Example usage for javax.security.auth.kerberos KeyTab getKeys

Introduction

In this page you can find the example usage for javax.security.auth.kerberos KeyTab getKeys.

Prototype

public KerberosKey[] getKeys(KerberosPrincipal principal) 

Source Link

Document

Returns fresh keys for the given Kerberos principal.

Usage

From source file:io.druid.security.kerberos.KerberosAuthenticator.java

private String getPrincipalFromRequestNew(HttpServletRequest req) {
    String authorization = req//from   w  ww.j  ava2 s . co  m
            .getHeader(org.apache.hadoop.security.authentication.client.KerberosAuthenticator.AUTHORIZATION);
    if (authorization == null || !authorization
            .startsWith(org.apache.hadoop.security.authentication.client.KerberosAuthenticator.NEGOTIATE)) {
        return null;
    } else {
        authorization = authorization.substring(
                org.apache.hadoop.security.authentication.client.KerberosAuthenticator.NEGOTIATE.length())
                .trim();
        final Base64 base64 = new Base64(0);
        final byte[] clientToken = base64.decode(authorization);
        try {
            DerInputStream ticketStream = new DerInputStream(clientToken);
            DerValue[] values = ticketStream.getSet(clientToken.length, true);

            // see this link for AP-REQ format: https://tools.ietf.org/html/rfc1510#section-5.5.1
            for (DerValue value : values) {
                if (isValueAPReq(value)) {
                    APReq apReq = new APReq(value);
                    Ticket ticket = apReq.ticket;
                    EncryptedData encData = ticket.encPart;
                    int eType = encData.getEType();

                    // find the server's key
                    EncryptionKey finalKey = null;
                    Subject serverSubj = loginContext.getSubject();
                    Set<Object> serverCreds = serverSubj.getPrivateCredentials(Object.class);
                    for (Object cred : serverCreds) {
                        if (cred instanceof KeyTab) {
                            KeyTab serverKeyTab = (KeyTab) cred;
                            KerberosPrincipal serverPrincipal = new KerberosPrincipal(this.serverPrincipal);
                            KerberosKey[] serverKeys = serverKeyTab.getKeys(serverPrincipal);
                            for (KerberosKey key : serverKeys) {
                                if (key.getKeyType() == eType) {
                                    finalKey = new EncryptionKey(key.getKeyType(), key.getEncoded());
                                    break;
                                }
                            }
                        }
                    }

                    if (finalKey == null) {
                        log.error("Could not find matching key from server creds.");
                        return null;
                    }

                    // decrypt the ticket with the server's key
                    byte[] decryptedBytes = encData.decrypt(finalKey, KeyUsage.KU_TICKET);
                    decryptedBytes = encData.reset(decryptedBytes);
                    EncTicketPart decrypted = new EncTicketPart(decryptedBytes);
                    String clientPrincipal = decrypted.cname.toString();
                    return clientPrincipal;
                }
            }
        } catch (Exception ex) {
            Throwables.propagate(ex);
        }
    }

    return null;
}

---

From source file:org.apache.druid.security.kerberos.KerberosAuthenticator.java

private String getPrincipalFromRequestNew(HttpServletRequest req) {
    String authorization = req//ww w .ja va2s  .c  o  m
            .getHeader(org.apache.hadoop.security.authentication.client.KerberosAuthenticator.AUTHORIZATION);
    if (authorization == null || !authorization
            .startsWith(org.apache.hadoop.security.authentication.client.KerberosAuthenticator.NEGOTIATE)) {
        return null;
    } else {
        authorization = authorization.substring(
                org.apache.hadoop.security.authentication.client.KerberosAuthenticator.NEGOTIATE.length())
                .trim();
        final Base64 base64 = new Base64(0);
        final byte[] clientToken = base64.decode(authorization);
        try {
            DerInputStream ticketStream = new DerInputStream(clientToken);
            DerValue[] values = ticketStream.getSet(clientToken.length, true);

            // see this link for AP-REQ format: https://tools.ietf.org/html/rfc1510#section-5.5.1
            for (DerValue value : values) {
                if (isValueAPReq(value)) {
                    APReq apReq = new APReq(value);
                    Ticket ticket = apReq.ticket;
                    EncryptedData encData = ticket.encPart;
                    int eType = encData.getEType();

                    // find the server's key
                    EncryptionKey finalKey = null;
                    Subject serverSubj = loginContext.getSubject();
                    Set<Object> serverCreds = serverSubj.getPrivateCredentials(Object.class);
                    for (Object cred : serverCreds) {
                        if (cred instanceof KeyTab) {
                            KeyTab serverKeyTab = (KeyTab) cred;
                            KerberosPrincipal kerberosPrincipal = new KerberosPrincipal(serverPrincipal);
                            KerberosKey[] serverKeys = serverKeyTab.getKeys(kerberosPrincipal);
                            for (KerberosKey key : serverKeys) {
                                if (key.getKeyType() == eType) {
                                    finalKey = new EncryptionKey(key.getKeyType(), key.getEncoded());
                                    break;
                                }
                            }
                        }
                    }

                    if (finalKey == null) {
                        log.error("Could not find matching key from server creds.");
                        return null;
                    }

                    // decrypt the ticket with the server's key
                    byte[] decryptedBytes = encData.decrypt(finalKey, KeyUsage.KU_TICKET);
                    decryptedBytes = encData.reset(decryptedBytes);
                    EncTicketPart decrypted = new EncTicketPart(decryptedBytes);
                    String clientPrincipal = decrypted.cname.toString();
                    return clientPrincipal;
                }
            }
        } catch (Exception ex) {
            Throwables.propagate(ex);
        }
    }

    return null;
}

---