Nested and Inner Type Summary

Modifier and Type	Class and Description
public static class	SpnegoAuthenticator.AcceptAction This class gets a gss credential via a privileged action.
public static class	SpnegoAuthenticator.AuthenticateAction
public static class	SpnegoAuthenticator.SpnegoTokenFixer This class implements a hack around an incompatibility between the SPNEGO implementation in Windows and the SPNEGO implementation in Java 8 update 40 onwards.

Modifier and Type	Field and Description
private boolean	applyJava8u40Fix
private static final String	AUTH_HEADER_VALUE_NEGOTIATE
private final Log	log Hides org.apache.catalina.authenticator.AuthenticatorBase.log.
private String	loginConfigName
private Pattern	noKeepAliveUserAgents
private boolean	storeDelegatedCredential

Constructor Summary

Access	Constructor and Description
public	SpnegoAuthenticator()

Method Summary

Modifier and Type	Method and Description
protected boolean	doAuthenticate(Request The request that triggered the authentication request, HttpServletResponse The response associated with the request response) Implements abstract org.apache.catalina.authenticator.AuthenticatorBase.doAuthenticate. Provided for sub-classes to implement their specific authentication mechanism.
public boolean	getApplyJava8u40Fix()
protected String	getAuthMethod() Implements abstract org.apache.catalina.authenticator.AuthenticatorBase.getAuthMethod. Return the authentication method, which is vendor-specific and not defined by HttpServletRequest.
public String	getLoginConfigName()
public String	getNoKeepAliveUserAgents()
protected void	initInternal() Overrides org.apache.catalina.valves.ValveBase.initInternal. Sub-classes wishing to perform additional initialization should override this method, ensuring that super.initInternal() is the first call in the overriding method.
protected boolean	isPreemptiveAuthPossible(Request The request to check for credentials request) Overrides org.apache.catalina.authenticator.AuthenticatorBase.isPreemptiveAuthPossible. Can the authenticator perform preemptive authentication for the given request?
public boolean	isStoreDelegatedCredential()
public void	setApplyJava8u40Fix(boolean applyJava8u40Fix)
public void	setLoginConfigName(String loginConfigName)
public void	setNoKeepAliveUserAgents(String noKeepAliveUserAgents)
public void	setStoreDelegatedCredential(boolean storeDelegatedCredential)

Field Detail

applyJava8u40Fix	back to summary
private boolean applyJava8u40Fix

AUTH_HEADER_VALUE_NEGOTIATE	back to summary
private static final String AUTH_HEADER_VALUE_NEGOTIATE

log	back to summary
private final Log log Hides org.apache.catalina.authenticator.AuthenticatorBase.log.

loginConfigName	back to summary
private String loginConfigName

noKeepAliveUserAgents	back to summary
private Pattern noKeepAliveUserAgents

storeDelegatedCredential	back to summary
private boolean storeDelegatedCredential

Constructor Detail

SpnegoAuthenticator	back to summary
public SpnegoAuthenticator()

Method Detail

doAuthenticate back to summary

doAuthenticate	back to summary
protected boolean doAuthenticate(Request request, HttpServletResponse response) throws IOException Implements abstract org.apache.catalina.authenticator.AuthenticatorBase.doAuthenticate. Doc from org.apache.catalina.authenticator.AuthenticatorBase.doAuthenticate. Provided for sub-classes to implement their specific authentication mechanism. Parameters request:Request The request that triggered the authentication response:HttpServletResponse The response associated with the request Returns:boolean `true` if the the user was authenticated, otherwise `false`, in which case an authentication challenge will have been written to the response Annotations @Override Exceptions IOException: If an I/O problem occurred during the authentication process

protected boolean doAuthenticate(Request request, HttpServletResponse response) throws IOException

Implements abstract org.apache.catalina.authenticator.AuthenticatorBase.doAuthenticate.

Doc from org.apache.catalina.authenticator.AuthenticatorBase.doAuthenticate.

Provided for sub-classes to implement their specific authentication mechanism.

