Example usage for javax.security.auth.kerberos KerberosKey getKeyType

Introduction

In this page you can find the example usage for javax.security.auth.kerberos KerberosKey getKeyType.

Prototype

public final int getKeyType() 

Source Link

Document

Returns the key type for this long-term key.

Usage

From source file:io.druid.security.kerberos.KerberosAuthenticator.java

private String getPrincipalFromRequestNew(HttpServletRequest req) {
    String authorization = req//from  w ww  . j a  v a  2s  .  co m
            .getHeader(org.apache.hadoop.security.authentication.client.KerberosAuthenticator.AUTHORIZATION);
    if (authorization == null || !authorization
            .startsWith(org.apache.hadoop.security.authentication.client.KerberosAuthenticator.NEGOTIATE)) {
        return null;
    } else {
        authorization = authorization.substring(
                org.apache.hadoop.security.authentication.client.KerberosAuthenticator.NEGOTIATE.length())
                .trim();
        final Base64 base64 = new Base64(0);
        final byte[] clientToken = base64.decode(authorization);
        try {
            DerInputStream ticketStream = new DerInputStream(clientToken);
            DerValue[] values = ticketStream.getSet(clientToken.length, true);

            // see this link for AP-REQ format: https://tools.ietf.org/html/rfc1510#section-5.5.1
            for (DerValue value : values) {
                if (isValueAPReq(value)) {
                    APReq apReq = new APReq(value);
                    Ticket ticket = apReq.ticket;
                    EncryptedData encData = ticket.encPart;
                    int eType = encData.getEType();

                    // find the server's key
                    EncryptionKey finalKey = null;
                    Subject serverSubj = loginContext.getSubject();
                    Set<Object> serverCreds = serverSubj.getPrivateCredentials(Object.class);
                    for (Object cred : serverCreds) {
                        if (cred instanceof KeyTab) {
                            KeyTab serverKeyTab = (KeyTab) cred;
                            KerberosPrincipal serverPrincipal = new KerberosPrincipal(this.serverPrincipal);
                            KerberosKey[] serverKeys = serverKeyTab.getKeys(serverPrincipal);
                            for (KerberosKey key : serverKeys) {
                                if (key.getKeyType() == eType) {
                                    finalKey = new EncryptionKey(key.getKeyType(), key.getEncoded());
                                    break;
                                }
                            }
                        }
                    }

                    if (finalKey == null) {
                        log.error("Could not find matching key from server creds.");
                        return null;
                    }

                    // decrypt the ticket with the server's key
                    byte[] decryptedBytes = encData.decrypt(finalKey, KeyUsage.KU_TICKET);
                    decryptedBytes = encData.reset(decryptedBytes);
                    EncTicketPart decrypted = new EncTicketPart(decryptedBytes);
                    String clientPrincipal = decrypted.cname.toString();
                    return clientPrincipal;
                }
            }
        } catch (Exception ex) {
            Throwables.propagate(ex);
        }
    }

    return null;
}

---

From source file:org.apache.druid.security.kerberos.KerberosAuthenticator.java

private String getPrincipalFromRequestNew(HttpServletRequest req) {
    String authorization = req/*from w ww . ja v  a  2  s. c  o m*/
            .getHeader(org.apache.hadoop.security.authentication.client.KerberosAuthenticator.AUTHORIZATION);
    if (authorization == null || !authorization
            .startsWith(org.apache.hadoop.security.authentication.client.KerberosAuthenticator.NEGOTIATE)) {
        return null;
    } else {
        authorization = authorization.substring(
                org.apache.hadoop.security.authentication.client.KerberosAuthenticator.NEGOTIATE.length())
                .trim();
        final Base64 base64 = new Base64(0);
        final byte[] clientToken = base64.decode(authorization);
        try {
            DerInputStream ticketStream = new DerInputStream(clientToken);
            DerValue[] values = ticketStream.getSet(clientToken.length, true);

            // see this link for AP-REQ format: https://tools.ietf.org/html/rfc1510#section-5.5.1
            for (DerValue value : values) {
                if (isValueAPReq(value)) {
                    APReq apReq = new APReq(value);
                    Ticket ticket = apReq.ticket;
                    EncryptedData encData = ticket.encPart;
                    int eType = encData.getEType();

                    // find the server's key
                    EncryptionKey finalKey = null;
                    Subject serverSubj = loginContext.getSubject();
                    Set<Object> serverCreds = serverSubj.getPrivateCredentials(Object.class);
                    for (Object cred : serverCreds) {
                        if (cred instanceof KeyTab) {
                            KeyTab serverKeyTab = (KeyTab) cred;
                            KerberosPrincipal kerberosPrincipal = new KerberosPrincipal(serverPrincipal);
                            KerberosKey[] serverKeys = serverKeyTab.getKeys(kerberosPrincipal);
                            for (KerberosKey key : serverKeys) {
                                if (key.getKeyType() == eType) {
                                    finalKey = new EncryptionKey(key.getKeyType(), key.getEncoded());
                                    break;
                                }
                            }
                        }
                    }

                    if (finalKey == null) {
                        log.error("Could not find matching key from server creds.");
                        return null;
                    }

                    // decrypt the ticket with the server's key
                    byte[] decryptedBytes = encData.decrypt(finalKey, KeyUsage.KU_TICKET);
                    decryptedBytes = encData.reset(decryptedBytes);
                    EncTicketPart decrypted = new EncTicketPart(decryptedBytes);
                    String clientPrincipal = decrypted.cname.toString();
                    return clientPrincipal;
                }
            }
        } catch (Exception ex) {
            Throwables.propagate(ex);
        }
    }

    return null;
}

---