Module jcifs

Package org.codelibs.jcifs.smb.impl

Class Kerb5Authenticator

java.lang.Object

org.codelibs.jcifs.smb.impl.NtlmPasswordAuthenticator

org.codelibs.jcifs.smb.impl.Kerb5Authenticator

All Implemented Interfaces:

Serializable, Cloneable, Principal, Credentials, CredentialsInternal

Direct Known Subclasses:

JAASAuthenticator

public class Kerb5Authenticator
extends NtlmPasswordAuthenticator

Base kerberos authenticator Uses a subject that contains kerberos credentials for use in GSSAPI context establishment. Be advised that short/NetBIOS name usage is not supported with this authenticator. Always specify full FQDNs. This can be a problem if using DFS in it's default configuration as they still return referrals in short form. See KB-244380 for compatible server configuration. See Configuration.isDfsConvertToFQDN() for a workaround.

See Also:

• Serialized Form

Nested Class Summary

Nested classes/interfaces inherited from class org.codelibs.jcifs.smb.impl.NtlmPasswordAuthenticator

NtlmPasswordAuthenticator.AuthenticationType

Constructor Summary

Constructors

Constructor	Description
Kerb5Authenticator(Subject subject)	Construct a Kerb5Authenticator object with Subject which hold TGT retrieved from KDC.
Kerb5Authenticator(Subject subject, String domain, String username, String password)	Construct a Kerb5Authenticator object with Subject and potential NTLM fallback (if the server does not support kerberos).

Method Summary

Modifier and Type	Method	Description
Kerb5Authenticator	clone()	Create a copy of the credentials.
static void	cloneInternal(Kerb5Authenticator to, Kerb5Authenticator from)	Clone the context
SSPContext	createContext(CIFSContext tc, String targetDomain, String host, byte[] initialToken, boolean doSigning)	Create an SSP context for authentication.
boolean	equals(Object other)	Compares two NtlmPasswordAuthentication objects for equality.
int	getLifeTime()	Get lifetime of this context.
String	getRealm()	Get the Kerberos realm
String	getService()	Get the service name.
Subject	getSubject()	Get the Subject object.
String	getUser()	Get the user name which authenticate against to.
String	getUserDomain()	Returns the domain.
int	getUserLifeTime()	Get lifetime of current user.
int	hashCode()	Return the upcased username hash code.
boolean	isAnonymous()	Check if these are anonymous credentials.
boolean	isPreferredMech(org.bouncycastle.asn1.ASN1ObjectIdentifier mechanism)	Check if the given mechanism is preferred for this credential
void	refresh()	Refresh the credentials.
void	setForceFallback(boolean forceFallback)	Testing only: force fallback to NTLM
void	setLifeTime(int time)	Set the lifetime for this context.
void	setRealm(String realm)	Set the Kerberos realm
void	setService(String name)	Set the service name which is used to setup GSSContext.
protected void	setSubject(Subject subject)	Set the Kerberos subject
void	setUser(String name)	Set the user name which is used to setup GSSContext.
void	setUserLifeTime(int time)	Set lifetime of current user.
String	toString()	Return the domain and username in the format: domain\\username.

Methods inherited from class org.codelibs.jcifs.smb.impl.NtlmPasswordAuthenticator

cloneInternal, getAnsiHash, getName, getNTHash, getPassword, getSigningKey, getSpecifiedUserDomain, getUnicodeHash, getUsername, getUserSessionKey, getUserSessionKey, guessAuthenticationType, isGuest, unwrap

Methods inherited from class java.lang.Object

finalize, getClass, notify, notifyAll, wait, wait, wait

Methods inherited from interface java.security.Principal

implies

Constructor Details

Kerb5Authenticator

public Kerb5Authenticator(Subject subject)

Construct a Kerb5Authenticator object with Subject which hold TGT retrieved from KDC. If multiple TGT are contained, the first one will be used to retrieve user principal.

Parameters:

subject - represents the user who perform Kerberos authentication. It contains tickets retrieve from KDC.

Kerb5Authenticator

public Kerb5Authenticator(Subject subject,
 String domain,
 String username,
 String password)

Construct a Kerb5Authenticator object with Subject and potential NTLM fallback (if the server does not support kerberos).

Parameters:

subject - represents the user who perform Kerberos authentication. Should at least contain a TGT for the user.

domain - domain for NTLM fallback

username - user for NTLM fallback

password - password for NTLM fallback

Method Details

setForceFallback

public void setForceFallback(boolean forceFallback)

Testing only: force fallback to NTLM

Parameters:

forceFallback - the forceFallback to set

createContext

public SSPContext createContext(CIFSContext tc,
 String targetDomain,
 String host,
 byte[] initialToken,
 boolean doSigning)
                         throws SmbException

Create an SSP context for authentication.

