void setServicePrincipalName(String servicePrincipalName)

Set the service principal name to be used. The default is host/hostname.

Parameters
servicePrincipalName:String

The principal name

validateIdentityback to summary
public boolean validateIdentity(ServerSession session, String identity)

Validate the source identity obtained from the context after negotiation is complete. The default implementation here always succeeds.

Parameters
session:ServerSession

The current session

identity:String

The identity from the GSS context

Returns:boolean

true if the identity is valid, false if invalid

validateInitialUserback to summary
public boolean validateInitialUser(ServerSession session, String user)

Validate the user name passed in the initial SSH_MSG_USERAUTH_REQUEST message. This is sort of mandated by RFC 4462, but it may be more useful to wait for the GSS negotiation to complete. The default implementation here always succeeds.

Parameters
session:ServerSession

The current session

user:String

The user name from the initial request

Returns:boolean

true if the user is valid, false if invalid