Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-7112336

Request is for enhancements to the GSS API implementation and code paths

    XMLWordPrintable

    Details

      Description

      Request is for enhancements to the GSS API implementation and code paths leading from javax.security.sasl.Sasl.createSaslServer, to allow for not providing a server name argument and instead using the DefaultAcceptorCredential to dynamically select the appropriate key from the key tab. This would allow for clients to connect to our server to using FQDN or shortname interchangably and get the approproate key when both entries exist in the keytab.

      The underlying implementation changes are descibed below:
      ====
      jdk/src/share/classes/com/sun/security/sasl/gsskerb/GssKrb5Server.java

      where we find this:

      66 final class GssKrb5Server extends GssKrb5Base implements SaslServer {
      67 private static final String MY_CLASS_NAME = GssKrb5Server.class.getName();
      68
      69 private int handshakeStage = 0;
      70 private String peer;
      71 private String authzid;
      72 private CallbackHandler cbh;
      73
      74 /**
      75 * Creates a SASL mechanism with server credentials that it needs
      76 * to participate in GSS-API/Kerberos v5 authentication exchange
      77 * with the client.
      78 */
      79 GssKrb5Server(String protocol, String serverName,
      80 Map props, CallbackHandler cbh) throws SaslException {
      81
      82 super(props, MY_CLASS_NAME);
      83
      84 this.cbh = cbh;
      --->85 String service = protocol + "@" + serverName;
      86
      87 logger.log(Level.FINE, "KRB5SRV01:Using service name: {0}", service);

      That's the only place that serverName is referenced. The we have this:

      88
      89 try {
      90 GSSManager mgr = GSSManager.getInstance();
      91
      92 // Create the name for the requested service entity for Krb5 mech
      --->93 GSSName serviceName = mgr.createName(service,
      94 GSSName.NT_HOSTBASED_SERVICE, KRB5_OID);
      95
      --->96 GSSCredential cred = mgr.createCredential(serviceName,
      97 GSSCredential.INDEFINITE_LIFETIME,
      98 KRB5_OID, GSSCredential.ACCEPT_ONLY);
      99
      100 // Create a context using the server's credentials
      -->101 secCtx = mgr.createContext(cred);

      Exactly as I'd predicted. This should all be changed to be something
      like:

      79 GssKrb5Server(String protocol, String serverName,
      80 Map props, CallbackHandler cbh) throws SaslException {
      81
      82 super(props, MY_CLASS_NAME);
      +83 String service = null
      84
      85 this.cbh = cbh;
      86
      +87 if (serverName != null)
      88 service = protocol + "@" + serverName;
      89
      90 logger.log(Level.FINE, "KRB5SRV01:Using service name: {0}", service);
      91
      92 try {
      93 GSSManager mgr = GSSManager.getInstance();
      94 GSSCredential cred = null;
      95
      +96 if (service != null) {
      97 // Create the name for the requested service entity for Krb5 mech
      98 GSSName serviceName = mgr.createName(service,
      99 GSSName.NT_HOSTBASED_SERVICE, KRB5_OID);
      100
      101 GSSCredential cred = mgr.createCredential(serviceName,
      102 GSSCredential.INDEFINITE_LIFETIME,
      103 KRB5_OID, GSSCredential.ACCEPT_ONLY);
      +104 }
      105
      106 // Create a context using the server's credentials
      107 secCtx = mgr.createContext(cred);

      However, I'm sure the maintainer will want to retain <protocol> (really, the service name) for checking later, when acceptSecContext() completes they can then call the getTargName() method of the context and check that the target's name matches the given <protocol>, if one was given.
      ====

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              weijun Weijun Wang
              Reporter:
              sdellafi Sandra Dellafiora (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:
                Imported:
                Indexed: