Package org.globus.gsi.gssapi
Class GlobusGSSContextImpl
java.lang.Object
org.globus.gsi.gssapi.GlobusGSSContextImpl
- All Implemented Interfaces:
ExtendedGSSContext
,GSSContext
Implementation of SSL/GSI mechanism for Java GSS-API. The implementation
is based on JSSE (for SSL API) and the
BouncyCastle library
(for certificate processing API).
The implementation is not designed to be thread-safe.
The implementation is not designed to be thread-safe.
-
Field Summary
FieldsModifier and TypeFieldDescriptionprotected Boolean
protected boolean
protected BouncyCastleCertProcessingFactory
protected Boolean
protected boolean
protected boolean
protected GlobusGSSCredentialImpl
Credential of this context.protected ExtendedGSSCredential
Credential delegated using delegation APIprotected boolean
Delegation finished indicatorprotected int
Delegation stateprotected GSIConstants.DelegationType
protected ExtendedGSSCredential
Credential delegated during context establishmentprotected boolean
protected boolean
protected GSSName
Expected target name.protected Date
Context expiration date.static final int
Used to distinguish between a token created bywrap
withGSSConstants.GSI_BIG
QoP and a regular token created bywrap
.protected Integer
protected KeyPair
Used during delegationprotected Boolean
Limited peer credentialsprotected Map
protected Boolean
protected Boolean
protected Boolean
protected int
Context roleprotected GSSName
The name of the context initiatorprotected SSLConfigurator
protected SSLContext
protected SSLEngine
protected int
Handshake stateprotected GSSName
The name of the context acceptorprotected TrustedCertificates
Fields inherited from interface org.ietf.jgss.GSSContext
DEFAULT_LIFETIME, INDEFINITE_LIFETIME
-
Constructor Summary
Constructors -
Method Summary
Modifier and TypeMethodDescriptionbyte[]
acceptDelegation
(int lifetime, byte[] buf, int off, int len) Accept a delegated credential.byte[]
acceptSecContext
(byte[] inBuff, int off, int len) This function drives the accepting side of the context establishment process.void
acceptSecContext
(InputStream in, OutputStream out) It works just likeacceptSecContext
method.protected void
void
dispose()
byte[]
export()
Currently not implemented.protected byte[]
boolean
boolean
boolean
Returns the delegated credential that was delegated using theinitDelegation
andacceptDelegation
functions.boolean
int
getMech()
byte[]
getMIC
(byte[] inBuf, int off, int len, MessageProp prop) Returns a cryptographic MIC (message integrity check) of a specified message.void
getMIC
(InputStream inStream, OutputStream outStream, MessageProp msgProp) Currently not implemented.boolean
Gets a context option.boolean
boolean
int
getWrapSizeLimit
(int qop, boolean confReq, int maxTokenSize) Currently not implemented.byte[]
initDelegation
(GSSCredential credential, Oid mechanism, int lifetime, byte[] buf, int off, int len) Initiate the delegation of a credential.byte[]
initSecContext
(byte[] inBuff, int off, int len) This function drives the initiating side of the context establishment process.int
initSecContext
(InputStream in, OutputStream out) It works just likeinitSecContext
method.inquireByOid
(Oid oid) Retrieves arbitrary data about this context.boolean
Used during delegation to determine the state of the delegation.boolean
boolean
boolean
boolean
Currently not implemented.void
requestAnonymity
(boolean state) void
requestConf
(boolean state) void
requestCredDeleg
(boolean state) void
requestInteg
(boolean state) void
requestLifetime
(int lifetime) void
requestMutualAuth
(boolean state) void
requestReplayDet
(boolean state) void
requestSequenceDet
(boolean state) protected void
setAcceptNoClientCerts
(Object value) void
setBannedCiphers
(String[] ciphers) Specifies a list of ciphers that will not be used.void
Currently not implemented.protected void
setCheckContextExpired
(Object value) protected void
setDelegationType
(Object value) protected void
setGssMode
(Object value) void
Sets a context option.protected void
setProxyPolicyHandlers
(Object value) protected void
setRejectLimitedProxy
(Object value) protected void
protected void
setRequireClientAuth
(Object value) protected void
setTrustedCertificates
(Object value) byte[]
unwrap
(byte[] inBuf, int off, int len, MessageProp prop) Unwraps a token generated bywrap
method on the other side of the context.void
unwrap
(InputStream inStream, OutputStream outStream, MessageProp msgProp) Currently not implemented.protected void
verifyDelegatedCert
(X509Certificate certificate) void
verifyMIC
(byte[] inTok, int tokOff, int tokLen, byte[] inMsg, int msgOff, int msgLen, MessageProp prop) Verifies a cryptographic MIC (message integrity check) of a specified message.void
verifyMIC
(InputStream tokStream, InputStream msgStream, MessageProp msgProp) Currently not implemented.byte[]
wrap
(byte[] inBuf, int off, int len, MessageProp prop) Wraps a message for integrity and protection.void
wrap
(InputStream inStream, OutputStream outStream, MessageProp msgProp) Currently not implemented.
