Top Description Inners Fields Constructors Methods
org.eclipse.jetty.security

public Class SPNEGOLoginService

extends ContainerLifeCycle
implements LoginService
Class Inheritance
All Implemented Interfaces
org.eclipse.jetty.security.LoginService
Imports
java.io.Serializable, java.net.InetAddress, java.nio.file.Path, java.util.Base64, .HashMap, .Map, java.util.concurrent.Callable, java.util.function.Function, javax.security.auth.Subject, javax.security.auth.login.AppConfigurationEntry, .Configuration, .LoginContext, org.eclipse.jetty.server.Request, .Session, org.eclipse.jetty.util.component.ContainerLifeCycle, org.eclipse.jetty.util.security.SecurityUtils, org.ietf.jgss.GSSContext, .GSSCredential, .GSSException, .GSSManager, .GSSName, .Oid, org.slf4j.Logger, .LoggerFactory

A configurable (as opposed to using system properties) SPNEGO LoginService.

At startup, this LoginService will login via JAAS the service principal, composed of the service name and the host name, for example HTTP/wonder.com, using a keyTab file as the service principal credentials.

Upon receiving an HTTP request, the server tries to authenticate the client calling LoginService#login(String, Object, Request, Function) where the GSS APIs are used to verify client tokens and (perhaps after a few round-trips) a GSSContext is established.

Nested and Inner Type Summary

Modifier and TypeClass and Description
private static class
SPNEGOLoginService.GSSContextHolder

private class
SPNEGOLoginService.SPNEGOConfiguration

private static class
SPNEGOLoginService.SPNEGOContext

Field Summary

Modifier and TypeField and Description
private SPNEGOLoginService.SPNEGOContext
_context

private final GSSManager
_gssManager

private String
_hostName

private IdentityService
_identityService

private Path
_keyTabPath

private final LoginService
_loginService

private final String
_realm

private String
_serviceName

private static final Logger
LOG

Hides org.eclipse.jetty.util.component.ContainerLifeCycle.LOG.

Constructor Summary

AccessConstructor and Description
public
SPNEGOLoginService(String realm, LoginService loginService)

Method Summary

Modifier and TypeMethod and Description
private Callable<byte[]>
acceptGSSContext(GSSContext gssContext, byte[] token)

protected void
doStart()

Overrides org.eclipse.jetty.util.component.ContainerLifeCycle.doStart.

Starts the managed lifecycle beans in the order they were added.

public String
getHostName()

Returns: the host name of the service

public IdentityService
getIdentityService()

Implements org.eclipse.jetty.security.LoginService.getIdentityService.

Get the IdentityService associated with this Login Service.

public Path

Returns:

the path of the keyTab file containing service credentials
getKeyTabPath()

Get the path of the keyTab file containing service credentials.

public String
getName()

Implements org.eclipse.jetty.security.LoginService.getName.

Returns: the realm name

public String
getServiceName()

Returns: the service name, typically "HTTP"

public UserIdentity
login(String
The username.
username, Object
The users credentials.
credentials, Request
The request or null
request, Function<Boolean, Session>
function to retrieve or create a session.
getOrCreateSession)

Implements org.eclipse.jetty.security.LoginService.login.

Login a user.

public void
logout(UserIdentity user)

Implements org.eclipse.jetty.security.LoginService.logout.

private Callable<GSSContext>
newGSSContext()

private Callable<SPNEGOLoginService.SPNEGOContext>
newSpnegoContext(Subject subject)

public void
setHostName(String
the host name of the service
hostName)

Set the host name of the service.

public void
setIdentityService(IdentityService
the IdentityService associated with this Login Service.
identityService)

Implements org.eclipse.jetty.security.LoginService.setIdentityService.

Set the IdentityService associated with this Login Service.

public void
setKeyTabPath(Path
the path of the keyTab file containing service credentials
keyTabFile)

Set the path of the keyTab file containing service credentials.

public void
setServiceName(String
the service name
serviceName)

private String
toUserName(GSSContext gssContext)

public boolean
validate(UserIdentity
The user to validate
user)

Implements org.eclipse.jetty.security.LoginService.validate.

Validate a user identity.

Inherited from org.eclipse.jetty.util.component.ContainerLifeCycle:
addBeanaddBeanaddEventListeneraddManagedcontainsdestroydoStopdumpdumpdumpdumpObjectsdumpStdErrgetBeangetBeansgetBeansgetContainedBeansgetContainedBeansisAutoisManagedisUnmanagedmanageremoveBeanremoveBeansremoveEventListenersetBeansstartstopunmanageupdateBeanupdateBeanupdateBeansupdateBeans

Field Detail

_contextback to summary
private SPNEGOLoginService.SPNEGOContext _context
_gssManagerback to summary
private final GSSManager _gssManager
_hostNameback to summary
private String _hostName
_identityServiceback to summary
private IdentityService _identityService
_keyTabPathback to summary
private Path _keyTabPath
_loginServiceback to summary
private final LoginService _loginService
_realmback to summary
private final String _realm
_serviceNameback to summary
private String _serviceName
LOGback to summary
private static final Logger LOG

Hides org.eclipse.jetty.util.component.ContainerLifeCycle.LOG.

Constructor Detail

SPNEGOLoginServiceback to summary
public SPNEGOLoginService(String realm, LoginService loginService)

Method Detail

acceptGSSContextback to summary
private Callable<byte[]> acceptGSSContext(GSSContext gssContext, byte[] token)
doStartback to summary
protected void doStart() throws Exception

Overrides org.eclipse.jetty.util.component.ContainerLifeCycle.doStart.

Doc from org.eclipse.jetty.util.component.ContainerLifeCycle.doStart.

Starts the managed lifecycle beans in the order they were added.

Annotations
@Override
Exceptions
Exception:

Doc from org.eclipse.jetty.util.component.AbstractLifeCycle.doStart.

If there was a problem starting. Will cause a transition to FAILED state

getHostNameback to summary
public String getHostName()
Returns:String

the host name of the service

See Also
setServiceName(String)
getIdentityServiceback to summary
public IdentityService getIdentityService()

Implements org.eclipse.jetty.security.LoginService.getIdentityService.

Doc from org.eclipse.jetty.security.LoginService.getIdentityService.

Get the IdentityService associated with this Login Service.

Returns:IdentityService

the IdentityService associated with this Login Service.

Annotations
@Override
getKeyTabPathback to summary
public Path getKeyTabPath()

Get the path of the keyTab file containing service credentials.

Returns:Path

the path of the keyTab file containing service credentials

getNameback to summary
public String getName()

Implements org.eclipse.jetty.security.LoginService.getName.

Returns:String

the realm name

Annotations
@Override
getServiceNameback to summary
public String getServiceName()
Returns:String

the service name, typically "HTTP"

See Also
getHostName()
loginback to summary
public UserIdentity login(String username, Object credentials, Request request, Function<Boolean, Session> getOrCreateSession)

Implements org.eclipse.jetty.security.LoginService.login.

Doc from org.eclipse.jetty.security.LoginService.login.

Login a user.

Parameters
username:String

The username.

credentials:Object

The users credentials.

request:Request

The request or null

getOrCreateSession:Function<Boolean, Session>

function to retrieve or create a session.

Returns:UserIdentity

A UserIdentity if the credentials matched, otherwise null

Annotations
@Override
logoutback to summary
public void logout(UserIdentity user)

Implements org.eclipse.jetty.security.LoginService.logout.

Annotations
@Override
newGSSContextback to summary
private Callable<GSSContext> newGSSContext()
newSpnegoContextback to summary
private Callable<SPNEGOLoginService.SPNEGOContext> newSpnegoContext(Subject subject)
setHostNameback to summary
public void setHostName(String hostName)

Set the host name of the service.