Parameters

request:Request: The request that triggered the authentication
response:HttpServletResponse: The response associated with the request

Returns:boolean

true if the the user was authenticated, otherwise false, in which case an authentication challenge will have been written to the response

Annotations

@Override

Exceptions

IOException:: If an I/O problem occurred during the authentication process

getApplyJava8u40Fix	back to summary
public boolean getApplyJava8u40Fix()

getAuthMethod	back to summary
protected String getAuthMethod() Implements abstract org.apache.catalina.authenticator.AuthenticatorBase.getAuthMethod. Doc from org.apache.catalina.authenticator.AuthenticatorBase.getAuthMethod. Return the authentication method, which is vendor-specific and not defined by HttpServletRequest. Returns:String the authentication method, which is vendor-specific and not defined by HttpServletRequest. Annotations @Override

getAuthMethod

back to summary

protected String getAuthMethod()

Implements abstract org.apache.catalina.authenticator.AuthenticatorBase.getAuthMethod.

Doc from org.apache.catalina.authenticator.AuthenticatorBase.getAuthMethod.

Return the authentication method, which is vendor-specific and not defined by HttpServletRequest.

Returns:String

the authentication method, which is vendor-specific and not defined by HttpServletRequest.

Annotations

@Override

getLoginConfigName	back to summary
public String getLoginConfigName()

getNoKeepAliveUserAgents	back to summary
public String getNoKeepAliveUserAgents()

initInternal	back to summary
protected void initInternal() throws LifecycleException Overrides org.apache.catalina.valves.ValveBase.initInternal. Doc from org.apache.catalina.util.LifecycleMBeanBase.initInternal. Sub-classes wishing to perform additional initialization should override this method, ensuring that super.initInternal() is the first call in the overriding method. Annotations @Override Exceptions LifecycleException: Doc from org.apache.catalina.util.LifecycleBase.initInternal. If the initialisation fails

initInternal

back to summary

protected void initInternal() throws LifecycleException

Overrides org.apache.catalina.valves.ValveBase.initInternal.

Doc from org.apache.catalina.util.LifecycleMBeanBase.initInternal.

Sub-classes wishing to perform additional initialization should override this method, ensuring that super.initInternal() is the first call in the overriding method.

Annotations

@Override

Exceptions

LifecycleException:

Doc from org.apache.catalina.util.LifecycleBase.initInternal.

If the initialisation fails

isPreemptiveAuthPossible back to summary

isPreemptiveAuthPossible	back to summary
protected boolean isPreemptiveAuthPossible(Request request) Overrides org.apache.catalina.authenticator.AuthenticatorBase.isPreemptiveAuthPossible. Doc from org.apache.catalina.authenticator.AuthenticatorBase.isPreemptiveAuthPossible. Can the authenticator perform preemptive authentication for the given request? Parameters request:Request The request to check for credentials Returns:boolean `true` if preemptive authentication is possible, otherwise `false` Annotations @Override

protected boolean isPreemptiveAuthPossible(Request request)

Overrides org.apache.catalina.authenticator.AuthenticatorBase.isPreemptiveAuthPossible.

Doc from org.apache.catalina.authenticator.AuthenticatorBase.isPreemptiveAuthPossible.

Can the authenticator perform preemptive authentication for the given request?

Parameters

request:Request: The request to check for credentials

Returns:boolean

true if preemptive authentication is possible, otherwise false

Annotations

@Override

isStoreDelegatedCredential	back to summary
public boolean isStoreDelegatedCredential()

setApplyJava8u40Fix	back to summary
public void setApplyJava8u40Fix(boolean applyJava8u40Fix)

setLoginConfigName	back to summary
public void setLoginConfigName(String loginConfigName)

setNoKeepAliveUserAgents	back to summary
public void setNoKeepAliveUserAgents(String noKeepAliveUserAgents)

setStoreDelegatedCredential	back to summary
public void setStoreDelegatedCredential(boolean storeDelegatedCredential)

org.apache.catalina.authenticator back to summary

public Class SpnegoAuthenticator.AcceptAction

Class Inheritance

extends Object
implements PrivilegedExceptionAction<byte[]>

java.lang.Object
org.apache.catalina.authenticator.SpnegoAuthenticator.AcceptAction

All Implemented Interfaces

java.security.PrivilegedExceptionAction

This class gets a gss credential via a privileged action.

Field Summary

Modifier and Type	Field and Description
pack-priv byte[]	decoded
pack-priv GSSContext	gssContext

Constructor Summary

Access	Constructor and Description
public	AcceptAction(GSSContext context, byte[] decodedToken)

Method Summary

Modifier and Type	Method and Description
public byte[]	run() Implements java.security.PrivilegedExceptionAction.run. Performs the computation.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

decoded	back to summary
pack-priv byte[] decoded

gssContext	back to summary
pack-priv GSSContext gssContext

Constructor Detail

AcceptAction	back to summary
public AcceptAction(GSSContext context, byte[] decodedToken)

Method Detail

run back to summary

run	back to summary
public byte[] run() throws GSSException Implements java.security.PrivilegedExceptionAction.run. Doc from java.security.PrivilegedExceptionAction.run. Performs the computation. This method will be called by `AccessController.doPrivileged` after enabling privileges. Returns:byte[] a class-dependent value that may represent the results of the computation. Each class that implements `PrivilegedExceptionAction` should document what (if anything) this value represents. Annotations @Override

public byte[] run() throws GSSException

Implements java.security.PrivilegedExceptionAction.run.