Specified by:

createContext in interface CredentialsInternal

Overrides:

createContext in class NtlmPasswordAuthenticator

Parameters:

tc - the CIFS context

targetDomain - the target domain for authentication

host - the target host

initialToken - initial authentication token, if any

doSigning - whether message signing should be enabled

Returns:

a new SSP authentication context

Throws:

SmbException - if context creation fails

See Also:

• NtlmPasswordAuthenticator.createContext(org.codelibs.jcifs.smb.CIFSContext, java.lang.String, java.lang.String, byte[], boolean)

setSubject

protected void setSubject(Subject subject)

Set the Kerberos subject

Parameters:

subject - the subject to set

refresh

public void refresh()
             throws CIFSException

Description copied from interface: CredentialsInternal

Refresh the credentials.

Specified by:

refresh in interface CredentialsInternal

Overrides:

refresh in class NtlmPasswordAuthenticator

Throws:

CIFSException - if refresh fails

clone

public Kerb5Authenticator clone()

Description copied from interface: CredentialsInternal

Create a copy of the credentials.

Specified by:

clone in interface CredentialsInternal

Overrides:

clone in class NtlmPasswordAuthenticator

Returns:

a copy of the credentials

cloneInternal

public static void cloneInternal(Kerb5Authenticator to,
 Kerb5Authenticator from)

Clone the context

Parameters:

to - the target authenticator

from - the source authenticator

setUser

public void setUser(String name)

Set the user name which is used to setup GSSContext. If null is set, the default user will be used which is retrieved from the first TGT found in Subject .

Parameters:

name - the user name used to setup GSSContext

setRealm

public void setRealm(String realm)

Set the Kerberos realm

Parameters:

realm - the realm to set

getRealm

public String getRealm()

Get the Kerberos realm

Returns:

the kerberos realm

getSubject

public Subject getSubject()

Get the Subject object.

Specified by:

getSubject in interface CredentialsInternal

Overrides:

getSubject in class NtlmPasswordAuthenticator

Returns:

Subject represents the user who perform Kerberos authentication. It contains the tickets retrieve from KDC.

getUser

public String getUser()

Get the user name which authenticate against to. If the default user is used, Null will be returned.

Returns:

user name

setService

public void setService(String name)

Set the service name which is used to setup GSSContext. Program will use this name to require service ticket from KDC.

Parameters:

name - the service name used to require service ticket from KDC.

getService

public String getService()

Get the service name.

Returns:

the service name used to require service ticket from KDC

getUserLifeTime

public int getUserLifeTime()

Get lifetime of current user.

Returns:

the remaining lifetime in seconds. If the default lifetime is used, this value have no meaning.

setUserLifeTime

public void setUserLifeTime(int time)

Set lifetime of current user.

Parameters:

time - the lifetime in seconds

getLifeTime

public int getLifeTime()

Get lifetime of this context.

Returns:

the remaining lifetime in seconds. If the default lifetime is used, this value have no meaning.

setLifeTime

public void setLifeTime(int time)

Set the lifetime for this context.

Parameters:

time - the lifetime in seconds

isAnonymous

public boolean isAnonymous()

Check if these are anonymous credentials.

Specified by:

isAnonymous in interface Credentials

Overrides:

isAnonymous in class NtlmPasswordAuthenticator

Returns:

whether these are anonymous credentials

See Also:

• Credentials.isAnonymous()

isPreferredMech

public boolean isPreferredMech(org.bouncycastle.asn1.ASN1ObjectIdentifier mechanism)

Check if the given mechanism is preferred for this credential

Overrides:

isPreferredMech in class NtlmPasswordAuthenticator

Parameters:

mechanism - the mechanism to check

Returns:

whether the given mechanism is the preferred one for this credential

See Also:

• NtlmPasswordAuthenticator.isPreferredMech(org.bouncycastle.asn1.ASN1ObjectIdentifier)

toString

public String toString()

Return the domain and username in the format: domain\\username. This is equivalent to getName().

Specified by:

toString in interface Principal

Overrides:

toString in class NtlmPasswordAuthenticator

See Also:

• Object.toString()

equals

public boolean equals(Object other)

Compares two NtlmPasswordAuthentication objects for equality. Two NtlmPasswordAuthentication objects are equal if their caseless domain and username fields are equal

Specified by:

equals in interface Principal

Overrides:

equals in class NtlmPasswordAuthenticator

See Also:

• NtlmPasswordAuthenticator.equals(java.lang.Object)

hashCode

public int hashCode()

Return the upcased username hash code.

Specified by:

hashCode in interface Principal

Overrides:

hashCode in class NtlmPasswordAuthenticator

See Also:

• Object.hashCode()

getUserDomain

public String getUserDomain()

Description copied from class: NtlmPasswordAuthenticator

Returns the domain.

Specified by:

getUserDomain in interface Credentials

Overrides:

getUserDomain in class NtlmPasswordAuthenticator

Returns:

the domain the user account is in