krb5deleauthaction.java

JAAS 例子代码

/**
 * Krb5DeleAuthAction.java
 *
 * Copyright 2009 Tidal Software. All rights reserved.
 *
 * Revision History:
 * Date             Name                Action
 * ------------------------------------------------
 * Feb 12, 2009       wayne            Created
 */
package com.tidalsoft.webconsole.sso.http;

import java.io.*;
import java.net.*;
import java.security.*;

import jcifs.util.*;

import org.ietf.jgss.*;

import com.tidalsoft.webconsole.sso.*;
import com.tidalsoft.webconsole.sso.UserAuthResult.*;

public class Krb5DeleAuthAction implements
		PrivilegedExceptionAction<UserAuthResult> {

	private HttpURLConnection connection;
	private ByteArrayOutputStream cachedOutput;
	private UserCredential userCred;
	private String serverPrinc;

	Krb5DeleAuthAction(String serverPrinc, HttpURLConnection connection,
			ByteArrayOutputStream cachedOutput, UserCredential paraUserCred) {
		this.connection = connection;
		this.cachedOutput = cachedOutput;
		this.userCred = paraUserCred;
		this.serverPrinc = serverPrinc;
	}

	/**
	 * @see java.security.PrivilegedExceptionAction#run()
	 */
	@Override
	public UserAuthResult run() throws GSSException, IOException {
		UserAuthResult result = new UserAuthResult();

		Oid spnegoOid = new Oid("1.3.6.1.5.5.2");

		GSSManager manager = GSSManager.getInstance();

		if (userCred == null)
			throw new IOException("Failed to get user credential.");

		GSSCredential gssCred = userCred.getDeleCred();
		if (gssCred == null)
			throw new IOException("Failed to get delegate credential");
		result.setSrcName(gssCred.getName().toString());

		GSSName serverName = manager.createName(serverPrinc,
				GSSName.NT_HOSTBASED_SERVICE, spnegoOid);

		GSSContext context = manager.createContext(serverName, spnegoOid,
				gssCred, GSSContext.DEFAULT_LIFETIME);

		byte[] token = new byte[0];
		token = context.initSecContext(token, 0, token.length);

		if (token == null) {
			result.setState(State.FAILED);
			return result;
		}

		String authStr = Base64.encode(token);

		connection.setRequestProperty("Authorization", "Negotiate " + authStr);
		connection.connect();
		if (cachedOutput != null && connection.getDoOutput()) {
			OutputStream output = connection.getOutputStream();
			cachedOutput.writeTo(output);
			output.flush();
		}

		result.setState(State.ESTABLISHED);
		return result;
	}
}