Doc from java.security.PrivilegedExceptionAction.run.

Performs the computation. This method will be called by AccessController.doPrivileged after enabling privileges.

Returns:byte[]

a class-dependent value that may represent the results of the computation. Each class that implements PrivilegedExceptionAction should document what (if anything) this value represents.

Annotations

@Override

org.apache.catalina.authenticator back to summary

public Class SpnegoAuthenticator.AuthenticateAction

Class Inheritance

extends Object
implements PrivilegedAction<Principal>

java.lang.Object
org.apache.catalina.authenticator.SpnegoAuthenticator.AuthenticateAction

All Implemented Interfaces

java.security.PrivilegedAction

Field Summary

Modifier and Type	Field and Description
private final GSSContext	gssContext
private final Realm	realm
private final boolean	storeDelegatedCredential

Constructor Summary

Access	Constructor and Description
public	AuthenticateAction(Realm realm, GSSContext gssContext, boolean storeDelegatedCredential)

Method Summary

Modifier and Type	Method and Description
public Principal	run() Implements java.security.PrivilegedAction.run. Performs the computation.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

gssContext	back to summary
private final GSSContext gssContext

realm	back to summary
private final Realm realm

storeDelegatedCredential	back to summary
private final boolean storeDelegatedCredential

Constructor Detail

AuthenticateAction	back to summary
public AuthenticateAction(Realm realm, GSSContext gssContext, boolean storeDelegatedCredential)

Method Detail

run back to summary

run	back to summary
public Principal run() Implements java.security.PrivilegedAction.run. Doc from java.security.PrivilegedAction.run. Performs the computation. This method will be called by `AccessController.doPrivileged` after enabling privileges. Returns:Principal a class-dependent value that may represent the results of the computation. Each class that implements `PrivilegedAction` should document what (if anything) this value represents. Annotations @Override

public Principal run()

Implements java.security.PrivilegedAction.run.

Doc from java.security.PrivilegedAction.run.

Performs the computation. This method will be called by AccessController.doPrivileged after enabling privileges.

Returns:Principal

a class-dependent value that may represent the results of the computation. Each class that implements PrivilegedAction should document what (if anything) this value represents.

Annotations

@Override

org.apache.catalina.authenticator back to summary

public Class SpnegoAuthenticator.SpnegoTokenFixer

Class Inheritance

extends Object

java.lang.Object
org.apache.catalina.authenticator.SpnegoAuthenticator.SpnegoTokenFixer

This class implements a hack around an incompatibility between the SPNEGO implementation in Windows and the SPNEGO implementation in Java 8 update 40 onwards. It was introduced by the change to fix this bug: https://bugs.openjdk.java.net/browse/JDK-8048194 (note: the change applied is not the one suggested in the bug report)

It is not clear to me if Windows, Java or Tomcat is at fault here. I think it is Java but I could be wrong.

This hack works by re-ordering the list of mechTypes in the NegTokenInit token.

Field Summary

Modifier and Type	Field and Description
private int	pos
private final byte[]	token

Constructor Summary

Access	Constructor and Description
private	SpnegoTokenFixer(byte[] token)

Method Summary

Modifier and Type	Method and Description
public static void	fix(byte[] token)
private void	fix()
private boolean	length()
private int	lengthAsInt()
private boolean	oid(String expected)
private String	oidAsString()
private boolean	tag(int expected)

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

pos	back to summary
private int pos

token	back to summary
private final byte[] token

Constructor Detail

SpnegoTokenFixer	back to summary
private SpnegoTokenFixer(byte[] token)

Method Detail

fix	back to summary
public static void fix(byte[] token)

fix	back to summary
private void fix()

length	back to summary
private boolean length()

lengthAsInt	back to summary
private int lengthAsInt()

oid	back to summary
private boolean oid(String expected)

oidAsString	back to summary
private String oidAsString()

tag	back to summary
private boolean tag(int expected)