public class GSSContextAcceptor extends Object
| Modifier and Type | Field and Description |
|---|---|
private GSSContext |
context
The GSSContext being established, or that was established.
|
private KerberosSettings |
kerberosSettings
The Kerberos settings.
|
private GSSAcceptorLoginModule |
krbLoginModule
The Kerberos login module and server login state.
|
private org.slf4j.Logger |
log
Class logger.
|
private KerberosRealmSettings |
realmSettings
The realm in use.
|
private GSSCredential |
serverCreds
Server credentials used during context establishment.
|
private Oid |
spnegoOid
The OID representing the SPNEGO pseudo-mechanism.
|
| Constructor and Description |
|---|
GSSContextAcceptor(KerberosSettings settings)
Constructor.
|
| Modifier and Type | Method and Description |
|---|---|
private byte[] |
acceptFirstToken(byte[] inToken,
int offset,
int len)
Process the first inbound GSS token.
|
byte[] |
acceptSecContext(byte[] inToken,
int offset,
int len)
Process the inbound GSS token.
|
private void |
createGSSContext(KerberosRealmSettings realm)
Establish initial server credentials and create a GSS acceptor context based on then.
|
GSSContext |
getContext()
Return the GSS security context.
|
private GSSCredential |
getServerCredential(Subject subject)
Create the credential for the GSS-API.
|
void |
logout()
Dispose of the context and the server's credentials, and do a logout of the Kerberos login module.
|
@Nonnull private final org.slf4j.Logger log
@Nonnull private KerberosSettings kerberosSettings
@Nullable private KerberosRealmSettings realmSettings
@Nullable private GSSAcceptorLoginModule krbLoginModule
@Nullable private GSSCredential serverCreds
@Nullable private GSSContext context
public GSSContextAcceptor(@Nonnull KerberosSettings settings) throws GSSException
settings - the KerberosSettings to useGSSException - if an error occurs establishing server credentials@Nullable public GSSContext getContext()
@Nullable public byte[] acceptSecContext(@Nonnull byte[] inToken, int offset, int len) throws Exception
During the first (and likely only) token step, we will also establish the server's credentials in the process. If additional round trips occur, this will be detected and the previous partial context will be used.
inToken - token generated by the peeroffset - the offset within the inToken where the token beginslen - the length of the tokenException - if an error occurspublic void logout()
@Nullable private byte[] acceptFirstToken(@Nonnull byte[] inToken, int offset, int len) throws Exception
inToken - token generated by the peeroffset - the offset within the inToken where the token beginslen - the length of the tokenException - if an error occursprivate void createGSSContext(@Nonnull KerberosRealmSettings realm) throws GSSException, LoginException, PrivilegedActionException
realm - realm settings to useGSSException - thrown if GSS context could not be createdLoginException - thrown if login failedPrivilegedActionException - thrown if GSS credentials could not be created@Nonnull private GSSCredential getServerCredential(@Nonnull Subject subject) throws PrivilegedActionException
subject - Kerberos subject to create the credentials fromPrivilegedActionException - thrown if server credentials could not be createdCopyright © 1999–2018 Shibboleth Consortium. All rights reserved.