-
Field Details
-
GSI_WRAP
public static final int GSI_WRAPUsed to distinguish between a token created bywrap
withGSSConstants.GSI_BIG
QoP and a regular token created bywrap
.- See Also:
-
state
protected int stateHandshake state -
delegationState
protected int delegationStateDelegation state -
delegatedCred
Credential delegated using delegation API -
delegationFinished
protected boolean delegationFinishedDelegation finished indicator -
credentialDelegation
protected boolean credentialDelegation -
anonymity
protected boolean anonymity -
encryption
protected boolean encryption -
established
protected boolean established -
sourceName
The name of the context initiator -
targetName
The name of the context acceptor -
role
protected int roleContext role -
delegCred
Credential delegated during context establishment -
delegationType
-
gssMode
-
checkContextExpiration
-
rejectLimitedProxy
-
requireClientAuth
-
acceptNoClientCerts
-
requireAuthzWithDelegation
-
ctxCred
Credential of this context. Might be anonymous -
expectedTargetName
Expected target name. Used for authorization in initiator -
goodUntil
Context expiration date. -
sslConfigurator
-
sslContext
-
sslEngine
-
conn
protected boolean conn -
certFactory
-
keyPair
Used during delegation -
tc
-
proxyPolicyHandlers
-
peerLimited
Limited peer credentials
-
-
Constructor Details
-
GlobusGSSContextImpl
- Parameters:
target
- expected target name. Can be null.cred
- credential. Cannot be null. Might be anonymous.- Throws:
GSSException
-
-
Method Details
-
acceptSecContext
This function drives the accepting side of the context establishment process. It is expected to be called in tandem with theinitSecContext
function.
The behavior of context establishment process can be modified byGSSConstants.GSS_MODE
andGSSConstants.REJECT_LIMITED_PROXY
context options. If theGSSConstants.GSS_MODE
option is set toGSIConstants.MODE_SSL
the context establishment process will be compatible with regular SSL (no credential delegation support). If the option is set toGSIConstants.MODE_GSI
credential delegation during context establishment process will be accepted. If theGSSConstants.REJECT_LIMITED_PROXY
option is enabled, a peer presenting limited proxy credential will be automatically rejected and the context establishment process will be aborted.- Specified by:
acceptSecContext
in interfaceGSSContext
- Returns:
- a byte[] containing the token to be sent to the peer. null indicates that no token is generated (needs more data)
- Throws:
GSSException
-
initSecContext
This function drives the initiating side of the context establishment process. It is expected to be called in tandem with theacceptSecContext
function.
The behavior of context establishment process can be modified byGSSConstants.GSS_MODE
,GSSConstants.DELEGATION_TYPE
, andGSSConstants.REJECT_LIMITED_PROXY
context options. If theGSSConstants.GSS_MODE
option is set toGSIConstants.MODE_SSL
the context establishment process will be compatible with regular SSL (no credential delegation support). If the option is set toGSIConstants.GSS_MODE_GSI
credential delegation during context establishment process will performed. The delegation type to be performed can be set using theGSSConstants.DELEGATION_TYPE
context option. If theGSSConstants.REJECT_LIMITED_PROXY
option is enabled, a peer presenting limited proxy credential will be automatically rejected and the context establishment process will be aborted.- Specified by:
initSecContext
in interfaceGSSContext
- Returns:
- a byte[] containing the token to be sent to the peer. null indicates that no token is generated (needs more data).
