コード例 #1
0
  private byte[] parseToken(byte[] rawToken) {
    byte[] token = rawToken;
    DerValue tmpToken = new DerValue(rawToken);
    if (debug.messageEnabled()) {
      debug.message("token tag:" + DerValue.printByte(tmpToken.getTag()));
    }
    if (tmpToken.getTag() != (byte) 0x60) {
      return null;
    }

    ByteArrayInputStream tmpInput = new ByteArrayInputStream(tmpToken.getData());

    // check for SPNEGO OID
    byte[] oidArray = new byte[spnegoOID.length];
    tmpInput.read(oidArray, 0, oidArray.length);
    if (Arrays.equals(oidArray, spnegoOID)) {
      debug.message("SPNEGO OID found in the Auth Token");
      tmpToken = new DerValue(tmpInput);

      // 0xa0 indicates an init token(NegTokenInit); 0xa1 indicates an
      // response arg token(NegTokenTarg). no arg token is needed for us.

      if (tmpToken.getTag() == (byte) 0xa0) {
        debug.message("DerValue: found init token");
        tmpToken = new DerValue(tmpToken.getData());
        if (tmpToken.getTag() == (byte) 0x30) {
          debug.message("DerValue: 0x30 constructed token found");
          tmpInput = new ByteArrayInputStream(tmpToken.getData());
          tmpToken = new DerValue(tmpInput);

          // In an init token, it can contain 4 optional arguments:
          // a0: mechTypes
          // a1: contextFlags
          // a2: octect string(with leading char 0x04) for the token
          // a3: message integrity value

          while (tmpToken.getTag() != (byte) -1 && tmpToken.getTag() != (byte) 0xa2) {
            // look for next mech token DER
            tmpToken = new DerValue(tmpInput);
          }
          if (tmpToken.getTag() != (byte) -1) {
            // retrieve octet string
            tmpToken = new DerValue(tmpToken.getData());
            token = tmpToken.getData();
          }
        }
      }
    } else {
      debug.message("SPNEGO OID not found in the Auth Token");
      byte[] krb5Oid = new byte[KERBEROS_V5_OID.length];
      int i = 0;
      for (; i < oidArray.length; i++) {
        krb5Oid[i] = oidArray[i];
      }
      tmpInput.read(krb5Oid, i, krb5Oid.length - i);
      if (!Arrays.equals(krb5Oid, KERBEROS_V5_OID)) {
        debug.message("Kerberos V5 OID not found in the Auth Token");
        token = null;
      } else {
        debug.message("Kerberos V5 OID found in the Auth Token");
      }
    }
    return token;
  }
コード例 #2
0
  /**
   * Processes the authentication request.
   *
   * @param callbacks
   * @param state
   * @return -1 as succeeded; 0 as failed.
   * @exception AuthLoginException upon any failure.
   */
  public int process(Callback[] callbacks, int state) throws AuthLoginException {
    int result = ISAuthConstants.LOGIN_IGNORE;

    if (!getConfigParams()) {
      initWindowsDesktopSSOAuth(options);
    }

    // retrieve the spnego token
    byte[] spnegoToken = getSPNEGOTokenFromHTTPRequest(getHttpServletRequest());
    if (spnegoToken == null) {
      spnegoToken = getSPNEGOTokenFromCallback(callbacks);
    }

    if (spnegoToken == null) {
      debug.message("spnego token is not valid.");
      throw new AuthLoginException(amAuthWindowsDesktopSSO, "token", null);
    }

    if (debug.messageEnabled()) {
      debug.message(
          "SPNEGO token: \n" + DerValue.printByteArray(spnegoToken, 0, spnegoToken.length));
    }
    // parse the spnego token and extract the kerberos mech token from it
    final byte[] kerberosToken = parseToken(spnegoToken);
    if (kerberosToken == null) {
      debug.message("kerberos token is not valid.");
      throw new AuthLoginException(amAuthWindowsDesktopSSO, "token", null);
    }
    if (debug.messageEnabled()) {
      debug.message(
          "Kerberos token retrieved from SPNEGO token: \n"
              + DerValue.printByteArray(kerberosToken, 0, kerberosToken.length));
    }

    // authenticate the user with the kerberos token
    try {
      authenticateToken(kerberosToken);
      debug.message("WindowsDesktopSSO authentication succeeded.");
      result = ISAuthConstants.LOGIN_SUCCEED;
    } catch (PrivilegedActionException pe) {
      Exception e = extractException(pe);
      if (e instanceof GSSException) {
        int major = ((GSSException) e).getMajor();
        if (major == GSSException.CREDENTIALS_EXPIRED) {
          debug.message("Credential expired. Re-establish credential...");
          serviceLogin();
          try {
            authenticateToken(kerberosToken);
            debug.message("Authentication succeeded with new cred.");
            result = ISAuthConstants.LOGIN_SUCCEED;
          } catch (Exception ee) {
            debug.message("Authentication failed with new cred.");
            throw new AuthLoginException(amAuthWindowsDesktopSSO, "auth", null, ee);
          }
        } else {
          debug.message("Authentication failed with GSSException.");
          throw new AuthLoginException(amAuthWindowsDesktopSSO, "auth", null, e);
        }
      }
    } catch (GSSException e) {
      int major = e.getMajor();
      if (major == GSSException.CREDENTIALS_EXPIRED) {
        debug.message("Credential expired. Re-establish credential...");
        serviceLogin();
        try {
          authenticateToken(kerberosToken);
          debug.message("Authentication succeeded with new cred.");
          result = ISAuthConstants.LOGIN_SUCCEED;
        } catch (Exception ee) {
          debug.message("Authentication failed with new cred.");
          throw new AuthLoginException(amAuthWindowsDesktopSSO, "auth", null, ee);
        }
      } else {
        debug.message("Authentication failed with GSSException.");
        throw new AuthLoginException(amAuthWindowsDesktopSSO, "auth", null, e);
      }
    } catch (AuthLoginException e) {
      throw e;
    } catch (Exception e) {
      debug.message("Authentication failed with generic exception.");
      throw new AuthLoginException(amAuthWindowsDesktopSSO, "auth", null, e);
    }
    return result;
  }