Parameters
hostName:String

the host name of the service

setIdentityServiceback to summary
public void setIdentityService(IdentityService identityService)

Implements org.eclipse.jetty.security.LoginService.setIdentityService.

Doc from org.eclipse.jetty.security.LoginService.setIdentityService.

Set the IdentityService associated with this Login Service.

Parameters
identityService:IdentityService

the IdentityService associated with this Login Service.

Annotations
@Override
setKeyTabPathback to summary
public void setKeyTabPath(Path keyTabFile)

Set the path of the keyTab file containing service credentials.

Parameters
keyTabFile:Path

the path of the keyTab file containing service credentials

setServiceNameback to summary
public void setServiceName(String serviceName)
Parameters
serviceName:String

the service name

See Also
setHostName(String)
toUserNameback to summary
private String toUserName(GSSContext gssContext)
validateback to summary
public boolean validate(UserIdentity user)

Implements org.eclipse.jetty.security.LoginService.validate.

Doc from org.eclipse.jetty.security.LoginService.validate.

Validate a user identity. Validate that a UserIdentity previously created by a call to login(String, Object, Request, Function) is still valid.

Parameters
user:UserIdentity

The user to validate

Returns:boolean

true if authentication has not been revoked for the user.

Annotations
@Override
org.eclipse.jetty.security back to summary

private Class SPNEGOLoginService.GSSContextHolder

extends Object
implements Serializable
Class Inheritance
  • java.lang.Object
  • org.eclipse.jetty.security.SPNEGOLoginService.GSSContextHolder
All Implemented Interfaces
java.io.Serializable

Field Summary

Modifier and TypeField and Description
public static final String
ATTRIBUTE

private final transient GSSContext
gssContext

Constructor Summary

AccessConstructor and Description
private
GSSContextHolder(GSSContext gssContext)

Method Summary

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

ATTRIBUTEback to summary
public static final String ATTRIBUTE
gssContextback to summary
private final transient GSSContext gssContext

Constructor Detail

GSSContextHolderback to summary
private GSSContextHolder(GSSContext gssContext)
org.eclipse.jetty.security back to summary

private Class SPNEGOLoginService.SPNEGOConfiguration

extends Configuration
Class Inheritance

Constructor Summary

AccessConstructor and Description
private
SPNEGOConfiguration()

Method Summary

Modifier and TypeMethod and Description
public AppConfigurationEntry[]
getAppConfigurationEntry(String
the name used to index the Configuration.
name)

Implements abstract javax.security.auth.login.Configuration.getAppConfigurationEntry.

Retrieve the AppConfigurationEntries for the specified name from this Configuration.

Inherited from javax.security.auth.login.Configuration:
getConfigurationgetInstancegetInstancegetInstancegetParametersgetProvidergetTyperefreshsetConfiguration

Constructor Detail

SPNEGOConfigurationback to summary
private SPNEGOConfiguration()

Method Detail

getAppConfigurationEntryback to summary
public AppConfigurationEntry[] getAppConfigurationEntry(String name)

Implements abstract javax.security.auth.login.Configuration.getAppConfigurationEntry.

Doc from javax.security.auth.login.Configuration.getAppConfigurationEntry.

Retrieve the AppConfigurationEntries for the specified name from this Configuration.

Parameters
name:String

the name used to index the Configuration.

Returns:AppConfigurationEntry[]

an array of AppConfigurationEntries for the specified name from this Configuration, or null if there are no entries for the specified name

Annotations
@Override
org.eclipse.jetty.security back to summary

private Class SPNEGOLoginService.SPNEGOContext

extends Object
Class Inheritance

Field Summary

Modifier and TypeField and Description
private GSSCredential
_serviceCredential

private Subject
_subject

Constructor Summary

AccessConstructor and Description
private
SPNEGOContext()

Method Summary

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

_serviceCredentialback to summary
private GSSCredential _serviceCredential
_subjectback to summary
private Subject _subject

Constructor Detail

SPNEGOContextback to summary
private SPNEGOContext()