- Throws:
GSSException
-
wrap
Wraps a message for integrity and protection. A regular SSL-wrapped token is returned.- Specified by:
wrap
in interfaceGSSContext
- Throws:
GSSException
-
unwrap
Unwraps a token generated bywrap
method on the other side of the context.- Specified by:
unwrap
in interfaceGSSContext
- Throws:
GSSException
-
dispose
- Specified by:
dispose
in interfaceGSSContext
- Throws:
GSSException
-
isEstablished
public boolean isEstablished()- Specified by:
isEstablished
in interfaceGSSContext
-
requestCredDeleg
- Specified by:
requestCredDeleg
in interfaceGSSContext
- Throws:
GSSException
-
getCredDelegState
public boolean getCredDelegState()- Specified by:
getCredDelegState
in interfaceGSSContext
-
isInitiator
- Specified by:
isInitiator
in interfaceGSSContext
- Throws:
GSSException
-
isProtReady
public boolean isProtReady()- Specified by:
isProtReady
in interfaceGSSContext
-
requestLifetime
- Specified by:
requestLifetime
in interfaceGSSContext
- Throws:
GSSException
-
getLifetime
public int getLifetime()- Specified by:
getLifetime
in interfaceGSSContext
-
getMech
- Specified by:
getMech
in interfaceGSSContext
- Throws:
GSSException
-
getDelegCred
- Specified by:
getDelegCred
in interfaceGSSContext
- Throws:
GSSException
-
requestConf
- Specified by:
requestConf
in interfaceGSSContext
- Throws:
GSSException
-
getConfState
public boolean getConfState()- Specified by:
getConfState
in interfaceGSSContext
-
getMIC
Returns a cryptographic MIC (message integrity check) of a specified message.- Specified by:
getMIC
in interfaceGSSContext
- Throws:
GSSException
-
verifyMIC
public void verifyMIC(byte[] inTok, int tokOff, int tokLen, byte[] inMsg, int msgOff, int msgLen, MessageProp prop) throws GSSException Verifies a cryptographic MIC (message integrity check) of a specified message.- Specified by:
verifyMIC
in interfaceGSSContext
- Throws:
GSSException
-
initSecContext
It works just likeinitSecContext
method. It reads one SSL token from input stream, callsinitSecContext
method and writes the output token to the output stream (if any) SSL token is not read on the initial call.- Specified by:
initSecContext
in interfaceGSSContext
- Throws:
GSSException
-
acceptSecContext
It works just likeacceptSecContext
method. It reads one SSL token from input stream, callsacceptSecContext
method and writes the output token to the output stream (if any)- Specified by:
acceptSecContext
in interfaceGSSContext
- Throws:
GSSException
-
getSrcName
- Specified by:
getSrcName
in interfaceGSSContext
- Throws:
GSSException
-
getTargName
- Specified by:
getTargName
in interfaceGSSContext
- Throws:
GSSException
-
requestInteg
- Specified by:
requestInteg
in interfaceGSSContext
- Throws:
GSSException
-
getIntegState
public boolean getIntegState()- Specified by:
getIntegState
in interfaceGSSContext
-
requestSequenceDet
- Specified by:
requestSequenceDet
in interfaceGSSContext
- Throws:
GSSException
-
getSequenceDetState
public boolean getSequenceDetState()- Specified by:
getSequenceDetState
in interfaceGSSContext
-
requestReplayDet
- Specified by:
requestReplayDet
in interfaceGSSContext
- Throws:
GSSException
-
getReplayDetState
public boolean getReplayDetState()- Specified by:
getReplayDetState
in interfaceGSSContext
-
requestAnonymity
- Specified by:
requestAnonymity
in interfaceGSSContext
- Throws:
GSSException
-
getAnonymityState
public boolean getAnonymityState()- Specified by:
getAnonymityState
in interfaceGSSContext
-
requestMutualAuth
- Specified by:
requestMutualAuth
in interfaceGSSContext
- Throws:
GSSException
-
getMutualAuthState
public boolean getMutualAuthState()- Specified by:
getMutualAuthState
in interfaceGSSContext
-
generateCertRequest
- Throws:
GeneralSecurityException
-
verifyDelegatedCert
- Throws:
GeneralSecurityException
-
checkContext
- Throws:
GSSException
-
setGssMode
- Throws:
GSSException
-
setDelegationType
- Throws:
GSSException
-
setCheckContextExpired
- Throws:
GSSException
-
setRejectLimitedProxy
- Throws:
GSSException
-
setRequireClientAuth
- Throws:
GSSException
-
setRequireAuthzWithDelegation
- Throws:
GSSException
-
setAcceptNoClientCerts
- Throws:
GSSException
-
setProxyPolicyHandlers
- Throws:
GSSException
-
setTrustedCertificates
- Throws:
GSSException
-
setOption
Description copied from interface:ExtendedGSSContext
Sets a context option. It can be called by context initiator or acceptor but prior to the first call to initSecContext, acceptSecContext, initDelegation or acceptDelegation.- Specified by:
setOption
in interfaceExtendedGSSContext
- Parameters:
option
- option type.value
- option value.- Throws:
GSSException
- containing the following major error codes:GSSException.FAILURE
-
getOption
Description copied from interface:ExtendedGSSContext
Gets a context option. It can be called by context initiator or acceptor.- Specified by:
getOption
in interfaceExtendedGSSContext
- Parameters:
option
- option type.- Returns:
- value option value. Maybe be null.
- Throws:
GSSException
- containing the following major error codes:GSSException.FAILURE
-
initDelegation
public byte[] initDelegation(GSSCredential credential, Oid mechanism, int lifetime, byte[] buf, int off, int len) throws GSSException Initiate the delegation of a credential. This function drives the initiating side of the credential delegation process. It is expected to be called in tandem with theacceptDelegation
function.
The behavior of this function can be modified byGSSConstants.DELEGATION_TYPE
andGSSConstants.GSS_MODE
context options. TheGSSConstants.DELEGATION_TYPE
option controls delegation type to be performed. TheGSSConstants.GSS_MODE
option if set toGSIConstants.MODE_SSL
results in tokens that are not wrapped.- Specified by:
initDelegation
in interfaceExtendedGSSContext
- Parameters:
credential
- The credential to be delegated. May be null in which case the credential associated with the security context is used.mechanism
- The desired security mechanism. May be null.lifetime
- The requested period of validity (seconds) of the delegated credential.- Returns:
- A token that should be passed to
acceptDelegation
ifisDelegationFinished
returns false. May be null. - Throws:
GSSException
- containing the following major error codes:GSSException.FAILURE
-
acceptDelegation
Accept a delegated credential. This function drives the accepting side of the credential delegation process. It is expected to be called in tandem with theinitDelegation
function.
The behavior of this function can be modified byGSSConstants.GSS_MODE
context option. TheGSSConstants.GSS_MODE
option if set toGSIConstants.MODE_SSL
results in tokens that are not wrapped.- Specified by:
acceptDelegation
in interfaceExtendedGSSContext
- Parameters:
lifetime
- The requested period of validity (seconds) of the delegated credential.- Returns:
- A token that should be passed to
initDelegation
ifisDelegationFinished
returns false. May be null. - Throws:
GSSException
- containing the following major error codes:GSSException.FAILURE
-
getDelegatedCredential
Description copied from interface:ExtendedGSSContext
Returns the delegated credential that was delegated using theinitDelegation
andacceptDelegation
functions. This is to be called on the delegation accepting side once onceisDelegationFinished
returns true.- Specified by:
getDelegatedCredential
in interfaceExtendedGSSContext
- Returns:
- The delegated credential. Might be null if credential delegation is not finished.
-
isDelegationFinished
public boolean isDelegationFinished()Description copied from interface:ExtendedGSSContext
Used during delegation to determine the state of the delegation.- Specified by:
isDelegationFinished
in interfaceExtendedGSSContext
- Returns:
- true if delegation was completed, false otherwise.
-
inquireByOid
Retrieves arbitrary data about this context. Currently supported oid:-
GSSConstants.X509_CERT_CHAIN
returns certificate chain of the peer (X509Certificate[]
).
- Specified by:
inquireByOid
in interfaceExtendedGSSContext
- Parameters:
oid
- the oid of the information desired.- Returns:
- the information desired. Might be null.
- Throws:
GSSException
- containing the following major error codes:GSSException.FAILURE
-
-
setBannedCiphers
Description copied from interface:ExtendedGSSContext
Specifies a list of ciphers that will not be used.- Specified by:
setBannedCiphers
in interfaceExtendedGSSContext
- Parameters:
ciphers
- The list of banned ciphers.
-
getWrapSizeLimit
Currently not implemented.- Specified by:
getWrapSizeLimit
in interfaceGSSContext
- Throws:
GSSException
-
wrap
public void wrap(InputStream inStream, OutputStream outStream, MessageProp msgProp) throws GSSException Currently not implemented.- Specified by:
wrap
in interfaceGSSContext
- Throws:
GSSException
-
unwrap
public void unwrap(InputStream inStream, OutputStream outStream, MessageProp msgProp) throws GSSException Currently not implemented.- Specified by:
unwrap
in interfaceGSSContext
- Throws:
GSSException
-
getMIC
public void getMIC(InputStream inStream, OutputStream outStream, MessageProp msgProp) throws GSSException Currently not implemented.- Specified by:
getMIC
in interfaceGSSContext
- Throws:
GSSException
-
verifyMIC
public void verifyMIC(InputStream tokStream, InputStream msgStream, MessageProp msgProp) throws GSSException Currently not implemented.- Specified by:
verifyMIC
in interfaceGSSContext
- Throws:
GSSException
-
setChannelBinding
Currently not implemented.- Specified by:
setChannelBinding
in interfaceGSSContext
- Throws:
GSSException
-
isTransferable
Currently not implemented.- Specified by:
isTransferable
in interfaceGSSContext
- Throws:
GSSException
-
export
Currently not implemented.- Specified by:
export
in interfaceGSSContext
- Throws:
GSSException
-